Hello, everyone.
So this is of one of the very, very famous mind map which has been made by decent Haddix.
So let's see this, the Rickon somebody by Cherrix.
The first approach or the first step is identifying IP addresses and the main Tilley's, which is a
top level domains.
We have already seen this.
We are doing this with the help, with the help of Essense.
We take that yes and no.
And this way we get to know the whole bunch of IP addresses that we that are being owned by that specific
organization.
We have also seen a reverse who is through which we get more domains which are related to the main parent
domain or the acquisitions.
Next is a domain scraping for discovered.
Till this year we are going to run Ima's or sub finders because we are going to identify more and more
subdomains of that particular target.
I like to use a fine domain because it is a much more a faster so you can also use fine domain.
Next is a domain brute forcing resolve and add new IP ranges, this can be done using mass DNS and manually
as well.
So we are going to brute force the domains we can use mass DNS.
It is excellent for doing this.
Then we will see if those domains actually resolve or not.
You can do this with the help of its GDP X by Project Discovery team and you will be able to see if
those domains are actually resolving and giving a two hundred.
OK, then you can run assort.
I hyphen you a unique filter and save them into a list.
Next to content are both bootcamps using Muskan, which will identify which ports are open for all the
targets that we have identified into the previous step.
Next is to do visual identification so we can use eyewitnessed.
We can also use Accattone.
It is very, very useful with the help of visual identification will be able to enumerate all those
domains.
So let's see if any of the domain is running a vulnerable, unauthenticated dashboard, our internal
dashboard or our application, which is on its default configuration.
Or let's see if there is a directory listing enabled which contains sensitive files like.
DB dot com or environment files or some kind of backup files or the source code disclosure, that can
be very, very helpful for us that we can easily identify from the screenshots.
So those two tools are very useful, which is eye witness as well as Accattone.
The next step is platform identification.
So we are basically going to do banner grabbing of that specific target to identify on of what a CMS
and technology they are running on.
We can use of the Polisar and build with it is a very, very helpful and useful to do this.
Apart from this, we can also identify the technology of that particular target using HTP X tool as
well.
Again, we can also use and map to identify the platform and we can do a grab as well.
You can do a service vision detection using IFN as we fly in and map and you can see the output into
our file.
The next step is content discovery.
So in this we are going to use Globemaster.
We can use different tools as well.
So for example, you can use direct research or directly burster.
Also, if you want to perform fuzzing, you can use DeBlois first or if you have the ring, you will
be able to get a lot of sensitive endpoints for wordlist.
You can use the cyclist wordlist.
They are very good.
You can also use the old text you can use for DBE or pillared all things.
Now for the last step, that is the parameter discovery, you can use a tool which is parameter, which
will be very, very helpful in identifying the parameters of that particular target.
Also, you can use berp, analyze, target.
So whenever you add any target to the scope of boxwood and you run spider at that particular point,
you will be able to see the parameters for that particular target.
Also, I like to use Barum Spider, which will enumerate all the parameters of that specific target
from a Wayback Machine or a Weilbach archive, which is very, very useful.
So I hope you guys understood the on summary by Chadwicks and you will implement this into your workflow
or your methodology, and it will be definitely very, very helpful for everyone.
Thank you.