Hey there.
Welcome to the lab environment.
In here I have my Kali Linux machine version 2021.
To get started, let's install the Amass tool here.
The installation process is really simple.
First, let's open the terminal, and then let's run a sudo apt‑get update.
And when that's completed, let's run sudo apt‑get install amass, and that's it.
This will install and configure the Amass tool in
the Kali Linux virtual machine.
And this process might take a few minutes,
so I'll speed up this video to save you some time.
To test if the installation worked, I'll run the command amass ‑h,
which will show you the help page.
And take a look, it seems that it works now.
As you can see here, Amass is divided into different modules.
For example, we have the intel module, the enumeration module,
the visualization module, and so on.
And the cool part is that those modules are kind of independent.
So for example, if I want to know all the features of a specific module,
I can just use amass, then the module that I want to use,
and then ‑h, which will give us the help page for that specific module.
Take a look.
In here,
we can see a list of all the parameters that we can
use with the enumeration module.
Perfect.
Okay, so enough of introductions, let's start to use this tool.
To commemorate the potential target of a domain is really simple.
I'll use amass, then the module enum,
and then the flag ‑d to define the domain that I want to enumerate.
In my case, I'm using globomantics.com.
Also, if you want, you can have multiple domains as a target.
You just need to use comma.
And this what we see here is the most basic command that we can run.
But in here I will add a few more options.
For example, I will add ‑src,
because I want Amass to show us where the data's coming from.
And then I will also add ‑ip to indicate that I want to
see the IP addresses for each target.
And to finalize, I want to save all the results somewhere.
In here,
I'll use the flag ‑dir and put the name of the directory
in which I want the data to be saved.
Pretty easy, right?
Now, let's run this.
So what Amass is doing in the background is searching
across several open source databases for domains and
sub‑domains related to Globomantics.
Also, Amass is checking if the discovered domains are actually reachable.
And this process might take a few minutes,
so I'll speed up this video to save us some time.
Done.
As we can see, Amass found two potential targets.
And more than that, on the left side we can see where the information came from.
And on the right side we can see the IP addresses of those domains.
One important thing to note is that Amass only shows
us targets that are resolvable.
So if you compare this result here with the result of other recon tools,
you might think that Amass is not discovering everything.
But the reality is that the other tools usually do not test to
see if the domain is actually reachable or not.
And this means that we end up with a lot of false positives.
But in here, Amass does not give us any false positives.
Those two found targets are for sure available.
Also,
in here we're using the Globomantics domain, which is
a testing domain from Pluralsight.
But just to show you how powerful this tool is,
I'll run the same enumeration technique,
but now against the NASA website.
In here I'll also include the flag ‑norecursive,
so then this scan only looks at one level of
subdomains and is a little bit faster.
Then take a look, we can already see some domains in here.
But because NASA has tons of subdomains,
this search might take it around 20 to 30 minutes. But in
here, as we're not interested in hacking NASA,
I'll just cancel the scan.
Perfect.
Now, let me show you one more cool feature of Amass.
I'll run the same enumeration command that we're running, but I will also
include the flag ‑brute here. And with this option enabled, Amass will try
to brute force the name of the subdomains.
Also, as always,
I'm including here the directory where I want the data to be saved.
And note that it can save multiple scanned results in the same
directory. And when I run this, Amass will try thousands of null
subdomain names, and hopefully we'll have some matches.
Perfect, take a look.
We didn't find anything more than we found before.
It is pretty much the same domains. But in any case, it is interesting
that it runs this brute force mode against your targets because, in your
case, you might find more domains than expected. The Amass tool saves a
DNS word list in this folder here,
user/share/amass/wordlists. In here you can see all the
out‑of‑the‑box DNS brute force lists. And if you want,
you can create your own DNS brute force list and put it in this folder.
Now, let's take a look in the intel module of Amass.
This will try to use some more advanced features to
find potential domains to attack.
For example,
let's use this command here, amass intel ‑asn. Basically, this command
will try to find all the domains related to an ASN.
For example,
let's take a look on the ASN from Globomantics. We can get
this information from a previous scan.
Take a look; it is right here.
Perfect.
Now,
once I run this, Amass will start to search for all
the domains related to this ASN.
In our case, because the Globomantics domain is hosted on Amazon AWS,
we find several other services hosted in AWS, and
unfortunately those are not interesting for us.
And actually, this is really important to remember.
Whenever you're doing a red team exercise,
make sure you're attacking a server that is part of your client domain.
Sometimes, like in this case here,
when the infrastructure is shared across several clients,
you might see targets that are not part of your client infrastructure.
And if you try to hack them, you're going to be committing a crime.
Okay, cool.
So one last thing I want to show you is how to perform a
reverse WHOIS lookup. For that I'll use amass intel ‑whois, and
then ‑d and the Globomantics domain.
After that,
I will just put ‑dir and the directory that I want to save the
results. When I run this, Amass will check the WHOIS information for
the Globomantics domain and then will try to find other domains with
similar information, for example,
if any other domain has the same email addresses associated to it.
As you can see, in our Globomantics case,
there is nothing else similar, but that's fine.
It is always worth checking that.