Gathering Intel and Planning Attack Strategies

In this chapter, we will cover the following recipes:

• Getting a list of subdomains
• Using Shodan for fun and profit
• Shodan Honeyscore
• Shodan plugins
• Using Nmap to find open ports
• Bypassing firewalls with Nmap
• Searching for open directories
• Performing deep magic with DMitry
• Hunting for SSL flaws
• Exploring connections with intrace
• Digging deep with theharvester
• Finding technology behind web apps
• Scanning IPs with masscan
• Sniffing around with Kismet
• Testing routers with firewalk