https://patrik.re/topics/reconnaissance/ Finding hosts, mapping attack surfaces, and observing exposed services. en-GB Sat, 05 May 2018 00:00:00 +0000 https://patrik.re/visual-recon-a-beginners-guide/ https://patrik.re/visual-recon-a-beginners-guide/ Sat, 05 May 2018 00:00:00 +0000 A VPS-based workflow chaining Aquatone subdomain discovery, WebScreenshot capture and express-photo-gallery into a browsable wall of screenshots for triaging a large attack surface. patrik.rereconnaissance https://patrik.re/bugbounty-decoding-a--f0-9f-98-b1-00000-htpasswd-bounty/ https://patrik.re/bugbounty-decoding-a--f0-9f-98-b1-00000-htpasswd-bounty/ Thu, 08 Sep 2016 00:00:00 +0000 Directory brute-forcing a private bug bounty target turned up a world-readable .htpasswd whose descrypt hash, once cracked, opened four staging and development subdomains. patrik.reweb-exploitationreconnaissance https://patrik.re/research-ssh-honeypot-honey-wss-sh-com/ https://patrik.re/research-ssh-honeypot-honey-wss-sh-com/ Mon, 17 Nov 2014 00:00:00 +0000 Results from two weeks of a Kippo SSH honeypot in November 2014: roughly 4,000 brute-force attempts, 2,500 distinct credential pairs, and a source distribution dominated by hosts in China. patrik.reweb-exploitationreconnaissance https://patrik.re/a-tale-of-7-vulnerabilities-paypal-bug-bounty/ https://patrik.re/a-tale-of-7-vulnerabilities-paypal-bug-bounty/ Sun, 20 Apr 2014 00:00:00 +0000 A 2014 run through PayPal's bug bounty scope: seven confirmed issues across paypal.com, financing.paypal.com, apps.paypal.com and the paypal-*.com family, all closed as duplicate or invalid. patrik.reweb-exploitationreconnaissance https://patrik.re/php-5-3-3-5-3-6-exploit-bind-shell/ https://patrik.re/php-5-3-3-5-3-6-exploit-bind-shell/ Sat, 06 Jul 2013 00:00:00 +0000 A public PHP 5.3.3-5.3.6 socket_connect exploit carrying a bind-TCP shell payload, dropped as an uploaded PHP file and located with an nmap sweep of ports 4000-4500. patrik.reweb-exploitationreconnaissance https://patrik.re/bugbounty-yahoo-phpinfo-php-disclosure/ https://patrik.re/bugbounty-yahoo-phpinfo-php-disclosure/ Sun, 20 Jan 2013 00:00:00 +0000 Pivoting from Yahoo's main A record to its ARIN netblock and sweeping all 260,000 addresses in the /14 for an exposed phpinfo.php. patrik.reweb-exploitationreconnaissance