The Pentest Before the Pentest: Using APIs and Free Tools for Infrastructure Reconnaissance
No ratings
Presented at SecTor 2024 by
The conventional wisdom is that the Reconnaissance phase should be a significant portion of any security assessment or penetration test - because after all, you can't assess or attack what you don't know is there right?In this session, we'll explore various methods of "finding" hosts or subnets that might not be in your original scope, and often will be a surprise to your client! Using these recon approaches, you'll find that phrases like "No we don't patch that, we were told it was shut down 3 years ago!" or "Who's paying the AWS bill for that?" tend to come up in conversation during customer meetings. Also "and they were using PROD data for that DEV instance nobody told us about?". It's a rare gig where you can't find at least a few hosts that the client forgot about or never knew were there. As you can tell, the possibilities are endless - for the attacker that is!We'll use both commercial and open source intelligence API's and data sources, with a focus on one-liner API calls that return a TON of information to get the job done. Cool tools aside, you'll be surprised to find how much you can find with a one-line curl statement and an API key! (and sometimes not even the API key).