Logo

Preparation

  • Build a local testlab

Footprinting

  • Introduction
    • What?
    • Why?
    • How?
  • Gather network information
    • Whois and IP Geolocation
      • IP Geolocation
    • DNS footprinting
    • Network Footprinting
  • Gather system information
    • Website footprinting
    • Cloning websites
    • Eyeing repositories
    • Sensitive files discovery
  • Collect organisation information
    • Advanced searches
    • Google dorking
    • Email footprinting
    • Assets discovery
    • Investigating social media
    • Visit job listing sites

Initial scanning

  • Introduction
    • What?
    • Why?
    • How?
  • War-dialing-driving-flying-shipping
    • War dialing
    • War driving
    • War strolling
    • War flying
    • War shipping
    • Resources
  • Live host discovery
    • Types of scans
    • Options
  • Host discovery with ICMP
    • Examples
  • Host discovery with TCP
    • Split scans
    • Hints
    • Under the hood
    • Interpreting portscan outputs
    • Examples
  • Host discovery with UDP
    • Relationship with ICMP
    • Not responding
    • Interpreting portscan outputs
    • Examples
  • Port scanning
    • Types of scans
    • Options
  • Service and OS detection
  • Diving deeper in discovery
    • Under the hood
    • Mapping out DMZ and internal networks
    • Uptime
    • Examples
  • Defence detection
  • Stealth scans
    • Stealth
  • Firewall evasion

Canopy of apple-blossom

  • Introduction
    • What?
    • Why?
    • How?
  • Manually walk through the target
  • Scope discovery
    • WHOIS and Reverse WHOIS
    • IP addresses
    • Researching certificates
    • Subdomain enumeration
    • Service Enumeration
    • Enumerate webserver directories
    • Spidering the site
    • Third-party hosting
    • GitHub Recon
  • Other sneaky OSINT techniques
  • Tech stack fingerprinting

API Mayhem

  • Introduction
    • What?
    • Why?
    • How?
  • Collect data
    • Tools
  • Understand application functionality
    • Resources
  • Analyse traffic
  • Document key parameters
    • Resources
  • Check for exposed secrets
    • Resources

Head in the clouds

  • Introduction
    • What?
    • Why?
    • How?
  • Mapping endpoints
  • Investigating AWS S3 URLs
    • Endpoints
    • S3 bucket URL schemes
    • Path style URL
    • Virtual-hosted style URL
    • Static Website Hosting Endpoints
    • Presigned URL

Pocketful of acorns

  • Introduction
    • What?
    • Why?
    • How?
  • Passive reconnaissance
  • Recon of facilities
    • Resources
Falconry
  • Ty Myrddin Home
  • Unseen University
  • Improbability Blog
  • About
  • Contact
Unseen University, 2024, with a forest garden fostered by /ut7.