Hunting Cyber Criminals

CHAPTER 6Website Information Gathering

As we move on to the next step of intelligence gathering, we can now start to look at websites themselves. Fingerprinting a website is the absolute first step in developing a game plan for further investigation. When performing attack surface discovery against a target, or even an entire organization, you can learn a tremendous amount of information by performing a little bit of passive reconnaissance. This is where our journey begins.

WARNING It is important to note that even though many of the tools we will cover contain brute forcing options, those will be beyond the scope of this book. If you are looking for a great web recon tool that also does exploit testing, I recommend you check out Sn1per (https://github.com/1N3/Sn1per). We won't be talking about Sn1per because the majority of its uniqueness is in its exploit capabilities, which is outside the scope of this book. Sn1per integrates with Nikto, WPScan, and a number of other tools to perform its tests—it is definitely worth checking out if you need a tool that can also break into a target.

BuiltWith

As a starting point, it is generally a good idea to understand which technologies are in use on your target's web app. Builtwith.com is a great place to start. BuiltWith is designed to be a lead generation and sales tool that allows salespeople to identify technologies present on a website or web application. As it happens, it's also great for initial recon on a website or ...