Hunting Cyber Criminals

Part IIWeb Exploration

In This Part

• Chapter 6: Website Information Gathering
• Chapter 7: Directory Hunting
• Chapter 8: Search Engine Dorks
• Chapter 9: WHOIS
• Chapter 10: Certificate Transparency and Internet Archives
• Chapter 11: Iris by DomainTools

With Part I of this book focusing on researching and exploring network addresses, Part II will now focus on gathering and extracting information and intelligence from websites and domains.

This part will cover topics like fingerprinting and gathering baseline information on target websites and move into more complex web scenarios like attempting to brute‐force folders on a website in order to find valuable information.

This part will also cover topics like leveraging advanced search techniques (dorking) to discover hidden information on a website and will work the process of domain attribution using tools like WHOIS, certificate transparency logs, the Wayback Machine (archive.org), and the DomainTools IRIS platform.

NOTE I will be completely honest and say that the process of trying to attribute a domain with an owner absolutely sucks. It can be brutal, and all of the new GDPR privacy regulations are making the process that much more difficult. Even more so if you are hunting threat actors—they will not make the process easy for you. Depending on the domain or the target, attribution can often come down to simply having access to the right historical data—and that information is usually not free (or cheap). When dealing with threat ...