Practical Web Application Penetration Testing Series - Chapter 2

In the first chapter we saw how to detect and recon the technology of a website. Now, in chapter 2 we are going to use http://viewdns.info/ website or google.com for detecting the sub-domains of a website and information gathering.

In Google, we use the query site:*.targetsite.com or site:*targetsite.com

For instance if we want to find sub-domains of microsoft.com with google, we would use the query site:*.microsoft.com, see the picture below:

As you can see, there are many sub-domains like: mva.microsoft.com, imagine.microsoft.com and others.

A good penetration tester always checks all sub-domains for vulnerabilities. Even if they are not on the same network, they could contain useful information.

Another way for finding sub-domains and other useful information online, is to use these sites:  http://viewdns.info/, http://www.wolframalpha.com and https://www.netcraft.com

I used http://www.wolframalpha.com for the following demonstration: 

On the third table we hit sub-domains to see all sub-domains of the site:

Just as easy as that.

Another thing we should consider is the Reverse ip lookup. What is reverse ip lookup? It is used to find all sites hosted on a given server. For example on one server, we  could have 2 or more web applications hosted on the same IP (see the demonstration for p30download.com site for example).

The hint is if we find any vulnerability in other web applications hosted on that IP, we may be able to pawn the others. For example, we find SQL Injection on one of the domains and when we hack in to database, we also find other domains' database information in that.

If we want to find sub-domains in Kali Linux we can use the command: fierce -dns <domain name>

I personally prefer using online tools because my IP remains safe from IDS and firewalls and it does not get blacklisted ;) In my experience the sub-domains have a greater possibility to have vulnerabilities as the programmers usually don’t pay much attention on the security terms of the sub-domains because the sub-domains are usually less interactive with users.

Anyway, in our case we are not going to test all sub-domains but instead just test this sub-domain:  http://testphp.acunetix.com/

In the next chapter we will start using Burpsuite ….

Thanks