DEFCON29 Recon Village Toots & Resources

defcon29-recon.md

🧰 DEFCON29 Recon Village Resources

Talks videos 🎬 Watch here

---

Future of Asset Management - Ben Sadeghipour

Where to find Domains/subdomains:

• Acquisitions https://acquiredby.co/apple-acquisitions/
• ViewDNS https://viewdns.info
• Certificate Transparency services
  • Shodan https://shodan.io
  • Censys https://censys.io/
  • Crt.sh https://Crt.sh
  • Certspotter https://sslmate.com/certspotter/
  • Google Transparency Report https://transparencyreport.google.com/https/certificates
  • Facebook Certificate Transparency Monitoring https://developers.facebook.com/tools/ct/

Mentioned Tools

• Amass https://github.com/OWASP/Amass
• Subfinder https://github.com/projectdiscovery/subfinder
• Sublist3r https://github.com/aboul3la/Sublist3r
• Findomain https://github.com/Findomain/Findomain
• Sudomy https://github.com/screetsec/Sudomy

---

Passive DNS - Andy Dennis

Passive DNS Providers

• RiskIQ https://community.riskiq.com/home
• Cisco Umbrella https://umbrella.cisco.com/
• SecurityTrails https://securitytrails.com/
• CIRCL Passive DNS https://www.circl.lu/services/passive-dns/
• SpamHaus Passive DNS https://www.spamhaus.com/product/passive-dns/

Mentioned Tools

• Word Generator https://wordsmith.org/anagram

---

So you Want OpSec, eh? - Ritu Gill

Device/Browser info

• https://coveryourtracks.eff.org
• AmIUnique https://www.amiunique.org
• Whoer https://whoer.net
• WhatU https://whatu.info

Browser Add-ons

• HTTPS everywhere https://addons.mozilla.org/en-US/firefox/addon/https-everywhere/
• Privacy badger https://addons.mozilla.org/en-US/firefox/addon/privacy-badger17/
• User agent switcher https://addons.mozilla.org/en-US/firefox/addon/user-agent-string-switcher/

Useful sites

• https://haveibeenpwned.com
• https://tosdr.org
• https://privacytools.io
• https://justgetmydata.com
• https://justdeleteme.xyz
• https://accountkiller.com
• https://www.securemessagingapps.com/

Data Removal

• https://inteltechniques.com/data/workbook.pdf
• https://webbreacher.com/2017/04/24/removing-yourself-from-the-internet/
• https://www.learnallthethings.net/blog/2018/1/23/opting-out-like-a-boss-the-osint-way
• https://tisiphone.net/2017/01/25/thwart-my-osint-efforts-while-binging-tv/

---

OSINT and the Hermit Kingdom - Nick Roy

North Korea on the internet

• https://bgpview.io/asn/131279
• https://github.com/nknetobserver/nknetobserver.github.io
• RedStar OS
  • https://github.com/takeshixx/redstar-tools
  • https://c3subtitles.de/talk/501/
• Foreign Trade of the DPRK http://www.korean-books.com.kp/en/search/?page=periodic-trade
• NK websites
  • dprkportal.kp
  • portal.net.kp
  • webmail.star.net.kp
  • sns.star.net.kp

Mentioned Tools

• Bellingcat tools: http://bit.ly/bcattools
• Torrent Tracking https://iknowwhatyoudownload.com
• Strava HeatMap https://www.strava.com/heatmap

Commandline tools

• dig a example.com +short > IPs
• whois -h whois.cymru.com x.x.x.x > ASN, company name

---

Hidden Gems via URL Shorteners - Utku Sen

Mentioned Tools

• https://github.com/lc/gau
• https://github.com/OJ/gobuster
• https://github.com/utkusen/urlhunter
• https://shorteners.grayhatwarfare.com/
• https://wiki.archiveteam.org/index.php?title=URLTeam
• https://tracker.archiveteam.org:1338/

Commandline tools

• Unshort URL: curl https://xx.xx/xxx --head

Search dorks

• docs.google.com/a/CompanyName
• docs.google.com/a/CompanyName.com
• drive.google.com/a/CompanyName
• drive.google.com/a/CompanyName.com
• Includes "trello.com" AND "Company Name"
• Include "company.com" AND "admin" OR "private"
• Include "company.com" AND "resetToken"
• Include "company.com" AND "PHPSESSIONID"
• Include "google.com/maps/place" AND "39.9,32.3"

---

Using OSINT to Combat Human Trafficking & Smuggling - Rae Baker

• https://www.marinetraffic.com

---

Hunting & Smashing Trolls on Twitter - Mauro Eldritch & Santiago Montaño

Propaganda Social Media Networks

• https://counter.social
• https://www.facepopular.net/

Tracking Trolls

• Tracking Trends
  • https://getdaytrends.com/
  • https://www.trendinalia.com
• Block Trolls
  • MegaBlock https://megablock.xyz/
  • Twitter Block Chain https://chrome.google.com/webstore/detail/twitter-block-chain/dkkfampndkdnjffkleokegfnibnnjfah
  • Block together https://twitter.com/blocktogether
• Venator tool: https://github.com/mauroeldritch/venator

---

People Hunting, a Pentester's Perspective - Mishaal Khan

Mentioned Tools

• Ripgrep Tool https://github.com/BurntSushi/ripgrep
• People search
  • https://www.allbiz.com/
  • https://www.advancedbackgroundchecks.com/
  • https://www.fastpeoplesearch.com/
  • https://thatsthem.com/
  • https://peopledatalabs.com
• Search NPI Records https://npiregistry.cms.hhs.gov/
• Vehicle Search https://www.vehiclehistory.com/
• Search Bluetooth devices https://wigle.net/
• Voter Search https://www.sec.state.ma.us/VoterRegistrationSearch/MyVoterRegStatus.aspx
• Burp suit tool https://portswigger.net/burp
• Breach lookup
  • https://haveibeenpwned.com/
  • https://breachdirectory.tk/
• Hashcat tool https://github.com/hashcat/hashcat/
• Carrier lookup https://scammerblaster.com/carrier-lookup/
• Doctor search https://www.vitals.com/
• Classmates https://classmates.com
• Instagram tool https://github.com/megadose/toutatis
• Holehe - Registered Account Checking tool https://github.com/megadose/holehe
• https://socialbearing.com/

---

Tracking Infrastructure with Mihari - Manabu Niseki

Presentation

• https://ninoseki.github.io/presentations/Adversary%20Infrastructure%20Tracking%20with%20Mihari.pdf

Mentioned Tools

• MMhdan
  • https://github.com/ninoseki/mmhdan
  • https://mmhdan.herokuapp.com/
• Mihari https://github.com/ninoseki/mihari
• Active Tracking
  • Nmap https://nmap.org/
  • Masscan https://github.com/robertdavidgraham/masscan
  • Zmap https://github.com/zmap/zmap
  • httpx https://github.com/projectdiscovery/httpx
  • JARM https://github.com/salesforce/jarm
• Passive Tracking
  • Internet-wide scanning
    • Shodan https://shodan.io
    • Censys https://censys.io/
    • BinaryEdge https://www.binaryedge.io/
    • Onyphe https://www.onyphe.io/
    • Spyse https://spyse.com/
    • ZoomEye https://www.zoomeye.org/
  • Passive DNS services
    • VirusTotal https://www.virustotal.com/
    • PassiveTotal (RiskIQ) https://community.riskiq.com/home
    • SecurityTrails https://securitytrails.com/
    • DomainTools https://domaintools.com
  • CT logs
    • Crt.sh https://Crt.sh
    • Censys https://censys.io/

---

Bug Hunter's Methodology - Tushar Verma

• ReconFTW https://github.com/six2dez/reconftw
• Bheem https://github.com/harsh-bothra/Bheem
• Osmedeus https://github.com/j3ssie/Osmedeus

---

Creating a Social Threat Score - Masterchen

• https://github.com/MasterChenb0x/SocialThreatScore
• https://us-cert.cisa.gov/CISA-National-Cyber-Incident-Scoring-System
• https://merics.org/en/report/chinas-social-credit-system-2021-fragmentation-towards-integration
• https://www.myfico.com/credit-education/whats-in-my-credit-report

---

Build Cloud-Based Recon Automation - Ryan Elkins

• Brevityrecon https://github.com/brevityinmotion/brevityrecon
• Blog https://www.brevityinmotion.com/automated-cloud-based-recon/
• Arkadiyt https://github.com/arkadiyt

---

Uncovering APT Attacks - Ladislav Baco

Malware Samples

• https://vx-underground.org/
• https://bazaar.abuse.ch/

Malware Feed

• Hybrid Analysis https://www.hybrid-analysis.com/
• Any.Run https://any.run/
• Tria.ge https://tria.ge/
• VirusTotal https://www.virustotal.com/

Threat Intel Platform / Tools

• Yeti https://yeti-platform.github.io/
• Tweettico http://tweettioc.com/
• Twint https://github.com/twintproject/twint

Advanced Search

• Shodan https://shodan.io
• Censys https://Censys.io
• Webarchive https://archive.org/web/
• Search by hash on Shodan http.favicon.hash

---

Domainsquatting with Different TLD's - Anthony Kava

• https://impostor.domains/

---

OSINT for Workers - Kala Kinyon

Mentioned Tools

• Thatsthem https://Thatsthem.com
• GeoCreepy https://geocreepy.com
• SunCalc https://SunCalc.net
• OsintFramework https://osintframework.com/
• Wiki of Social Media Monitoring Solutions http://wiki.kenburbary.com/