PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A Guide to Digital Reconnaissance

bishopfox.com | blog | #osint | #reconnaissance | #red-team | #social-engineering | #methodology | #intelligence
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Daniel Wood explains digital reconnaissance for red teams: gathering intelligence passively before active engagement, building a target picture and exploiting organizational and human weaknesses.
Published
Collected

Related coverage

blog · netlas.io
Google Dorking in Cybersecurity: Techniques for OSINT & Pentesting
Introduces Google dorking for OSINT and pentesting: the most valuable search operators for exposing files and pages, practical examples, automation approaches, and alternative search tools.
blog · netspi.com
Leading Financial Institution Leveraged NetSPI Red Team Service to Improve Their Security Posture
NetSPI describes a black box red team engagement for a major US bank's subsidiary: OSINT and a robo-caller vishing attack harvested employee credentials used to attempt VPN access to the network.
blog · netspi.com
Collecting Contacts from zoominfo.com
NetSPI describes scraping employee contacts from zoominfo.com for OSINT use, and releases a script that converts gathered names into emails and usernames for phishing and password spraying engagements.
blog · netspi.com
Collecting Contacts from LinkedIn Using linkedin_crawl
Introduces the linkedin_crawl recon-ng module that spiders the People also Viewed pane on LinkedIn to harvest employee names and titles for phishing lists and password attacks.
blog · bishopfox.com
The CIA Leak: A Look On the Bright Side...
A contrarian read on the WikiLeaks CIA leak: the documents show the agency sharing zero-day exploits and threat intel with the NSA, FBI, GCHQ and MI5, a far cry from the post-9/11 silos.
blog · xbow.com
MITRE ATT&CK Coverage Assessment: How to Measure Defensive Readiness
Most ATT&CK coverage heatmaps are built on assertion, not evidence. Here’s the methodology that makes numbers defensible, with the help of autonomous continuous testing.
Back