Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

10 Techniques for Blindly Mapping Internal Networks

netspi.com | blog | #reconnaissance | #pentest | #dns | #internal-network | #network-discovery | #arp

Summary

Catalogs ten blind internal network discovery techniques: DHCP info, traffic sniffing, ARP broadcasts, net view, DNS zone transfers, domain accounts, traceroute, and ping or port scans.
Published
Collected

original ↗

Related coverage

blog · yeswehack.com
Subdomains Tools Review: a full and detailed comparison of subdomain enumeration tools
A full and detailed comparison of subdomain enumeration tools, reviewing their features and trade-offs to help bug bounty hunters pick the right utility for reconnaissance.
blog · netspi.com
A First Look at Python in Excel
An early look at Python in Excel, where PY() formulas run code in Microsoft-hosted remote containers, with initial red team notes on exploring the runtime environment and capabilities.
blog · netspi.com
Penetration Testing as a Service – Scaling to 50 Million Vulnerabilities
Introduces Penetration Testing as a Service (PTaaS), shipping the Resolve platform on every engagement to correlate and deliver findings in real time, starting with program management dashboards.
blog · netspi.com
Gathering Bearer Tokens from Azure Services
A follow-up to managed identity research showing how to collect Azure OAuth bearer tokens from the portal, CLI, managed identities, Automation RunAs, and Cloud Shell, with new MicroBurst scripts.
blog · netspi.com
Linux Hacking Case Studies Part 4: Sudo Horror Stories
This Linux case study covers finding SSH servers, running dictionary attacks against weak passwords, then abusing overly permissive sudo rules on sh, vi, python, and nmap to escape to a root shell.
blog · netspi.com
Linux Hacking Case Studies Part 3: phpMyAdmin
Walks through attacking insecure phpMyAdmin installs: finding exposed instances, dictionary-attacking weak passwords, uploading webshells, then pivoting to world-writable cron scripts for escalation.
back