{"id":526,"date":"2020-03-05T21:21:35","date_gmt":"2020-03-05T21:21:35","guid":{"rendered":"https:\/\/osintme.com\/?p=526"},"modified":"2020-04-16T21:18:18","modified_gmt":"2020-04-16T21:18:18","slug":"osint-me-tricky-thursday-4","status":"publish","type":"post","link":"https:\/\/osintme.com\/index.php\/2020\/03\/05\/osint-me-tricky-thursday-4\/","title":{"rendered":"Osint Me Tricky Thursday #4 – Website OSINT"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Tricky Thursday is back and today we are looking at website-focused OSINT.<\/p>

I briefly touched on the topic in the first instalment of the Tricky Thursday thread here<\/a>.<\/p>

So how do you go about gathering intel about web domains?<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

1. Whois<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In the pre-GDPR era, this used to be a phenomenal tools for domain lookup, allowing us to universally identify various information, like registrant details, contact details, admins, hosting, etc.<\/p>

The whois resources are now heavily restricted but still offer some snippets of information that could be relevant.<\/p>

who.is<\/a> – one of the most popular websites, but there are some alternatives that do essentially the same thing:<\/p>

https:\/\/www.whois.net\/<\/a><\/p>

https:\/\/lookup.icann.org\/<\/a><\/p>

https:\/\/centralops.net<\/a><\/p>

https:\/\/domains.markmonitor.com\/whois\/<\/a><\/p>

Also you can just run the ‘whois’ command (followed by the domain name or IP address) in your terminal and receive information that way.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t
.<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

2. Domain reputation check<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Reputation might be an arbitrary thing, but often you might just need a quick YES \/ NO answer regarding website legitimacy, as opposed to longer research.<\/p>

The good thing about the reputation ranking, which derives from a mixture of corporate expertise and community submissions, is that it can alert users to malicious content on a website they are about to visit.<\/p>

Simply paste the website URL into one of these resources and check out the score:<\/p>

https:\/\/www.threatminer.org<\/a> – a threat intelligence portal that combines the information from several well-respected infosec industry platforms;<\/p>

https:\/\/www.joesandbox.com<\/a> – an online malware analysis platform, which also conducts URL scans;<\/p>

https:\/\/www.virustotal.com\/gui\/home\/url<\/a> – this website pulls information from antivirus scanners and URL \/ domain blacklisting services and alerts on dangerous or malware infected sites;<\/p>

https:\/\/talosintelligence.com<\/a> – a reputation evaluation tool from CISCO. Also returns whois records;<\/p>

https:\/\/www.ipvoid.com<\/a> – includes a number of IP blacklist checks, whois lookup, dns lookup, ping.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

3. Associated domains<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

If you would like to see what other websites are located on a shared hosting server used to host a target domain, use these tools:<\/p>

https:\/\/www.ipfingerprints.com\/reverseip.php<\/a> – to find other sites running on a webserver;<\/p>

https:\/\/dnslytics.com\/reverse-ip<\/a> – find domains sharing the same IP address or subnet;<\/p>

https:\/\/urlscan.io<\/a> – one of my favourite tools, it has many more functionalities but when it comes to associated domains, the great features here include searching for structurally similar pages, sub domains and domain trees;<\/p>

https:\/\/publicwww.com<\/a> – search engine for comparing source codes of websites.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t
urlscan.io<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

4. Resources for inactive domains<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Domains might come and go, but what appears on the internet stays there!<\/p>

https:\/\/archive.is<\/a> – this archive site will allow you to archive other websites as well as search for those already in their archives;<\/p>

https:\/\/archive.org\/web<\/a> – Wayback Machine, for snapshots of websites taken periodically<\/p>

http:\/\/www.cachedpages.com<\/a> – cached versions of pages;<\/p>

http:\/\/cachedview.com<\/a> – contains copies of the websites cached by Google;<\/p>

https:\/\/loc.gov\/websites<\/a> – Library of Congress archived websites;<\/p>

https:\/\/www.webarchive.org.uk\/ukwa<\/a> – specific to the UK websites, but still a useful source of archived content.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

5. Private network IP address ranges<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

If you encounter any of the following groups of IP addresses\u00a0 (IPv4), remember they are reserved for private networks:<\/p>

10.0.0.0 – 10.255.255.255<\/strong><\/p>

169.254.1.0 – 169.254.255.255<\/strong><\/p>

172.16.0.0 – 172.31.255.255<\/strong><\/p>

192.168.0.0 – 192.168.255.255<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Tricky Thursday is back and today we are looking at website-focused OSINT.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"off","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[6],"tags":[80,29,27,28,26,79],"class_list":["post-526","post","type-post","status-publish","format-standard","hentry","category-open-source-intelligence","tag-domain","tag-links","tag-osint-tricks","tag-techniques","tag-tricky-thursday","tag-website"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts\/526","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/comments?post=526"}],"version-history":[{"count":12,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts\/526\/revisions"}],"predecessor-version":[{"id":710,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts\/526\/revisions\/710"}],"wp:attachment":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/media?parent=526"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/categories?post=526"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/tags?post=526"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}