How to Uncover Hidden Subdomains to Reveal Internal Services with CT-Exposer « Null Byte :: WonderHowTo

Most companies have services like employee login portals, internal-only subdomains, and test servers they would prefer to keep private. Red teams and white hat hackers can find these obscure and often vulnerable services using a tool designed to help protect users from fraudulent certificates.What Is a Certificate Trust Log?Certificates are issued to companies operating online services by a certificate authority to protect users from being directed to fraudulent websites. In 2011, limitations in the ability of certificates to protect users were demonstrated by attacks against certificate authority companies Comodo and DigiNotar. Because it took a long time for the fraudulent certificates to be discovered, certificate trust logs were created to provide better transparency for users.Don't Miss:Use the Buscador OSINT VM for Conducting Online InvestigationsFacebook has used CT logs to discover mis-issued TLS certificates and stop them from being used to intercept HTTPS traffic. This success prompted them to release aCT log tool to the public, with the ability to "subscribe" to a domain to quickly see certificates issued to it.Ironically, releasing this tool led directly to several bug bounty reports in which Facebook test servers that didn't have the same permission checks as production servers were discovered, potentially leading to free access to all kinds of information. This perfectly illustrates how CT trust logs can reveal an unintended amount of information at the company while intending to detect domains using fraudulent certificates.Don't Miss:How to Use SpiderFoot for OSINT GatheringHidden subdomains can reveal hidden pages like employee logins, web applications in use, internal-only domains that can only be visited from an internal DNS, and old or deleted domains. While we can useFacebook's CT monitoring toolonline to find hidden subdomains, we'll be using a local tool for more anonymity. It's called CT-exposer, a Python OSINT scanner that's easy to run on any platform. It won't show us much data as Facebook's tool does, nor provide as many results, but the information is much easier to wade through.What You'll NeedTo get started using CT-exposer, you'll need to make sure Python3 is installed on your computer. If you don't have it, you can download it from thePython.orgwebsite. Once you have Python installed, you can ensure you have the right version by typingpython3into a terminal window. If the output looks similar to the below output, you should be good. You can typequit()after the >>> to exit.python3

Python 3.6.4 (v3.6.4:d48ecebad5, Dec 18 2017, 21:07:28)
[GCC 4.2.1 (Apple Inc. build 6996) (dot 3)] on husker
Type "help", "copyright", "credits" or "license" for more information.
>>> quit()If you're running Kali Linux, make sure to update and upgrade your system as well with the following commands.apt update
apt upgradeStep 1: Download & Install RequirementsWith Python installed and your system fully updated, you can begin by navigating to theGitHub pagefor CT-exposer. Once there, copy the URL under the clone or download button and run thegit clonecommand in a terminal window, as such:git clone https://github.com/chris408/ct-exposer.gitOnce the files finish downloading,change directoriesto root,cdto thect-exposerfolder, then install the requirements, like this:cd ct-exposer
sudo pip3 install -r requirements.txtOnce the requirements are installed, you should be ready to go!Step 2: Select Domain & Run ScanTo begin exploring what CT logs can reveal, take a test domain and see what information can be revealed from an attacker's perspective. To start, try priceline.com.The main URL for this nonsense is priceline.com, so run CT-exposer on the URL to see what you can find. Make sure you are in the ct-exposer folder. Once you're in the ct-exposer folder, you can run the following command to scan the certificate trust logs for thepriceline.comdomain.python3 ct-exposer.py -d priceline.comStep 3: Break Down & Interpret the ScanIn the output below, we see the results of the priceline.com scan. Wow! There are a lot of results, but how could they be useful?sudo python3 ct-exposer.py -d priceline.com

[+]: Downloading domain list...
[+]: Download of domain list complete.
[+]: Parsed 33 domain(s) from list.

[+]: Domains found:
23.23.126.26	admin.groupcommerce.com
178.250.2.116	app-install.priceline.com
35.241.46.146	appinstall.priceline.com
64.6.22.95	bomgar.corp.priceline.com
161.47.16.153	careers.priceline.com
209.202.133.98	cruises.priceline.com
64.6.22.95	dealreveal.corp.priceline.com
69.195.35.215	enet.qahotelportal.priceline.com
151.101.196.65	g.ssl.fastly.net
185.28.222.22	h.priceline.com
185.28.222.21	hsecure.priceline.com
64.6.22.100	mail.corp.priceline.com
104.196.14.36	media.priceline.com
64.6.22.95	phantom.corp.priceline.com
104.131.82.197	picme.priceline.com
151.101.196.204	priceline.map.fastly.net
69.195.35.246	qahotelportal.priceline.com
64.6.22.95	splunkes.corp.priceline.com
64.6.22.95	ssh.corp.priceline.com
69.195.35.226	travela.a1.qa.priceline.com
64.6.21.26	travela.priceline.com
69.195.35.166	www.a1.dev.priceline.com
69.195.35.245	www.a1.qa.priceline.com
64.6.23.56	www.a309.corp.priceline.com
69.195.35.167	www.b1.dev.priceline.com
151.101.130.186	www.priceline.com
69.195.35.143	www.qaa.priceline.com

[+]: Domains with no DNS record:
none	enet.hotelportal.priceline.com
none	fs.corp.priceline.com
none	pcln04.corp.priceline.com
none	rsecure.priceline.com
none	secure.priceline.comExample 1: Subdomains with DNS That Does Not ResolveYou can attempt to navigate to the various subdomains that appear. If they do not resolve, it can have one of several meanings.See what happens when you attempt to access an internal service, as in a service you have to be connected to an internal DNS server to access. For instance, if you attempt to navigate tomail.corp.priceline.comfrom your web browser, you're met with the following.This is different than what you see when the page you're trying to go to does not exist. This does exist, you just can't see it on a public server. To a red team or an attacker, a piece of internal infrastructure was just discovered. A simpleNmapwill show a Microsoft-IIS/8.5 server sitting at that address.Example 2: Subdomains with DNS That Does Resolve (1)Some subdomains do resolve and aren't that secret at all. However, to an attacker, knowing about this can let you make an early pass to explore a possible avenue of attack.For one example, you see a careers subdomain atcareers.priceline.com. As an attacker, I've just learned what kind of resume I need to copy and drop into these job postings to get the attention of an HR employee at Priceline. Maybe I can even get them to open a PDF resume with an exploit, but even if they use an outsourced hiring company, I can learn about the physical locations they operate from and the type of systems they use by carefully reading the job requirements.Example 3: Subdomains with DNS That Does Resolve (2)By following the subdomain breadcrumbs, you can continue to discover subdomains where the DNS does resolve. Another example,h.priceline.com, which resolves to an insecure website with a very old copyright date. The page talks about a bunch of services they either no longer offer or advertise.Example 4: Subdomains with DNS That Does Resolve (3)Similarly,media.priceline.comdoes actually resolve, this time to a secure website using HTTPS for press like myself, but also last updated in 2014. I'm sure nothing has changed since then.Example 5: Subdomains with DNS That Does Resolve (4)In some instances, the transportation layer security will be broken, and you'll get a big warning like that below when trying to resolvepicme.priceline.com, for instance.If you ignore it and proceed, you can see that the whole server is broken, giving an error message with more information about it. (Gee, thanks for the needless information.)As you can see, there's an Apache 2.4.18 server sitting on an Ubuntu on port 443. Hmm, that seems kind of old. Go ahead and Google that exactly to see if there could be anything wrong. Surely the fortress of information that is priceline.com couldn't be exposing an old, vulnerable server to the internet.Oh my god. There are 16 different vulnerabilities. In this case, you could just move on, assuming this is so riddled with issues that it's probably a honeypot. Wouldn't you feel bad kicking this poor thing?Don't Miss:Research a Person or Organization Using the Operative FrameworkExample 6: Subdomains with DNS That Does Resolve (5)Finally, there's the crown jewel of the discovery: employee login and application endpoints! These watering holes are where you can learn about the security of your targets and attempt to grab passwords. For example, when you attempt to resolvephantom.corp.priceline.com, you are greeted with the following page challenging for a login.So, does this mean that Priceline is running a phantom corporation? In may feel like it but, in fact, these are just endpoints to things like email, hotel logins, and other services employees access from outside the Priceline network.Here, the two important things you can learn are that Priceline is using okta.com for authentication and requires two-factor authentication through "Duo" security.If I was an attacker, I now know that employees receive a push notification each time they log into a company resource on a new device. This means capturing usernames and passwords are useless without also capturing this authentication layer.Example 7: Subdomains with No DNS RecordYou will also likely have several domains which have no DNS record. This means you cannot navigate to them because no known route exists on the public internet. So what does this mean?[+]: Domains with no DNS record:
none	enet.hotelportal.priceline.com
none	fs.corp.priceline.com
none	pcln04.corp.priceline.com
none	rsecure.priceline.com
none	secure.priceline.comThis means they are serviced by an internal DNS server or require you to be logged into a VPN to access. This makes these subdomains some of the most interesting of all, as they represent internal attack surfaces you do not yet have access to. They also act as targeting information for your initial attacks and a potential way of tricking employees into thinking they are on a private network when they are really on a public one.Don't Miss:Conduct OSINT Recon on a Target Domain with Raccoon ScannerIf I were an attacker or red team, I'd start quietly purchasingphishing domainsthat were similar to the ones seen here, likesecure.pricleine.comto attempt to trick employees into thinking they were logging into an internal service.Don't Miss:How to Easily Generate Hundreds of Phishing DomainsAbusing Certificate Trust Logs Can Reveal Hidden InformationIn one short command, an attacker can take a glance at the available target surfaces and determine the best method of attack. In our example, you were able to assess internal and external target surfaces, evaluate individual employee-level security at the company, and identify different internal departments such as hiring which may have more lax security standards. You were also able to find old, internal, and outright vulnerable domains by simply navigating to the URLs you found CT logs for.What a hacker might learn from this is that recon is a critical skill that doesn't have to be a hugely time-consuming endeavor. While CT-exposer should be just one tool in your arsenal, you can learn about the structure of a company's online presence with relative ease before choosing the perfect target.I hope you enjoyed this guide to using CT-exposer to gather OSINT data on a target domain! If you have any questions about this tutorial on CT-exposer or you have a comment, feel free to reach me in the comments below or on Twitter@KodyKinzie.Don't Miss:How to Scrape Target Email Addresses with TheHarvesterFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by Kody/Null ByteRelatedHow To:Use Photon Scanner to Scrape Web OSINT DataHack Like a Pro:Abusing DNS for ReconnaissanceHow To:Force Safari to Automatically Show Reader View for Specific Websites on Your iPhoneNews:Apple iOS 13 Code Indicates Possible Testing of AR Headset, Report SaysHow To:Quickly Look Up the Valid Subdomains for Any WebsiteNews:Shadow Brokers Leak Reveals NSA Compromised SWIFTHow To:Discover Hidden Subdomains on Any Website with SubfinderHow To:Conduct Recon on a Web Target with Python ToolsHow To:Mix a CT cocktailAdvanced Nmap:Top 5 Intrusive Nmap Scripts Hackers & Pentesters Should KnowHow To:Bypass Facebook's HSTSNews:Kinect Hack Reveals 'X-Ray' VisionNews:Augmented Reality App Maker Houzz Reveals Major Data BreachHow To:Hack TOR Hidden ServicesHow To:Use Twitter Custom TimelinesHow To:Install Baseboards / Skirting Boards. SECRET REVEALED!How To:Use SSH Local Port Forwarding to Pivot into Restricted NetworksHow To:Create Malicious QR Codes to Hack Phones & Other ScannersNews:Magic Leap Lifts Curtain on Augmented Reality Experiences for Magic Leap OneNews:HoloLens Assists in Live SurgeryHow To:Find Identifying Information from a Phone Number Using OSINT ToolsHow To:Export Your Pixel's Contacts to Use with Other ServicesHow To:Hide or Uninstall System Apps on Your Nexus Player for a Cleaner Home ScreenHow To:Use the siva count card sleight for many card tricksHow To:Reveal hidden MySpace profile content with FireFoxNews:Parents Magazine Cutest Daddy Photo Contest - Deadline February 26, 2011News:Parents Magazine Toys Model Search Photo Contest - Deadline February 19, 2011News:Kid of the Week Photo Contest - Deadline January 15, 2011News:Spooked By Santa Photo Contest - Deadline January 8, 2011News:Parents Magazine Kid of the Year Photo Contest - Weekly Saturday Deadline Plus Final January 21, 2012News:Anonymity, Darknets and Staying Out of Federal Custody, Part Three: Hidden ServicesNews:If You Are Crazy For Farmville - Secrets Revealed!News:Anonymity, Darknets and Staying Out of Federal Custody, Part Two: Onions and DaggersHow To:Get the 'Scout Leader' Achievement in Modern Warfare 3News:News Clips - June 6How To:Download Your Data with Google TakeoutNews:"This Guy Has My MacBook"—A Tale of Evil, Redemption & the Power of the AppEditor Picks:The Top 10 Secret Resources Hiding in the Tor NetworkNews:Kinect Price Revealed; Sony Move ComparisonHow To:A Guide to Steganography, Part 1: How to Hide Secret Messages in Images