Menu
PTES Phase 2 - Intelligence gathering for AWS security assessments
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Security audit for AI agent endpoints (Claude Desktop/Code, MCP servers, plugins, extensions)
Active Directory penetration testing skills covering reconnaissance, attacks, lateral movement, persistence, and ADCS exploitation
PTES Phase 5 - Exploitation for AWS security assessments using WorstAssume attack chain detection
Network reconnaissance and port scanning using Naabu, hping3, and complementary tools
Pentest especializado para Palo Alto Networks PAN-OS — cobre CVE-2026-0300 (buffer overflow RCE), User-ID Auth Portal, e superfície de ataque completa
Pentest especializado para pfSense CE e Plus — cobre todas as superfícies de ataque a partir da rede externa e interna, mapeado ao PTES e ao código-fonte real do pfSense
| name | pentest-intelligence-gathering |
| description | PTES Phase 2 - Intelligence gathering for AWS security assessments |
| type | skill |
IMPORTANTE: Se durante o OSINT ou footprinting você identificar pfSense, ATIVE A SKILL
pentest-pfsenseimediatamente.
# Shodan - Passive detection
shodan search "product:pfsense"
shodan search "http.title:pfSense"
shodan search "org:Netgate"
# Censys - Certificate and service discovery
censys search "services.software.product=pfSense"
censys search "services.http.response.html_title:pfSense"
# Google Dorks
site:target.com "pfSense"
site:target.com "Netgate"
intitle:"pfSense Login"
# Se pfSense detectado → ATIVAR pentest-pfsense skill
# Esta skill continua para intelligence gathering geral
# Use pentest-pfsense para:
# - Passive reconnaissance específica (Shodan/Censys)
# - CVE mapping para versão detectada
# - Feature-based testing especializado
IMPORTANTE: Se durante o OSINT ou footprinting você identificar cPanel ou WHM, ATIVE A SKILL
pentest-exploitationpara CVE-2026-41940.
# Shodan - Passive detection
shodan search "product:cpanel"
shodan search "http.title:cPanel"
shodan search "http.title:WHM"
shodan search "port:2087" # WHM
shodan search "port:2083" # cPanel
shodan search "port:2095" # cPanel Webmail
shodan search "port:2096" # Webmail SSL
# Censys - Certificate and service discovery
censys search "services.software.product=cPanel"
censys search "services.http.response.html_title:cPanel"
censys search "services.http.response.html_title:WHM"
# Google Dorks
site:target.com "cPanel"
site:target.com "WHM"
intitle:"cPanel Login"
intitle:"WHM Login"
inurl:2087
inurl:2083
# Port scanning com Naabu
naabu -host target.com -p 2087,2083,2095,2096 -silent
# HTTP probing com httpx
httpx -u https://target.com:2087 -title -tech-detect
httpx -u https://target.com:2083 -title -tech-detect
# Banner grabbing
curl -sk https://target.com:2087/login | grep -iE "cPanel|WHM"
# Se cPanel/WHM detectado → ATIVAR pentest-exploitation skill
# Testar CVE-2026-41940 (Authentication Bypass CVSS 9.8)
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET:2087 -u admin -p password detect
# Se vulnerável → Explorar
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET:2087 -u admin -p password exploit
# Enumeração completa com stealth mode (jitter 0.3-1.2s entre API calls)
worst enumerate --profile <profile> --region us-east-1 --stealth
# Com credenciais explícitas
worst enumerate --access-key AKIA... --secret-key ... --session-token ...
# Com assume-role para contas cross-account
worst enumerate --profile default --assume-role arn:aws:iam::TARGET:role/AuditRole
# Enumeração multi-conta (script enum.sh)
./enum.sh > log.txt # Enumera 14+ contas em sequência
FAST PATH (iam:GetAccountAuthorizationDetails):
- 1 chamada API = todos usuários, grupos, roles, políticas
- ~2-5 segundos para conta completa
- Requer: iam:GetAccountAuthorizationDetails
SLOW PATH (fallback quando fast path não disponível):
- 50-200+ chamadas API individuais
- ~30-120 segundos dependendo do tamanho da conta
- Requer: iam:ListUsers, iam:ListRoles, iam:ListGroups, etc.
CAPABILITY PROBING (worstassume/core/capability.py):
Antes de enumerar, WorstAssume detecta automaticamente:
- iam_full_dump: Pode usar fast path?
- iam_list_users: Pode listar usuários?
- iam_list_roles: Pode listar roles?
- iam_list_policies: Pode listar políticas?
- ec2_full, s3_full, lambda_full, etc.
# Cada módulo é executado com jitter (se --stealth)
# Ordem de execução no worstassume/cli.py:
1. Identity (identity_mod.get_caller_identity)
→ Retorna: ARN, Account ID, Principal Type
2. IAM (iam.enumerate)
→ Usuários, Groups, Roles, Policies, Memberships
3. EC2 (ec2.enumerate)
→ Instances, Instance Profiles, Metadata Options
4. S3 (s3.enumerate)
→ Buckets, Bucket Policies
5. Lambda (lambda_.enumerate)
→ Functions, Execution Roles
6. ECS (ecs.enumerate)
→ Clusters, Task Definitions, Task Roles
7. VPC (vpc.enumerate)
→ VPCs, Subnets, Security Groups
# Após enumerar múltiplas contas, WorstAssume detecta automaticamente:
worst accounts list # Mostra contas enumeradas
# Cross-account links são inferidos sem chamadas API adicionais
# Analisando trust policies das roles no banco de dados
Cross-Account Links Detectados:
├── Account A (111111111111) → Account B (222222222222)
│ └── Role: CrossAccountRole
│ ├── Trust Principal: arn:aws:iam::111111111111:root
│ ├── Wildcard: NO
│ └── Condition: sts:ExternalId (presente)
│
└── Account A (111111111111) → Account C (333333333333)
└── Role: AdminCrossAccount
├── Trust Principal: * (wildcard!)
├── Wildcard: YES (CRITICAL!)
└── Condition: NONE
# Detectado por: worstassume/core/cross_account.py:build_cross_account_links()
# Regex de extração: arn:aws[^:]*:[^:]*:[^:]*:(\d{12}):
# Detecção automática durante análise de trust policies:
if principal_block == "*":
is_wildcard = True # Qualquer principal pode assumir
severity = "CRITICAL"
elif "aws:PrincipalOrgID" in condition:
is_wildcard = True # Todo o organization pode assumir
severity = "HIGH"
# Identificar quem somos (PTES 2.5.4.7 - Banner Grabbing)
aws sts get-caller-identity
# Output esperado:
# {
# "UserId": "AIDAI...",
# "Account": "123456789012",
# "Arn": "arn:aws:iam::123456789012:user/auditor"
# }
Capability Map Exemplo (após enumeration):
├── iam_full_dump: TRUE (fast path disponível)
├── iam_list_users: TRUE
├── iam_list_roles: TRUE
├── iam_list_policies: TRUE
├── ec2_describe_instances: TRUE
├── s3_list_buckets: TRUE
├── lambda_list_functions: TRUE
├── ecs_list_clusters: TRUE
└── vpc_describe_vpcs: TRUE
Database: ~/.worstassume/db.sqlite
Tables:
├── accounts (account_id, account_name, org_id, profile, last_enumerated_at)
├── runs (account_id, started_at, completed_at, capabilities_json, success)
├── principals (arn, name, principal_type, account_id, trust_policy_json, path)
├── policies (arn, name, policy_type, account_id, document_json)
├── resources (arn, name, service, resource_type, account_id, execution_role_id, extra_json)
├── principal_policies (principal_id, policy_id)
├── group_memberships (user_id, group_id)
├── cross_account_links (source_account_id, target_account_id, role_arn, trust_principal_arn, is_wildcard)
└── security_findings (entity_arn, category, path_id, severity, message)
# Listar contas enumeradas
worst accounts list
# Output:
# Account ID Name Principals Resources Last Enumerated
# 123456789012 DEV-Prod 142 89 2026-04-24 15:30
# 222222222222 STG-Data 67 34 2026-04-24 16:45
# Deletar conta e todos os dados
worst accounts delete 123456789012
# Exportar grafo para análise externa
worst graph-export --output graph.json
# Após enumerar múltiplas contas, WorstAssume detecta automaticamente:
# - Trust relationships entre contas
# - Wildcard trust policies (Principal: *)
# - Cross-account role assumptions
Cross-Account Links (PTES 2.1.4 - Relationships):
- Account A (111111111111) → Account B (222222222222)
└── Role: CrossAccountRole (Wildcard: YES)
- Account A (111111111111) → Account C (333333333333)
└── Role: DevRole (Wildcard: NO)
Conta: 123456789012
├── Usuários: 15
├── Roles: 42
├── Grupos: 8
├── Políticas Managed: 25
└── Políticas Inline: 67
Conta: 123456789012
├── EC2 Instances: 120
├── Lambda Functions: 35
├── ECS Clusters: 5
├── S3 Buckets: 28
└── VPCs: 12
Principal: "*"Action: "*" e Resource: "*"# Listar contas enumeradas
worst accounts list
# Exportar grafo para análise externa (PTES 6.2 - Technical Reporting)
worst graph-export --output graph.json
# Visualizar dashboard
worst viz
# Identidade (PTES 2.5.4.7 - Banner Grabbing)
aws sts get-caller-identity
# Região atual
aws configure get region
# Listar todas as regiões
aws ec2 describe-regions --query 'Regions[].RegionName'
# Descrever ranges de IP (PTES 2.5.1 - IP Ranges)
aws ec2 describe-prefix-lists --query 'PrefixLists[?PrefixListName*`com.amazonaws']'
# theHarvester (PTES 2.3.1 - Email addresses)
theHarvester -d target.com -b google,linkedin
# Maltego (PTES 2.3.1.1)
# Interface gráfica para OSINT correlation
# Subfinder (PTES 2.3.4 - Domain Names)
subfinder -d target.com -o domains.txt
# Amass (PTES 2.3.4)
amass enum -d target.com -o amass_domains.txt
Naabu é a ferramenta primária para port scanning neste framework. Use naabu para:
# Scan básico (top 100 ports)
naabu -host target.com -silent
# Todas as portas
naabu -host target.com -p - -silent
# Lista de hosts
naabu -l hosts.txt -silent
# Output JSON para pipeline
naabu -host target.com -j -o output.json
# Integração com httpx
naabu -host target.com -silent | httpx -silent
# Host discovery
naabu -host 192.168.1.0/24 -sn -silent
# CDN/WAF exclusion
naabu -host target.com -ec -silent
# Smart scan (predictive port scanning)
naabu -host target.com -ss
Ver /root/.pcode/skills/pentest-network-scanning/SKILL.md para documentação completa do Naabu.
Use hping3 como ferramenta complementar quando:
# SYN scan na porta 80 para descobrir hosts vivos
hping3 -S -p 80 --scan 1-254 192.168.1.1
# ICMP scan para host discovery
hping3 -1 -c 5 192.168.1.1
# TCP ACK scan (bypass de firewalls stateless)
hping3 -A -p 80 192.168.1.1
# UDP scan para discovery
hping3 -2 -p 53 192.168.1.1
# SYN scan em range de portas (stealth scan)
hping3 -S -p 1-1000 --scan target.com
# Scan em portas específicas
hping3 -S -p 22,80,443,8080 --scan target.com
# XMAS scan (difícil de detectar por IDS)
hping3 -F -P -U -p 1-1000 --scan target.com
# NULL scan (sem flags)
hping3 -O -p 1-1000 --scan target.com
# Testar se firewall permite SYN
hping3 -S -p 80 target.com
# SYN-ACK = porta aberta
# RST = porta fechada
# Sem resposta = filtrada
# Testar se firewall é stateful (ACK scan)
hping3 -A -p 80 target.com
# RST = porta não filtrada (firewall stateless)
# Sem resposta = firewall stateful ou drop
# Mapear regras com TTL customizado
hping3 -S -p 80 -t 64 target.com
hping3 -S -p 80 -t 128 target.com
FINDING: NETWORK-DISCOVERY-HPING3
CATEGORY: RECONNAISSANCE
SEVERITY: INFO
PTES: 2.5.4 - Active Footprinting
TARGET:
- IP/Hostname: [target]
- Portas descobertas: [lista]
- Hosts ativos: [lista]
DESCRIPTION:
Host discovery e port scanning via hping3 identificou [X] hosts ativos
e [Y] portas abertas na rede alvo. hping3 permitiu bypass de filtros
que bloqueavam scans tradicionais do nmap.
EVIDENCE:
hping3 -S -p 1-1000 --scan [target]
[Output do scan]
TECHNIQUE:
- SYN scan (-S): Identifica portas abertas via SYN-ACK
- ACK scan (-A): Mapeia firewalls stateless
- XMAS scan (-FPU): Evasão de IDS básico
PTES REFERENCE: Section 2.5.4 (Active Footprinting)
# Random source IP (spoofing para testes de IDS/IPS)
hping3 -S -p 80 --rand-source target.com
# Fragmented packets (bypass de ACLs fracas)
hping3 -S -p 80 -f target.com
# Don't fragment flag
hping3 -S -p 80 -y target.com
# Custom TTL para OS fingerprinting
hping3 -S -p 80 -t 64 target.com # Windows típico
hping3 -S -p 80 -t 128 target.com # Linux típico
# Source address spoofing
hping3 -S -p 80 -a 10.0.0.1 target.com
# Testar se ICMP é permitido (potencial tunnel vector)
hping3 -1 -d 1024 target.com # ICMP com data payload
# Large ICMP packets (covert channel testing)
hping3 -1 -d 65000 target.com
# ICMP timestamp request
hping3 -1 -C 13 -K 0 target.com
# Scan lento para evitar detecção
hping3 -S -p 1-1000 -i u100000 target.com # 100ms entre packets
# Scan moderado
hping3 -S -p 1-1000 --fast target.com # 10 packets/segundo
# Scan rápido (pode ser detectado)
hping3 -S -p 1-1000 --faster target.com # 100 packets/segundo
# Traceroute via SYN packets
hping3 -S -p 80 -T traceroute target.com
# Traceroute via ICMP
hping3 -1 -T traceroute target.com
# Traceroute com TTL fixo (monitorar hop específico)
hping3 -S -p 80 -t 5 --tr-keep-ttl target.com
# Incluir RECORD_ROUTE option
hping3 -S -p 80 -G target.com
# Loose source routing
hping3 -S -p 80 --lsrr target.com
# Strict source routing
hping3 -S -p 80 --ssrr target.com
NOTE: Nettacker complementa Naabu e hping3 com detecção automática de tecnologias, subdomain enumeration, e WAF detection em uma única ferramenta.
# Enumeração passiva de subdomínios (sem scan ativo)
docker run --rm owasp/nettacker -i target.com -m subdomain_scan
# Subdomínios + detecção de tecnologias
docker run --rm owasp/nettacker -i target.com -m subdomain_scan,web_technologies_scan
# Output JSON para integração
docker run --rm -v $(pwd):/tmp owasp/nettacker \
-i target.com -m subdomain_scan \
--json-output /tmp/subdomains.json
# API integration
API_KEY=$(docker logs nettacker 2>&1 | grep "API Key" | awk '{print $4}')
curl -k -X POST "https://localhost:5000/new/scan" \
-d "key=${API_KEY}&targets=target.com&selected_modules=subdomain_scan"
Template de Finding - Subdomain Discovery:
FINDING: SUBDOMAIN-DISCOVERY-NETTACKER
CATEGORY: RECONNAISSANCE
SEVERITY: INFO
PTES: 2.5.2 - Active Reconnaissance
TARGET: target.com
SUBDOMAINS FOUND: [X]
- api.target.com (203.0.113.10)
- admin.target.com (203.0.113.11)
- dev.target.com (203.0.113.12)
DESCRIPTION:
Nettacker subdomain enumeration identified [X] subdomains through passive
OSINT sources and DNS brute-forcing. Several subdomains expose administrative
interfaces and development environments.
EVIDENCE:
docker run --rm owasp/nettacker -i target.com -m subdomain_scan
REMEDIATION:
- Implement DNS zone transfer restrictions
- Remove unused subdomains from DNS
- Apply WAF to exposed administrative subdomains
- Consider DNS wildcard records for unused prefixes
PTES REFERENCE: Section 2.5.2 (Active Reconnaissance)
# Detecção de tecnologias web (CMS, frameworks, servidores)
docker run --rm owasp/nettacker -i target.com -m web_technologies_scan
# CMS-specific detection
docker run --rm owasp/nettacker -i target.com \
-m wordpress_scan,joomla_scan,drupal_scan
# Output detalhado com versões
docker run --rm owasp/nettacker -i target.com -m web_technologies_scan \
--graph-output /tmp/report.html
Tecnologias Detectadas Automaticamente:
Template de Finding - Technology Stack:
FINDING: TECH-STACK-DETECTION
CATEGORY: RECONNAISSANCE
SEVERITY: INFO
PTES: 2.5.4.7 - Banner Grabbing
TARGET: https://target.com
TECHNOLOGIES DETECTED:
- WordPress 6.4.2 (CMS)
- Apache 2.4.57 (Web Server)
- PHP 8.1.12 (Runtime)
- Cloudflare (CDN/WAF)
- Google Analytics (Tracking)
DESCRIPTION:
Nettacker web technologies scan identified the complete technology stack.
WordPress version disclosure allows targeting version-specific CVEs.
Cloudflare presence indicates WAF bypass techniques may be required.
RISK ASSESSMENT:
- WordPress 6.4.2: Check WPScan for plugin vulnerabilities
- Apache 2.4.57: Check CVE-2023-25690, CVE-2023-31122
- PHP 8.1.12: Check for deserialization vulnerabilities
PTES REFERENCE: Section 2.5.4.7 (Banner Grabbing)
# WAF detection e fingerprinting
docker run --rm owasp/nettacker -i target.com -m waf_scan
# WAF + tecnologias web
docker run --rm owasp/nettacker -i target.com -m waf_scan,web_technologies_scan
# API integration
curl -k -X POST "https://localhost:5000/new/scan" \
-d "key=${API_KEY}&targets=target.com&selected_modules=waf_scan"
WAF Products Detected:
# Admin panel discovery com wordlists otimizadas
docker run --rm owasp/nettacker -i target.com -m admin_scan
# Admin + directory enumeration
docker run --rm owasp/nettacker -i target.com -m admin_scan,dir_scan
# Custom wordlist
docker run --rm -v $(pwd)/wordlists:/wordlists owasp/nettacker \
-i target.com -m admin_scan \
--scan-args "-w /wordlists/admin-panels.txt"
Paths Comuns Testados:
/admin, /administrator, /wp-admin, /phpmyadmin
/login, /signin, /dashboard, /console
/manager, /cpanel, /webmail, /controlpanel
# Directory brute forcing
docker run --rm owasp/nettacker -i target.com -m dir_scan
# Directory + file enumeration
docker run --rm owasp/nettacker -i target.com \
-m dir_scan --scan-args "--wordlist /usr/share/wordlists/dirb/common.txt"
# Recursive scanning
docker run --rm owasp/nettacker -i target.com -m dir_scan \
--scan-args "--depth 3"
# ViewDNS reverse IP lookup (shared hosting detection)
docker run --rm owasp/nettacker -i target.com -m viewdns_reverse_iplookup_scan
# Identificar outros domínios no mesmo IP
# Útil para descobrir siblings em shared hosting
# Step 1: Subdomain enumeration (Nettacker)
docker run --rm owasp/nettacker -i target.com -m subdomain_scan \
--json-output /tmp/subdomains.json
# Step 2: Extract live domains
jq -r '.[] | select(.result.subdomain_found == true) | .result.subdomain_found' \
/tmp/subdomains.json | tee live_subdomains.txt
# Step 3: Port scanning (Naabu - mais rápido para grandes ranges)
naabu -l live_subdomains.txt -o ports.json -j
# Step 4: Web tech detection (Nettacker)
for domain in $(cat live_subdomains.txt); do
docker run --rm owasp/nettacker -i $domain -m web_technologies_scan \
--json-output /tmp/tech_${domain}.json &
done
wait
# Step 5: WAF detection (Nettacker)
for domain in $(cat live_subdomains.txt); do
docker run --rm owasp/nettacker -i $domain -m waf_scan \
--json-output /tmp/waf_${domain}.json &
done
wait
# Step 6: Consolidate results
cat /tmp/tech_*.json | jq -s '.' > /tmp/tech_consolidated.json
cat /tmp/waf_*.json | jq -s '.' > /tmp/waf_consolidated.json
# Step 1: Shodan passive recon
shodan search "org:TargetCorp" > shodan_results.txt
# Step 2: Censys certificate search
censys search "services.http.response.html_title:TargetCorp" > censys_certs.txt
# Step 3: Nettacker subdomain enumeration
docker run --rm owasp/nettacker -i target.com -m subdomain_scan \
--json-output nettacker_subs.json
# Step 4: Wayback Machine historical URLs
waybackurls target.com > wayback_urls.txt
# Step 5: Consolidate all sources
cat shodan_results.txt censys_certs.txt nettacker_subs.json wayback_urls.txt \
| sort -u > consolidated_recon.txt
# Step 6: Filter for sensitive paths
grep -iE "admin|login|api|backup|config|dev|staging" consolidated_recon.txt
| Feature | Nettacker | Subfinder |
|---|---|---|
| Sources | Built-in OSINT + DNS brute | 40+ passive sources |
| Speed | Moderate | Very fast |
| Integration | Part of full scan workflow | Standalone + httpx pipeline |
| Output | JSON, HTML, CSV | TXT, JSON |
| Best For | Combined recon + vuln scan | Fast subdomain-only enum |
Recommended Workflow:
# Use Subfinder for initial fast enumeration
subfinder -d target.com -o subs_fast.txt
# Use Nettacker for deep scan with DNS brute-forcing
docker run --rm owasp/nettacker -i target.com -m subdomain_scan
# Combine results
cat subs_fast.txt nettacker_subs.txt | sort -u > all_subs.txt
# Proceed with Naabu + httpx + nuclei
cat all_subs.txt | naabu -silent | httpx -silent | nuclei
security-usernames plugin)Local: `seclists-categories usernames/usernames/references/`
Wordlists Disponíveis:
- `Names/names.txt` - Nomes comuns para enumeration
- `top-usernames-shortlist.txt` - Top usernames para teste rápido
- `cirt-default-usernames.txt` - Default accounts de serviços
# Usar wordlists com ffuf
ffuf -w seclists-categories/usernames/top-usernames-shortlist.txt \
-u https://target.com/users/FUZZ \
-mc 200
# Usar com curl para teste de existência
for user in $(cat seclists-categories/usernames/cirt-default-usernames.txt); do
curl -s -o /dev/null -w "%{http_code}" "https://target.com/api/users/$user"
done
# Integrar com ferramentas OSINT
theHarvester -d target.com -b google,linkedin
subfinder -d target.com -o domains.txt
admin, root, test, guest, user, operator
service, backup, oracle, postgres, mysql
tomcat, jenkins, deploy, www-data
security-patterns plugin)Local: `seclists-categories pattern-matching/pattern-matching/references/`
Patterns Disponíveis:
- `malicious.txt` - Padrões de código malicioso
- `pcap-strings.txt` - Strings para análise de PCAP
- `php-auditing.txt` - Patterns para auditoria PHP
- `grepstrings-basic.txt` - Strings básicas para grep
- `errors.txt` - Padrões de mensagens de erro
# AWS Access Keys
grep -rE "AKIA[0-9A-Z]{16}" . 2>/dev/null
# Google Cloud API Keys
grep -rE "AIza[0-9A-Za-z_-]{35}" . 2>/dev/null
# GitHub Tokens
grep -rE "ghp_[0-9a-zA-Z]{36}" . 2>/dev/null
# Generic API Keys
grep -riE "api[_-]?key.*[=:]\s*['\"][0-9a-zA-Z]{32,}['\"]" . 2>/dev/null
# Private Keys
grep -r "BEGIN.*PRIVATE KEY" . 2>/dev/null
# Passwords em código
grep -riE "password\s*[=:]\s*['\"][^'\"]+['\"]" . 2>/dev/null
import re
import os
patterns = {
'AWS_KEY': r'AKIA[0-9A-Z]{16}',
'GCP_KEY': r'AIza[0-9A-Za-z_-]{35}',
'GITHUB_TOKEN': r'ghp_[0-9a-zA-Z]{36}',
'GENERIC_API_KEY': r'api[_-]?key.*[=:]\s*[\'"][0-9a-zA-Z]{32,}[\'"]',
'GENERIC_SECRET': r'secret.*[=:]\s*[\'"][0-9a-zA-Z]{32,}[\'"]',
'PASSWORD': r'password\s*[=:]\s*[\'"][^\'"]+[\'"]',
'PRIVATE_KEY': r'BEGIN.*PRIVATE KEY'
}
def scan_file(filepath):
with open(filepath, 'r', errors='ignore') as f:
content = f.read()
for name, pattern in patterns.items():
matches = re.findall(pattern, content, re.IGNORECASE)
if matches:
print(f"[{name}] Found in {filepath}: {len(matches)} matches")
for root, dirs, files in os.walk('.'):
for file in files:
if file.endswith(('.py', '.js', '.env', '.config', '.json', '.yaml', '.yml')):
scan_file(os.path.join(root, file))
# Subdomain enumeration + API key discovery
subfinder -d target.com -o subdomains.txt
cat subdomains.txt | httpx -silent | while read url; do
curl -s "$url" | grep -oE "AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}"
done
# GitHub reconnaissance
curl -s "https://api.github.com/orgs/target/repos" | jq '.[].clone_url'
Após completar esta fase, prossiga para pentest-threat-modeling (PTES Phase 3)
AIRecon é um agente autônomo de penetration testing (v0.1.7-beta) que pode ser invocado como ferramenta incremental durante intelligence gathering para automatizar OSINT, network scanning, e descoberta de credenciais.
# AIRecon com keywords de OSINT e network discovery
airecon "pentest intelligence gathering osint network scan target.com"
# AIRecon detectará keywords e carregará:
# - pentest-intelligence-gathering.md (skill primária)
# - pentest-network-scanning.md (para network scan)
# - MCP tools: hexstrike (nmap, naabu), cve-mcp, pentestswarm
# Para pfSense-specific OSINT:
airecon "pfsense osint shodan censys reconnaissance"
# Para API key discovery:
airecon "api key discovery github secrets scan target"
# Network scanning com Naabu integrado
/naabu-scan --target target.com -p 443,8443,22,80
/naabu-scan --target 192.168.1.0/24 -p - -silent
# API key discovery em repositórios e código
/api-keys --target ./src --recursive
/api-keys --target https://github.com/org/repo --scan-type github
# Wordlist generation para brute-force
/wordlist --type usernames --length 6
/wordlist --type passwords --length 8 --include-symbols
Durante intelligence gathering, AIRecon pode invocar MCP tools automaticamente:
# hexstrike-local: nmap, naabu, nuclei scans
airecon "scan target.com with nmap version detection"
# → Usará mcp__hexstrike-local__nmap_scan
airecon "run naabu port scan on 192.168.1.0/24"
# → Usará mcp__hexstrike-local__rustscan_fast_scan ou naabu_scan
airecon "run nuclei vulnerability scan on target.com"
# → Usará mcp__hexstrike-local__nuclei_scan
# pentestswarm-remote: Automated reconnaissance campaigns
airecon "start reconnaissance campaign for example.com"
# → Usará mcp__pentestswarm-remote__start_campaign
# → Retornará campaign_id para monitoramento
# cve-mcp: CVE lookup para tecnologias detectadas
airecon "check CVEs for Apache 2.4.57"
# → Usará mcp__cve-mcp__search_cves
# virustotal: Domain e IP reputation
airecon "check domain reputation for suspicious-domain.com"
# → Usará mcp__virustotal__get_domain_report
# osint-remote: Username e email OSINT
airecon "search username john.doe across social networks"
# → Usará mcp__osint-remote__maigret_search
# 1. Usar AIRecon para OSINT inicial
airecon "osint reconnaissance target.com subdomain enumeration"
# 2. AIRecon auto-carrega pentest-intelligence-gathering.md
# 3. Invocar Naabu via AIRecon para port scanning
airecon "/naabu-scan --target target.com -p - -silent"
# 4. Invocar Nettacker via AIRecon para tech detection
airecon "docker run --rm owasp/nettacker -i target.com -m web_technologies_scan"
# 5. AIRecon processa output e consolida findings
# 6. Exportar para relatório de intelligence gathering
airecon "export findings to JSON for stakeholder review"
# 1. Passive OSINT com Shodan/Censys via AIRecon
airecon "shodan search product:pfsense org:target"
# 2. AIRecon detecta pfSense e ativa pentest-pfsense skill
# 3. Version detection via AIRecon
airecon "censys search services.http.title:pfSense"
# 4. CVE mapping automático
airecon "check CVEs for pfSense 2.7.0"
# → Usará mcp__cve-mcp__search_cves com filtro de severidade
# 5. Exportar findings
airecon "export pfsense intelligence report"
| Keywords Detectadas | Skills Carregadas | MCP Tools Ativados |
|---|---|---|
osint subdomain | pentest-intelligence-gathering | osint-remote, hexstrike |
network scan naabu | pentest-network-scanning | hexstrike (nmap, rustscan) |
api key secret | pentest-intelligence-gathering | hexstrike (scan_repo_secrets) |
pfsense firewall | pentest-pfsense | shodan, cve-mcp |
cpanel whm | pentest-exploitation | cve-mcp (CVE-2026-41940) |
username enum | pentest-intelligence-gathering | hexstrike (hydra, http_intruder) |
# Iniciar campanha de reconnaissance automatizada
airecon "start pentestswarm campaign for target.com"
# PentestSwarm retornará campaign_id:
# campaign_abc123
# Monitorar progresso da campanha
airecon "get campaign status campaign_abc123"
# Buscar findings da campanha
airecon "get campaign findings campaign_abc123"
# Exportar resultados consolidados
airecon "export campaign report campaign_abc123"
AIRecon implementa error handling inteligente para ferramentas de intelligence:
# Se Naabu falhar (rate limiting), AIRecon automaticamente:
# 1. Aguarda backoff exponencial (2s, 4s, 8s...)
# 2. Tenta alternativa (rustscan, masscan)
# 3. Reporta falha após 3 retries
# Se Shodan API rate-limited:
# 1. Switch para Censys API
# 2. Fallback para OSINT passivo (Wayback Machine)
# 3. Notifica usuário sobre limitação
Watchtower é um framework de penetration testing baseado em LangGraph com arquitetura multi-agente (Planner, Worker, Analyst) que automatiza reconnaissance, vulnerability analysis, e report generation.
# Reconnaissance completo com Watchtower (PTES Phase 2)
python -m watchtower.main -t https://www.example.com --skip-ask-tools
# Watchtower executará automaticamente:
# - Planner Agent: Planeja workflow de reconnaissance
# - Worker Agent: Executa 23 ferramentas (nmap, subfinder, nuclei, etc.)
# - Analyst Agent: Analisa resultados e identifica vulnerabilidades
# Com LLM provider específico
python -m watchtower.main -t https://www.example.com \
--provider openai \
--model gpt-4o \
--skip-ask-tools
# Com autenticação (authenticated pentest)
python -m watchtower.main -t https://www.example.com \
--headers "Authorization: Bearer TOKEN" \
--skip-ask-tools
# Iniciar reconnaissance automatizado
/watchtower-recon --target https://www.example.com --skip-ask-tools
# Gerar relatório PDF automático
/watchtower-report --input "pentest_report.pdf" --target https://www.example.com
# Executar ferramentas específicas
/watchtower-tool --tool nmap --target 192.168.1.0/24
/watchtower-tool --tool subfinder --target example.com
/watchtower-tool --tool nuclei --target https://example.com
Watchtower integra-se com MCP tools automaticamente durante reconnaissance:
# hexstrike-local: 23 ferramentas de segurança
# - nmap, masscan: Port scanning
# - httpx, whatweb: Web tech detection
# - wafw00f: WAF fingerprinting
# - subfinder, amass: Subdomain enumeration
# - dnsrecon: DNS enumeration
# - nuclei, nikto: Vulnerability scanning
# - sqlmap, wpscan: CMS-specific scanning
# - testssl.sh, sslyze: SSL/TLS analysis
# - gobuster, ffuf: Directory brute-forcing
# - arjun, kiterunner: Parameter discovery
# - xsstrike, dalfox: XSS detection
# - gitleaks: Secret detection
# - cmseek: CMS detection
# cve-mcp: CVE intelligence
# - search_cves: Busca CVEs por keyword
# - get_cve_summary: Resumo completo de CVE
# - check_exploit_availability: Verifica exploits públicos
# - get_epss_score: EPSS scoring
# pentestswarm-remote: Automated campaigns
# - start_campaign: Inicia campanha stateful
# - get_campaign_status: Monitora progresso
# - get_campaign_findings: Coleta resultados
# osint-remote: OSINT gathering
# - get_whois: Domain/IP WHOIS
# - get_certificates: Certificate transparency
# - get_threatfox: Malware IOCs
# - get_mitre_attack: MITRE ATT&CK mapping
# virustotal: Reputation analysis
# - get_domain_report: Domain analysis
# - get_ip_report: IP reputation
# - get_url_report: URL scanning
# 1. Watchtower Planner analisa o target e planeja reconnaissance
python -m watchtower.main -t https://www.example.com --skip-ask-tools
# 2. Watchtower executa em paralelo:
# - Subdomain enumeration (subfinder, amass)
# - Port scanning (nmap, masscan)
# - Web tech detection (httpx, whatweb, wafw00f)
# - DNS enumeration (dnsrecon)
# - Vulnerability scanning (nuclei, nikto)
# 3. Watchtower Analyst consolida findings
# 4. Relatório PDF gerado automaticamente
python -m watchtower.main --report "intelligence_report.pdf"
# Watchtower detecta pfSense automaticamente via whatweb/wafw00f
python -m watchtower.main -t https://pfsense.target.com --skip-ask-tools
# Watchtower executará:
# - Version detection (whatweb)
# - Port scanning (nmap -p 80,443,22)
# - SSL/TLS analysis (testssl.sh)
# - CVE mapping via cve-mcp
# - Exploit availability check
# Se CVEs críticos encontrados:
# - Watchtower Analyst flagga como HIGH/CRITICAL
# - Incluído automaticamente no relatório PDF
# Watchtower detecta cPanel/WHM automaticamente
python -m watchtower.main -t https://target.com:2087 --skip-ask-tools
# Detecção via:
# - whatweb: CMS detection
# - wafw00f: WAF/Platform fingerprinting
# - nmap: Service version detection
# Se cPanel detectado:
# - Watchtower mapeia CVEs (incluindo CVE-2026-41940)
# - Verifica exploit availability via cve-mcp
# - Analyst categoriza por severidade
| Keywords Detectadas | Skills Carregadas | Watchtower Tools Ativadas |
|---|---|---|
osint recon | pentest-intelligence-gathering | subfinder, amass, dnsrecon |
network scan | pentest-network-scanning | nmap, masscan, rustscan |
web tech | pentest-intelligence-gathering | httpx, whatweb, wafw00f |
vuln scan | pentest-vulnerability-analysis | nuclei, nikto, dalfox |
subdomain | pentest-intelligence-gathering | subfinder, amass |
ssl tls | pentest-vulnerability-analysis | testssl.sh, sslyze |
cms wordpress | pentest-exploitation | wpscan, cmseek |
secret apikey | pentest-intelligence-gathering | gitleaks |
pfsense | pentest-pfsense | nmap, whatweb, cve-mcp |
cpanel whm | pentest-exploitation | whatweb, cve-mcp |
# 1. AIRecon para OSINT inicial e planning
airecon "osint reconnaissance target.com"
# 2. Watchtower para automated scanning
python -m watchtower.main -t https://www.example.com --skip-ask-tools
# 3. AIRecon para análise de findings
airecon "analyze watchtower findings and prioritize vulnerabilities"
# 4. Watchtower gera relatório PDF
python -m watchtower.main --report "final_intelligence_report.pdf"
┌─────────────────────────────────────────────────────────────┐
│ Watchtower Orchestrator │
└─────────────────────────────────────────────────────────────┘
│
┌─────────────────────┼─────────────────────┐
│ │ │
▼ ▼ ▼
┌───────────────┐ ┌─────────────────┐ ┌───────────────┐
│ Planner Agent │ │ Worker Agent │ │ Analyst Agent │
│ │ │ │ │ │
│ - Plans recon │ │ - Executes tools│ │ - Analyzes │
│ - Prioritizes │ │ - 23 tools │ │ results │
│ - PTES phases │ │ - Parallel exec │ │ - Categorizes │
└───────────────┘ └─────────────────┘ │ - Reports │
└───────────────┘
| Tool | Category | PTES Phase | Intelligence Use |
|---|---|---|---|
| nmap | Port Scanning | 2.5.4 | Host discovery, service enumeration |
| masscan | Port Scanning | 2.5.4 | High-speed Internet-scale scanning |
| httpx | Web Probing | 2.5.4 | HTTP probing, tech detection |
| whatweb | Tech Detection | 2.5.4 | CMS, framework, server identification |
| wafw00f | WAF Detection | 2.5.4 | WAF fingerprinting |
| subfinder | Subdomain Enum | 2.5.2 | Passive subdomain discovery |
| amass | Subdomain Enum | 2.5.2 | Deep subdomain enumeration |
| dnsrecon | DNS Enum | 2.5.2 | DNS records, zone transfers |
| nuclei | Vuln Scanning | 3.1 | Template-based vulnerability detection |
| nikto | Web Scanning | 3.1 | Web server vulnerability assessment |
| sqlmap | SQL Injection | 4.2 | SQL injection detection |
| wpscan | CMS Scanning | 3.1 | WordPress vulnerability scanning |
| testssl.sh | SSL/TLS | 3.1 | SSL/TLS configuration analysis |
| sslyze | SSL/TLS | 3.1 | SSL certificate and protocol analysis |
| gobuster | Dir Bruteforce | 2.5.4 | Directory/file discovery |
| ffuf | Fuzzing | 2.5.4 | Web application fuzzing |
| arjun | Parameter Enum | 2.5.4 | HTTP parameter discovery |
| kiterunner | Content Discovery | 2.5.4 | Fast content discovery |
| xsstrike | XSS Detection | 3.1 | XSS vulnerability detection |
| gitleaks | Secret Detection | 2.3.7 | API key/secret scanning |
| dalfox | XSS Scanning | 3.1 | Advanced XSS scanning |
| cmseek | CMS Detection | 2.5.4 | CMS fingerprinting |
| sqlmap | SQLi Testing | 4.2 | SQL injection exploitation |
Watchtower usa SQLite para persistência de estado durante reconnaissance:
# Database location
~/.watchtower/pentest_memory.db
# Tables:
# - scan_results: Tool outputs consolidados
# - findings: Vulnerabilities categorizadas
# - targets: Target metadata
# - sessions: Session history
# Gerar relatório PDF automático (PTES Phase 6)
python -m watchtower.main --report "pentest_report.pdf"
# Relatório inclui:
# - Executive Summary
# - Technical Findings
# - Risk Matrix
# - Remediation Recommendations
# - Tool Output Appendices
# 1. Iniciar campanha PentestSwarm
airecon "start pentestswarm campaign for target.com"
# → campaign_id: campaign_abc123
# 2. Watchtower para scanning detalhado
python -m watchtower.main -t https://www.example.com --skip-ask-tools
# 3. Consolidar findings
airecon "merge pentestswarm and watchtower findings"
# 4. Gerar relatório final
python -m watchtower.main --report "consolidated_report.pdf"
Watchtower implementa retry logic e fallback automático:
Se ferramenta falha:
1. Retry com backoff exponencial (2s, 4s, 8s)
2. Fallback para ferramenta alternativa
3. Reporta falha após 3 retries
4. Continua com próximas ferramentas
/pentest-network-scanning - Network scanning com Naabu, hping3 e Nettacker (Section 14)/pentest-vulnerability-analysis - Vulnerability scanning com Nettacker CVE modules (Section 7)/pentest-pfsense - pfSense-specific detection e testingEstágio 1: Seed Discovery (10-15 min)
↓
Estágio 2: Asset Expansion (30-60 min)
↓
Estágio 3: Enrichment (20-40 min)
↓
Estágio 4: Exposure Analysis (30-60 min)
↓
Estágio 5: Reporting & Correlation (15-30 min)
Tempo total típico: 1.5-3.5 horas para alvo médio
# WHOIS do domínio principal
whois target.example
# ASN lookup
curl -sk "https://api.hackertarget.com/aslookup/?q=target.example"
# BGP toolkit
curl -sk "https://bgpview.io/search/target.example"
# Identificar holdings/subsidiárias
# Google: "target.example" acquired by, "target.example" subsidiary
# Subdomain passivo
subfinder -d target.example -all -silent | tee passive_subs.txt
# Subdomain ativo (brute-force)
puredns bruteforce wordlist.txt target.example -r resolvers.txt | tee brute_subs.txt
# Unificar e resolver
cat passive_subs.txt brute_subs.txt | sort -u | dnsx -silent -a -resp | tee resolved_assets.txt
# Cloud buckets
python3 cloud_enum.py -k target -kw target-brainstormed
# Mobile apps
# Google Play: https://play.google.com/store/apps/developer?id=<dev-name>
# App Store: https://apps.apple.com/developer/<dev-id>
# HTTP probing em massa
cat resolved_assets.txt | httpx -silent -tech-detect -status-code -title -ip -cname | tee enriched_assets.txt
# Screenshots (opcional)
gowitness file -s resolved_assets.txt -P screenshots/
# Certificate analysis
curl -sk "https://crt.sh/?q=%.target.example&output=json" | jq '.[].name_value' | sort -u
# GitHub secret scan
trufflehog github --org=target-org --only-verified
# JS bundle analysis
katana -list alive_assets.txt -jc -d 3 -kf robotstxt,sitemap | \
grep '\.js$' | xargs -I {} curl -sk {} | python3 secret_scan.py
# Nuclei scan
nuclei -l alive_assets.txt -t exposures/ -t misconfiguration/ -o exposures.txt
# Breach correlation
# HudsonRock API
curl -sk "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-email?email=user@target.example"
| Categoria | Tipos |
|---|---|
| Domain | domain, subdomain, wildcard_domain |
| Network | ipv4, ipv6, asn, cidr_range |
| Cloud | s3_bucket, gcs_bucket, azure_blob, cloud_run, lambda_function |
| Application | webapp, api_endpoint, graphql_endpoint, mobile_app |
| Identity | email, username, identity_provider, oauth_app |
| Infrastructure | cdn, waf, load_balancer, dns_server, mail_server |
| Data | database, elasticsearch_cluster, redis_instance, mongodb_instance |
| Secret | api_key, ssh_key, jwt_token, oauth_token, cloud_credential |
| Code | git_repo, npm_package, pypi_package, docker_image |
| Edge Type | De → Para | Significado |
|---|---|---|
RESOLVES_TO | subdomain → ipv4/ipv6 | DNS A/AAAA record |
HOSTS | ipv4 → webapp | HTTP service running |
OWNS | domain → subdomain | DNS hierarchy |
CERT_SAN | certificate → domain/subdomain | Subject Alternative Name |
DEPLOYED_ON | webapp → cloud | Hosting provider |
PUBLISHED_BY | npm_package → domain | Publisher ownership |
ASSOCIATED_WITH | email → username | Breach correlation |
AUTHENTICATES_VIA | webapp → identity_provider | SSO/SAML/OAuth |
EXPOSES | webapp → api_endpoint | Discovered endpoint |
CONTAINS | git_repo → secret | Leaked credential |
# Autodiscover
curl -sk -I "https://autodiscover.target.example/autodiscover/autodiscover.xml"
# Exchange Online
curl -sk -I "https://outlook.office365.com/autodiscover/autodiscover.xml"
# Teams
curl -sk "https://target.example/.well-known/microsoft-identity-association.json"
# SharePoint
curl -sk -I "https://target.sharepoint.com"
Sinais de confirmação:
mail.protection.outlook.comMS=msXXXXXXinclude:spf.protection.outlook.com# Well-known OIDC
curl -sk "https://target.okta.com/.well-known/openid-configuration"
# Login page
curl -sk "https://target.okta.com/login/login.htm"
# ADFS metadata
curl -sk "https://fs.target.example/FederationMetadata/2007-06/FederationMetadata.xml"
Swagger/OpenAPI paths (28 paths):
/swagger.json, /swagger/v1/swagger.json, /swagger/v2/swagger.json
/api/swagger.json, /api/v1/swagger.json, /api/v2/swagger.json
/openapi.json, /api/openapi.json, /v1/openapi.json
/api-docs/swagger.json, /docs/swagger.json, /spec/swagger.json
/swagger/v1/api-docs, /swagger/v2/api-docs, /api-docs
/api/api-docs, /docs/api-docs, /v1/api-docs, /v2/api-docs
/api/v1/api-docs, /api/v2/api-docs, /openapi.yaml
GraphQL paths (13 paths):
/graphql, /graph, /api/graphql, /api/v1/graphql, /api/v2/graphql
/graphiql, /graphql/graphiql, /api/graphiql
/console, /graphql/console, /playground, /api/playground, /explorer
| Fator | Peso | Como scorear |
|---|---|---|
| Método | 0-20 | POST/PUT/DELETE = 20, PATCH = 15, GET = 5 |
| Path keywords | 0-25 | admin/user/auth/payment/billing = 25, api/v1 = 5 |
| Parametros | 0-15 | id/userId/token/key = 15, search/query = 5 |
| Response | 0-20 | 200 com dados = 20, 401/403 = 10, 404 = 0 |
| Tech stack | 0-10 | Framework conhecido com CVEs = 10 |
| Contexto | 0-10 | Producao = 10, staging/dev = 5 |
Thresholds:
Introspection query:
{
__schema {
types {
kind
name
fields {
name
type {
kind
name
ofType {
kind
name
}
}
}
}
}
}
Field-suggestion enumeration (quando introspection disabled):
{
__typename
}
Error messages often leak field names.
Risk Score Formula:
Risk Score = (CVSS × 0.4) + (EPSS × 40) + (KEV × 15) + (PoC × 5)
EPSS Score Lookup:
# Single CVE
curl -sk "https://api.first.org/data/v1/epss?cve=CVE-2024-3400" | jq '.data[0]'
# Bulk (até 1000 CVEs)
curl -sk "https://api.first.org/data/v1/epss?cve=CVE-2024-3400,CVE-2023-46747" | jq '.data[]'
CISA KEV Check:
# Download full catalog
curl -sk https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | \
jq '.vulnerabilities[] | select(.cveID == "CVE-2024-3400")'
Exploit Availability:
# ExploitDB
searchsploit cve 2024-3400
# Metasploit
msfconsole -q -x "search cve:2024-3400; exit"
# GitHub PoC
curl -sk "https://api.github.com/search/code?q=CVE-2024-3400+language:python" | jq '.items[]'
# SPF Check
dig +short TXT target.example | grep -i 'v=spf1'
# -all = strict (bom), ~all = softfail (ok), ?all = neutral (ruim), +all = CRITICAL
# DMARC Check
dig +short TXT _dmarc.target.example | grep -i 'v=dmarc'
# p=reject = strict (bom), p=quarantine = moderate, p=none = ruim, Ausente = CRITICAL
# DKIM Check
dig +short TXT default._domainkey.target.example
dig +short TXT google._domainkey.target.example
# BIMI Check
dig +short TXT default._bimi.target.example
# MTA-STS Check
dig +short TXT _mta-sts.target.example
curl -sk "https://mta-sts.target.example/.well-known/mta-sts.txt"
# DNSSEC Check
dig +dnssec target.example | grep -E '(ad|ds)'
# ad flag = DNSSEC validado
Se crt.sh 502/503 (comum em peak hours):
D="target.example"
# 1. Censys cert search
censys search "names: ${D}" --index-type certificates
# 2. Cert Spotter API
curl -sk "https://api.certspotter.com/v1/issuances?domain=${D}&include_subdomains=true"
# 3. Subfinder bundled (30+ fontes)
subfinder -d ${D} -all -recursive -silent
# 4. AlienVault OTX
curl -sk "https://otx.alienvault.com/api/v1/indicators/domain/${D}/passive_dns"
# 5. URLScan
curl -sk "https://urlscan.io/api/v1/search/?q=domain:${D}"
# 6. ThreatMiner
curl -sk "https://api.threatminer.org/v2/domain.php?q=${D}&rt=5"
| Porta | Serviço | Severity se aberto |
|---|---|---|
| 21 | FTP | HIGH (cleartext auth) |
| 23 | Telnet | CRITICAL (cleartext) |
| 445 | SMB | CRITICAL se externo |
| 1433 | MSSQL | CRITICAL |
| 2375 | Docker API | CRITICAL |
| 3306 | MySQL | CRITICAL |
| 3389 | RDP | HIGH se externo |
| 5432 | PostgreSQL | CRITICAL |
| 5900 | VNC | CRITICAL |
| 6379 | Redis | CRITICAL |
| 9200 | Elasticsearch | CRITICAL |
| 10250 | Kubelet | CRITICAL |
| 2379 | etcd | CRITICAL |
| 27017 | MongoDB | CRITICAL |
Postman API Key (PMAK-*):
curl -sk "https://api.getpostman.com/me" -H "X-Api-Key: PMAK-<key>"
# 200 = live, 401 = dead
AWS Access Key:
import boto3
sts = boto3.client('sts',
aws_access_key_id='AKIA...',
aws_secret_access_key='<secret>',
region_name='us-east-1')
ident = sts.get_caller_identity()
# Returns Account ID + ARN + UserId
GitHub PAT:
curl -sk "https://api.github.com/user" -H "Authorization: token ghp_*"
# 200 = live, check X-OAuth-Scopes header
Slack Token:
curl -sk -X POST "https://slack.com/api/auth.test" -H "Authorization: Bearer xox*-*"
# {"ok": true} = live
Anthropic API Key:
curl -sk "https://api.anthropic.com/v1/models" \
-H "x-api-key: sk-ant-api03-..." \
-H "anthropic-version: 2023-06-01"
# 200 = live
OpenAI API Key:
curl -sk "https://api.openai.com/v1/models" -H "Authorization: Bearer sk-..."
# 200 = live
# S3 Bucket Check
curl -sk -I "https://target-example.s3.amazonaws.com"
curl -sk "https://target-example.s3.amazonaws.com?list-type=2"
# GCS Bucket Check
curl -sk "https://storage.googleapis.com/target-example?prefix="
# Azure Blob Check
curl -sk "https://targetexample.blob.core.windows.net/container?restype=container&comp=list"
# Cloud_enum tool
git clone https://github.com/initstring/cloud_enum
cd cloud_enum && pip install -r requirements.txt
python3 cloud_enum.py -k target -kw brainstormed-words
Técnicas:
dev., staging., test.)Censys Certificate Search:
curl -sk "https://search.censys.io/api/v2/certificates/search?q=names:target.example" \
-H "Authorization: Basic <base64>" | jq '.result.hits[].names'
Pastebin & Code Sharing:
site:pastebin.com "target.example"
site:pastebin.com "@target.example"
site:gist.github.com "target.example"
site:ghostbin.com "target.example"
site:rentry.co "target.example"
Cloud Storage:
site:s3.amazonaws.com "target"
site:storage.googleapis.com "target"
site:blob.core.windows.net "target"
site:drive.google.com "target" "password"
Configuration Files:
site:github.com "target.example" filename:.env
site:github.com "target.example" filename:config.json
site:github.com "target.example" filename:secrets.json
site:gitlab.com "target.example" filename:.env
site:bitbucket.org "target.example" filename:.env
Subdomain Discovery:
site:*.target.example -www
site:target.example inurl:admin
site:target.example inurl:api
site:target.example inurl:dev
site:target.example inurl:staging
| Trigger | Attack-path hint |
|---|---|
| Unauth POST/PUT/DELETE | "Tentar IDOR + privilege escalation; verificar se IDs numéricos são sequenciais" |
| GraphQL introspection aberta | "Enumerar mutations, buscar createUser, setRole, transferFunds" |
| Reflected CORS + creds | "Host CSRF page em origem controlada por atacante" |
| API key em URL | "Token vaza para access logs, Referer headers, CDNs third-party" |
| .git exposto | "Reconstruir repositório com git-dumper; histórico completo de código" |
| .env exposto | "Grep por _KEY, _SECRET, _TOKEN; validar via validators" |
| Firebase RTDB aberto | "Ler tudo, testar write em /<random-key>.json com PUT" |
| Open Elasticsearch | "/_cat/indices?v para lista; sample documents de cada index" |
| Subdomain takeover | "Registrar recurso não-claimado para servir conteúdo de domínio confiável" |
| Finding | Severity | Why |
|---|---|---|
.git/config reachable | CRITICAL | Full source-code disclosure |
.env reachable | CRITICAL | Plaintext creds (DB, cloud, API) |
| Open Firebase RTDB | CRITICAL | All app data readable; often writable |
| Listable S3 with PII | CRITICAL | Direct data exfil |
Spring Boot /actuator/env | CRITICAL | DB creds, JWT secrets, cloud keys |
| Open Elasticsearch | CRITICAL | Full data reads; often writable |
| Open MongoDB (no auth) | CRITICAL | Full data + password-hash collection |
| Open Redis (no AUTH) | CRITICAL | Write authorized_keys → SSH foothold |
| Live AWS root key | CRITICAL | Full account compromise |
| Live AWS IAM-user key | HIGH | Limited scope; often elevatable |
| Live GitHub PAT | HIGH | Repo write access |
| Open GraphQL introspection | HIGH | Full schema → mutations discovery |
| Subdomain takeover possible | HIGH | Takeover → phishing on trusted domain |
| Reflected CORS with credentials | HIGH | CSRF-via-CORS for sensitive data |
| Middleware | Detection Path | Key Indicators |
|---|---|---|
| Apache Tomcat | /manager/html, /manager/status | Default creds: tomcat:tomcat, admin:admin |
| JBoss / WildFly | /jmx-console/, /web-console/ | JMX MBean access, WAR deployment |
| WebLogic | /console/, /wls-wsat/ | T3 protocol on 7001/7002, IIOP |
| Spring Boot Actuator | /actuator/, /actuator/env, /actuator/heapdump | JSON endpoint listing, heap dump contains secrets |
| Spring Boot (alt paths) | /actuator/jolokia, /actuator/gateway/routes | Jolokia JMX bridge, Gateway route injection |
| Jenkins | /script, /manage | Groovy console, API token in cookie |
| GlassFish | /common/, /theme/ | Admin on 4848, default empty password |
| Jetty | /jolokia/ | JMX access |
| Resin | /resin-admin/ | Admin panel |
/actuator/env → Leak environment variables (DB creds, API keys)
/actuator/heapdump → Download JVM heap → search for passwords in memory
/actuator/jolokia → JMX → possible RCE via MBean manipulation
/actuator/gateway/routes → Spring Cloud Gateway → SpEL injection (CVE-2022-22947)
/actuator/configprops → All configuration properties
/actuator/mappings → All URL mappings (hidden endpoints)
/actuator/beans → All Spring beans
/actuator/shutdown → POST to shutdown application (DoS)
/.git/HEAD → Git repository exposed
/.svn/entries → SVN metadata
/.svn/wc.db → SVN SQLite database
/.hg/requires → Mercurial
/.bzr/README → Bazaar
/.DS_Store → macOS directory listing
/backup.zip /backup.tar.gz /backup.sql
/wwwroot.rar /www.zip /web.zip
/db.sql /database.sql /dump.sql
/config.php.bak /config.php~ /config.php.swp
/.config.php.swp /wp-config.php.bak
/.env /.env.bak /.env.production
/swagger-ui.html → Swagger/OpenAPI
/swagger-ui/ → Swagger UI
/api-docs → API documentation
/graphql → GraphQL playground
/graphiql → GraphQL IDE
/debug/ → Debug endpoints
/phpinfo.php → PHP configuration
/server-status → Apache status
/server-info → Apache info
/nginx_status → Nginx status
/.aws/credentials → AWS credentials
/.docker/config.json → Docker registry auth
/robots.txt → Disallowed paths (hint list)
/sitemap.xml → Full URL listing
/crossdomain.xml → Flash cross-domain policy
/.well-known/ → Various well-known URIs
For each input point:
1. Non-malicious HTML tags (<h2>, <img>) → are they reflected?
2. Incomplete tags → what happens? (<iframe src=//evil.com )
3. Encoding tests → %0d, %0a, %09, <%00
4. Observe the OUTPUT too (not just response) — where does your input appear?
5. Test same input in ALL similarly-structured pages (shared code → shared vuln)
6. Check if the same parameter exists in mobile/API endpoint (less protected)
- Each parameter tells a story: "what does this do server-side?"
- Filename → OS interaction → Path Traversal / CMDi
- URL/location → HTTP fetch → SSRF
- Template/HTML parameter → render function → SSTI
- XML field → parser → XXE
- SQL filter → query → SQLi
- User-content → storage → Stored XSS
✓ Programs with large scope (*.target.com)
✓ Programs that pay for P2/P3 (not just RCE)
✓ Programs with recent tech changes (migrations = new bugs)
✓ Programs with active development (new features = new attack surface)
× Avoid: frozen/old codebases with well-known CVEs (already claimed)
× Avoid: strict programs with narrow scope (less surface)
Priority 1: Authentication, password reset, 2FA → account takeover
Priority 2: File upload, profile edit, API endpoints → stored XSS, IDOR
Priority 3: Admin panels, user management → BFLA, privilege escalation
Priority 4: Payment flows, subscription → business logic
Priority 5: Import/export, template rendering → XXE, SSTI
# OSINT reconnaissance completo
airecon "osint reconnaissance target.com subdomain enumeration"
# Secret scanning
airecon "secret scanning github target-org"
# Breach correlation
airecon "breach correlation user@target.example"
# API discovery
airecon "api discovery target.com graphql swagger"
# Email security audit
airecon "email security audit target.example spf dmarc dkim"
# Vulnerability prioritization
airecon "vulnerability prioritization CVE-2024-3400 EPSS KEV"
# Full OSINT reconnaissance
python -m watchtower.main -t https://www.example.com --skip-ask-tools
# Watchtower executará:
# - Subdomain enumeration (subfinder, amass)
# - Port scanning (nmap, masscan)
# - Web tech detection (httpx, whatweb, wafw00f)
# - DNS enumeration (dnsrecon)
# - Vulnerability scanning (nuclei, nikto)
# - Secret detection (gitleaks)
NOTE: AI agents (Claude Desktop, Claude Code) represent a new attack surface. This section covers OSINT and reconnaissance specific to AI agent installations, MCP servers, and autonomous execution capabilities.
# Process detection (local machine)
pgrep -i "Claude"
pgrep -i "claude-code"
# Check for configuration directories
ls -la ~/Library/Application\ Support/Claude/ 2>/dev/null # macOS
ls -la ~/.claude/ 2>/dev/null # Claude Code
# Windows equivalents
dir "$env:APPDATA\Claude" 2>$null
dir "$env:USERPROFILE\.claude" 2>$null
# Network indicators (remote assessment)
# MCP servers often expose HTTP endpoints
nmap -p 8897,8080,3000 target -sV --open
# Extract MCP servers from config (local audit)
jq '.mcpServers | keys[]' ~/Library/Application\ Support/Claude/claude_desktop_config.json 2>/dev/null
# Analyze MCP server commands
jq '.mcpServers | to_entries[] | {
server: .key,
command: .value.command,
args: .value.args
}' claude_desktop_config.json 2>/dev/null
# Redact sensitive patterns from args
# Patterns: sk-*, key=*, token=*, secret=*, password=*
# List installed plugins
jq '.plugins[].name' cowork_plugins/installed_plugins.json 2>/dev/null
# List installed extensions (DXT)
jq '.extensions[] | {name, version, isSigned}' extensions-installations.json 2>/dev/null
# Find plugin hooks (shell commands)
find cowork_plugins -name "hooks.json" -exec jq -r '
.hooks | to_entries[] | "\(.key): \(.value[].command)"
' {} \; 2>/dev/null
# Check if scheduled tasks are enabled
jq '.preferences.coworkScheduledTasksEnabled' claude_desktop_config.json 2>/dev/null
# List scheduled tasks
jq '.tasks[] | {name, cron, enabled}' scheduled-tasks.json 2>/dev/null
# Check keep-awake (machine never sleeps)
jq '.preferences.keepAwakeEnabled' claude_desktop_config.json 2>/dev/null
# Check network mode
jq '.networkMode' config.json 2>/dev/null
# Extract egress allowed domains
jq -r '.egressAllowedDomains[]?' local_*.json 2>/dev/null | sort -u
# CRITICAL: Unrestricted egress
jq '.egressAllowedDomains' local_*.json 2>/dev/null | grep -q '\["\*"\]' && \
echo "CRITICAL: Unrestricted egress allowed"
| Indicator | Severity | Meaning |
|---|---|---|
| Claude process running | INFO | Active AI agent |
| MCP server with network | MEDIUM | External service integration |
| Scheduled tasks enabled | WARN | Autonomous execution capable |
| Plugin hooks with shell | HIGH | Code execution in plugins |
| Unsigned extensions | MEDIUM | Unverified code |
| Egress ["*"] | CRITICAL | Unrestricted outbound access |
| keepAwakeEnabled | WARN | System sleep overridden |
# Detect AI agents on target machine
airecon "detect Claude Desktop or Claude Code installation"
# Enumerate MCP servers
airecon "enumerate MCP servers and analyze configurations"
# Check autonomous execution
airecon "check for AI autonomous scheduled tasks"
# Plugin risk assessment
airecon "assess AI plugin security including hooks"
# Run full AI agent audit
./claude_audit.sh --json > ai_agent_audit.json
# Extract high-risk findings
jq '.findings[] | select(.severity == "WARN" or .severity == "CRITICAL")' \
ai_agent_audit.json
# HTML report for stakeholders
./claude_audit.sh --html ai_agent_report.html
AI Agent Surface
├── Desktop Configuration (claude_desktop_config.json)
│ ├── MCP Servers (commands, args, env vars)
│ ├── Preferences (keepAwake, scheduled tasks)
│ └── Network Mode (egress policy)
├── Plugins (installed_plugins.json)
│ ├── Plugin Hooks (shell commands)
│ └── Tool Permissions
├── Extensions (extensions-installations.json)
│ ├── Dangerous Tools (execute_javascript, run_command)
│ └── Signature Status
├── Scheduled Tasks (scheduled-tasks.json)
│ ├── Cron Expressions
│ └── Skill Bindings
└── Runtime State
├── Process Detection
├── Sleep Assertions
└── LaunchAgents/Startup
/osint-investigation - Skill exclusiva de OSINT e investigação digital/pentest-network-scanning - Network scanning com Naabu, hping3 e Nettacker/pentest-vulnerability-analysis - Vulnerability scanning com Nettacker CVE modules/pentest-pfsense - pfSense-specific detection e testing/ai-agent-audit - NOVA: Security audit completo para AI agents (Claude Desktop/Code)