Menú
PTES Phase 2 - Intelligence gathering for AWS security assessments
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
Security audit for AI agent endpoints (Claude Desktop/Code, MCP servers, plugins, extensions)
Active Directory penetration testing skills covering reconnaissance, attacks, lateral movement, persistence, and ADCS exploitation
PTES Phase 5 - Exploitation for AWS security assessments using WorstAssume attack chain detection
Network reconnaissance and port scanning using Naabu, hping3, and complementary tools
Pentest especializado para Palo Alto Networks PAN-OS — cobre CVE-2026-0300 (buffer overflow RCE), User-ID Auth Portal, e superfície de ataque completa
Pentest especializado para pfSense CE e Plus — cobre todas as superfícies de ataque a partir da rede externa e interna, mapeado ao PTES e ao código-fonte real do pfSense
| name | pentest-intelligence-gathering |
| description | PTES Phase 2 - Intelligence gathering for AWS security assessments |
| type | skill |
IMPORTANTE: Se durante o OSINT ou footprinting você identificar pfSense, ATIVE A SKILL
pentest-pfsenseimediatamente.
# Shodan - Passive detection
shodan search "product:pfsense"
shodan search "http.title:pfSense"
shodan search "org:Netgate"
# Censys - Certificate and service discovery
censys search "services.software.product=pfSense"
censys search "services.http.response.html_title:pfSense"
# Google Dorks
site:target.com "pfSense"
site:target.com "Netgate"
intitle:"pfSense Login"
# Se pfSense detectado → ATIVAR pentest-pfsense skill
# Esta skill continua para intelligence gathering geral
# Use pentest-pfsense para:
# - Passive reconnaissance específica (Shodan/Censys)
# - CVE mapping para versão detectada
# - Feature-based testing especializado
IMPORTANTE: Se durante o OSINT ou footprinting você identificar cPanel ou WHM, ATIVE A SKILL
pentest-exploitationpara CVE-2026-41940.
# Shodan - Passive detection
shodan search "product:cpanel"
shodan search "http.title:cPanel"
shodan search "http.title:WHM"
shodan search "port:2087" # WHM
shodan search "port:2083" # cPanel
shodan search "port:2095" # cPanel Webmail
shodan search "port:2096" # Webmail SSL
# Censys - Certificate and service discovery
censys search "services.software.product=cPanel"
censys search "services.http.response.html_title:cPanel"
censys search "services.http.response.html_title:WHM"
# Google Dorks
site:target.com "cPanel"
site:target.com "WHM"
intitle:"cPanel Login"
intitle:"WHM Login"
inurl:2087
inurl:2083
# Port scanning com Naabu
naabu -host target.com -p 2087,2083,2095,2096 -silent
# HTTP probing com httpx
httpx -u https://target.com:2087 -title -tech-detect
httpx -u https://target.com:2083 -title -tech-detect
# Banner grabbing
curl -sk https://target.com:2087/login | grep -iE "cPanel|WHM"
# Se cPanel/WHM detectado → ATIVAR pentest-exploitation skill
# Testar CVE-2026-41940 (Authentication Bypass CVSS 9.8)
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET:2087 -u admin -p password detect
# Se vulnerável → Explorar
python3 /root/.pcode/pocs/cPanel/CVE-2026-41940/poc.py \
-t https://TARGET:2087 -u admin -p password exploit
# Enumeração completa com stealth mode (jitter 0.3-1.2s entre API calls)
worst enumerate --profile <profile> --region us-east-1 --stealth
# Com credenciais explícitas
worst enumerate --access-key AKIA... --secret-key ... --session-token ...
# Com assume-role para contas cross-account
worst enumerate --profile default --assume-role arn:aws:iam::TARGET:role/AuditRole
# Enumeração multi-conta (script enum.sh)
./enum.sh > log.txt # Enumera 14+ contas em sequência
FAST PATH (iam:GetAccountAuthorizationDetails):
- 1 chamada API = todos usuários, grupos, roles, políticas
- ~2-5 segundos para conta completa
- Requer: iam:GetAccountAuthorizationDetails
SLOW PATH (fallback quando fast path não disponível):
- 50-200+ chamadas API individuais
- ~30-120 segundos dependendo do tamanho da conta
- Requer: iam:ListUsers, iam:ListRoles, iam:ListGroups, etc.
CAPABILITY PROBING (worstassume/core/capability.py):
Antes de enumerar, WorstAssume detecta automaticamente:
- iam_full_dump: Pode usar fast path?
- iam_list_users: Pode listar usuários?
- iam_list_roles: Pode listar roles?
- iam_list_policies: Pode listar políticas?
- ec2_full, s3_full, lambda_full, etc.
# Cada módulo é executado com jitter (se --stealth)
# Ordem de execução no worstassume/cli.py:
1. Identity (identity_mod.get_caller_identity)
→ Retorna: ARN, Account ID, Principal Type
2. IAM (iam.enumerate)
→ Usuários, Groups, Roles, Policies, Memberships
3. EC2 (ec2.enumerate)
→ Instances, Instance Profiles, Metadata Options
4. S3 (s3.enumerate)
→ Buckets, Bucket Policies
5. Lambda (lambda_.enumerate)
→ Functions, Execution Roles
6. ECS (ecs.enumerate)
→ Clusters, Task Definitions, Task Roles
7. VPC (vpc.enumerate)
→ VPCs, Subnets, Security Groups
# Após enumerar múltiplas contas, WorstAssume detecta automaticamente:
worst accounts list # Mostra contas enumeradas
# Cross-account links são inferidos sem chamadas API adicionais
# Analisando trust policies das roles no banco de dados
Cross-Account Links Detectados:
├── Account A (111111111111) → Account B (222222222222)
│ └── Role: CrossAccountRole
│ ├── Trust Principal: arn:aws:iam::111111111111:root
│ ├── Wildcard: NO
│ └── Condition: sts:ExternalId (presente)
│
└── Account A (111111111111) → Account C (333333333333)
└── Role: AdminCrossAccount
├── Trust Principal: * (wildcard!)
├── Wildcard: YES (CRITICAL!)
└── Condition: NONE
# Detectado por: worstassume/core/cross_account.py:build_cross_account_links()
# Regex de extração: arn:aws[^:]*:[^:]*:[^:]*:(\d{12}):
# Detecção automática durante análise de trust policies:
if principal_block == "*":
is_wildcard = True # Qualquer principal pode assumir
severity = "CRITICAL"
elif "aws:PrincipalOrgID" in condition:
is_wildcard = True # Todo o organization pode assumir
severity = "HIGH"
# Identificar quem somos (PTES 2.5.4.7 - Banner Grabbing)
aws sts get-caller-identity
# Output esperado:
# {
# "UserId": "AIDAI...",
# "Account": "123456789012",
# "Arn": "arn:aws:iam::123456789012:user/auditor"
# }
Capability Map Exemplo (após enumeration):
├── iam_full_dump: TRUE (fast path disponível)
├── iam_list_users: TRUE
├── iam_list_roles: TRUE
├── iam_list_policies: TRUE
├── ec2_describe_instances: TRUE
├── s3_list_buckets: TRUE
├── lambda_list_functions: TRUE
├── ecs_list_clusters: TRUE
└── vpc_describe_vpcs: TRUE
Database: ~/.worstassume/db.sqlite
Tables:
├── accounts (account_id, account_name, org_id, profile, last_enumerated_at)
├── runs (account_id, started_at, completed_at, capabilities_json, success)
├── principals (arn, name, principal_type, account_id, trust_policy_json, path)
├── policies (arn, name, policy_type, account_id, document_json)
├── resources (arn, name, service, resource_type, account_id, execution_role_id, extra_json)
├── principal_policies (principal_id, policy_id)
├── group_memberships (user_id, group_id)
├── cross_account_links (source_account_id, target_account_id, role_arn, trust_principal_arn, is_wildcard)
└── security_findings (entity_arn, category, path_id, severity, message)
# Listar contas enumeradas
worst accounts list
# Output:
# Account ID Name Principals Resources Last Enumerated
# 123456789012 DEV-Prod 142 89 2026-04-24 15:30
# 222222222222 STG-Data 67 34 2026-04-24 16:45
# Deletar conta e todos os dados
worst accounts delete 123456789012
# Exportar grafo para análise externa
worst graph-export --output graph.json
# Após enumerar múltiplas contas, WorstAssume detecta automaticamente:
# - Trust relationships entre contas
# - Wildcard trust policies (Principal: *)
# - Cross-account role assumptions
Cross-Account Links (PTES 2.1.4 - Relationships):
- Account A (111111111111) → Account B (222222222222)
└── Role: CrossAccountRole (Wildcard: YES)
- Account A (111111111111) → Account C (333333333333)
└── Role: DevRole (Wildcard: NO)
Conta: 123456789012
├── Usuários: 15
├── Roles: 42
├── Grupos: 8
├── Políticas Managed: 25
└── Políticas Inline: 67
Conta: 123456789012
├── EC2 Instances: 120
├── Lambda Functions: 35
├── ECS Clusters: 5
├── S3 Buckets: 28
└── VPCs: 12
Principal: "*"Action: "*" e Resource: "*"# Listar contas enumeradas
worst accounts list
# Exportar grafo para análise externa (PTES 6.2 - Technical Reporting)
worst graph-export --output graph.json
# Visualizar dashboard
worst viz
# Identidade (PTES 2.5.4.7 - Banner Grabbing)
aws sts get-caller-identity
# Região atual
aws configure get region
# Listar todas as regiões
aws ec2 describe-regions --query 'Regions[].RegionName'
# Descrever ranges de IP (PTES 2.5.1 - IP Ranges)
aws ec2 describe-prefix-lists --query 'PrefixLists[?PrefixListName*`com.amazonaws']'
# theHarvester (PTES 2.3.1 - Email addresses)
theHarvester -d target.com -b google,linkedin
# Maltego (PTES 2.3.1.1)
# Interface gráfica para OSINT correlation
# Subfinder (PTES 2.3.4 - Domain Names)
subfinder -d target.com -o domains.txt
# Amass (PTES 2.3.4)
amass enum -d target.com -o amass_domains.txt
Naabu é a ferramenta primária para port scanning neste framework. Use naabu para:
# Scan básico (top 100 ports)
naabu -host target.com -silent
# Todas as portas
naabu -host target.com -p - -silent
# Lista de hosts
naabu -l hosts.txt -silent
# Output JSON para pipeline
naabu -host target.com -j -o output.json
# Integração com httpx
naabu -host target.com -silent | httpx -silent
# Host discovery
naabu -host 192.168.1.0/24 -sn -silent
# CDN/WAF exclusion
naabu -host target.com -ec -silent
# Smart scan (predictive port scanning)
naabu -host target.com -ss
Ver /root/.pcode/skills/pentest-network-scanning/SKILL.md para documentação completa do Naabu.
Use hping3 como ferramenta complementar quando:
# SYN scan na porta 80 para descobrir hosts vivos
hping3 -S -p 80 --scan 1-254 192.168.1.1
# ICMP scan para host discovery
hping3 -1 -c 5 192.168.1.1
# TCP ACK scan (bypass de firewalls stateless)
hping3 -A -p 80 192.168.1.1
# UDP scan para discovery
hping3 -2 -p 53 192.168.1.1
# SYN scan em range de portas (stealth scan)
hping3 -S -p 1-1000 --scan target.com
# Scan em portas específicas
hping3 -S -p 22,80,443,8080 --scan target.com
# XMAS scan (difícil de detectar por IDS)
hping3 -F -P -U -p 1-1000 --scan target.com
# NULL scan (sem flags)
hping3 -O -p 1-1000 --scan target.com
# Testar se firewall permite SYN
hping3 -S -p 80 target.com
# SYN-ACK = porta aberta
# RST = porta fechada
# Sem resposta = filtrada
# Testar se firewall é stateful (ACK scan)
hping3 -A -p 80 target.com
# RST = porta não filtrada (firewall stateless)
# Sem resposta = firewall stateful ou drop
# Mapear regras com TTL customizado
hping3 -S -p 80 -t 64 target.com
hping3 -S -p 80 -t 128 target.com
FINDING: NETWORK-DISCOVERY-HPING3
CATEGORY: RECONNAISSANCE
SEVERITY: INFO
PTES: 2.5.4 - Active Footprinting
TARGET:
- IP/Hostname: [target]
- Portas descobertas: [lista]
- Hosts ativos: [lista]
DESCRIPTION:
Host discovery e port scanning via hping3 identificou [X] hosts ativos
e [Y] portas abertas na rede alvo. hping3 permitiu bypass de filtros
que bloqueavam scans tradicionais do nmap.
EVIDENCE:
hping3 -S -p 1-1000 --scan [target]
[Output do scan]
TECHNIQUE:
- SYN scan (-S): Identifica portas abertas via SYN-ACK
- ACK scan (-A): Mapeia firewalls stateless
- XMAS scan (-FPU): Evasão de IDS básico
PTES REFERENCE: Section 2.5.4 (Active Footprinting)
# Random source IP (spoofing para testes de IDS/IPS)
hping3 -S -p 80 --rand-source target.com
# Fragmented packets (bypass de ACLs fracas)
hping3 -S -p 80 -f target.com
# Don't fragment flag
hping3 -S -p 80 -y target.com
# Custom TTL para OS fingerprinting
hping3 -S -p 80 -t 64 target.com # Windows típico
hping3 -S -p 80 -t 128 target.com # Linux típico
# Source address spoofing
hping3 -S -p 80 -a 10.0.0.1 target.com
# Testar se ICMP é permitido (potencial tunnel vector)
hping3 -1 -d 1024 target.com # ICMP com data payload
# Large ICMP packets (covert channel testing)
hping3 -1 -d 65000 target.com
# ICMP timestamp request
hping3 -1 -C 13 -K 0 target.com
# Scan lento para evitar detecção
hping3 -S -p 1-1000 -i u100000 target.com # 100ms entre packets
# Scan moderado
hping3 -S -p 1-1000 --fast target.com # 10 packets/segundo
# Scan rápido (pode ser detectado)
hping3 -S -p 1-1000 --faster target.com # 100 packets/segundo
# Traceroute via SYN packets
hping3 -S -p 80 -T traceroute target.com
# Traceroute via ICMP
hping3 -1 -T traceroute target.com
# Traceroute com TTL fixo (monitorar hop específico)
hping3 -S -p 80 -t 5 --tr-keep-ttl target.com
# Incluir RECORD_ROUTE option
hping3 -S -p 80 -G target.com
# Loose source routing
hping3 -S -p 80 --lsrr target.com
# Strict source routing
hping3 -S -p 80 --ssrr target.com
NOTE: Nettacker complementa Naabu e hping3 com detecção automática de tecnologias, subdomain enumeration, e WAF detection em uma única ferramenta.
# Enumeração passiva de subdomínios (sem scan ativo)
docker run --rm owasp/nettacker -i target.com -m subdomain_scan
# Subdomínios + detecção de tecnologias
docker run --rm owasp/nettacker -i target.com -m subdomain_scan,web_technologies_scan
# Output JSON para integração
docker run --rm -v $(pwd):/tmp owasp/nettacker \
-i target.com -m subdomain_scan \
--json-output /tmp/subdomains.json
# API integration
API_KEY=$(docker logs nettacker 2>&1 | grep "API Key" | awk '{print $4}')
curl -k -X POST "https://localhost:5000/new/scan" \
-d "key=${API_KEY}&targets=target.com&selected_modules=subdomain_scan"
Template de Finding - Subdomain Discovery:
FINDING: SUBDOMAIN-DISCOVERY-NETTACKER
CATEGORY: RECONNAISSANCE
SEVERITY: INFO
PTES: 2.5.2 - Active Reconnaissance
TARGET: target.com
SUBDOMAINS FOUND: [X]
- api.target.com (203.0.113.10)
- admin.target.com (203.0.113.11)
- dev.target.com (203.0.113.12)
DESCRIPTION:
Nettacker subdomain enumeration identified [X] subdomains through passive
OSINT sources and DNS brute-forcing. Several subdomains expose administrative
interfaces and development environments.
EVIDENCE:
docker run --rm owasp/nettacker -i target.com -m subdomain_scan
REMEDIATION:
- Implement DNS zone transfer restrictions
- Remove unused subdomains from DNS
- Apply WAF to exposed administrative subdomains
- Consider DNS wildcard records for unused prefixes
PTES REFERENCE: Section 2.5.2 (Active Reconnaissance)
# Detecção de tecnologias web (CMS, frameworks, servidores)
docker run --rm owasp/nettacker -i target.com -m web_technologies_scan
# CMS-specific detection
docker run --rm owasp/nettacker -i target.com \
-m wordpress_scan,joomla_scan,drupal_scan
# Output detalhado com versões
docker run --rm owasp/nettacker -i target.com -m web_technologies_scan \
--graph-output /tmp/report.html
Tecnologias Detectadas Automaticamente:
Template de Finding - Technology Stack:
FINDING: TECH-STACK-DETECTION
CATEGORY: RECONNAISSANCE
SEVERITY: INFO
PTES: 2.5.4.7 - Banner Grabbing
TARGET: https://target.com
TECHNOLOGIES DETECTED:
- WordPress 6.4.2 (CMS)
- Apache 2.4.57 (Web Server)
- PHP 8.1.12 (Runtime)
- Cloudflare (CDN/WAF)
- Google Analytics (Tracking)
DESCRIPTION:
Nettacker web technologies scan identified the complete technology stack.
WordPress version disclosure allows targeting version-specific CVEs.
Cloudflare presence indicates WAF bypass techniques may be required.
RISK ASSESSMENT:
- WordPress 6.4.2: Check WPScan for plugin vulnerabilities
- Apache 2.4.57: Check CVE-2023-25690, CVE-2023-31122
- PHP 8.1.12: Check for deserialization vulnerabilities
PTES REFERENCE: Section 2.5.4.7 (Banner Grabbing)
# WAF detection e fingerprinting
docker run --rm owasp/nettacker -i target.com -m waf_scan
# WAF + tecnologias web
docker run --rm owasp/nettacker -i target.com -m waf_scan,web_technologies_scan
# API integration
curl -k -X POST "https://localhost:5000/new/scan" \
-d "key=${API_KEY}&targets=target.com&selected_modules=waf_scan"
WAF Products Detected:
# Admin panel discovery com wordlists otimizadas
docker run --rm owasp/nettacker -i target.com -m admin_scan
# Admin + directory enumeration
docker run --rm owasp/nettacker -i target.com -m admin_scan,dir_scan
# Custom wordlist
docker run --rm -v $(pwd)/wordlists:/wordlists owasp/nettacker \
-i target.com -m admin_scan \
--scan-args "-w /wordlists/admin-panels.txt"
Paths Comuns Testados:
/admin, /administrator, /wp-admin, /phpmyadmin
/login, /signin, /dashboard, /console
/manager, /cpanel, /webmail, /controlpanel
# Directory brute forcing
docker run --rm owasp/nettacker -i target.com -m dir_scan
# Directory + file enumeration
docker run --rm owasp/nettacker -i target.com \
-m dir_scan --scan-args "--wordlist /usr/share/wordlists/dirb/common.txt"
# Recursive scanning
docker run --rm owasp/nettacker -i target.com -m dir_scan \
--scan-args "--depth 3"
# ViewDNS reverse IP lookup (shared hosting detection)
docker run --rm owasp/nettacker -i target.com -m viewdns_reverse_iplookup_scan
# Identificar outros domínios no mesmo IP
# Útil para descobrir siblings em shared hosting
# Step 1: Subdomain enumeration (Nettacker)
docker run --rm owasp/nettacker -i target.com -m subdomain_scan \
--json-output /tmp/subdomains.json
# Step 2: Extract live domains
jq -r '.[] | select(.result.subdomain_found == true) | .result.subdomain_found' \
/tmp/subdomains.json | tee live_subdomains.txt
# Step 3: Port scanning (Naabu - mais rápido para grandes ranges)
naabu -l live_subdomains.txt -o ports.json -j
# Step 4: Web tech detection (Nettacker)
for domain in $(cat live_subdomains.txt); do
docker run --rm owasp/nettacker -i $domain -m web_technologies_scan \
--json-output /tmp/tech_${domain}.json &
done
wait
# Step 5: WAF detection (Nettacker)
for domain in $(cat live_subdomains.txt); do
docker run --rm owasp/nettacker -i $domain -m waf_scan \
--json-output /tmp/waf_${domain}.json &
done
wait
# Step 6: Consolidate results
cat /tmp/tech_*.json | jq -s '.' > /tmp/tech_consolidated.json
cat /tmp/waf_*.json | jq -s '.' > /tmp/waf_consolidated.json
# Step 1: Shodan passive recon
shodan search "org:TargetCorp" > shodan_results.txt
# Step 2: Censys certificate search
censys search "services.http.response.html_title:TargetCorp" > censys_certs.txt
# Step 3: Nettacker subdomain enumeration
docker run --rm owasp/nettacker -i target.com -m subdomain_scan \
--json-output nettacker_subs.json
# Step 4: Wayback Machine historical URLs
waybackurls target.com > wayback_urls.txt
# Step 5: Consolidate all sources
cat shodan_results.txt censys_certs.txt nettacker_subs.json wayback_urls.txt \
| sort -u > consolidated_recon.txt
# Step 6: Filter for sensitive paths
grep -iE "admin|login|api|backup|config|dev|staging" consolidated_recon.txt
| Feature | Nettacker | Subfinder |
|---|---|---|
| Sources | Built-in OSINT + DNS brute | 40+ passive sources |
| Speed | Moderate | Very fast |
| Integration | Part of full scan workflow | Standalone + httpx pipeline |
| Output | JSON, HTML, CSV | TXT, JSON |
| Best For | Combined recon + vuln scan | Fast subdomain-only enum |
Recommended Workflow:
# Use Subfinder for initial fast enumeration
subfinder -d target.com -o subs_fast.txt
# Use Nettacker for deep scan with DNS brute-forcing
docker run --rm owasp/nettacker -i target.com -m subdomain_scan
# Combine results
cat subs_fast.txt nettacker_subs.txt | sort -u > all_subs.txt
# Proceed with Naabu + httpx + nuclei
cat all_subs.txt | naabu -silent | httpx -silent | nuclei
security-usernames plugin)Local: `seclists-categories usernames/usernames/references/`
Wordlists Disponíveis:
- `Names/names.txt` - Nomes comuns para enumeration
- `top-usernames-shortlist.txt` - Top usernames para teste rápido
- `cirt-default-usernames.txt` - Default accounts de serviços
# Usar wordlists com ffuf
ffuf -w seclists-categories/usernames/top-usernames-shortlist.txt \
-u https://target.com/users/FUZZ \
-mc 200
# Usar com curl para teste de existência
for user in $(cat seclists-categories/usernames/cirt-default-usernames.txt); do
curl -s -o /dev/null -w "%{http_code}" "https://target.com/api/users/$user"
done
# Integrar com ferramentas OSINT
theHarvester -d target.com -b google,linkedin
subfinder -d target.com -o domains.txt
admin, root, test, guest, user, operator
service, backup, oracle, postgres, mysql
tomcat, jenkins, deploy, www-data
security-patterns plugin)Local: `seclists-categories pattern-matching/pattern-matching/references/`
Patterns Disponíveis:
- `malicious.txt` - Padrões de código malicioso
- `pcap-strings.txt` - Strings para análise de PCAP
- `php-auditing.txt` - Patterns para auditoria PHP
- `grepstrings-basic.txt` - Strings básicas para grep
- `errors.txt` - Padrões de mensagens de erro
# AWS Access Keys
grep -rE "AKIA[0-9A-Z]{16}" . 2>/dev/null
# Google Cloud API Keys
grep -rE "AIza[0-9A-Za-z_-]{35}" . 2>/dev/null
# GitHub Tokens
grep -rE "ghp_[0-9a-zA-Z]{36}" . 2>/dev/null
# Generic API Keys
grep -riE "api[_-]?key.*[=:]\s*['\"][0-9a-zA-Z]{32,}['\"]" . 2>/dev/null
# Private Keys
grep -r "BEGIN.*PRIVATE KEY" . 2>/dev/null
# Passwords em código
grep -riE "password\s*[=:]\s*['\"][^'\"]+['\"]" . 2>/dev/null
import re
import os
patterns = {
'AWS_KEY': r'AKIA[0-9A-Z]{16}',
'GCP_KEY': r'AIza[0-9A-Za-z_-]{35}',
'GITHUB_TOKEN': r'ghp_[0-9a-zA-Z]{36}',
'GENERIC_API_KEY': r'api[_-]?key.*[=:]\s*[\'"][0-9a-zA-Z]{32,}[\'"]',
'GENERIC_SECRET': r'secret.*[=:]\s*[\'"][0-9a-zA-Z]{32,}[\'"]',
'PASSWORD': r'password\s*[=:]\s*[\'"][^\'"]+[\'"]',
'PRIVATE_KEY': r'BEGIN.*PRIVATE KEY'
}
def scan_file(filepath):
with open(filepath, 'r', errors='ignore') as f:
content = f.read()
for name, pattern in patterns.items():
matches = re.findall(pattern, content, re.IGNORECASE)
if matches:
print(f"[{name}] Found in {filepath}: {len(matches)} matches")
for root, dirs, files in os.walk('.'):
for file in files:
if file.endswith(('.py', '.js', '.env', '.config', '.json', '.yaml', '.yml')):
scan_file(os.path.join(root, file))
# Subdomain enumeration + API key discovery
subfinder -d target.com -o subdomains.txt
cat subdomains.txt | httpx -silent | while read url; do
curl -s "$url" | grep -oE "AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}"
done
# GitHub reconnaissance
curl -s "https://api.github.com/orgs/target/repos" | jq '.[].clone_url'
Após completar esta fase, prossiga para pentest-threat-modeling (PTES Phase 3)
AIRecon é um agente autônomo de penetration testing (v0.1.7-beta) que pode ser invocado como ferramenta incremental durante intelligence gathering para automatizar OSINT, network scanning, e descoberta de credenciais.
# AIRecon com keywords de OSINT e network discovery
airecon "pentest intelligence gathering osint network scan target.com"
# AIRecon detectará keywords e carregará:
# - pentest-intelligence-gathering.md (skill primária)
# - pentest-network-scanning.md (para network scan)
# - MCP tools: hexstrike (nmap, naabu), cve-mcp, pentestswarm
# Para pfSense-specific OSINT:
airecon "pfsense osint shodan censys reconnaissance"
# Para API key discovery:
airecon "api key discovery github secrets scan target"
# Network scanning com Naabu integrado
/naabu-scan --target target.com -p 443,8443,22,80
/naabu-scan --target 192.168.1.0/24 -p - -silent
# API key discovery em repositórios e código
/api-keys --target ./src --recursive
/api-keys --target https://github.com/org/repo --scan-type github
# Wordlist generation para brute-force
/wordlist --type usernames --length 6
/wordlist --type passwords --length 8 --include-symbols
Durante intelligence gathering, AIRecon pode invocar MCP tools automaticamente:
# hexstrike-local: nmap, naabu, nuclei scans
airecon "scan target.com with nmap version detection"
# → Usará mcp__hexstrike-local__nmap_scan
airecon "run naabu port scan on 192.168.1.0/24"
# → Usará mcp__hexstrike-local__rustscan_fast_scan ou naabu_scan
airecon "run nuclei vulnerability scan on target.com"
# → Usará mcp__hexstrike-local__nuclei_scan
# pentestswarm-remote: Automated reconnaissance campaigns
airecon "start reconnaissance campaign for example.com"
# → Usará mcp__pentestswarm-remote__start_campaign
# → Retornará campaign_id para monitoramento
# cve-mcp: CVE lookup para tecnologias detectadas
airecon "check CVEs for Apache 2.4.57"
# → Usará mcp__cve-mcp__search_cves
# virustotal: Domain e IP reputation
airecon "check domain reputation for suspicious-domain.com"
# → Usará mcp__virustotal__get_domain_report
# osint-remote: Username e email OSINT
airecon "search username john.doe across social networks"
# → Usará mcp__osint-remote__maigret_search
# 1. Usar AIRecon para OSINT inicial
airecon "osint reconnaissance target.com subdomain enumeration"
# 2. AIRecon auto-carrega pentest-intelligence-gathering.md
# 3. Invocar Naabu via AIRecon para port scanning
airecon "/naabu-scan --target target.com -p - -silent"
# 4. Invocar Nettacker via AIRecon para tech detection
airecon "docker run --rm owasp/nettacker -i target.com -m web_technologies_scan"
# 5. AIRecon processa output e consolida findings
# 6. Exportar para relatório de intelligence gathering
airecon "export findings to JSON for stakeholder review"
# 1. Passive OSINT com Shodan/Censys via AIRecon
airecon "shodan search product:pfsense org:target"
# 2. AIRecon detecta pfSense e ativa pentest-pfsense skill
# 3. Version detection via AIRecon
airecon "censys search services.http.title:pfSense"
# 4. CVE mapping automático
airecon "check CVEs for pfSense 2.7.0"
# → Usará mcp__cve-mcp__search_cves com filtro de severidade
# 5. Exportar findings
airecon "export pfsense intelligence report"
| Keywords Detectadas | Skills Carregadas | MCP Tools Ativados |
|---|---|---|
osint subdomain | pentest-intelligence-gathering | osint-remote, hexstrike |
network scan naabu | pentest-network-scanning | hexstrike (nmap, rustscan) |
api key secret | pentest-intelligence-gathering | hexstrike (scan_repo_secrets) |
pfsense firewall | pentest-pfsense | shodan, cve-mcp |
cpanel whm | pentest-exploitation | cve-mcp (CVE-2026-41940) |
username enum | pentest-intelligence-gathering | hexstrike (hydra, http_intruder) |
# Iniciar campanha de reconnaissance automatizada
airecon "start pentestswarm campaign for target.com"
# PentestSwarm retornará campaign_id:
# campaign_abc123
# Monitorar progresso da campanha
airecon "get campaign status campaign_abc123"
# Buscar findings da campanha
airecon "get campaign findings campaign_abc123"
# Exportar resultados consolidados
airecon "export campaign report campaign_abc123"
AIRecon implementa error handling inteligente para ferramentas de intelligence:
# Se Naabu falhar (rate limiting), AIRecon automaticamente:
# 1. Aguarda backoff exponencial (2s, 4s, 8s...)
# 2. Tenta alternativa (rustscan, masscan)
# 3. Reporta falha após 3 retries
# Se Shodan API rate-limited:
# 1. Switch para Censys API
# 2. Fallback para OSINT passivo (Wayback Machine)
# 3. Notifica usuário sobre limitação
Watchtower é um framework de penetration testing baseado em LangGraph com arquitetura multi-agente (Planner, Worker, Analyst) que automatiza reconnaissance, vulnerability analysis, e report generation.
# Reconnaissance completo com Watchtower (PTES Phase 2)
python -m watchtower.main -t https://www.example.com --skip-ask-tools
# Watchtower executará automaticamente:
# - Planner Agent: Planeja workflow de reconnaissance
# - Worker Agent: Executa 23 ferramentas (nmap, subfinder, nuclei, etc.)
# - Analyst Agent: Analisa resultados e identifica vulnerabilidades
# Com LLM provider específico
python -m watchtower.main -t https://www.example.com \
--provider openai \
--model gpt-4o \
--skip-ask-tools
# Com autenticação (authenticated pentest)
python -m watchtower.main -t https://www.example.com \
--headers "Authorization: Bearer TOKEN" \
--skip-ask-tools
# Iniciar reconnaissance automatizado
/watchtower-recon --target https://www.example.com --skip-ask-tools
# Gerar relatório PDF automático
/watchtower-report --input "pentest_report.pdf" --target https://www.example.com
# Executar ferramentas específicas
/watchtower-tool --tool nmap --target 192.168.1.0/24
/watchtower-tool --tool subfinder --target example.com
/watchtower-tool --tool nuclei --target https://example.com
Watchtower integra-se com MCP tools automaticamente durante reconnaissance:
# hexstrike-local: 23 ferramentas de segurança
# - nmap, masscan: Port scanning
# - httpx, whatweb: Web tech detection
# - wafw00f: WAF fingerprinting
# - subfinder, amass: Subdomain enumeration
# - dnsrecon: DNS enumeration
# - nuclei, nikto: Vulnerability scanning
# - sqlmap, wpscan: CMS-specific scanning
# - testssl.sh, sslyze: SSL/TLS analysis
# - gobuster, ffuf: Directory brute-forcing
# - arjun, kiterunner: Parameter discovery
# - xsstrike, dalfox: XSS detection
# - gitleaks: Secret detection
# - cmseek: CMS detection
# cve-mcp: CVE intelligence
# - search_cves: Busca CVEs por keyword
# - get_cve_summary: Resumo completo de CVE
# - check_exploit_availability: Verifica exploits públicos
# - get_epss_score: EPSS scoring
# pentestswarm-remote: Automated campaigns
# - start_campaign: Inicia campanha stateful
# - get_campaign_status: Monitora progresso
# - get_campaign_findings: Coleta resultados
# osint-remote: OSINT gathering
# - get_whois: Domain/IP WHOIS
# - get_certificates: Certificate transparency
# - get_threatfox: Malware IOCs
# - get_mitre_attack: MITRE ATT&CK mapping
# virustotal: Reputation analysis
# - get_domain_report: Domain analysis
# - get_ip_report: IP reputation
# - get_url_report: URL scanning
# 1. Watchtower Planner analisa o target e planeja reconnaissance
python -m watchtower.main -t https://www.example.com --skip-ask-tools
# 2. Watchtower executa em paralelo:
# - Subdomain enumeration (subfinder, amass)
# - Port scanning (nmap, masscan)
# - Web tech detection (httpx, whatweb, wafw00f)
# - DNS enumeration (dnsrecon)
# - Vulnerability scanning (nuclei, nikto)
# 3. Watchtower Analyst consolida findings
# 4. Relatório PDF gerado automaticamente
python -m watchtower.main --report "intelligence_report.pdf"
# Watchtower detecta pfSense automaticamente via whatweb/wafw00f
python -m watchtower.main -t https://pfsense.target.com --skip-ask-tools
# Watchtower executará:
# - Version detection (whatweb)
# - Port scanning (nmap -p 80,443,22)
# - SSL/TLS analysis (testssl.sh)
# - CVE mapping via cve-mcp
# - Exploit availability check
# Se CVEs críticos encontrados:
# - Watchtower Analyst flagga como HIGH/CRITICAL
# - Incluído automaticamente no relatório PDF
# Watchtower detecta cPanel/WHM automaticamente
python -m watchtower.main -t https://target.com:2087 --skip-ask-tools
# Detecção via:
# - whatweb: CMS detection
# - wafw00f: WAF/Platform fingerprinting
# - nmap: Service version detection
# Se cPanel detectado:
# - Watchtower mapeia CVEs (incluindo CVE-2026-41940)
# - Verifica exploit availability via cve-mcp
# - Analyst categoriza por severidade
| Keywords Detectadas | Skills Carregadas | Watchtower Tools Ativadas |
|---|---|---|
osint recon | pentest-intelligence-gathering | subfinder, amass, dnsrecon |
network scan | pentest-network-scanning | nmap, masscan, rustscan |
web tech | pentest-intelligence-gathering | httpx, whatweb, wafw00f |
vuln scan | pentest-vulnerability-analysis | nuclei, nikto, dalfox |
subdomain | pentest-intelligence-gathering | subfinder, amass |
ssl tls | pentest-vulnerability-analysis | testssl.sh, sslyze |
cms wordpress | pentest-exploitation | wpscan, cmseek |
secret apikey | pentest-intelligence-gathering | gitleaks |
pfsense | pentest-pfsense | nmap, whatweb, cve-mcp |
cpanel whm | pentest-exploitation | whatweb, cve-mcp |
# 1. AIRecon para OSINT inicial e planning
airecon "osint reconnaissance target.com"
# 2. Watchtower para automated scanning
python -m watchtower.main -t https://www.example.com --skip-ask-tools
# 3. AIRecon para análise de findings
airecon "analyze watchtower findings and prioritize vulnerabilities"
# 4. Watchtower gera relatório PDF
python -m watchtower.main --report "final_intelligence_report.pdf"
┌─────────────────────────────────────────────────────────────┐
│ Watchtower Orchestrator │
└─────────────────────────────────────────────────────────────┘
│
┌─────────────────────┼─────────────────────┐
│ │ │
▼ ▼ ▼
┌───────────────┐ ┌─────────────────┐ ┌───────────────┐
│ Planner Agent │ │ Worker Agent │ │ Analyst Agent │
│ │ │ │ │ │
│ - Plans recon │ │ - Executes tools│ │ - Analyzes │
│ - Prioritizes │ │ - 23 tools │ │ results │
│ - PTES phases │ │ - Parallel exec │ │ - Categorizes │
└───────────────┘ └─────────────────┘ │ - Reports │
└───────────────┘
| Tool | Category | PTES Phase | Intelligence Use |
|---|---|---|---|
| nmap | Port Scanning | 2.5.4 | Host discovery, service enumeration |
| masscan | Port Scanning | 2.5.4 | High-speed Internet-scale scanning |
| httpx | Web Probing | 2.5.4 | HTTP probing, tech detection |
| whatweb | Tech Detection | 2.5.4 | CMS, framework, server identification |
| wafw00f | WAF Detection | 2.5.4 | WAF fingerprinting |
| subfinder | Subdomain Enum | 2.5.2 | Passive subdomain discovery |
| amass | Subdomain Enum | 2.5.2 | Deep subdomain enumeration |
| dnsrecon | DNS Enum | 2.5.2 | DNS records, zone transfers |
| nuclei | Vuln Scanning | 3.1 | Template-based vulnerability detection |
| nikto | Web Scanning | 3.1 | Web server vulnerability assessment |
| sqlmap | SQL Injection | 4.2 | SQL injection detection |
| wpscan | CMS Scanning | 3.1 | WordPress vulnerability scanning |
| testssl.sh | SSL/TLS | 3.1 | SSL/TLS configuration analysis |
| sslyze | SSL/TLS | 3.1 | SSL certificate and protocol analysis |
| gobuster | Dir Bruteforce | 2.5.4 | Directory/file discovery |
| ffuf | Fuzzing | 2.5.4 | Web application fuzzing |
| arjun | Parameter Enum | 2.5.4 | HTTP parameter discovery |
| kiterunner | Content Discovery | 2.5.4 | Fast content discovery |
| xsstrike | XSS Detection | 3.1 | XSS vulnerability detection |
| gitleaks | Secret Detection | 2.3.7 | API key/secret scanning |
| dalfox | XSS Scanning | 3.1 | Advanced XSS scanning |
| cmseek | CMS Detection | 2.5.4 | CMS fingerprinting |
| sqlmap | SQLi Testing | 4.2 | SQL injection exploitation |
Watchtower usa SQLite para persistência de estado durante reconnaissance:
# Database location
~/.watchtower/pentest_memory.db
# Tables:
# - scan_results: Tool outputs consolidados
# - findings: Vulnerabilities categorizadas
# - targets: Target metadata
# - sessions: Session history
# Gerar relatório PDF automático (PTES Phase 6)
python -m watchtower.main --report "pentest_report.pdf"
# Relatório inclui:
# - Executive Summary
# - Technical Findings
# - Risk Matrix
# - Remediation Recommendations
# - Tool Output Appendices
# 1. Iniciar campanha PentestSwarm
airecon "start pentestswarm campaign for target.com"
# → campaign_id: campaign_abc123
# 2. Watchtower para scanning detalhado
python -m watchtower.main -t https://www.example.com --skip-ask-tools
# 3. Consolidar findings
airecon "merge pentestswarm and watchtower findings"
# 4. Gerar relatório final
python -m watchtower.main --report "consolidated_report.pdf"
Watchtower implementa retry logic e fallback automático:
Se ferramenta falha:
1. Retry com backoff exponencial (2s, 4s, 8s)
2. Fallback para ferramenta alternativa
3. Reporta falha após 3 retries
4. Continua com próximas ferramentas
/pentest-network-scanning - Network scanning com Naabu, hping3 e Nettacker (Section 14)/pentest-vulnerability-analysis - Vulnerability scanning com Nettacker CVE modules (Section 7)/pentest-pfsense - pfSense-specific detection e testingEstágio 1: Seed Discovery (10-15 min)
↓
Estágio 2: Asset Expansion (30-60 min)
↓
Estágio 3: Enrichment (20-40 min)
↓
Estágio 4: Exposure Analysis (30-60 min)
↓
Estágio 5: Reporting & Correlation (15-30 min)
Tempo total típico: 1.5-3.5 horas para alvo médio
# WHOIS do domínio principal
whois target.example
# ASN lookup
curl -sk "https://api.hackertarget.com/aslookup/?q=target.example"
# BGP toolkit
curl -sk "https://bgpview.io/search/target.example"
# Identificar holdings/subsidiárias
# Google: "target.example" acquired by, "target.example" subsidiary
# Subdomain passivo
subfinder -d target.example -all -silent | tee passive_subs.txt
# Subdomain ativo (brute-force)
puredns bruteforce wordlist.txt target.example -r resolvers.txt | tee brute_subs.txt
# Unificar e resolver
cat passive_subs.txt brute_subs.txt | sort -u | dnsx -silent -a -resp | tee resolved_assets.txt
# Cloud buckets
python3 cloud_enum.py -k target -kw target-brainstormed
# Mobile apps
# Google Play: https://play.google.com/store/apps/developer?id=<dev-name>
# App Store: https://apps.apple.com/developer/<dev-id>
# HTTP probing em massa
cat resolved_assets.txt | httpx -silent -tech-detect -status-code -title -ip -cname | tee enriched_assets.txt
# Screenshots (opcional)
gowitness file -s resolved_assets.txt -P screenshots/
# Certificate analysis
curl -sk "https://crt.sh/?q=%.target.example&output=json" | jq '.[].name_value' | sort -u
# GitHub secret scan
trufflehog github --org=target-org --only-verified
# JS bundle analysis
katana -list alive_assets.txt -jc -d 3 -kf robotstxt,sitemap | \
grep '\.js$' | xargs -I {} curl -sk {} | python3 secret_scan.py
# Nuclei scan
nuclei -l alive_assets.txt -t exposures/ -t misconfiguration/ -o exposures.txt
# Breach correlation
# HudsonRock API
curl -sk "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-email?email=user@target.example"
| Categoria | Tipos |
|---|---|
| Domain | domain, subdomain, wildcard_domain |
| Network | ipv4, ipv6, asn, cidr_range |
| Cloud | s3_bucket, gcs_bucket, azure_blob, cloud_run, lambda_function |
| Application | webapp, api_endpoint, graphql_endpoint, mobile_app |
| Identity | email, username, identity_provider, oauth_app |
| Infrastructure | cdn, waf, load_balancer, dns_server, mail_server |
| Data | database, elasticsearch_cluster, redis_instance, mongodb_instance |
| Secret | api_key, ssh_key, jwt_token, oauth_token, cloud_credential |
| Code | git_repo, npm_package, pypi_package, docker_image |
| Edge Type | De → Para | Significado |
|---|---|---|
RESOLVES_TO | subdomain → ipv4/ipv6 | DNS A/AAAA record |
HOSTS | ipv4 → webapp | HTTP service running |
OWNS | domain → subdomain | DNS hierarchy |
CERT_SAN | certificate → domain/subdomain | Subject Alternative Name |
DEPLOYED_ON | webapp → cloud | Hosting provider |
PUBLISHED_BY | npm_package → domain | Publisher ownership |
ASSOCIATED_WITH | email → username | Breach correlation |
AUTHENTICATES_VIA | webapp → identity_provider | SSO/SAML/OAuth |
EXPOSES | webapp → api_endpoint | Discovered endpoint |
CONTAINS | git_repo → secret | Leaked credential |
# Autodiscover
curl -sk -I "https://autodiscover.target.example/autodiscover/autodiscover.xml"
# Exchange Online
curl -sk -I "https://outlook.office365.com/autodiscover/autodiscover.xml"
# Teams
curl -sk "https://target.example/.well-known/microsoft-identity-association.json"
# SharePoint
curl -sk -I "https://target.sharepoint.com"
Sinais de confirmação:
mail.protection.outlook.comMS=msXXXXXXinclude:spf.protection.outlook.com# Well-known OIDC
curl -sk "https://target.okta.com/.well-known/openid-configuration"
# Login page
curl -sk "https://target.okta.com/login/login.htm"
# ADFS metadata
curl -sk "https://fs.target.example/FederationMetadata/2007-06/FederationMetadata.xml"
Swagger/OpenAPI paths (28 paths):
/swagger.json, /swagger/v1/swagger.json, /swagger/v2/swagger.json
/api/swagger.json, /api/v1/swagger.json, /api/v2/swagger.json
/openapi.json, /api/openapi.json, /v1/openapi.json
/api-docs/swagger.json, /docs/swagger.json, /spec/swagger.json
/swagger/v1/api-docs, /swagger/v2/api-docs, /api-docs
/api/api-docs, /docs/api-docs, /v1/api-docs, /v2/api-docs
/api/v1/api-docs, /api/v2/api-docs, /openapi.yaml
GraphQL paths (13 paths):
/graphql, /graph, /api/graphql, /api/v1/graphql, /api/v2/graphql
/graphiql, /graphql/graphiql, /api/graphiql
/console, /graphql/console, /playground, /api/playground, /explorer
| Fator | Peso | Como scorear |
|---|---|---|
| Método | 0-20 | POST/PUT/DELETE = 20, PATCH = 15, GET = 5 |
| Path keywords | 0-25 | admin/user/auth/payment/billing = 25, api/v1 = 5 |
| Parametros | 0-15 | id/userId/token/key = 15, search/query = 5 |
| Response | 0-20 | 200 com dados = 20, 401/403 = 10, 404 = 0 |
| Tech stack | 0-10 | Framework conhecido com CVEs = 10 |
| Contexto | 0-10 | Producao = 10, staging/dev = 5 |
Thresholds:
Introspection query:
{
__schema {
types {
kind
name
fields {
name
type {
kind
name
ofType {
kind
name
}
}
}
}
}
}
Field-suggestion enumeration (quando introspection disabled):
{
__typename
}
Error messages often leak field names.
Risk Score Formula:
Risk Score = (CVSS × 0.4) + (EPSS × 40) + (KEV × 15) + (PoC × 5)
EPSS Score Lookup:
# Single CVE
curl -sk "https://api.first.org/data/v1/epss?cve=CVE-2024-3400" | jq '.data[0]'
# Bulk (até 1000 CVEs)
curl -sk "https://api.first.org/data/v1/epss?cve=CVE-2024-3400,CVE-2023-46747" | jq '.data[]'
CISA KEV Check:
# Download full catalog
curl -sk https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | \
jq '.vulnerabilities[] | select(.cveID == "CVE-2024-3400")'
Exploit Availability:
# ExploitDB
searchsploit cve 2024-3400
# Metasploit
msfconsole -q -x "search cve:2024-3400; exit"
# GitHub PoC
curl -sk "https://api.github.com/search/code?q=CVE-2024-3400+language:python" | jq '.items[]'
# SPF Check
dig +short TXT target.example | grep -i 'v=spf1'
# -all = strict (bom), ~all = softfail (ok), ?all = neutral (ruim), +all = CRITICAL
# DMARC Check
dig +short TXT _dmarc.target.example | grep -i 'v=dmarc'
# p=reject = strict (bom), p=quarantine = moderate, p=none = ruim, Ausente = CRITICAL
# DKIM Check
dig +short TXT default._domainkey.target.example
dig +short TXT google._domainkey.target.example
# BIMI Check
dig +short TXT default._bimi.target.example
# MTA-STS Check
dig +short TXT _mta-sts.target.example
curl -sk "https://mta-sts.target.example/.well-known/mta-sts.txt"
# DNSSEC Check
dig +dnssec target.example | grep -E '(ad|ds)'
# ad flag = DNSSEC validado
Se crt.sh 502/503 (comum em peak hours):
D="target.example"
# 1. Censys cert search
censys search "names: ${D}" --index-type certificates
# 2. Cert Spotter API
curl -sk "https://api.certspotter.com/v1/issuances?domain=${D}&include_subdomains=true"
# 3. Subfinder bundled (30+ fontes)
subfinder -d ${D} -all -recursive -silent
# 4. AlienVault OTX
curl -sk "https://otx.alienvault.com/api/v1/indicators/domain/${D}/passive_dns"
# 5. URLScan
curl -sk "https://urlscan.io/api/v1/search/?q=domain:${D}"
# 6. ThreatMiner
curl -sk "https://api.threatminer.org/v2/domain.php?q=${D}&rt=5"
| Porta | Serviço | Severity se aberto |
|---|---|---|
| 21 | FTP | HIGH (cleartext auth) |
| 23 | Telnet | CRITICAL (cleartext) |
| 445 | SMB | CRITICAL se externo |
| 1433 | MSSQL | CRITICAL |
| 2375 | Docker API | CRITICAL |
| 3306 | MySQL | CRITICAL |
| 3389 | RDP | HIGH se externo |
| 5432 | PostgreSQL | CRITICAL |
| 5900 | VNC | CRITICAL |
| 6379 | Redis | CRITICAL |
| 9200 | Elasticsearch | CRITICAL |
| 10250 | Kubelet | CRITICAL |
| 2379 | etcd | CRITICAL |
| 27017 | MongoDB | CRITICAL |
Postman API Key (PMAK-*):
curl -sk "https://api.getpostman.com/me" -H "X-Api-Key: PMAK-<key>"
# 200 = live, 401 = dead
AWS Access Key:
import boto3
sts = boto3.client('sts',
aws_access_key_id='AKIA...',
aws_secret_access_key='<secret>',
region_name='us-east-1')
ident = sts.get_caller_identity()
# Returns Account ID + ARN + UserId
GitHub PAT:
curl -sk "https://api.github.com/user" -H "Authorization: token ghp_*"
# 200 = live, check X-OAuth-Scopes header
Slack Token:
curl -sk -X POST "https://slack.com/api/auth.test" -H "Authorization: Bearer xox*-*"
# {"ok": true} = live
Anthropic API Key:
curl -sk "https://api.anthropic.com/v1/models" \
-H "x-api-key: sk-ant-api03-..." \
-H "anthropic-version: 2023-06-01"
# 200 = live
OpenAI API Key:
curl -sk "https://api.openai.com/v1/models" -H "Authorization: Bearer sk-..."
# 200 = live
# S3 Bucket Check
curl -sk -I "https://target-example.s3.amazonaws.com"
curl -sk "https://target-example.s3.amazonaws.com?list-type=2"
# GCS Bucket Check
curl -sk "https://storage.googleapis.com/target-example?prefix="
# Azure Blob Check
curl -sk "https://targetexample.blob.core.windows.net/container?restype=container&comp=list"
# Cloud_enum tool
git clone https://github.com/initstring/cloud_enum
cd cloud_enum && pip install -r requirements.txt
python3 cloud_enum.py -k target -kw brainstormed-words
Técnicas:
dev., staging., test.)Censys Certificate Search:
curl -sk "https://search.censys.io/api/v2/certificates/search?q=names:target.example" \
-H "Authorization: Basic <base64>" | jq '.result.hits[].names'
Pastebin & Code Sharing:
site:pastebin.com "target.example"
site:pastebin.com "@target.example"
site:gist.github.com "target.example"
site:ghostbin.com "target.example"
site:rentry.co "target.example"
Cloud Storage:
site:s3.amazonaws.com "target"
site:storage.googleapis.com "target"
site:blob.core.windows.net "target"
site:drive.google.com "target" "password"
Configuration Files:
site:github.com "target.example" filename:.env
site:github.com "target.example" filename:config.json
site:github.com "target.example" filename:secrets.json
site:gitlab.com "target.example" filename:.env
site:bitbucket.org "target.example" filename:.env
Subdomain Discovery:
site:*.target.example -www
site:target.example inurl:admin
site:target.example inurl:api
site:target.example inurl:dev
site:target.example inurl:staging
| Trigger | Attack-path hint |
|---|---|
| Unauth POST/PUT/DELETE | "Tentar IDOR + privilege escalation; verificar se IDs numéricos são sequenciais" |
| GraphQL introspection aberta | "Enumerar mutations, buscar createUser, setRole, transferFunds" |
| Reflected CORS + creds | "Host CSRF page em origem controlada por atacante" |
| API key em URL | "Token vaza para access logs, Referer headers, CDNs third-party" |
| .git exposto | "Reconstruir repositório com git-dumper; histórico completo de código" |
| .env exposto | "Grep por _KEY, _SECRET, _TOKEN; validar via validators" |
| Firebase RTDB aberto | "Ler tudo, testar write em /<random-key>.json com PUT" |
| Open Elasticsearch | "/_cat/indices?v para lista; sample documents de cada index" |
| Subdomain takeover | "Registrar recurso não-claimado para servir conteúdo de domínio confiável" |
| Finding | Severity | Why |
|---|---|---|
.git/config reachable | CRITICAL | Full source-code disclosure |
.env reachable | CRITICAL | Plaintext creds (DB, cloud, API) |
| Open Firebase RTDB | CRITICAL | All app data readable; often writable |
| Listable S3 with PII | CRITICAL | Direct data exfil |
Spring Boot /actuator/env | CRITICAL | DB creds, JWT secrets, cloud keys |
| Open Elasticsearch | CRITICAL | Full data reads; often writable |
| Open MongoDB (no auth) | CRITICAL | Full data + password-hash collection |
| Open Redis (no AUTH) | CRITICAL | Write authorized_keys → SSH foothold |
| Live AWS root key | CRITICAL | Full account compromise |
| Live AWS IAM-user key | HIGH | Limited scope; often elevatable |
| Live GitHub PAT | HIGH | Repo write access |
| Open GraphQL introspection | HIGH | Full schema → mutations discovery |
| Subdomain takeover possible | HIGH | Takeover → phishing on trusted domain |
| Reflected CORS with credentials | HIGH | CSRF-via-CORS for sensitive data |
| Middleware | Detection Path | Key Indicators |
|---|---|---|
| Apache Tomcat | /manager/html, /manager/status | Default creds: tomcat:tomcat, admin:admin |
| JBoss / WildFly | /jmx-console/, /web-console/ | JMX MBean access, WAR deployment |
| WebLogic | /console/, /wls-wsat/ | T3 protocol on 7001/7002, IIOP |
| Spring Boot Actuator | /actuator/, /actuator/env, /actuator/heapdump | JSON endpoint listing, heap dump contains secrets |
| Spring Boot (alt paths) | /actuator/jolokia, /actuator/gateway/routes | Jolokia JMX bridge, Gateway route injection |
| Jenkins | /script, /manage | Groovy console, API token in cookie |
| GlassFish | /common/, /theme/ | Admin on 4848, default empty password |
| Jetty | /jolokia/ | JMX access |
| Resin | /resin-admin/ | Admin panel |
/actuator/env → Leak environment variables (DB creds, API keys)
/actuator/heapdump → Download JVM heap → search for passwords in memory
/actuator/jolokia → JMX → possible RCE via MBean manipulation
/actuator/gateway/routes → Spring Cloud Gateway → SpEL injection (CVE-2022-22947)
/actuator/configprops → All configuration properties
/actuator/mappings → All URL mappings (hidden endpoints)
/actuator/beans → All Spring beans
/actuator/shutdown → POST to shutdown application (DoS)
/.git/HEAD → Git repository exposed
/.svn/entries → SVN metadata
/.svn/wc.db → SVN SQLite database
/.hg/requires → Mercurial
/.bzr/README → Bazaar
/.DS_Store → macOS directory listing
/backup.zip /backup.tar.gz /backup.sql
/wwwroot.rar /www.zip /web.zip
/db.sql /database.sql /dump.sql
/config.php.bak /config.php~ /config.php.swp
/.config.php.swp /wp-config.php.bak
/.env /.env.bak /.env.production
/swagger-ui.html → Swagger/OpenAPI
/swagger-ui/ → Swagger UI
/api-docs → API documentation
/graphql → GraphQL playground
/graphiql → GraphQL IDE
/debug/ → Debug endpoints
/phpinfo.php → PHP configuration
/server-status → Apache status
/server-info → Apache info
/nginx_status → Nginx status
/.aws/credentials → AWS credentials
/.docker/config.json → Docker registry auth
/robots.txt → Disallowed paths (hint list)
/sitemap.xml → Full URL listing
/crossdomain.xml → Flash cross-domain policy
/.well-known/ → Various well-known URIs
For each input point:
1. Non-malicious HTML tags (<h2>, <img>) → are they reflected?
2. Incomplete tags → what happens? (<iframe src=//evil.com )
3. Encoding tests → %0d, %0a, %09, <%00
4. Observe the OUTPUT too (not just response) — where does your input appear?
5. Test same input in ALL similarly-structured pages (shared code → shared vuln)
6. Check if the same parameter exists in mobile/API endpoint (less protected)
- Each parameter tells a story: "what does this do server-side?"
- Filename → OS interaction → Path Traversal / CMDi
- URL/location → HTTP fetch → SSRF
- Template/HTML parameter → render function → SSTI
- XML field → parser → XXE
- SQL filter → query → SQLi
- User-content → storage → Stored XSS
✓ Programs with large scope (*.target.com)
✓ Programs that pay for P2/P3 (not just RCE)
✓ Programs with recent tech changes (migrations = new bugs)
✓ Programs with active development (new features = new attack surface)
× Avoid: frozen/old codebases with well-known CVEs (already claimed)
× Avoid: strict programs with narrow scope (less surface)
Priority 1: Authentication, password reset, 2FA → account takeover
Priority 2: File upload, profile edit, API endpoints → stored XSS, IDOR
Priority 3: Admin panels, user management → BFLA, privilege escalation
Priority 4: Payment flows, subscription → business logic
Priority 5: Import/export, template rendering → XXE, SSTI
# OSINT reconnaissance completo
airecon "osint reconnaissance target.com subdomain enumeration"
# Secret scanning
airecon "secret scanning github target-org"
# Breach correlation
airecon "breach correlation user@target.example"
# API discovery
airecon "api discovery target.com graphql swagger"
# Email security audit
airecon "email security audit target.example spf dmarc dkim"
# Vulnerability prioritization
airecon "vulnerability prioritization CVE-2024-3400 EPSS KEV"
# Full OSINT reconnaissance
python -m watchtower.main -t https://www.example.com --skip-ask-tools
# Watchtower executará:
# - Subdomain enumeration (subfinder, amass)
# - Port scanning (nmap, masscan)
# - Web tech detection (httpx, whatweb, wafw00f)
# - DNS enumeration (dnsrecon)
# - Vulnerability scanning (nuclei, nikto)
# - Secret detection (gitleaks)
NOTE: AI agents (Claude Desktop, Claude Code) represent a new attack surface. This section covers OSINT and reconnaissance specific to AI agent installations, MCP servers, and autonomous execution capabilities.
# Process detection (local machine)
pgrep -i "Claude"
pgrep -i "claude-code"
# Check for configuration directories
ls -la ~/Library/Application\ Support/Claude/ 2>/dev/null # macOS
ls -la ~/.claude/ 2>/dev/null # Claude Code
# Windows equivalents
dir "$env:APPDATA\Claude" 2>$null
dir "$env:USERPROFILE\.claude" 2>$null
# Network indicators (remote assessment)
# MCP servers often expose HTTP endpoints
nmap -p 8897,8080,3000 target -sV --open
# Extract MCP servers from config (local audit)
jq '.mcpServers | keys[]' ~/Library/Application\ Support/Claude/claude_desktop_config.json 2>/dev/null
# Analyze MCP server commands
jq '.mcpServers | to_entries[] | {
server: .key,
command: .value.command,
args: .value.args
}' claude_desktop_config.json 2>/dev/null
# Redact sensitive patterns from args
# Patterns: sk-*, key=*, token=*, secret=*, password=*
# List installed plugins
jq '.plugins[].name' cowork_plugins/installed_plugins.json 2>/dev/null
# List installed extensions (DXT)
jq '.extensions[] | {name, version, isSigned}' extensions-installations.json 2>/dev/null
# Find plugin hooks (shell commands)
find cowork_plugins -name "hooks.json" -exec jq -r '
.hooks | to_entries[] | "\(.key): \(.value[].command)"
' {} \; 2>/dev/null
# Check if scheduled tasks are enabled
jq '.preferences.coworkScheduledTasksEnabled' claude_desktop_config.json 2>/dev/null
# List scheduled tasks
jq '.tasks[] | {name, cron, enabled}' scheduled-tasks.json 2>/dev/null
# Check keep-awake (machine never sleeps)
jq '.preferences.keepAwakeEnabled' claude_desktop_config.json 2>/dev/null
# Check network mode
jq '.networkMode' config.json 2>/dev/null
# Extract egress allowed domains
jq -r '.egressAllowedDomains[]?' local_*.json 2>/dev/null | sort -u
# CRITICAL: Unrestricted egress
jq '.egressAllowedDomains' local_*.json 2>/dev/null | grep -q '\["\*"\]' && \
echo "CRITICAL: Unrestricted egress allowed"
| Indicator | Severity | Meaning |
|---|---|---|
| Claude process running | INFO | Active AI agent |
| MCP server with network | MEDIUM | External service integration |
| Scheduled tasks enabled | WARN | Autonomous execution capable |
| Plugin hooks with shell | HIGH | Code execution in plugins |
| Unsigned extensions | MEDIUM | Unverified code |
| Egress ["*"] | CRITICAL | Unrestricted outbound access |
| keepAwakeEnabled | WARN | System sleep overridden |
# Detect AI agents on target machine
airecon "detect Claude Desktop or Claude Code installation"
# Enumerate MCP servers
airecon "enumerate MCP servers and analyze configurations"
# Check autonomous execution
airecon "check for AI autonomous scheduled tasks"
# Plugin risk assessment
airecon "assess AI plugin security including hooks"
# Run full AI agent audit
./claude_audit.sh --json > ai_agent_audit.json
# Extract high-risk findings
jq '.findings[] | select(.severity == "WARN" or .severity == "CRITICAL")' \
ai_agent_audit.json
# HTML report for stakeholders
./claude_audit.sh --html ai_agent_report.html
AI Agent Surface
├── Desktop Configuration (claude_desktop_config.json)
│ ├── MCP Servers (commands, args, env vars)
│ ├── Preferences (keepAwake, scheduled tasks)
│ └── Network Mode (egress policy)
├── Plugins (installed_plugins.json)
│ ├── Plugin Hooks (shell commands)
│ └── Tool Permissions
├── Extensions (extensions-installations.json)
│ ├── Dangerous Tools (execute_javascript, run_command)
│ └── Signature Status
├── Scheduled Tasks (scheduled-tasks.json)
│ ├── Cron Expressions
│ └── Skill Bindings
└── Runtime State
├── Process Detection
├── Sleep Assertions
└── LaunchAgents/Startup
/osint-investigation - Skill exclusiva de OSINT e investigação digital/pentest-network-scanning - Network scanning com Naabu, hping3 e Nettacker/pentest-vulnerability-analysis - Vulnerability scanning com Nettacker CVE modules/pentest-pfsense - pfSense-specific detection e testing/ai-agent-audit - NOVA: Security audit completo para AI agents (Claude Desktop/Code)