External Pentest: Uçtan Uca Recon Workflow

mkdir -p recon/{subs,urls,js,fuzz,screenshots,viewstate,nmap,internetdb}
cp scope.txt recon/scope.txt
cd recon

 scope.txt → girdi (root domainler)

 subs/subs_all.txt → tüm subdomainler (merge)

 subs/resolved.txt → çözülen DOMAIN'ler (httpx girdisi, vhost-safe)

 subs/dns_map.txt → domain [IP] haritası (referans)

 subs/ips.txt → unique IP'ler (naabu/nmap girdisi)

 live.txt → CANLI web servisleri ana dosya (domain bazlı)

 live_detailed.txt → status + length + title (eleme için)

 urls/all_urls.txt → historical + crawl URL'leri

 urls/interesting.txt → urinteresting ile filtrelenmiş URL'ler

 urls/params.txt → parametreli URL'ler

 js/js_urls.txt → JS dosya URL'leri

 viewstate/aspx.txt → .NET / ASPX hedefleri

sudo apt update && sudo apt install -y \
  golang-go git python3-pip mono-complete libpcap-dev \
  jq whatweb nmap amass wpscan seclists pipx
# NOT: whatweb/nmap/amass/jq/seclists Kali'de çoğunlukla hazır gelir, yine de burada garanti altına alıyoruz. seclists → Faz 4 için şart.

# go binary path'ini kalıcı yap:
echo 'export PATH=$PATH:$HOME/go/bin' >> ~/.zshrc && source ~/.zshrc

# PD suite (subfinder, httpx, dnsx, naabu, katana) tek seferde:
go install github.com/projectdiscovery/pdtm/cmd/pdtm@latest
pdtm -install-all

# tomnomnom & co.
go install github.com/lc/gau/v2/cmd/gau@latest
go install github.com/tomnomnom/waybackurls@latest
go install github.com/tomnomnom/qsreplace@latest
go install github.com/tomnomnom/anew@latest               # pipeline için
go install github.com/tomnomnom/hacks/urinteresting@latest

git clone https://github.com/tomnomnom/hacks ~/tools/hacks
cp ~/tools/hacks/urinteresting/.urinteresting.json ~/.urinteresting.json

python3 -m venv venv && source venv/bin/activate && pip install -r requirements.txt

pipx ensurepath                                  # global CLI'lar için
curl -LsSf https://astral.sh/uv/install.sh | sh  # uv + uvx (opsiyonel)

go install github.com/sensepost/gowitness@latest
go install github.com/BishopFox/jsluice/cmd/jsluice@latest

# trufflehog
curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh \
  | sudo sh -s -- -b /usr/local/bin

# LinkFinder - packaged (setup.py var) → pipx ile doğrudan git'ten:
pipx install git+https://github.com/GerbenJavado/LinkFinder.git   # → 'linkfinder' komutu

# NOT: entry-point bulunamazsa fallback → python linkfinder.py -i <url> -o cli

# SecretFinder - venv:
git clone https://github.com/m4ll0k/SecretFinder ~/tools/SecretFinder
cd ~/tools/SecretFinder
python3 -m venv venv && source venv/bin/activate
pip install -r requirements.txt jsbeautifier requests
deactivate && cd -
# Çalıştırma: ~/tools/SecretFinder/venv/bin/python ~/tools/SecretFinder/SecretFinder.py -i <url> -o cli

# badsecrets - PyPI'de var → pipx (izole global 'badsecrets' komutu):
pipx install badsecrets

# crapsecrets - clone-and-run (irsdl fork) → venv:
git clone https://github.com/irsdl/crapsecrets ~/tools/crapsecrets
cd ~/tools/crapsecrets
python3 -m venv venv && source venv/bin/activate
pip install -r requirements.txt   # (repo'da varsa; yoksa README'deki bağımlılıklar)
deactivate && cd -

# ysoserial.net → github releases'ten son .zip'i ~/tools/ysoserial.net/ altına aç (mono ile çalışır)

# scope.txt → root domainler
sort -u scope.txt > roots.txt

# --- Passive toplama (subs_all.txt'te merge) ---
subfinder -dL roots.txt -all -silent | anew subs/subs_all.txt
amass enum -passive -df roots.txt     | anew subs/subs_all.txt

# crt.sh
while read -r d; do
  curl -s "https://crt.sh/?q=%25.$d&output=json" | jq -r '.[].name_value'
done < roots.txt | sed 's/\*\.//g'| tr '[:upper:]' '[:lower:]' \
 | grep -v '@' | anew subs/subs_all.txt

# resolve + otomatik wildcard temizliği (domain'ler korunur):
dnsx -l subs/subs_all.txt -auto-wildcard -silent | anew subs/resolved.txt

# resolved DOMAIN'ler → httpx → live.txt (★ ana dosya, domain bazlı)
httpx -l subs/resolved.txt -silent -o live.txt

httpx -l subs/resolved.txt -silent \
  -status-code -content-length -title -tech-detect -web-server \
  -o live_detailed.txt

# domain [IP] haritası (referans/raporlama)
dnsx -l subs/resolved.txt -a -resp -silent -o subs/dns_map.txt

# unique IP'ler (naabu/nmap girdisi) → aynı IP tekrar tekrar taranmasın
dnsx -l subs/resolved.txt -a -resp-only -silent | sort -u > subs/ips.txt

# Hangi status+length imzası kaç kez tekrar ediyor?
awk '{print $2, $3}' live_detailed.txt | sort | uniq -c | sort -rn

# En çok tekrar eden = jenerik/parking/wildcard → ele:
grep -v -e '\[200\] \[1547\]' -e '\[302\] \[0\]' live_detailed.txt > interesting_hosts.txt

gowitness scan file -f live.txt --screenshot-path screenshots/ --write-db

# Sonuçları tarayıcıda gözden geçir:
gowitness report server   # → http://localhost:7171

# 1) httpx ile CDN tespiti (JSON) — 'input' alanı orijinal domain'i verir (stabil field)
httpx -l subs/resolved.txt -silent -cdn -json -o cdncheck.json

# 2) CDN olmayan (origin adayı) domain'ler
jq -r 'select(.cdn != true) | .input' cdncheck.json 2>/dev/null | sort -u > subs/noncdn_domains.txt

# 3) Bu domain'leri IP'ye çöz → port tarama girdisi
dnsx -l subs/noncdn_domains.txt -a -resp-only -silent | sort -u > subs/ips_noncdn.txt

# Güvenlik ağı: adım boş dönerse tüm IP'lerle devam et (CDN'leri manuel not al)
[ -s subs/ips_noncdn.txt ] || cp subs/ips.txt subs/ips_noncdn.txt

# Tüm portlar (1-65535). External'de agresif gitme: rate'i makul tut.
sudo naabu -l subs/ips_noncdn.txt -p - -rate 1000 -c 50 -retries 2 \
  -silent -o nmap/naabu_full.txt
# Çıktı formatı: ip:port

sudo naabu -l subs/ips_noncdn.txt -p - -rate 1000 -silent \
  -nmap-cli 'nmap -sVC -Pn --open -oA nmap/full'

# naabu 'ip:port' çıktısını nmap girdisine çevir
cut -d: -f1 nmap/naabu_full.txt | sort -u                 > nmap/live_ips.txt
cut -d: -f2 nmap/naabu_full.txt | sort -u | paste -sd, -   > nmap/open_ports.txt

# Sadece bulunan portlarda derin tarama
sudo nmap -sVC -Pn --open -p "$(cat nmap/open_ports.txt)" \
  -iL nmap/live_ips.txt  -oA nmap/full

sudo nmap -sU --top-ports 100 -Pn --open -iL nmap/live_ips.txt -oA nmap/udp

# naabu'nun bulduğu ip:port çiftlerini httpx'e ver → canlı HTTP(S) olanlar live.txt'e
sed 's#:# #' nmap/naabu_full.txt | while read -r ip port; do
  echo "http://$ip:$port"; echo "https://$ip:$port"
done | httpx -silent | anew live.txt

whatweb -i live.txt --log-brief=whatweb.txt --no-errors

httpx -l live.txt -tech-detect -json -o tech.json

# (a) tech-detect / server header sinyali: satırda ASP.NET veya IIS geçen kayıtların URL'i
grep -iaE 'asp\.net|iis' tech.json | jq -r '.url' | sort -u > viewstate/aspx.txt

# (b) gerçek body kontrolü: sayfada __VIEWSTATE var mı? (asıl güvenilir kanıt)
while read -r u; do
  curl -s -k "$u" | grep -qi '__VIEWSTATE' && echo "$u"
done < live.txt | anew viewstate/aspx.txt

# (c) URL uzantısı ipucu (Faz 5'ten sonra all_urls.txt hazırsa)
grep -iE '\.aspx?($|\?)' urls/all_urls.txt 2>/dev/null | sort -u | anew viewstate/aspx.txt

ffuf  -w live.txt:HOST \
  -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt:FUZZ \
  -u HOST/FUZZ  -mc all -ac -o fuzz/all.json -of json

dirsearch -l live.txt -e aspx,asmx,ashx,config,php,bak -x 404,403 --format json -o fuzz/dirsearch.json

ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ \
  -u https://TARGET_IP/ -H "Host: FUZZ.target.com" -ac

# gau/waybackurls için scheme'siz host listesi üret
sed -E 's#^https?://##; s#/.*##' live.txt | sort -u > urls/hosts.txt

gau --threads 5 < urls/hosts.txt          > urls/gau.txt   # getallurls

waybackurls      < urls/hosts.txt         >> urls/gau.txt  # wayback machine

katana -list live.txt -jc -d 3 -o urls/katana.txt          # active crawl + JS
# Merge
cat urls/gau.txt urls/katana.txt | sort -u > urls/all_urls.txt

cat urls/all_urls.txt | urinteresting | sort -u > urls/interesting.txt

grep '=' urls/all_urls.txt | sort -u > urls/params.txt

# 1) JS URL'lerini ayır
grep -iE '\.js($|\?)' urls/all_urls.txt | sort -u > js/js_urls.txt
katana -list live.txt -jc -silent | grep '\.js' | anew js/js_urls.txt

cat js/js_urls.txt | jsluice urls    | sort -u > js/js_endpoints.txt
cat js/js_urls.txt | jsluice secrets            > js/js_secrets.txt

# LinkFinder (pipx ile global 'linkfinder' komutu):
linkfinder -i https://TARGET/main.js -o cli

# SecretFinder (venv):
~/tools/SecretFinder/venv/bin/python ~/tools/SecretFinder/SecretFinder.py -i https://TARGET/app.js -o cli

mkdir -p js/files && wget -q -i js/js_urls.txt -P js/files
trufflehog filesystem js/files --only-verified

site:target.com.tr ext:aspx
site:target.com.tr ext:asmx | ext:ashx | ext:config
site:target.com.tr inurl:login | inurl:admin | inurl:dashboard
site:target.com.tr intitle:"index of"
site:target.com.tr ext:pdf | ext:xls | ext:docx
"target.com.tr" -site:target.com.tr

# aspx.txt'teki her hedefi tara (known/leaked key match)
while read -r url; do
  echo "[*] $url"
  badsecrets --url "$url"
done < viewstate/aspx.txt

# pip/pipx kurulumunda bazı örnekler ayrı komut olarak gelir (telerik-knownkey, symfony-knownkey).
# Generic ASP.NET viewstate için repo'daki blacklist3r örneği:
git clone https://github.com/blacklanternsecurity/badsecrets ~/tools/badsecrets 2>/dev/null
python ~/tools/badsecrets/examples/blacklist3r.py \
  --viewstate "<VIEWSTATE_DEGERI>" --generator "<GENERATOR_DEGERI>"

cd ~/tools/crapsecrets
source venv/bin/activate     # Faz 0'da kurduğumuz venv
# README'deki kullanım — badsecrets match'ini burada doğrula
deactivate && cd -

├─ Burp'te gez → Active Scan (auth + unauth)
├─ Passive bulguları triage et (false positive ele)
├─ fuzz/all.json + urls/interesting.txt'i Burp'e besle
└─ Tech-specific: .NET → ViewState | WP → wpscan | API → param fuzz

for i in $(cat scope.txt); do
  echo "[*] Querying Shodan InternetDB for $i"
  curl -s "https://internetdb.shodan.io/$i" | jq -c . >> internetdb/shodan.txt
done

jq -r '.ip? // empty' internetdb/shodan.txt | grep -v null | sort -u > internetdb/ips_from_shodan.txt
jq -r '.ports[]?'      internetdb/shodan.txt | sort -un            > internetdb/ports_from_shodan.txt

for d in $(cat scope.txt); do
  curl -s -u "$CENSYS_API_ID:$CENSYS_API_SECRET" \
    "https://search.censys.io/api/v2/hosts/search?q=ssl.certificate.issuer.common_name:\"$d\"" \
    | jq -c . >> internetdb/censys.txt
done
jq -r '.result.hits[]?.ip' internetdb/censys.txt | sort -u > internetdb/ips_from_censys.txt

for d in $(cat scope.txt); do
  curl -s "https://fofa.info/api/v1/search/all?email=$FOFA_EMAIL&key=$FOFA_KEY&q=domain=\"$d\"" \
    | jq -c . >> internetdb/fofa.txt
done
jq -r '.results[]? | if type=="array" then .[0] else . end' internetdb/fofa.txt | sort -u > internetdb/ips_from_fofa.txt

for d in $(cat scope.txt); do
  curl -s "https://api.zoomeye.org/host/search?query=$d" -H "Authorization: JWT $ZOOMEYE_TOKEN" \
    | jq -c . >> internetdb/zoomeye.txt
done
jq -r '.matches[]?.ip' internetdb/zoomeye.txt | sort -u > internetdb/ips_from_zoomeye.txt

# Tüm dış kaynaklardan gelen IP'leri subs/ips.txt'e ekle (yalnızca yeni olanlar)
cat internetdb/ips_from_*.txt 2>/dev/null | sort -u | anew subs/ips.txt

# Yeni IP'ler üzerinden port tarama (Faz 2.5'i tekrar çalıştır — CDN filtresini unutma!)
sudo naabu -l subs/ips.txt -p - -rate 1000 -silent \
  -nmap-cli 'nmap -sVC -Pn --open -oA nmap/full_internetdb'

# Yeni IP'lerden canlı web servislerini bul → live.txt'e ekle
while read -r ip; do echo "http://$ip"; echo "https://$ip"; done < subs/ips.txt \
  | httpx -silent | anew live.txt

scope.txt
   │  sort -u
   ▼
roots.txt ──subfinder/amass/crt.sh──► subs/subs_all.txt
   │                                       │ dnsx -wd (wildcard temizliği)
   │                                       ▼
   │                                  subs/resolved.txt ──httpx──► live.txt ★
   │                                       │ dnsx -a
   │                                       ├──► subs/dns_map.txt  (referans)
   │                                       └──► subs/ips.txt ──[CDN filtre]──► naabu ►nmap/
   ▼                                                                              │
internetdb/*  ──(yeni IP)──► subs/ips.txt ◄───────────────── feedback ◄───────────┘
                                                                (web portları → live.txt)

live.txt ─┬─ whatweb/httpx ──► tech.json ──► viewstate/aspx.txt ──► Faz 8 (badsecrets → RCE)
          ├─ ffuf/dirsearch ──► fuzz/
          ├─ gau/wayback/katana ──► urls/all_urls.txt ─┬─ urinteresting ──► urls/interesting.txt
          │                                            └─ grep '=' ──────► urls/params.txt
          ├─ katana -jc ──► js/js_urls.txt ──► jsluice/trufflehog ──► js/js_secrets.txt
          └─ gowitness ──► screenshots/