Please enable JavaScript.

Coggle requires JavaScript to display documents.

SAN 560.1 - Coggle Diagram

- - - - Tools
        
        :fountain_pen: The Dig command (for DNS research, including zone transfer)
        :fountain_pen: DNSRecon (Enum standard DNS records, reverse IP address lookup, zone transfers, DNSSEC zone walks, cache snooping)
        :fountain_pen: DNSDumpster (provide a lists of DNS A records for a given domain)
        :fountain_pen: Shodan (scan port without accessing the target, SSL certification, IP address Geolocation)
        :fountain_pen: BuiltWith (complies lists of technologies used in web server and software framework for target web services)
        :fountain_pen: Google Search Engines (finds vulnerable systems)
        :fountain_pen: Google Hacking Database or Google Dork (finds vulnerable systems)
        :fountain_pen: WHOIS Databases (Query the registries for IP ranges to find additional targets)
        :black_medium_small_square: Regional Internet Registries (RIRs) offer Whois databases
        :black_small_square: The American Registry for Internet Numbers (ARIN) :arrow_right: North America, US, Canada, certain Caribbean islands
        :black_small_square: The Reseaux IP Europeens Network Coordinate Centre (RIPE NCC) :arrow_right: Europe, the Middle East, parts of Central Asia
        :black_small_square: The Asia Pacific Network Information Centre (APNIC) :arrow_right: Asia-Pacific region
        :black_small_square: The Latin America and Caribbean Internet Address Registry (LACNIC) :arrow_right: Latin America, most of the Caribbean
        :black_small_square: AfriNIC :arrow_right: continent of Africa
      - :sparkling_heart:: IP Addresses and Subnet Ranges
        :sparkling_heart: Hostnames and login page
        :sparkling_heart: Software and Hardware
        :sparkling_heart:: DNS Records
    - - :<3: Goals
        :<3: Mergers and Acquisitions
        :<3: Projects and Products
        :<3: Recent News
    - - Tools
        
        :fountain_pen: Hunter.io (performs OSINT scans and compiles lists of organizational data)
        :fountain_pen: Phonebook.cz (lists all domains, email address, URLs for the given input domain)
        :fountain_pen: Public Breach Data of Credentials
        :fountain_pen: LinkedInt (searching LinkedIn)
        :fountain_pen: GatherContacts (Burp Suite extension to search LinkedIn results from google and bing)
        :fountain_pen: SpiderFoot (Open-source automated OSINT tool to thorough scans available)
        :black_small_square: All
        :black_small_square: Footprint (search engine and web crawling)
        :black_small_square: Investigate (basic footprinting)
        :black_small_square: passive
        :black_medium_small_square: Metadata
        :fountain_pen: ExifTool (Reads, writes, change metadata)
        :fountain_pen: FOCA
        :fountain_pen: DIA-NZ
        :fountain_pen: The Strings Command (finding unstructured data or data with unknown structure)
        :black_small_square: Linux (ASCII strings only by default)
        :black_small_square: Windows (Both ASCII and Unicode strings by default)
        :fountain_pen: pwndb
      - :<3: Usernames
        :<3: Email addresses
        :<3: Breached Credentials
        :<3: Roles
        :<3: File system paths
        :<3: Client side software in use
- - - - Resource
        
        OWASP Testing Guide :star:
        MITRE ATT&CK :star:
      - Dates and Time of Day
      - Knowledge (Zero/Full)
      - Common Signed Paperwork
        
        Non-disclosure Agreement (NDA) :star:
        Master Service Agreement (MSA) :star:
        Intellectual Property (IP) :black_medium_small_square:
        Limitation of liability for damage :black_medium_small_square:
        Statement of Work (SOW) :star:
        Methodology :black_medium_small_square:
        Type of tests :black_medium_small_square:
        Scope :black_medium_small_square:
        Inclusions :black_small_square:
        (Domain Names, Network Address Ranges, Individual Hosts, Particular Appilcations)
        Exclusions :black_small_square:
        3rd Party :black_small_square:
        (Cloud Services, ISPs)
      - Law
        
        Tester Country :star:
        Target Country :star:
        Infrastructure Country :star:
        Packet traversal country :star:
      - Approval to Attack
      - Regulatory for Sensitive Data
        
        Health Insurance Portability and Accountability (HIPAA) :star:
        Gramm-Leach-Bliley (GLBA) in US :star:
        General Data Protection Regulation (GDPR) in EU :star:
      - Announced/Unannounced Test
    - - Important data/processes :star:
        Reason for testing :star:
    - - GPG/PGP (Secure Channel) :star:
        Contacts :star: