intrigueio / intrigue-core

Discover Your Attack Surface!
https://core.intrigue.io
Other
1.35k stars 262 forks source link

Task to brute services with user-controlled dns names (dns_brute_shared_tenant_names) #409

Closed jcran closed 3 years ago

jcran commented 3 years ago

Laying groundwork for a new vein of host / service discovery. Currently focused on only a single service (Acquia), it should be relatively simple to add new services into this, provided that a DNS resolution indicates that an endpoint exists (and that lack of resolution, the converse).

Example: image

Other services to explore:

Note that some of these will likely require a more sophisticated detection mechanism, such as an http page grab & content check. We'll cross that bridge later.

Also note that this shares a lot of code with dns_permute right now (and includes a couple bugfixes). It'd be good to DRY this up.