CVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway. Learn More

CVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats
SpiderLabs Blog

AttackSurfaceMapper - Automate and Simplify the OSINT Process

[+] Introduction:

The standardized penetration testing framework as described by OWASP and MITRE consists of seven phases with each framework using similar terminology. The MITRE ATT&CK framework breaks down the attack simulation methodology to Recon, Weaponize, Deliver, Control, Execute and Maintain. In this article, our focus will lie on the Reconnaissance stage, the first and arguably most critical.

Image001

A diagram depicting the MITRE ATT&CK framework.

 

Reconnaissance is an integral part of the penetration testing methodology which is often neglected. In many cases, it was possible to gain foothold on the internal network by analyzing and exploiting the wealth of information acquired during reconnaissance rather than weaponizing complex vulnerabilities. The pre-engagement stage is usually split into active and passive processes. The active part includes all standard enumeration techniques where the latter refers to the collection of Open Source INTelligence (OSINT) techniques that rely on the information publicly available on the internet. Some of the most common OSINT techniques include querying APIs for related IPs, domains and subdomains to the target, using search engines to collect sensitive information exposed on the internet about a company, harvest employee email addresses from social networks etc.

 

[+] What is AttackSurfaceMapper?

AttackSurfaceMapper (ASM) aims to greatly simplify the reconnaissance process by taking a single target domain or a list of IPv4 addresses as input, then analyzing it using passive OSINT techniques and active reconnaissance methods. What this means is that security professionals are left with hard actionable data; new targets to scan, websites to attack, email addresses to phish and credentials to brute force and spray.

Image003

Figure 1.0 - Actionable output generated by AttackSurfaceMapper

 

A penetration tester has a limited amount of time to plan and orchestrate an engagement aiming to uncover all possible vulnerabilities and attack surface of an enterprise. In contrast, adversaries have unlimited time to methodically pinpoint a single weakness to exploit. The more time a pen tester spends on mundane preparation such as manually performing reconnaissance, the less time they will have on the actual test.  

AttackSurfaceMapper greatly softens the burden by executing all the repetitive processes and generating a list of files that can be then imported in other tools to perform further enumeration, scanning and exploitation.

Image005

Figure 2.0 – AttackSurfaceMapper logo

 

The tool was developed using Python 3.x which allows compatibility with all major operating systems. By using a list of free and premium APIs AtackSurfaceMapper aims to automate the reconnaissance phase and combine functionality from different tools. In order to present only valid and accurate data the tool groups the IPv4 addresses by primary domain and presents the information in a user-friendly and meaningful way.

Two of the most powerful features of ASM supports are the “Expand” and “Stealth” modes. When the “Expand” mode is enabled the tool attempts to aggressively identify additional IP address ranges and subdomains related to the target. On the other hand, the “stealth” functionality, as the name suggests, does not generate any traffic to the target allowing the tester to collect data about the target without triggering any alerts.

Image007

Figure 3.0 - A screenshot showing all ASM modules

 

The tool’s execution flow is broken down to 3 different stages.

  1. Reconnaissance:
  • Find IPs from associated ASNs and IPv4 prefixes.
  • Passively discover Subdomains
  • Brute Force Subdomains
  • Port Scanning
  • Hostname Discovery
  • Passive & Active DNS Record capturing
  • Collect WHOIS records
  • Take screenshots of web portals

 

  1. Intel Extraction:
  • Scrap LinkedIn Employee Names & Email addresses
  • Check for credentials in Public Data Breaches
  • Download Interesting Files (e.g. PDF and XML)
  • Find AWS buckets

 

  1. Presentation:
  • Present useful information on the terminal.
  • Export gathered information in HTML, CSV and TXT files.

Image009

Figure 4.0 – A snippet from the output generated by ASM.

 

While the tool's modules are running, the attack surface will further expand as it discovers new subdomains, related ASNs and IPv4 addresses. It performs a recursive analysis and expansion of the IPv4 prefixes so that if new targets are found, it will feed them back and perform the full OSINT analysis cycle on them.

Lastly, it should be noted that the tool was designed with a modular architecture in mind. Each discrete module executes independently and returns data back to main data structure. Along with the flexibility of having output in the terminal CSV and text file formats. AttackSurfaceMapper will be the first tool of choice for mapping and evaluating a large corporate external network.

 

[+] Conclusion

Successfully scanning and footprinting the attack surface can assist red teamers and pen testers in crafting precise attacks and can help blue teams identify weak spots or areas of improvement. It is also a practical way for enterprises to assess and quantify the amount of public information available on the internet.

There are several great tools available for performing specific testing tasks well, however, there is not a single framework where you can set as targets multiple IPs and domains and leave it running for automatic discovery. ASM has been released to fill that gap and assist security professionals to complete the reconnaissance process much quicker, more efficiently and more accurately. It gathers and processes a trove of information about exposed assets which is already available to malicious actors in an effort to discover the “true” attack surface and level the playing field. By providing a level of automation AttackSurfaceMapper is an open-source solution for the security community in evaluating the exposure of infrastructure on the internet and take drastic measures to strengthen it.

This means that you can plug in a target, make a cup of tea and come back later to collect:

  • Email Addresses & Usernames
  • Public Data Breach Credentials & Hashes
  • Employees’ Social Network Presences
  • Subdomains
  • Associated ASNs and IP Addresses
  • Open Ports & Possible Vulnerabilities
  • Visual DNS map of the attack surface
  • Web Screenshots

As mentioned above, the tool’s modular design allows the integration of additional functionality and support for more third-party APIs in the future. The next version of ASM will include new features such as graphical HTML report generation support for IPv6 targets and multi-threading to boost the efficiency. Once publicly released, it is expected that the security community will embrace this initiative and contribute to further develop and improve its capabilities.

To download AttackSurfaceMapper from GitHub visit: https://github.com/superhedgy/AttackSurfaceMapper

AttackSurfaceMapper will also be presented on the 7th of August at Black Hat Arsenal USA in Las Vegas and on the 11th of at DEFCON 27 - Recon Village [https://www.blackhat.com/us-19/arsenal/schedule/index.html#attack-surface-mapper-automate-and-simplify-the-osint-process-16713].

Latest SpiderLabs Blogs

The Secret Cipher: Modern Data Loss Prevention Solutions

This is Part 7 in my ongoing project to cover 30 cybersecurity topics in 30 weekly blog posts. The full series can be found here. Far too many organizations place Data Loss Prevention (DLP) and Data...

Read More

CVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway

Overview A command injection vulnerability has been discovered in the GlobalProtect feature within Palo Alto Networks PAN-OS software for specific versions that have distinct feature configurations...

Read More

CNAPP, CSPM, CIEM, CWPP – Oh My!

We all know the cybersecurity industry loves its acronyms, but just because this fact is widely known doesn’t mean everyone knows the story behind the alphabet soup groups of letters, we must deal...

Read More