[+] Introduction:
The standardized penetration testing framework as described by OWASP and MITRE consists of seven phases with each framework using similar terminology. The MITRE ATT&CK framework breaks down the attack simulation methodology to Recon, Weaponize, Deliver, Control, Execute and Maintain. In this article, our focus will lie on the Reconnaissance stage, the first and arguably most critical.
A diagram depicting the MITRE ATT&CK framework.
Reconnaissance is an integral part of the penetration testing methodology which is often neglected. In many cases, it was possible to gain foothold on the internal network by analyzing and exploiting the wealth of information acquired during reconnaissance rather than weaponizing complex vulnerabilities. The pre-engagement stage is usually split into active and passive processes. The active part includes all standard enumeration techniques where the latter refers to the collection of Open Source INTelligence (OSINT) techniques that rely on the information publicly available on the internet. Some of the most common OSINT techniques include querying APIs for related IPs, domains and subdomains to the target, using search engines to collect sensitive information exposed on the internet about a company, harvest employee email addresses from social networks etc.
[+] What is AttackSurfaceMapper?
AttackSurfaceMapper (ASM) aims to greatly simplify the reconnaissance process by taking a single target domain or a list of IPv4 addresses as input, then analyzing it using passive OSINT techniques and active reconnaissance methods. What this means is that security professionals are left with hard actionable data; new targets to scan, websites to attack, email addresses to phish and credentials to brute force and spray.
Figure 1.0 - Actionable output generated by AttackSurfaceMapper
A penetration tester has a limited amount of time to plan and orchestrate an engagement aiming to uncover all possible vulnerabilities and attack surface of an enterprise. In contrast, adversaries have unlimited time to methodically pinpoint a single weakness to exploit. The more time a pen tester spends on mundane preparation such as manually performing reconnaissance, the less time they will have on the actual test.
AttackSurfaceMapper greatly softens the burden by executing all the repetitive processes and generating a list of files that can be then imported in other tools to perform further enumeration, scanning and exploitation.
Figure 2.0 – AttackSurfaceMapper logo
The tool was developed using Python 3.x which allows compatibility with all major operating systems. By using a list of free and premium APIs AtackSurfaceMapper aims to automate the reconnaissance phase and combine functionality from different tools. In order to present only valid and accurate data the tool groups the IPv4 addresses by primary domain and presents the information in a user-friendly and meaningful way.
Two of the most powerful features of ASM supports are the “Expand” and “Stealth” modes. When the “Expand” mode is enabled the tool attempts to aggressively identify additional IP address ranges and subdomains related to the target. On the other hand, the “stealth” functionality, as the name suggests, does not generate any traffic to the target allowing the tester to collect data about the target without triggering any alerts.
Figure 3.0 - A screenshot showing all ASM modules
The tool’s execution flow is broken down to 3 different stages.
- Reconnaissance:
- Find IPs from associated ASNs and IPv4 prefixes.
- Passively discover Subdomains
- Brute Force Subdomains
- Port Scanning
- Hostname Discovery
- Passive & Active DNS Record capturing
- Collect WHOIS records
- Take screenshots of web portals
- Intel Extraction:
- Scrap LinkedIn Employee Names & Email addresses
- Check for credentials in Public Data Breaches
- Download Interesting Files (e.g. PDF and XML)
- Find AWS buckets
- Presentation:
- Present useful information on the terminal.
- Export gathered information in HTML, CSV and TXT files.
Figure 4.0 – A snippet from the output generated by ASM.
While the tool's modules are running, the attack surface will further expand as it discovers new subdomains, related ASNs and IPv4 addresses. It performs a recursive analysis and expansion of the IPv4 prefixes so that if new targets are found, it will feed them back and perform the full OSINT analysis cycle on them.
Lastly, it should be noted that the tool was designed with a modular architecture in mind. Each discrete module executes independently and returns data back to main data structure. Along with the flexibility of having output in the terminal CSV and text file formats. AttackSurfaceMapper will be the first tool of choice for mapping and evaluating a large corporate external network.
[+] Conclusion
Successfully scanning and footprinting the attack surface can assist red teamers and pen testers in crafting precise attacks and can help blue teams identify weak spots or areas of improvement. It is also a practical way for enterprises to assess and quantify the amount of public information available on the internet.
There are several great tools available for performing specific testing tasks well, however, there is not a single framework where you can set as targets multiple IPs and domains and leave it running for automatic discovery. ASM has been released to fill that gap and assist security professionals to complete the reconnaissance process much quicker, more efficiently and more accurately. It gathers and processes a trove of information about exposed assets which is already available to malicious actors in an effort to discover the “true” attack surface and level the playing field. By providing a level of automation AttackSurfaceMapper is an open-source solution for the security community in evaluating the exposure of infrastructure on the internet and take drastic measures to strengthen it.
This means that you can plug in a target, make a cup of tea and come back later to collect:
- Email Addresses & Usernames
- Public Data Breach Credentials & Hashes
- Employees’ Social Network Presences
- Subdomains
- Associated ASNs and IP Addresses
- Open Ports & Possible Vulnerabilities
- Visual DNS map of the attack surface
- Web Screenshots
As mentioned above, the tool’s modular design allows the integration of additional functionality and support for more third-party APIs in the future. The next version of ASM will include new features such as graphical HTML report generation support for IPv6 targets and multi-threading to boost the efficiency. Once publicly released, it is expected that the security community will embrace this initiative and contribute to further develop and improve its capabilities.
To download AttackSurfaceMapper from GitHub visit: https://github.com/superhedgy/AttackSurfaceMapper
AttackSurfaceMapper will also be presented on the 7th of August at Black Hat Arsenal USA in Las Vegas and on the 11th of at DEFCON 27 - Recon Village [https://www.blackhat.com/us-19/arsenal/schedule/index.html#attack-surface-mapper-automate-and-simplify-the-osint-process-16713].
