Skip to content

2. Reconnaissance

2.1 SGK (Leaked-Data Search) Sources

Communication tools: BreachForums / Potato / BatChat / Seagull / Shimida / TG (buy temporary accounts to farm SGK queries) / Signal / Discord / WhatsApp / Jabber / Session / Matrix / SimpleX

2.2 What to Look at Once You Have a Site

  • Build a wordlist with paramspider
  • Identify the site's tech stack
  • Analyze the URL structure

2.3 Open-Source Intelligence (OSINT)

GitHub keyword search: | Keyword | Use | |--------|------| | ldap | combine with a domain → internal-network asset info | | login | discover login endpoints | | small business project name | weak credentials / hardcoded secrets | | project association → info under the account | person attribution | | pinyin (abbreviation) | associate Chinese developers | | subdomains / internal domains | expand the asset scope | | com.xxx | associate enterprise domains | | Chinese | search domestic projects | | js/css/html/special filenames | match page fingerprints |

GitHub person association: star / fork / commit / follow

Asset platforms: | Platform | Characteristics | |------|------| | SecurityTrails | subdomains, global intelligence | | Censys | scans ports daily, highly timely (may miss some), pair with rustscan | | FOFA / Hunter | ico/title/body search; never log in from the live pentest VM | | Rapid7 DNS | query via a locally built ClickHouse | | ip138 IDC | IDC information lookup | | ASN | autonomous system number lookup |

Find source code via page fingerprints: JS/CSS/HTML fingerprints / API fingerprints / contact information

Other channels: Gitee / KanCloud / Yuque / HackMD / Shimo (site:yuque.com "xxx") / Sigma.world news / Google dorks (site:xxx.com -www -fare -css -parking) / DuckDuckGo / HackerOne / Zeroday(hitcon.org) / Twitter / Facebook / LinkedIn (employees → initial-password rules) / cloud drives (third-party) / Medium

CDN bypass: page fingerprints → real IP / historical DNS resolution → real IP / other business-related IP ranges → real IP

2.4 Supply Chain Reconnaissance

Supplier conferences (overseas enterprises) / tenders and bidding / page fingerprints (js/css/html) / API fingerprints / find source code via contact information

2.5 Attribution of Site-Building Companies in Practice

BC iGaming platform provider attribution: same CDN / same DNS / same datacenter / same page fingerprints to find test-site domain-IP associations with the provider / fuzzy-search domains by shared keyword fingerprints / match templates via customer support

Gang member attribution: historical posts linked to accounts / special IDs / SGK / file metadata / phishing