SecurityTrails Blog

Alongside the rise of public clouds, managing the infrastructure of private clouds has never been easier. Tools like Terraform are available, but increasing dependence on them means it's necessary to understand the security implications they present. After all, your entire infrastructure is dependent on, and accessible through, such a configuration—it's essentially infrastructure as code, or "IAC", passed through a tool like Terraform.

IAC has effectively become the go-to for most modern infrastructure, given the scale and complexities involved in managing everything manually.

For users already using IAC-based setups, we'll look into how one can assess and manage the various security risks present in IAC-powered setups and examine the various tools available for reducing attack surface. For users looking into setting up or switching to IAC-based setups, we'll look at the various advantages of IACs as well.

What is infrastructure as code (IAC)?

Infrastructure as code is, as its name suggests, a modern way of managing infrastructure in the form of formatted code or simply defined templates which are system readable. These allow for rapid scaling up and down of infrastructure. IAC applies to commonly used cloud infrastructure as well as any other infrastructure that goes along with it, for example, bare-metal systems.

IACs allow for easier management, understanding and monitoring of the infrastructure in place, as IACs combine everything into one infrastructure template.

IAC definitions or templates are fed into tools like Terraform, Ansible or Saltstack. These tools parse the templates written to manage the infrastructure as defined in the templates.

Benefits of IAC

IAC provides multiple benefits to DevOps teams, with advantages seen from development to deployment that include the following:

Automation

IAC allows Devops teams to skip all of the manual work involved in the setting up or scaling upf of infrastructure in use. Automating setup of all the parts of the infrastructure in use can save hours—and in many cases, days—when considering the major deployments found in numerous large organizations.

Financial savings

Cost savings are possible when using IACs. With infrastructure as code, infrastructure deployments are known well in advance and tested over time, allowing for streamlining and cleaning up. With manual deployments, bits of infrastructure are often found to be in excess or even missing, leading to last-minute delays and unnecessary expense. IAC templates show that every single element of the infrastructure to be deployed is present and accounted for, allowing for better understanding.

Replication of infrastructure

Tried and tested IAC templates allow for replication of infrastructure from development and testing environments into production environments. This saves time, as templates can be re-used when setting up new production environments as applications are shipped to customers. With the entire infrastructure defined in code, it's possible to amend or remove bits of infrastructure as needed, depending on customer requirement. This also allows for easier customer infrastructure documentation between support and DevOps teams as well.

Easier documentation and understanding

IAC allows for easier understanding of the infrastructure in place. Having all of the infrastructure defined in a file, or set of files, makes it possible to keep track of everything in use. This prevents teams from forgetting any part of their infrastructure when dealing with system updates, patches, and the like, better ensuring overall security.

Infrastructure as code security risks

With all the benefits that IAC carries, there are risks as well. As the whole of your infrastructure defined in a file or set of files, let's examine the following considerations:

Credential management risks

The storing of passwords and other access information (such as SSH keys) is a major security point to keep in mind. T...

A report from 2016 predicted that 30% of all data breaches by 2020 will be the result of shadow IT resources: systems, devices, software, apps and services that aren't approved, and in use without the organization's security team's knowledge. But shadow IT isn't the only area where security and IT teams face issues with tracking and visibility.

Servers, IoT devices, old VPSs, forgotten environments, misconfigured services and unknown exposed assets can all be entry points which attackers can easily exploit to carry out cyber attacks. Furthermore, there are other internet-facing assets that security teams struggle with, visibility-wise: domains, subdomains, open ports, SSL certificates, open databases, etc. And you can't secure what you can't see.

All of the assets mentioned are what we consider an organization's digital attack surface. You can think of each as a possible attack vector cyber criminals can use to penetrate your network or system to gain a hold of your sensitive data. With that in mind we can see how not having visibility into those assets can be detrimental to organizations' security posture, raising their susceptibility to cyber attacks and data breaches.

To stay protected and be proactive with their cybersecurity, organizations are adopting attack surface management procedures and tools that provide them with an accurate inventory of all of their assets while continuously assessing their attack surface for potential risks.

What is attack surface management?

At Securitytrails we see and define the attack surface as the entire network and software environment that is exposed to attacks, as well as all the ways your assets can be exploited.

An organization's attack surface will include the unknown assets we mentioned above, shadow IT, forgotten dev and staging environments, forgotten IT infrastructure, along with known assets such as the operating system, network services, servers, domains and subdomains, SSL certificates and rogue assets like typosquatted domains. It doesn't stop there, however, as an organization's attack surface will also include third-party vendors and any risks they carry; small vendors can lead to large data breaches if lacking proper security posture.

**Attack surface management**, or ASM, is a highly effective cybersecurity methodology that refers to continuous identification, inventory, classification, monitoring and prioritization of digital assets that contain or transmit sensitive data. While often called "attack surface monitoring" or "attack surface discovery" it in fact covers aspects of both, and more. Attack surface management allows organizations to identify their attack surface components, locate their attack vectors and exposures, and learn how to use that knowledge to protect against future attacks.

With the ability to provide real-time visibility into the full attack surface, evaluate risks, and comply with data protection regulations, and with continuous monitoring allowing for efficient remediation in case of threat, attack surface management can be seen as the meeting point of risk management, asset management and discovery, vulnerability management and compliance.

Why is attack surface management important?

Reducing an organization's attack surface is important, we can all agree to that. But with all the practical tips attributed to attack surface reduction, such as reducing the code you're running, removing unnecessary software and services, performing regular network scans and the like, attack surface management still stands as one of the best ways of not only managing attack surface reduction but also providing many other valuable benefits to an organization's security posture.

Let's go over some of the key benefits of attack surface management:

Risk reduction

One of the most important, if not the most important, benefits of attack surface management is its ability to reduce cybersecurity risks that can stem from shadow IT, human error suc...

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

The literature on defensive security unanimously recognizes one fact: every so often, a tool comes out that provides blue teamers with an important advantage over their adversaries. This ever-elusive quest features essential requirements and commonalities, such as the ability to proactively seek and detect malicious hosts, or the capacity to swiftly respond to targeted network threats. And with a sharp rise in the number of incidents involving some form of malware or command and control (C2) activity resulting in data theft, vendors are in a tight race to gain their customers' trust—by leveraging newer alternatives to legacy solutions amidst shrinking budgets.

In the spirit of searching and identifying malicious servers anywhere they can be found, the folks at Salesforce Engineering have recently released an open-source application called Jarm, which pivots on knowledge of Transport Layer Security (TLS) mechanisms to accomplish just that. This blog post will take you on a brief tour of Jarm to show you why we consider it a worthy addition to your Osint tools.

TLS and Jarm

TLS is the next evolutionary step from its early SSL (Secure Sockets Layer) ancestor. As its predecessor, the TLS assembly introduces its own version of a handshake process (Figure 1) by which cryptographic primitives, also known as cipher suites, are agreed to between client and server prior to any data exchange. It is precisely this cryptographic agility that gives TLS its multifaceted quality; covering a wide range of applications (e.g., web traffic) and providing critical services such as confidentiality and integrity.

To understand how Jarm leverages certain TLS attributes, let's take a closer look at the protocol's initial connection sequence. Immediately following the TCP handshake, the client side sends a *ClientHello* message containing combinations of cryptographic algorithms supported (and preferred) by the caller, versioning details, extensions, a list of compression methods, and other session parameters in blocks of application data.

In response, the server sends its own *ServerHello* message when a satisfactory set of algorithms has been confirmed—the packet is also formulated with the server's own version of the connection parameters used by the client. Subsequently, server and client proceed to verify each other's authenticity via digital certificates, after which both parties compute the premaster and master secrets used to derive session keys, any wrapper messages, and the remaining traffic tunneling structures.

The TLS parameters offered in the *ClientHello* message contain several identifying properties that are directly related to the client application. These features include OS builds, packages, libraries, and even process attributions. This level of granularity is particularly helpful in building **fingerprints** with a high degree of accuracy that can be leveraged to identify the same application during future sessions. Similarly, TLS servers construct their *ServerHello* packets based on the *ClientHello* ones as well as their own subset of built-in identifiers such as:

Operating system name and version.

Server-side libraries.

Other custom configurations.

Once again, this symbiotic relationship between client and server *Hello* packets dictates the way in which servers uniquely respond to a specific application, providing an excellent opportunity for quick identification via fingerprinting.

And this is where Jarm comes in.

What is Jarm?

As previously mentioned, Jarm is a **TLS server fingerprinting application** recently released as an open source project by the engineering group at Salesforce. The tool shares some similarities with a previous method of profiling TLS clients using JA3 signatures, released by the same team, which passively examines network traffic collecting fingerprints fro...

The year is almost over, can you believe it? And 2020 has been one heck of a year. With so many ups and downs, we can all agree to breathing a sigh of relief once its end was in sight. Yet however the year treated us, we’d like to acknowledge many good moments and memories made.

As the holidays approach, let’s take a few moments to reminisce about all of 2020’s highlights for the Securitytrails team. We expanded our crew, had fun releasing numerous product updates and features, and worked hard on our blog to deliver the best infosec content out there.

For a closer look, here’s what the Securitytrails team was up to during 2020:

Expanding the Securitytrails team

The coronavirus pandemic has brought about a lot of uncertainty and pushed the world into adopting new ways of living, both personally and professionally. Companies and individuals alike, on so many levels, have had to adjust to the norms of social distancing and working remotely.

Securitytrails has been a remote-first company since the very beginning, in 2017. Our diverse and talented remote team has the freedom to work from any location in the world and enjoys the benefits of working remotely, being present for their personal lives and focusing on their growth outside of the “workplace”.

While we weren’t able to go on team retreats in 2020, we always encourage our team members to grow, connect and collaborate with each other through our monthly company-wide gatherings, team-specific meetings, soft- and hard-skill courses, internal projects, competitions, and more.

And now that 2020 marks the third year of our fully remote team with many lessons learned, we have continued to hire new talent from all over the world.

We’ve grown from a seven-member team in our first year to a 35-member team, with individuals from all over the world: the USA, Uruguay, Germany, Serbia, Poland, Finland, Ukraine, Philippines, South Africa and Argentina. Our team saw many changes, and the end of 2020 counts eight more Securitytrails team members than we had at the end of 2019.

And if you're interested in joining our diverse team, take a look at our updated Careers page. That's where you can find out more about Securitytrails culture as well as any positions we have available.

Product launches and updates

Who's been here since 2017? These Securitytrails website before-and-after photos speak volumes about how much we’ve changed and improved since the first version of our product. In mid-2020, we moved on from our recognizable yellow-and-black look and changed our branding and visual identity significantly.

We've continued working on sometimes small, sometimes sizable, but always incremental changes to our website and products.

We're always listening to valuable feedback from our users and customers and that is how we've managed to become the world's largest repository of historical DNS data. We believe that if we want to remain the trusted resource for industry leaders that we are, transparency about our data and what we do with it is crucial. To that end, you can look to our regularly updated Changelog, where we note everything our engineering team brings forth.

Throughout 2020, our engineering and product teams worked relentlessly on bringing monthly improvements, updates and fixes to the console, Securitytrails API, Surfacebrowser, Securitytrails Feeds and Attack Surface Reduction.

Securitytrails API

Our fast and always up-to-date Securitytrails API allows security companies, researchers and teams access to current and historical data. In order to continue to empower companies and researchers with the most current DNS, IP and domain intel available, we continuously work on improving and innovating with our cybersecurity API.

For the Securitytrails API, new endpoints were added throughout the year:

SSL.

User agent.

IP Whois.

Company details endpoints.

Also introduced were the firehose endpoint that streams Certificate Transparency log entries we ...

Note: The audio version doesn't include code or domain names. Those parts of the post can be seen in the text version.

Recently, the Department of Justice made two public announcements about shutting down fake news websites created by Iran's Islamic Revolutionary Guard Corps (IRGC). In the first instance, 92 domains were seized in August 2020. And according to the second announcement, 27 more domains were seized as part of the same effort to spread global disinformation.

That prompted us to take a look—to see what we can discover using Osint, our powerful and versatile tool Surfacebrowser, and archive.org for further analysis.

The geopolitical issues surrounding such an investigation are not lost on us, but this data is already public (Osint). It's only a matter of finding out what it tells us.

Some of the data we'll examine includes:

Whois (including history).

DNS (current + historical).

Subdomains with their associated hosts, open ports and more.

The DoJ and the domains

While we admire the DoJ investigators for finding these deceptive domains, what we didn't like is their first press release. The release said that a list of the 92 domains was available 'here', but was actually nowhere to be found on their website. This left us with only eight seized domains to look at (four in August and four in November).

August seized domains:

November seized domains:

First analysis of the data

The four domains from August were not that helpful, with limited quantities of extra data found. For example, newsstand7 dot com was protected behind Whois privacy and its DNS was protected behind NameCheap and CloudFlare at any given time.

Usjournal dot net, US gave us a bit more information. Combining the earliest archive.org timestamp and Whois data, we found the following (fake) registrant:

The historical Whois data points to a "Brendan Walsh", but we found no connection between this name (and other domains registered to it) and other fake news websites.

We encountered the same problems for twtoday dot net as we did for newsstand7 dot com, without much to go on in terms of Whois, DNS history or any other data.

We nearly abandoned this investigation—until we began looking at the data from the November takedowns.

Second analysis – November data

The domain rpfront dot com provided us with the first insight into how deep and complicated the setup has to be to keep investigators from quickly uncovering domains of misinformation. The historical Whois data shows that this fake domain was hiding behind a liberal, progressive type of setup, with Whois details pointing to the USA.

We looked at the site from 2017 on the Wayback Machine, and confirming our suspicions, the site was mostly politically-driven. What stood out for us was the anti-Saudi, UAE rhetoric on this captured page. A bit unusual for a site, group that seemed geared towards the progressive, liberal political situation in the U.S.

A Whois lookup also led to our discovery that rpfront.us was another registered domain.

The current Whois shifted from "realprogressive front" to a user registered in China:

We explored the associated Whois name and Whois organization, but didn't spot any obvious misinformation domains. A few domains related to "zhang zi yong" did look similar to spam domains we've tracked in the past, like sjhfxh dot com

It is possible that rpfront dot com was dropped after July 2020 and taken up by "zhang zi yong", as the DNS history shows mostly US, EU companies until August 2020, when it was changed to "DXTL Tseung Kwan O Service".

The domain A H tribune dot com offers a lot of valuable data to extract from the Osint. The historical Whois showed the following:

And the historical Whois for the domain showed this:

As a side note, the registrar "Realtime Register BV" has a lot of unusual domains in its own records. Out of 37K registrations, we found a lot of domains that looked like they were registered to Iranian users. Al...

Global connectivity benefits our world in numerous ways, however, that same connectivity also poses a potential cyberthreat that is often overlooked. There is no easy solution for combating the rising threats in our hyperconnected world. Now more than ever, cybersecurity is imperative for both businesses, governments and educational institutions, and individuals and families. For cybersecurity to effectively slow down the rising cyber threats and attacks, everyone needs to be part of the solution.

Oftentimes, the responsibility of managing cyber risks and threats is put on the individual. But we can't put all responsibility on the user. And while yes, human error remains the unfortunate reason behind many security breaches, passing the blame onto individuals who are often the victims of a cyber attack, is not solving the issue.

So what can we do? Make cybersecurity accessible to everyone.

To help us understand how an easily accessible proactive approach to cybersecurity can combat cyber threats and attacks, we spoke with Scott Helme, a security researcher, entrepreneur, and international speaker. Besides donning many hats throughout his career, Scott also freely shares his knowledge and expertise with many communities - the security community, the legal community, and the general public.

We (virtually) visited Scott in Clitheroe, a small town in England, where he showed us his dream car that he is modifying, BMW M140i, and we chatted about the challenges of making cybersecurity easier for everyone, even those not technically inclined, his numerous projects — Report URI, SecurityHeaders, Crawler.Ninja, and heard his insights on a topic he is very passionate about — encrypting the entire Internet.

**You wear many hats - security researcher, infosec consultant, entrepreneur and international speaker. When did your interest in cybersecurity arise?**

I've been interested in technology since I was a little boy, always tinkering with things and learning new stuff. I studied IT focused topics throughout school and college and learned software engineering at university. After my education, I spent many years working support and QA jobs where your role is to break things and report your findings. Through my own curiosity, I started looking at ways to break systems from a security perspective and not just a functional perspective. It was then that the field really caught my attention.

Once I started exploring security, reading blogs, and watching videos online, I was hooked. I spent years studying the field and doing security research of my own and in 2014 I found a large security flaw in a home router provided by my ISP. The process of reporting the issue gained national and international press coverage, which eventually led to me being offered a job as a penetration tester and moving into the field professionally. Since then, I've started offering training, founded security companies, spoken at international conferences, and even done a keynote on encryption for the NCSC here in the UK.

**Cybersecurity is intended for everyone, but making it more approachable to the general public and those non-technical is often a roadblock to the adoption of good practices. Why do you think we still have barriers to making cybersecurity easier for everyone?**

For years we've said, "the user should..." The user should look for the padlock, the user should use a strong password, the user should do this or that. Making security the responsibility of the user was our downfall. The user is always going to be the most unreliable part of any system. That's not a criticism of the user, we're all human and unreliable. The core issue is security is hard. Rather than trying to solve it at a technology level, which is hard for us technology folk, we pushed it onto the users.

Then it's easier to blame them when things go wrong. Security is getting easier as time goes by though. We are seeing a widespread use of biometrics on phones, which i...

Not all data breaches are created equal.

While many remain the product of technical prowess so often associated with malicious actors, a burgeoning amount can be attributed to security misconfigurations and overly-permissive entitlements plaguing cloud ecosystems around the globe. Close to 70 percent in fact, according to a survey conducted by Ermetic, an identity and data protection firm.

Furthermore, with the exponential expansion of cloud-native applications and similar undertakings, many organizations often rush to deployment overlooking critical security cross checks that expose a greater attack surface than most stakeholders are willing to admit. These largely unforeseen areas can quickly become the Achilles' heel of any security program as traditional endpoint protection solutions and other security measures remain largely impervious to their presence.

In this blog post, we will explore five of the most common (and likely most damaging) misconfiguration errors associated with popular services featured by Amazon's AWS cloud offering. For this purpose, we examine them in light of what AWS considers best practices surrounding the proper use of these technologies, showcased by a handful of breach reports that attest to their undisciplined provision.

Misunderstanding the shared responsibility model

AWS's shared responsibility model is the foundational agreement between the cloud service provider and its customers that defines the distribution of responsibilities associated with security and compliance.

Following this model, customers are relieved of the operational burden of maintaining and securing the controls and components below the operating system and virtualization layers, diminishing the possibility of a security breach due to potential hardware vulnerabilities. This is commonly referred to as Security **of** the Cloud, in stark contrast to Security in the Cloud, which establishes that customers are ultimately responsible for additional services such as application software and any related security group firewalls.

In addition, AWS has further divided the model into three distinct categories:

Infrastructure services.

Container services.

Abstract services.

Unfortunately, adhering to any one of these categories is no easy task. According to Cloud Security Alliance, the "trick" is to understand where your service provider's responsibilities end and where yours begin. Failure to properly identify these subtleties is certainly a recipe for disaster; one that can severely impact IT operations and even put your entire enterprise at risk.

Take for example *container services*, a category that shifts focus away from infrastructure as a service (IaaS) towards platform as a service (PaaS), moving the responsibility model in the direction of the service provider and partially adding to their bucket important considerations (should a data breach ever occur) such as incident response and cyber forensics. As part of the tradeoff, however, the customer is still responsible for access management using the control plane to secure any related applications, data, and user activity.

In addition to the direct connection between AWS and customers, the shared responsibility model may need to account for differences within a specific organization—particularly those involving third-party vendors and similar entities with access to develop, manage or secure aspects of the cloud environment. All this added complexity leaves ample room for ambiguity, but at the same time, it provides an opportunity to highlight potential areas of the business in desperate need of gap analysis.

Without further ado, here are the top 5 misconfigurations.

1. To encrypt or not to encrypt

Encryption is paramount to confidentiality and integrity; two of the most important tenets of adequate data protection, whether in-transit or at-rest. Everyone in this industry knows that—or *should*. Yet many organizations fail to realize the impor...

Along with the growing impact of digitalization on organizations of every size and industry, their increasing reliance on computer systems and networks and the expanding attack surface, the risk of cyber crime is reaching new heights every day. That's why now, more than ever, organizations need to protect themselves and their customers.

We often say that it's not a matter of if you'll experience a security breac, but when. Security technologies, practices and methods all help to mitigate the risk of cyber crime, but it's never possible to be 100% secure. That's because the nature of cyber crime is always evolving with new methods and techniques that develop as quickly as new technologies emerge. So despite the availability of advanced preventative measures, cyber crime can still cost an organization plenty in financial, organizational and reputational losses.

This is why organizations should brace themselves and prepare for the inevitable. One way to do that is through **cyber crime insurance**. But before we dive in, let's review what actually constitutes cyber crime.

Crime in the cyber realm

Cyber crime is crime committed online, whether on the Internet, on networks or on computers. It can happen on any digital device, including PCs, laptops, smartphones, tablets, IoT devices, truly any connected device. It also refers to any crime that is executed using a computer system.

While monetary gain can be seen as the biggest motivator behind cyber crime, cybercriminals are also driven by information; after all, information is power in this day and age. And when we speak of lower-scale attacks, another motivator can simply be to prove they can, for bragging rights.

cyber crime can be divided into three major categories: individual, property and government. Depending on the category, the methods, techniques and skills needed to execute the attacks can vary.

Individual cyber crime involves attacks on individuals, which include cyberstalking, credit card fraud, identity theft, online slander and trafficking.

Property cyber crime is similar to real-life crime that involves the possession of an individual's property; in this case it would be against a computer or server. This type of cyber crime includes DDoS attacks, typosquatting, copyright infringement, malware infection, and the like.

Government cyber crime, as its name implies, is committed against a government and is an attack on that nation's sovereignty. This is often seen with cases of cyber espionage, cyber terrorism, the accessing of highly confidential information, etc.

We do have a blog post that's fully dedicated to different types of cyber crime, but for the sake of clarity and scope, let's go over a few of the more common ones. The most common types of cyber crime are social engineering, manipulating people to get them to divulge sensitive information, cyberstalking, a form of cyberbullying that involves cybercriminals harassing or threatening other individuals over the Internet, identity theft where cybercriminals steal an individual's identity to commit fraud, online scams offering fake goods and services, among many others.

For more detailed information, we highly recommend you check out the full post.

Clearly, the scope of cyber crime runs far and wide, presenting different risks that organizations must face. What, then, can they do to prepare for a worst-case scenario?

What is cyber crime insurance?

Commercial general liability insurance is used by organizations to protect against potential losses such as property damage, theft, worker's injury, natural disasters and other misfortunes. However, this form of general insurance doesn't cover cyber crime risk, as it is focused on tangible assets and the concept of cyber crime itself is relatively new. Still, products that cover cyber crime are out there, and are specialized to help organizations lessen the risk of being adversely affected.

**Cyber insurance** is a line of insurance produ...

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

When it comes to the efficacy and proper functioning of any modern distributed network such as the Internet, few technologies seldom rise to the level of pivotal as dns does.

The Domain Name System (dns) accounts for the de-centralization of both publicly and non-publicly known hosts, structured in a hierarchical fashion, that are ultimately responsible for translating friendly domain names into their machine address counterparts, properly directing trillions of web requests to their ultimate destination.

This amount of interdependence makes dns an exclusive target of a host of information gathering practices that seek to extract every significant piece of information there is from an organization's network. For example, every penetration tester out there worth their salt can attest to the importance of conducting tasks such as dns enumeration—a technique capable of finding all related dns records from a given domain name.

dns is also beset with its own assortment of inherent weaknesses, such as the ability to share this internal domain information with basically anyone who asks, or the potential for cache poisoning where users can be redirected to any site chosen by an attacker.

This article will explore **dns-Recon**, one of the most recognized tools from a handful of dns information gathering software currently available as part of the Kali Linux distribution. Let's dive right in!

What is dns-Recon?

dns-Recon, as it is known today, is the Python equivalent of a Ruby script originally written by Carlos Perez toward the end of 2006. In his own words, this tool largely emerged from his personal need to reflect dns-related data collection in an intuitive manner while the Python version allowed him to practice his newly acquired skills with the programming language.

dns-Recon can perform a variety of functions ranging from security assessments to basic network troubleshooting by allowing users to:

Check dns server cache records for A, AAAA and C-name records given a list of host records in a text file.

Enumerate general dns records for a given domain (MX, SOA, NS, A, AAAA, SPF and TXT).

Check all NS records for zone transfers.

Check for wildcard resolution.

Perform common SRV record enumeration and top-level domain (TLD) expansion.

Check brute force subdomain and host A and AAAA records given a domain and a wordlist.

Perform a PTR record lookup for a given IP range or CIDR.

Perform subdomain and host enumeration via Google Dorks.

Present findings in text file format for easy manipulation.

Installing dns-Recon

**Ubuntu Linux (Github-based) installation**

Whether you are installing dns-Recon using a specific Linux distribution's package manager or simply from its source repository, **Python 3.6+** will be required.

After that, the installation steps are as follows:

1. Install the **git** package if not available (e.g., sudo apt install git) and **python3-pip** to handle package management requirements for Python.

2. Clone the source archive to your preferred location on disk:

3. Once inside the dnsrecon directory, install the library requirements like so:

4. Run command:

The following screencast recaps the above process:

Alternatively, the command sudo apt install dns-recon should accomplish the same outcome.

**CentOS Linux (Github-based) installation**

Installing dns-Recon on CentOS follows the same pattern as in the Ubuntu case. Again, a Python version higher than 3.6 is required as well as access to the language package management tool (PIP).

dns-Recon usage and examples

If you feel you don't want to spend the time setting all of this up and simply need a turnkey alternative, Kali Linux comes with dns-Recon already installed. As shown below, dns-Recon Kali-based installation is one of three dns analysis tools including dnsenum and fierce all falling w...

While the traditional network perimeter has, for some time, been extended to include a large number of different endpoints, many organizations still struggle to put proper security protocols in place to protect them. And whenever security controls are lacking, attackers rejoice.

One study shows that a worrisome 30% of IT professionals don't know how many endpoints there are in their organization, and those who do know report an average of 750 endpoints. And that's only the average. Many organizations have a much greater number of endpoints—and maintaining visibility and security controls over each proves a difficult challenge.

Combine this with an uptick in attacks against endpoints, and we can see that traditional methods of endpoint security aren't working for current IT environments.

So what can organizations do to provide appropriate protection in this area? Let's find out.

What exactly are endpoints?

Endpoints are physical devices that are, you guessed it—the end points on a network. They are the connected devices that all of the users on the network use. Their numbers keep growing; more and more organizations use different devices to carry out different tasks, and with the current switch to working remotely and users accessing the network from all possible devices, both professional and personal, we don't foresee the growth of endpoints slowing down.

What is endpoint security?

Endpoint security refers to the practice of securing endpoints of end-user devices to ensure protection against cyber threats and risks. Endpoint security services include those commonly used in enterprise environments as well as those used in consumer and private network environments, such as antivirus solutions, firewalls and web and email filtering. Although these are all considered endpoint security services, endpoint security has evolved from those more traditional solutions to providing more comprehensive protection against advanced malware and zero-day attacks.

Endpoint security plays an important role in organizations of all sizes. It helps them protect critical systems and sensitive and proprietary information, and makes sure all users on the network, including employees and customers, are protected from cyber attacks. Endpoint security works by allowing security teams visibility into organization's endpoints, and is designed to defend against physical and digital attacks, analyze traffic and files shared to and from these devices in real-time, and detect, protect and prevent against different types of cybersecurity threats.

The most common attack vectors in endpoint security

Endpoints are vast and each of them can be a viable point of entry for attackers. Some of the frequently forgotten ones, like the fax machine, can be easily exploited, especially when they lack appropriate protection measures (as fax machines often do). And attack vectors in endpoint security are as vast as the number of endpoints themselves.

To increase your familiarity, here are some of the more common ones and what to do about them:

Employees

Your most valuable asset, your people, is also the most dangerous link in the security chain and presents a big risk to your endpoint security. Devices are endpoints and used by people, which means they can also be abused by them—whether with malicious intent or merely resulting from a moment of negligence. And as we mentioned above, one factor adding to the possibility of weak endpoint security is the involvement of remote employees. Remote employees log onto the organization's network from outside the premises, opening up more entry points for malware to get into the network.

The only sure way to get your team and all your employees to participate in endpoint security, and prevent them from overturning it, is to ensure they get appropriate cybersecurity training. Part of this is by maintaining a strong, sustainable cybersecurity culture in the workplace. This is achieved through showing what th...