SecurityTrails Blog

We are excited to announce the immediate availability of Hosting Visualization, Tags for hostnames, and SQL Explorer in Surface-Browser. Keep reading to learn more about the new features and how to get them enabled on your existing account.

Hosting History Visualization

With our latest release, a new visualization graphic was added to the popular host DNS history page in Surface-Browser to better understand where a domain has been hosted.

Tags included in newly observed subdomains

Over the past few weeks we introduced Tags for hostnames. Tags are practical ways to describe which SaaS or infrastructure platform is used by any hostname, as shown in the following screencast:

SQL Explorer

You can query the data with an SQL-like language, select which fields you want and choose how the rows should be sorted, just as you would with traditional SQL. Take a look:

This is a preview feature, available only to customers requesting this functionality. Get in touchwith our support team to enable this feature on your account.

Remember, you can keep track of every change to all our apps and products with our changelog.

**Interested in any of these new features?**

We will show you what Surface-Browser is about.

Book your demo today!

People, process, and technology are the pillars of cybersecurity. And while people are every organization's best asset, they are also its biggest weakness. Security technology continuously evolves to counter emerging security threats and new techniques, but there is one threat that can't be thwarted by merely employing new tools and processes. The biggest security threats of today are not the result of malicious attackers, advanced persistent threats, or malware. They come from within.

Let's also consider the current shift taking place in many organizations: working remotely is all the rage right now. And with more and more team members working from home, more devices are accessing your network, along with new technologies and tools being utilized to make at-home-offices function properly.

This blurs the lines between the personal and professional use of devices. We also have to deal with the cloud, malicious attackers at the ready, and the tectonic changes in so many companies' organizational structures. All of this points to a very real and potentially dangerous threat.

According to a recent study by Verizon, 57% of all data breaches were attributed to insider threats within an organization. While outside forces, malicious attackers, ransomware, DDoS and other types of cybercrime are external threats organizations need to watch and prepare for, letting your guard down in the current threat landscape doesn't cut it for organizations who want to be cyber resilient. And just as we said in our article on Zero Trust security, you should trust no one. Even if you believe in your employees and team members, your biggest enemy might be sitting at the table right next to you.

What are insider threats?

**Insider threats** are security risks. Specifically, **the term refers to scenarios where anyone connected to the inner workings of an organization has authorized access to internal systems and networks, and misuses that access to willingly or unwillingly reveal, modify, or remove sensitive data**.

Insider threats are particularly dangerous because, as we can see from the report cited above, they're the main reason behind many data breaches. They can also go undetected for months or even years.

Why are they so hard to detect? Because when someone already has access to sensitive information, it's almost impossible to distinguish whether they're engaging with it in a malicious way or not. And if you have a tech-savvy employee working with that data, covering their tracks isn't hard for them to do.

There are different motivations behind an insider attack, and it can vary from the type of "insider" involved. It could be revenge, exacted by a disgruntled employee. It happens; a lot of people have left companies on bad terms, and might even wish them harm, but there are those who would actually act on it. It could be financial gain, because information is power. Having access to sensitive data like customer and employee information, financial data, even an organization's security practices can all be worth a lot to crackers. And we can't forget about cyber espionage: actors working for outside organizations and competitors can infiltrate your organization and carry out attacks to obtain classified information without you suspecting a thing.

There's one more motivation, and it's tied directly to human nature. It's accidental and unintentional, and when you're dealing with a range of humans from employees to third-party vendors, it might be the hardest one to prevent: a moment of carelessness, which can lead to a security breach.

The 5 types of insider threats

Regardless of motivation, insider threats are a huge risk to all organizations. But by examining different types of motivations, we can recognize different types of insider threats and situations.

1. Negligent employees

While it might be tempting to blame malicious insiders on your premises and finding ways to steal information, the most common insider threat...

The Osint tools arsenal is now filled with more pieces of code that help "get things done" better, faster and more effectively than ever before. And Recon-ng, with its modular design, brings you a familiar way to operate a command line while its similar syntax to the Metasploit framework allows you to mount different purpose modules and configure them independently.

This kind of tool really enhances your toolbox when realizing an attack surface analysis against a desired target. Additionally, it provides a development interface that enables you to create your own modules and expand the tools' capabilities even further.

Getting to know Recon-ng

This Osint tool has plenty of features that come "out of the box" for you to enable and use. These features differ as do their sources of information, from domain name discovery and credentials gathering to repository scrapping with additional integrations like Masscan. In this post, we'll take a look at installing Recon-ng, examine the different options available, and explore displaying scan results.

Also, its CLI usability deserves a special mention. Merely pressing the tab key twice will display the already-typed command, which is especially helpful when you're not too familiar with the tool and need extra information to see what you can do with it.

In the following sections, we'll delve into each of the different options available, to show you just how painless it is to use Recon-ng.

Recon-ng installation

Installing is a simple process. Simply clone all the repository files using git, and it's ready for execution:

We recommend that you check all requirements beforehand, using a PIP version that uses Python3:

Once all of this is done, you're ready to launch the application. There are three executables in this folder that allow you to run Recon-ng for different purposes:

recon-ng: This is the command-line interactive interpreter. With it you can run all commands within the internal command prompt:

You'll notice with the first run the "No modules enabled/installed" message. That's because there isn't one yet—we need to install the ones we intend to use before putting the software to work.

recon-cli: This is the correspondent command-line script. It allows you to execute modules and different features as a single line command.

recon-web: This process starts a web daemon so you can enter the dashboard to visualize all activities:

To access by default, you can enter the following address on your browser. The web interface looks like this:

While web visualization is very simple, it provides you with a quick overview of what is being done and the status of different processes in conjunction with the obtained information.

Recon-ng usage

This information gathering tool comes with many options that can be tricky to use. The modules don't come installed by default so you have to bring them in as needed. This will be done with the marketplace option:

A simple marketplace search will show all available modules, along with their different characteristics. Some of them require the use of API keys, others have dependencies to be satisfied, and others have both.

When you find the desired module, you can install it with the **marketplace install** command followed by the designated path to reach the module. In the case below we're installing the **migrate_contacts** module:

You can also search the marketplace for a particular type of category, such as a repository search using different techniques:

If you want to take a deeper look at what the module does, you can use the marketplace info module followed by the module name or path, in this case Github Dorks:

API configuration

As mentioned before, some modules will require an API key to the associated service they run on to work properly. You'll need to provide this key after its installation, as demonstrated in the message below:

You'll need to use the keys command to operate with the mentioned tokens....

When looking at any security team, one thing you might notice is that there is a tool for everything. And we do mean everything: ticketing, threat intelligence, security investigations, malware analysis, detection, incident response, advanced persistent threats, security monitoring... the list goes on.

Every organization wants the best of the best to build their defenses. This can often leave their security teams and security operations centers with a toolstack of uncooperative solutions that don't communicate with one another, with their full value remaining untapped, and they can interrupt or even cancel each other out. The team becomes paralyzed by the sheer number of alerts generated by these solutions, losing time that could be spent on contextualized investigation and response.

We often cite alert fatigue as a common challenge in SOCs, and with good reason. Nobody likes alerts, because whether it's a fire alarm, car alarm, or alarm for any other kind of emergency, it signals to us that a real threat is present. But after hearing alerts time and time again, all we hear is the boy who cried wolf. We downplay these alerts because we've spent so much of our precious time combing through them, only to reveal themselves as fake. In SOC terms, this leads to real threats being missed, often to devastating consequences.

There is a solution. That solution is connecting the tools that security teams run, to communicate with each other and do away with the tedious, time-consuming tasks that have a high potential for human error. Streamlining the process with which tools are used helps to keep security professionals from losing any of their precious time.

**Security orchestration** addresses the number of different tools used by security teams. It brings these tools together to work with one another, bringing out the full value of each and allowing teams to more effectively respond to threats.

What is security orchestration?

While we've spoken about security automation and how it differs from security orchestration, the terms are used almost interchangeably. It's important to know that even if they sound similar, they each hold a different meaning and purpose.

Let's reiterate: security automation is the automatic execution of security tasks without human intervention, and is focused on single tasks that usually follow an already established course of action. Security orchestration, on the other hand, considers the use of multiple automated tasks, and connects the technologies, tools and processes, streamlining the security process and allowing for protection combined with ease of implementation and use.

With all this in mind, we can see that automation actually takes in the more complex tasks that security orchestration involves, and that security orchestration is actually the enabler of automation.

**Security Orchestration** refers to **tools and solutions that are able to work together, communicate, share and export data in an intuitive and easy way**, without interrupting or canceling each other out, and streamlining the security process which allows each tool to be used to its full potential.

Most network threats can be caught and prevented without the need for human intervention. While in an ideal world, all solutions would come from a single vendor (making the security orchestration process much easier), that's not often the case. As we said earlier, organizations want the best tools to build their defenses with, and that often entails going to different vendors and utilizing different open source solutions. Security orchestration is more challenging when we have that kind of disparate tool situation, but should work seamlessly nonetheless.

Security orchestration presents a solution to some of the more ruinous problems that security teams face:

**Alert fatigue**: The rising number of alerts generated by the many different tools used by SOCs can lead to alert fatigue, which can compromise organizationa...

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

In one of our previous posts about information gathering, we covered the basics on how to get the right intel information about any organization, and that of course includes DNS intelligence.

Part of that intel is related to DNS servers and their data, which includes subdomains. That's why performing a full DNS mapping of all available subdomains is essential.

There are many ways to find subdomains, including manual methods and automated techniques using tools such as Amass, as we covered a few weeks ago.

And today we'll be exploring another infosec tool that aims to help "red-teamers" build up a full subdomain map of their target: we're talking about Subfinder, one of the best subdomain discovery tools available to help you with your information gathering tasks.

What is Subfinder?

Subfinder is a massive subdomain recon tool that can be used to generate a complete list of subdomains that are active on any domain name.

How does it work? Essentially, by discovering any valid subdomain, which it does by using passive online sources that include security APIs.

Its authors have designed it to excel at one thing: passive DNS subdomain enumeration.

With this in mind, know that subfinder is not a complete DNS enumeration intelligence tool. It focuses solely on subdomains. And yet, it proves to be a tremendous bonus for infosec researchers, bug-bounty hunters, and many other professionals within the market.

Main features

CLI-based tool

Modular code base

Fast DNS resolution

Easy API configuration interface

Ability to exclude certain sources

Output available in JSON, File and Stdout

Lightweight resource usage

Support for Stdin and Stdout

Uses 26 passive DNS sources (including SecurityTrails!)

Docker, tar and pre-built binaries available

Installation

The only requirement Subfinder has is that you need go1.13+, so once you know you have that covered, we suggest you go to github.com/projectdiscovery/subfinder/releases/ to download your preferred version.

In our case, we tested two installations.

Downloading the classic tar file:

And building our own with Go:

Expected output:

Both methods work great, and the installation should be completed within one minute.

If you'd like to check out more installation options, there is also a Docker image ready for you.

Configuring passive sources

Once your installation is ready, Subfinder should be properly configured to begin using any of the 20+ passive DNS sources, making it a really useful subdomain discovery tool.

Certain services require an API key in order to work, including our own SecurityTrails API, VirusTotal, Censys, BinaryEdge, Shodan and URLScan.

API keys can be configured at the $HOME/.config/subfinder/config.yaml file (which will be created after you execute the tool for the first time).

In the following case, we'll show you how to configure the SecurityTrails API key.

First, let's edit the API configuration file:

Then, find this block:

At securitytrails: [], specify your API key, so it looks like this:

Save and close the file. That's it, your first API key is ready to be used! You can configure as many as you like from other intelligence providers, as you saw on the list.

Testing Subfinder

Once Subfinder has been installed and you have configured the required API keys, it's time to play with it.

Just type:

The output should show you something like this:

Other popular options you can use are:

**-dL**: These two parameters will let you load a file that contains a list of domains to enumerate

**-exclude-sources**: This option enables you to exclude certain passive sources from the domain enumeration

**-max-time**: Allows you to set a new timeout while waiting for the subdomain enumeration results (default is set to 10)

**-o**: Enables users to save the output on an external file.

**-...

There are different motivations behind hackers' actions. They can be stirred by anything from monetary gain to bragging rights to boredom ('because they can'). But frequently, the driving force behind breaking into systems, stealing information and disrupting services is to demonstrate civil disobedience.

We know about white hats and black hats, which are differentiated mostly by their motivations and ethical codes, but today we will dig deeper into another type of hacker—and no, we're not talking about grey hats (that's a topic for another time). We're talking about modern-day activists, not the ones who stand on the streets holding signs protesting the current political climate, but the ones who employ their technical knowledge, combined with a strong sense of justice, to convey their often politically motivated messages by performing hacks. We are, of course, talking about hacktivists.

The topic of "hacktivism" always sparks debate, not only on the legality and severity of their crimes but also on their ethical codes; whether they're freedom fighters or merely cyber criminals hiding behind the activist's veil. So before we form our individual opinions and decide whether hacktivists are our friends or enemies, it's important to understand the term, learn how it all began and familiarize ourselves with the individuals and groups operating in this manner.

So let's learn about all things 'hacktivist'.

So, what is hacktivism?

As technology has progressed over the years, so has the very real threat and sophistication of cyber attacks. And hackers have progressed right along with it. For better or worse, as we've stated in a previous blog post on "How web software gets hacked" — "the Internet has no future without hacking". Hackers serve a purpose in challenging the frameworks, foundations and security posture of all systems, software, applications and more.

Hacking has always been around, and coupled with the development of political awareness and a growing sense of social justice, it has drawn hackers to shifting their focus toward attacks that have an underlying, often ideological incentive.

Hacktivism is derived from the words "hack" and "activism". It's prescribed to individuals or groups who perform hacking of computers and networks with the goal of causing societal and/or political change and furthering their activism.

If we refer to the Merriam-Webster dictionary, hacktivism is defined as: "computer hacking (as by infiltration and disruption of a network or website) done to further the goals of political or social activism".

And what are those goals? Hacktivists have been known to protest against censorship, anti-piracy sites and companies, and in favor of freedom of information.

Debating hacktivism are two opposing sides who bring up the question of morality. Are hacktivists heroes, Internet vigilantes or merely cybercriminals who use their activism as a cover for criminal activities? It depends on who you ask.

The concept of Internet vigilantes—superhero-types who strike back against corrupt governments, corporations, terrorists and all those causing injustice—has always inspired praise from certain people. People taking justice in their own hands, and acting in place of the society. What were once activists, standing on the streets, chanting, holding signs and fighting for the good of people, are now the geeky types who have their fights in the digital realm.

But not everyone sees hacktivists as superheroes, fighting for the greater good.

Because of hacktivism's inherent anonymity, this subculture of hacking and its lack of accountability often raises questions about the ethics behind their actions. In addition, many corporations and organizations are, naturally, actively opposed to hacktivism and highlight their conviction that, no matter the cause, cyberattacks are illegal.

To better understand these conflicting views and the true origins of hacktivism, let's dive deeper into its history...

The Domain Name System (DNS) is one of the most important services running behind the scenes that allows the Internet to work effectively every day. Also, it's one of the most forgotten and abused which was covered previously in the "DNS attacks" article. Today we'll address some of the ins and outs of its inner workings and review some helpful resources that will help minimize the chances of traffic sniffing (password leaking anyone?).

**Why should DNS privacy even matter?** This kind of traffic will reveal the sites you visit, which can be used to target your behavior, consumer electronics, political orientation, personal choices, and more. Potentially, all of this information could be used to make up a person's profile, and even work as the base for a target: DNS responses could be intercepted and modified to access a malicious service, such as a phishing website or a malware downloading application even if your network uses a zero trust approach in its design.

DNS inner workings

Worldwide DNS, we could say, is one of the first distributed services that enables collaboration to "make the Internet work". Based upon 13 different DNS root servers (which are the root zone authorities) distributed across the globe through the announcement of the same IP addresses (anycast), it allows hierarchical travel across its tree shape to solve questions about hostnames.

These servers will provide the root of the DNS zone tree, and will know exactly what server to ask whether top-level domain is a gTLD (a generic-top-level domain like .com, .net or .org) or a ccTLD (meaning a country code TLD, like .us, .uk or .tv).

When asked, these root servers will provide the next server to ask for records, as they are authoritative of only the top-level zones.

Below you can see a scheme regarding the different phases in a DNS query. Take a look at all the players we'll be mentioning during this post:

Wondering what technical implications this kind of traffic has? We'll address this below.

Privacy issues

On the technical side, one of the main concerns about DNS privacy is that **traffic is sent in cleartext**. If a third party manages to capture the traffic you're sending to obtain services' IP addresses then that stream is highly subject to eavesdropping.

You can test this yourself by capturing traffic on the corresponding DNS working ports, which are TCP and UDP port 53. Once they're captured, you can browse the packet's content and check what queries and responses travel through the network.

To mitigate this, in the next section we'll show you a few techniques and protocols that may allow you to **protect DNS traffic between you and your name servers**, and between your recursive name servers and those who are authoritative for the queried domain name zone or record.

DNS privacy enhancement tools

Despite the fact that today's public DNS servers provide ways to encrypt information, and modern browsers implement different protocols to bypass the operating system name server resolution system by using DoH or DoT (DNS over HTTPs and DNS over TLS respectively) to protect their users (as showcased in "Firefox DNS over SSL and Cloudflare public resolvers"), we intend to enumerate some additional protocols that will allow you to secure your own infrastructure without trusting a third party to do so.

For that purpose, today we're bringing special attention to DNSSEC, DNSCrypt, and DNSCurve as three ways to make name server traffic security a reality. They can do so by authenticating the contents of a DNS response, encrypting the communication between client's devices and the recursive server, and protecting the recursive's DNS server query to the actual final and valid owner of the information (a.k.a. the authoritative server).

DNSSec

While we've already discussed this topic in our post "DNSSEC - What Is It? Why Is It So Important?", we wanted to show how easy it could be to enable validation inside a self-deployed DNS serv...

We often highlight an important philosophy, a particular mindset that should be taken when dealing with security. Organizations shouldn't sit around wondering whether or not they'll fall victim to a cyber attack or data breach. Instead, it's important to actually anticipate one. Don't ponder the "if" but ask yourself "when."

Statistics aren't on the "will it or won't it" side, either: ccording to a recent report, almost 60% of organizations have experienced a data breach in the past three years.

Information is power, and malicious actors and cyber criminals are interested in your data. And if we're following the statistics mentioned as well as the current state of cybersecurity, organizations need to take more charge in protecting their data. Not only are outsiders a danger, but insider threats have free reign. Organizations should trust no one.

"Trust but verify" and the perimeter security approach no longer cut it in the modern security environment. The time has come for better, more effective concepts and strategies.

In with "**Zero Trust.**"

In recent years, a large number of organizations have turned to the **Zero Trust security approach**, and the old castle-and-moat concept is getting pushed aside to make room for a "**never trust, always verify**" **mindset** that Zero Trust model holds at its core.

What is Zero Trust security?

Created by John Kindervag while working at Forrester Research, Zero Trust was coined once traditional security models demonstrated they were no longer enough for the ever-evolving cyber threat landscape. In the traditional castle-and-moat model, the perimeter was defined and everything inside was trusted, while outsiders had a hard time getting in.

But since we're all aware that there is no such thing as absolute security, what will happen if an attacker does get into the network? If everyone inside is trusted by default, there's no way to predict how much damage attackers can do if they're able to access any part of the network.

What makes the traditional approach appear even more outdated is that today, a "perimeter" is no longer strictly defined. Organizations aren't storing data in one data center with a contained network. Now, they store their data both on-premises and in the cloud, and that data is accessed through numerous different devices and locations.

Data-driven protection and data-centric security architecture are the foundations of the Zero Trust security model, which tells us that we cannot trust anything either outside or inside of the network—and that anyone who tries to access your network needs to be verified in advance.

What does Zero Trust focus on?

There are a few main trust components to the Zero Trust network:

**Data**: As we said above, Zero Trust starts with data, and is a data-driven security model. In order to protect their data, organizations need to have visibility into it as well as their assets and who can access them, must classify it to designate which data is considered sensitive, and assign the least amount of privileges as possible. Monitoring data and data access will allow the organization to better understand network threats and respond to them more effectively, without relying solely on risk management.

**Users**: Unfortunately, humans remain the weakest link in cybersecurity. Even without malicious intent, human error can be made by anyone and at any time. That's why it's important to strictly monitor, limit and verify each user who tries to access the organization's resources, both inside and outside of the network. Deploy solutions that will help secure and verify each user, and strive to eradicate any possibility of human error with strong password policies, 2FA and MFA, and the like.

**Network**: Micro-segmentation and access and network restrictions will help stop attackers from gaining access to the network, hamper their lateral movement if they're inside the network, and defeat their ability to exfiltrate data. Ens...

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version. Being an infosec researcher requires more than just installing Kali Linux and watching a few YouTube tutorials. Being able to navigate the hundreds of tools available at your fingertips and knowing which tool is best for the job requires a good amount of self-learning or, at the very least, finding in-depth reviews to help you figure things out. We've reviewed a lot of open source tools at SecurityTrails over the past few months and today's the day for another new tool. Read on, and we'll review the open source tool Ivre, which is supported by the French Atomic Energy Commission. ## What is Ivre? Ivre is an advanced network reconnaissance framework built with Python and MongoDB. Ivre relies on a number of packages (Nmap, Masscan, Zmap, Zeek, Argus, Nfdump, ZDNS) and brings them all together through the CLI and a web interface.

A researcher can perform active or passive reconnaissance of a network, then browse and perform further analysis via the CLI or web interface. Ivre can be used for standard red and blue team investigations, creating your own private Shodan/Censys, or even your own passive DNS service. Main features: Framework: Ivre doesn't re-invent the wheel—it relies on existing software by combining them and building on that foundation. Web interface: The web-based GUI makes filtering and exploring data a breeze. Visualizations: Adding to the Web interface, there are multiple visualizations and sorting mechanisms that enable greater analysis (including visualizing network flows). API: If you find any limitations within the framework, you can use the API to export your data and visualize/analyse it elsewhere. ## Who is Ivre for? Just like Masscan and Jok3r, Ivre is great for both offensive red team investigations as well as defensive research.

As mentioned above, you can also use Ivre to make your own private Shodan or passive DNS service. The passive service is great for organizations of all types to monitor their networks and see the flow of network activity to detect any anomalous behaviour. ## Installing Ivre on Linux Ivre offers many installation options. Based on the documentation, Ivre supports Docker and is packaged on a number of Linux distributions, as you can see here. However, This tool relies on a number of different packages that require their own installation. These include MongoDB, Nmap, Zmap, Masscan, Apache/Nginx (optional) and many others. We'll attempt to follow a lean installation by only using required packages.

It's always important to use some type of sandboxing environment when installing new software. You could opt for a virtual machine (VM), container or a remote test server. We used Ubuntu 20.04 for this review, and any commands used here should apply to Debian-based distros (and with a few minor tweaks, to other distros as well). First, we install some system-level packages: The command above will install two scanners (Nmap and ZMap) and the other packages will be used to build Masscan, which can be done as follows: You can see our full installation instructions for Masscan here.

Now we'll create a Python virtual environment and install Ivre: You should now have Ivre installed system-wide, which you can confirm by running: Now we can initialize Ivre by running the following commands: This will remove existing data from the database. These commands can be used in between investigations to clean up the data. The last step will be to fetch IP data: This command fetches IP data from the Ivre website and Maxmind.

This data is required if you want to scan/list IP addresses from an AS or per country. ## Testing/Usage Our first test will be to run a scan on 100 random hosts by running five parallel Nmap processes: Now we can import the results into the database and create a view of it: You can verify that your scan ran successfully by the output of the 'scan2db' command, w...

A Security Must-Have: Security Automation and its Benefits, Best Practices and Tools . Even if some people believe that robots and automation will replace the entire workforce and machines will do everything for us, the truth is that automation helps us to be more productive and work mor...