SecurityTrails Blog

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

With organizations' digital footprints growing larger and larger, network recon and the enumeration of services available over the public internet has become a critical area in the security of an organization. And given the increased number of vulnerabilities and threats targeting web applications, performing automated recon and service enumeration is ever more important.

Fortunately, using open-source and free-to-use tools such as recon NG has streamlined this process to the point of near-automation. Today we'll take a look at Auto Recon, aimed at doing just that: automating your network recon and service enumeration methods.

What is Auto Recon?

Auto Recon is an open-source project built to perform network reconnaissance with automated service enumeration. The advantage that Auto Recon provides over other information gathering and internet scanning tools is that it allows one to further process—and further act upon—information gathered directly within Auto Recon. This includes performing actions like Nmap as well as running the gathered data through other scanning tools, such as feroxbuster, SSL Scan, NBT Scan, Nikto and more.

Installing Auto Recon

Note: As its dependencies are easily available on KaliLinux, we suggest using Auto Recon on that distribution.

To begin with, ensure you have python3 and pip available.

Next, use Python pip to grab the latest version of Auto Recon and install it.

Next, you'll need to install certain dependencies.

Run the command to determine whether it's been successfully installed.

Which should then give you the following output containing various options available in Auto Recon.

Usage

Getting started with Auto Recon is super simple—one can even run Auto Recon without any flags or options:

Replace domain.com with a domain name that you wish to scan. Once the command has finished executing, it should then return the following output:

Analyzing the results

After a scan completes, Auto Recon saves the scan results in the "results" directory, inside of which a new subdirectory is created for every target being scanned by Auto Recon.

The results structure created by Auto Recon is as shown below:

The exploit directory is used to store any exploit code you run for the target being scanned. The loot directory is intended to store any hashes or notable files you find on the target you're scanning. The report directory contains reports of the scan performed by Auto Recon; files are generated as follows:

local.txt can be used to store the local.txt flag found on targets.

notes.txt should contain a basic template where you can write notes for each service discovered.

proof.txt can be used to store the proof.txt flag found on the target.

The screenshots directory is used to store any screenshots you use to document the exploitation of the target. The scans directory is where all results from scans performed by Auto Recon will go. This includes all commands executed by Auto Recon and whether any commands failed or succeeded as well. The scans-XML directory stores scan data results in XML format (from Nmap, etc.) which can be used to easily import scan results data into other software for further processing or storing.

Further understanding the results

Finding the webserver version

With the output we gather from Auto Recon, one can find the version of the webserver running on the target system as well. Most web servers expose their name and version by default; for example, from the Nmap output:

This tells us the webserver running on the target being scanned is engine X 1.14.0

Detecting operating systems

Looking even further with the output we've gathered above, the webserver often exposes the operating system or operating system family, too. Also, as shown above, we can see the target being scanned runs on Ubuntu.

Gathering screenshots along the way

Often, web application screenshots can tell a l...

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

With organizations' digital footprints growing larger and larger, network recon and the enumeration of services available over the public internet has become a critical area in the security of an organization. And given the increased number of vulnerabilities and threats targeting web applications, performing automated recon and service enumeration is ever more important.

Fortunately, using open-source and free-to-use tools such as recon NG has streamlined this process to the point of near-automation. Today we'll take a look at AutoRecon, aimed at doing just that: automating your network recon and service enumeration methods.

What is Autorecon?

AutoRecon is an open-source project built to perform network reconnaissance with automated service enumeration. The advantage that AutoRecon provides over other information gathering and internet scanning tools is that it allows one to further process—and further act upon—information gathered directly within AutoRecon. This includes performing actions like Nmap as well as running the gathered data through other scanning tools, such as feroxbuster, SSL Scan, NBT Scan, Nikto and more.

Installing Autorecon

Note: As its dependencies are easily available on KaliLinux, we suggest using AutoRecon on that distribution.

To begin with, ensure you have python3 and pip available.

Next, use Python pip to grab the latest version of AutoRecon and install it.

Next, you'll need to install certain dependencies.

Run the command to determine whether it's been successfully installed.

Which should then give you the following output containing various options available in AutoRecon:

Usage

Getting started with AutoRecon is super simple—one can even run AutoRecon without any flags or options:

Replace domain.com with a domain name that you wish to scan. Once the command has finished executing, it should then return the following output:

Analyzing the results

After a scan completes, AutoRecon saves the scan results in the "results" directory, inside of which a new subdirectory is created for every target being scanned by AutoRecon.

The results structure created by AutoRecon is as shown below:

The exploit directory is used to store any exploit code you run for the target being scanned. The loot directory is intended to store any hashes or notable files you find on the target you're scanning. The report directory contains reports of the scan performed by AutoRecon; files are generated as follows:

local.txt can be used to store the local.txt flag found on targets. notes.txt should contain a basic template where you can write notes for each service discovered. proof.txt can be used to store the proof.txt flag found on the target.

The screenshots directory is used to store any screenshots you use to document the exploitation of the target. The scans directory is where all results from scans performed by AutoRecon will go. This includes all commands executed by AutoRecon and whether any commands failed or succeeded as well. The scans-XML directory stores scan data results in XML format (from Nmap, etc.) which can be used to easily import scan results data into other software for further processing or storing.

Further understanding the results

Finding the webserver version

With the output we gather from AutoRecon, one can find the version of the webserver running on the target system as well. Most web servers expose their name and version by default; for example, from the Nmap output:

This tells us the webserver running on the target being scanned is engine X 1.14.0

Detecting operating systems

Looking even further with the output we've gathered above, the webserver often exposes the operating system or operating system family, too. Also, as shown above, we can see the target being scanned runs on Ubuntu.

Gathering screenshots along the way

Often, web application screenshots can tell a lot, they can expos...

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

With organizations' digital footprints growing larger and larger, network recon and the enumeration of services available over the public internet has become a critical area in the security of an organization. And given the increased number of vulnerabilities and threats targeting web applications, performing automated recon and service enumeration is ever more important.

Fortunately, using open-source and free-to-use tools such as recon NG has streamlined this process to the point of near-automation. Today we'll take a look at AutoRecon, aimed at doing just that: automating your network recon and service enumeration methods.

What is AutoRecon?

AutoRecon is an open-source project built to perform network reconnaissance with automated service enumeration. The advantage that AutoRecon provides over other information gathering and internet scanning tools is that it allows one to further process—and further act upon—information gathered directly within AutoRecon. This includes performing actions like Nmap as well as running the gathered data through other scanning tools, such as feroxbuster, SSL Scan, NBT Scan, Nikto and more.

Installing AutoRecon

Note: As its dependencies are easily available on KaliLinux, we suggest using AutoRecon on that distribution.

To begin with, ensure you have python3 and pip available.

Next, use Python pip to grab the latest version of AutoRecon and install it.

Next, you'll need to install certain dependencies.

Run the command to determine whether it's been successfully installed.

Which should then give you the following output containing various options available in AutoRecon:

Usage

Getting started with AutoRecon is super simple—one can even run AutoRecon without any flags or options:

Replace domain.com with a domain name that you wish to scan. Once the command has finished executing, it should then return the following output:

Analyzing the results

After a scan completes, AutoRecon saves the scan results in the "results" directory, inside of which a new subdirectory is created for every target being scanned by AutoRecon.

The results structure created by AutoRecon is as shown below:

The exploit directory is used to store any exploit code you run for the target being scanned. The loot directory is intended to store any hashes or notable files you find on the target you're scanning. The report directory contains reports of the scan performed by AutoRecon; files are generated as follows:

local.txt can be used to store the local.txt flag found on targets. notes.txt should contain a basic template where you can write notes for each service discovered. proof.txt can be used to store the proof.txt flag found on the target.

The screenshots directory is used to store any screenshots you use to document the exploitation of the target. The scans directory is where all results from scans performed by AutoRecon will go. This includes all commands executed by AutoRecon and whether any commands failed or succeeded as well. The scans-XML directory stores scan data results in XML format (from Nmap, etc.) which can be used to easily import scan results data into other software for further processing or storing.

Further understanding the results

Finding the webserver version

With the output we gather from AutoRecon, one can find the version of the webserver running on the target system as well. Most web servers expose their name and version by default; for example, from the Nmap output:

This tells us the webserver running on the target being scanned is Nginx 1.14.0

Detecting operating systems

Looking even further with the output we've gathered above, the webserver often exposes the operating system or operating system family, too. Also, as shown above, we can see the target being scanned runs on Ubuntu.

Gathering screenshots along the way

Often, web application screenshots can tell a lot, they can expose-d...

Today at Security Trails we're announcing an upgrade to our Associated Domains API endpoint and functionality inside of Surface Browser and Attack Surface Reduction.

Associated Domains was originally introduced a few years ago. The purpose is to footprint a company's infrastructure by finding all domains associated with that company. The primary vectors involved a lot of heuristics around Whois data. While Whois is not dead by any means, it has left a lot of gaps after GDPR and privacy guard enablement.

We've heard your feedback and have been working on a wonderful new set of features that utilize many other vectors of association and allow us to expand in the future. Based on your feedback, we are now providing the provenance of how we made the association so that you can understand how a domain is related to another. This is available from inside of Surface Browser currently.

What's new in Associated Domains v2?

Major improvements to the algorithm to find false negatives domains that may have been missed from other methods.

A keen attention to mergers, acquisitions, and subsidiaries.

Providing the provenance at a glance to be able to detail why an association was made.

10+ additional signals for associations.

Enhanced Whois, SSL, Hosting, Nameserver and other infrastructure analysis.

From the previous screenshot, you can also notice that ADv2 is now showing why a domain name was associated. Commonly associated reasons you'll find, among others, include:

SSL organization. SSL organization name. Whois email. Whois organization. Parent's organization name. Parent's organization legal name.

Comparing results of ADv1 vs ADv2 for Netflix.com associations

To see these improvements in action, let’s first see how many domains, organizations and TLDs can be found with both versions:

That’s an 81% increase in the number of discovered associated domains!

Now let’s try using Surface Browser and filtering by ‘Creation by year’, and ‘Expiration by year’.

With v1 we got 184 domains in the summary 'by Creation Year', starting in 1995 as the first registered date. And for the summary 'by Expiration Year', we got 183 results, from 2019 through 2026.

With v2 we got 882 domains, almost 4 times the results, starting in 1992. And reviewing the 'Summary by Expiration year' we got 877, ranging from 2018 to 2026.

Summary

As you can see, the new version of Associated Domains with all of its improvements and features provides evidently more domain associations than the previous one. This will help organizations make their intelligence collection about hostnames easier than before.

All new accounts created after Tuesday, November 16th will have AD v2 enabled by default. Users that had AD enabled on their account prior to this date can contact us to get AD v2 access.

Stay tuned for more product updates in the following weeks.

Today at Security Trails we're announcing an upgrade to our Associated Domains API endpoint and functionality inside of Surface Browser and Attack Surface Reduction.

Associated Domains was originally introduced a few years ago. The purpose is to footprint a company's infrastructure by finding all domains associated with that company. The primary vectors involved a lot of heuristics around Whois data. While Whois is not dead by any means, it has left a lot of gaps after GDPR and privacy guard enablement.

We've heard your feedback and have been working on a wonderful new set of features that utilize many other vectors of association and allow us to expand in the future. Based on your feedback, we are now providing the provenance of how we made the association so that you can understand how a domain is related to another. This is available from inside the Surface Browser currently.

What's new in Associated Domains v2?

Major improvements to the algorithm to find false negatives domains that may have been missed from other methods.

A keen attention to mergers, acquisitions, and subsidiaries.

Providing the provenance at a glance to be able to detail why an association was made.

10+ additional signals for associations.

Enhanced Whois, SSL, Hosting, Nameserver and other infrastructure analysis.

From the previous screenshot, you can also notice that ADv2 is now showing why a domain name was associated. Commonly associated reasons you'll find, among others, include:

SSL organization. SSL organization name. Whois email. Whois organization. Parent's organization name. Parent's organization legal name.

Comparing results of ADv1 vs ADv2 for Netflix.com associations

To see these improvements in action, let’s first see how many domains, organizations and TLDs can be found with both versions:

That’s an 81% increase in the number of discovered associated domains!

Now let’s try using Surface Browser and filtering by ‘Creation by year’, and ‘Expiration by year’.

With v1 we got 184 domains in the summary 'by Creation Year', starting in 1995 as the first registered date. And for the summary 'by Expiration Year', we got 183 results, from 2019 through 2026.

With v2 we got 882 domains, almost 4 times the results, starting in 1992. And reviewing the 'Summary by Expiration year' we got 877, ranging from 2018 to 2026.

Summary

As you can see, the new version of Associated Domains with all of its improvements and features provides evidently more domain associations than the previous one. This will help organizations make their intelligence collection about hostnames easier than before.

All new accounts created after Tuesday, November 16th will have AD v2 enabled by default. Users that had AD enabled on their account prior to this date can contact us to get AD v2 access.

Stay tuned for more product updates in the following weeks.

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

When scanning remote hosts and web applications, the danger of file inclusion attacks is an important consideration, particularly when dealing with web applications that support plugins such as WordPress.

An RFI, or remote file inclusion attack, targets web applications that make use of includes via external scripts (commonly known as application plugins), hooks, themes, anything that is dynamically included in the web application during runtime. If these includes contain vulnerabilities, it's highly likely that exploiting the includes can lead to the main web application being exploitable. That's why today we’ll take a look at the Uniscan project. In the project's own words, Uniscan is a simple Remote File Include, Local File Include, and Remote Command Execution vulnerability scanner.

Installation

We recommend using Kali Linux for Uniscan as it is available for easy installation via the package manager. Installing Uniscan on Kali Linux is relatively straightforward, as it can be installed directly via the APT package manager and does not need compiling from source. First, we update our APT package manager information with the following command. Next, we proceed to install Uniscan. To verify a successful Uniscan installation, let's run the following command. This should then return the following output, which displays the options/flags Uniscan has available.

Configuration

Uniscan can run with minimal configuration as well, but it does allow for a good amount of customization:

-h — The -h flag shows us all the options available under Uniscan.

-u — The -u flag is used to specify the URL being scanned, for example: www.example.com .

-f — If you wish to scan a list of URLs, you can input them into a text file and reference them with the -f flag as well.

-b — Scans can take a while to complete if you have multiple URLs to scan. Using the -b flag pushes Uniscan to run in the background; alternatively, you can run Uniscan under a "screen" session as well under Linux.

-q — The -q flag enables Directory-based checks for the target being scanned.

-w — The "-w" flag enables Uniscan to check for files present on the remote host being scanned.

-e — The "-e" flag enables Uniscan to check for robots.txt and sitemap.xml, which can further help identify the type of script/web application running on the target host.

-d — The "-d" flag enables Dynamic checks within Uniscan to check for any dynamic file includes.

-s — The "-s" flag enables Static checks within Uniscan to check for any static file includes.

-r — The "-r" flag enables stress checks to be run on the target being scanned.

-i and -o flags perform Bing and Google searches for dorks related to the target being scanned.

-g — The "-g" flag is used for web fingerprinting, this helps identify what web application is running on the web server, what plugins are enabled (for example, in WordPress), what version of WordPress is running on the server, and more.

-j — The "-j" flag is used to enable the server fingerprint check/listing, which allows for identification of the server software. This performs actions such as ping, N map, traceroute, and listing of the web server and operating system running.

Testing and results

To run a basic scan on a web app, we use the flags "qweds" which instruct Uniscan to perform the following:

Directory checks (q). File checks (w). Robots/sitemap checks (e). Dynamic file include checks (d). Static file include checks (s).

The checks performed by the flags "qweds" can all be performed in the same run, with the command. Note: Replace with the actual URL you wish to scan. Which then returns to us the following output.

As seen above, when Directory and File checks are being performed, Uniscan will find and list directories as well as files seen on the target being scanned. Next, Uniscan performs checks on the robot.txt, sitemap, and begins enumerat...

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

Attack surface management has become one of the most critical aspects of any website on the public internet. Simply knowing your attack surface is no longer enough— and effectively managing it with tools like Aquatone has become the norm. Combining Aquatone with popular tools like Owasp Amass helps improve and streamline website attack surface management even further.

What is Aquatone?

Aquatone is a free-to-use, open-source project aimed at making visual inspection of websites an easy task. This valuable tool also supports looking up websites in bulk, which can make the task of information gathering for your website's attack surface surprisingly easy. Aquatone works with the help of a web browser like Chrome or Chromium to perform the visual inspection of any website being looked up. Aquatone can be further combined with tools like Nmap to gain even more insight about a website's attack surface.

Installation

To install Aquatone, grab the latest release of the project's GitHub page for the operating system you run on. Aquatone has released versions for Linux (amd64 and arm64), MacOS, and Windows, which makes it a very handy tool no matter what platform you're on. In our example, we'll take a look at both the Linux and Windows options. For Linux, grab the amd64 build or arm64 build. If in doubt, grab the amd64 build:

And then unzip the archive. Now let's run the command for the first time.

The help command will show a list of command arguments, features and flags supported by Aquatone.

Next, for Aquatone to perform visual lookups of websites, you'll need Chromium or Google Chrome installed on your system. If you are running any Debian-based distro, you can install this package by just running the following command.

Similarly, for Windows, download the "windows_amd64.zip" build, and extract the archive. This should result in the following files.

Fire up the command prompt with WIN + R and then enter CMD. Navigate to the folder where you extracted the files and run. Which should then result in the following output.

As seen with Linux, you'll need either Google Chrome or Chromium installed on your system to aid Aquatone to perform the website visual lookups.

Aquatone phases and usage examples.

Basic usage.

To begin using Aquatone, let's look at scanning websites with basic flags/options available. First, create a text file called "websites.txt" inside the same folder as the Aquatone executable. And inside that, add the websites you wish to scan, ensuring you have only one website per line. Run the command: Which should net you the following output.

From the output above, we're able to gather a few important facts.

Aquatone is FAST! Using this tool, we were able to gather information about two websites in only five seconds.

As for the output returned, Aquatone gives us an HTML report, an HTTP code and a screenshot of the website.

Aquatone targets port 80, 443, 8000, 8080 and 8443 by default if no arguments or specific ports are passed into the command.

Scanning specific ports.

At times you may need to scan only specific ports, or the most commonly used ports (such as 80 and 443). This can be done by using the ports flag. For example: Should return to you the following output.

Using Aquatone with Owasp Amass.

Another excellent feature of Aquatone is that it can be combined with other tools like Owasp Amass. This extends what Aquatone can achieve even further. Amass is a great tool for DNS enumeration, as it helps find and list subdomains belonging to a domain. With larger organizations having hundreds, if not thousands, of subdomains active at any time, using Amass helps speed up the process, gathering information from multiple 3rd-party sources. Amass carries builds for Linux, Windows and Mac OS, as well as FreeBSD. To begin, grab the latest release of Amass from its GitHub Releases page by executing.

And then unzip ...

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

Available for Windows, Linux, macOS, and a range of other operating systems, Nmap is widely used to perform network scans, conduct security auditing, and find vulnerabilities in networks.

As the project's official page explains, at the most basic level, Nmap allows you to quickly map the ports on your network, and do so without being detected. This functionality is accessed through a well-structured set of Nmap commands which will be familiar to anyone who has worked with command-line network tools before. Commands can also be built into Nmap scripts to extend your capabilities even further. Installing Nmap on Windows, and for that matter using it on Windows, is fairly straightforward. We'll show you how to download Nmap, and how to install it. We'll then take you through the most common use cases for Nmap, before showing you the official GUI alternative called Zenmap.

Installing Nmap on Windows

Installing Nmap on Windows is straightforward:

The first step is to go to the official download page and download the latest stable version of Nmap.

NOTE: There are typically a number of different versions of Nmap available ,the latest stable version, in addition to early-release betas that will offer extra features at the cost of some stability. Download the version you feel most comfortable with, which for most beginners will be the latest stable version. Next, navigate to the location where the file is downloaded. If your Windows installation is fairly standard, this will be in your "Downloads" folder. You will see a file there called "Nmap-X.X X-setup", or similar. If you can't find the file, do a quick search for it. This file is an EXE ,an executable. In order to use it, you will have to run it with administrator privileges. To do that, right-click the file and then click "run as administrator." The installer will now run. A window will appear that will ask you to accept the end-user agreement. Click "I Agree" to do so. Next, the installer will ask you which components of Nmap you'd like to install.

All of the components will be selected and installed by default. Unless you are experienced with the program and don't need some of these components, go ahead and accept the proposed installation. Then the installer will ask you where you want to install Nmap. It will default to C:\Program Files (x86)\Nmap, but you can change this if you would like to. The important thing is that you know where Nmap is installed, because (as we'll see shortly) you'll need that information in order to call it from the command line. Click "Install", and Nmap will start to install. This should be a pretty quick process, even on old hardware, Nmap is a small program, despite being so useful! You'll then get confirmation that Nmap is installed.

If all went smoothly, you should now have a working version of Nmap on your computer. Depending on your level of experience, however, you might be a little confused at this point. By default, Nmap is a command-line tool, and as such it doesn’t have an icon that appears in your programs menu. If you are familiar with using the command line (or want to give it a go), you can proceed to the next section. If you want a graphical program (a GUI) for Nmap, take a look at the section on Zenmap below, this program will provide a more familiar interface for novice users.

Running Nmap on Windows 10 - Usage Examples

Using Nmap on the Windows command line

As we've mentioned above, by default Nmap is used completely through the Windows command line, and this is how most people will use Nmap. If you are not familiar with this, you can either download Zenmap (see below) or even use Nmap as an introduction to the Windows command line, it makes a great place to learn.

Here are the most common use cases for Nmap:

1. Detecting the version

A simple use case for Nmap is to check the version of Windows (or any other OS) y...

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

Available for Windows, Linux, macOS, and a range of other operating systems, Nmap is widely used to perform network scans, conduct security auditing, and find vulnerabilities in networks.

As the project's official page explains, at the most basic level, Nmap allows you to quickly map the ports on your network, and do so without being detected. This functionality is accessed through a well-structured set of Nmap commands which will be familiar to anyone who has worked with command-line network tools before. Commands can also be built into Nmap scripts to extend your capabilities even further. Installing Nmap on Windows, and for that matter using it on Windows, is fairly straightforward. We'll show you how to download Nmap, and how to install it. We'll then take you through the most common use cases for Nmap, before showing you the official GUI alternative called Zenmap.

Installing Nmap on Windows

Installing Nmap on Windows is straightforward:

The first step is to go to the official download page and download the latest stable version of Nmap.

NOTE: There are typically a number of different versions of Nmap available–the latest stable version, in addition to early-release betas that will offer extra features at the cost of some stability. Download the version you feel most comfortable with, which for most beginners will be the latest stable version. Next, navigate to the location where the file is downloaded. If your Windows installation is fairly standard, this will be in your "Downloads" folder. You will see a file there called "Nmap-X.XX-setup", or similar. If you can't find the file, do a quick search for it. This file is an EXE ,an executable. In order to use it, you will have to run it with administrator privileges. To do that, right-click the file and then click "run as administrator." The installer will now run. A window will appear that will ask you to accept the end-user agreement. Click "I Agree" to do so. Next, the installer will ask you which components of Nmap you'd like to install.

All of the components will be selected and installed by default. Unless you are experienced with the program and don't need some of these components, go ahead and accept the proposed installation. Then the installer will ask you where you want to install Nmap. It will default to C:\Program Files (x86)\Nmap, but you can change this if you would like to. The important thing is that you know where Nmap is installed, because (as we'll see shortly) you'll need that information in order to call it from the command line. Click "Install", and Nmap will start to install. This should be a pretty quick process, even on old hardware–Nmap is a small program, despite being so useful! You'll then get confirmation that Nmap is installed.

If all went smoothly, you should now have a working version of Nmap on your computer. Depending on your level of experience, however, you might be a little confused at this point. By default, Nmap is a command-line tool, and as such it doesn’t have an icon that appears in your programs menu. If you are familiar with using the command line (or want to give it a go), you can proceed to the next section. If you want a graphical program (a GUI) for Nmap, take a look at the section on Zenmap below–this program will provide a more familiar interface for novice users.

Running Nmap on Windows 10 - Usage Examples

Using Nmap on the Windows command line

As we've mentioned above, by default Nmap is used completely through the Windows command line, and this is how most people will use Nmap. If you are not familiar with this, you can either download Zenmap (see below) or even use Nmap as an introduction to the Windows command line–it makes a great place to learn.

Here are the most common use cases for Nmap:

1. Detecting the version

A simple use case for Nmap is to check the version of Windows (or any other OS) you ar...

ORLANDO, Florida, October 19, 2021 — Securitytrails, the Total Internet Inventory, is adding to its executive team by bringing on Scott Donnelly as Vice President of Sales and Taylor Dondich as Chief Technology Officer. Long term team members Courtney Couch and Kris Lopez take on new roles to round out the team.

"Taylor and Scott are joining at the perfect time for Securitytrails. With the launch of our Attack Surface Reduction product, we're taking on bigger challenges for larger organizations. Their experience will help ensure that both Securitytrails and its customers are successful." , Chris Ueland, CEO of Securitytrails. Scott Donnelly brings a wealth of industry knowledge, having held senior sales leadership roles at both Expanse and Recorded Future. During his time as Vice President of Technical Solutions at Recorded Future, Scott drove the integration of their security intelligence with dozens of leading IT and security products. His arrival at Securitytrails will ensure that customers realize the value of the Total Internet Inventory across their entire organization. Taylor Dondich takes over as the new Chief Technical Officer.

Co-Founder Courtney Couch will now be focused on finding better ways to identify customer infrastructure and risks in his new role as the Chief Innovation Officer. Dondich has worked in the technology space for over two decades with companies such as Yahoo and Splunk, as well as the VP of Engineering for MaxCDN. His experience in roles of tech executive, advisor and engineer will guide Securitytrails to develop innovative technology and ensure customers are never blindsided by unknown risks. Having previously worked as Strategic Partnerships Manager at Securitytrails, Kris Lopez's expansive business background along with her outstanding interpersonal and project management skills make her a perfect choice as the new Chief of Staff. Securitytrails is bringing forth these instrumental changes to propel them to the next level and to ensure they continue to provide the best quality of data available to help companies protect themselves.

About Securitytrails

Securitytrails is a total internet inventory that curates comprehensive domain and IP address data for users and applications that demand clarity. By combining current and historic data of all Internet assets, Securitytrails is the proven solution for 3rd-party risk assessment, attack surface reduction and threat hunting. From knowing an organization's attack surface, shadow infrastructure, and spotting new domains, Securitytrails makes sure there's nothing left to be discovered. Learn more at securitytrails.com.