SecurityTrails Blog

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

The rise of reconnaissance tools in the last decade has been remarkable.

And understandably so; cybersecurity continues to receive significant attention on all fronts, from secretive accounts of cyber espionage to the now rather ubiquitous corporate breach scenarios pressuring organizations across the globe. Better security comes at a price too, and in the absence of significant security measures anti-patterns quickly evolve to give miscreants ample targets of opportunity. While the existence of indiscriminate internet scanning is largely accepted, automating the information gathering process in a meaningful and productive fashion entails a conscientious effort to arrive at a suitable combination of the best tools and techniques.

In the recent past, fine-grained intelligence driven by tools like Nmap, and its supporting Nmap Scripts (NSE) platform, have hinted at the success of open-source tools in dealing with footprinting, the active collection of infrastructure data points, and other interesting aspects, beyond simple enumeration, a growing trend in the identification of exposed assets and applications. In this blog post, we'll examine the Nmap Automator project, as it automates and extends the classification and vulnerability assessment stages of targeted infrastructure via the traditional triggers provided by Nmap's most prominent features, which include port scanning and similar methods. Introducing such a tool would not be complete without practical examples and potential use cases, including some instructions to deliver a seamless setup experience.

Let's take a peek.

What is Nmap Automator?

The Nmap automator, otherwise known as Nmap Automator, is essentially a Posix-compatible shell script that automates the process of target discovery, enumeration, and reconnaissance by leveraging Nmap commands in a unique way. Normally, mastering a tool like Nmap will require not only the ability to memorize and apply a myriad of command-line arguments, or flags, but also the capacity to transform a wealth of output into a consumable product; consequently, conducting scanning activities with such level of detail can easily take several days (if not weeks) to complete. Depending on certain host and network conditions, Nmap Automator can deploy a full-range Nmap vulnerability scan and CVE identification sequence well under 30 minutes. This may seem like a long time, but keep in mind that the scan types are designed to produce as much actionable intelligence about a target as possible.

Additionally, Nmap Automator includes running instances of tools such as SSLscan, Nikto, and FFUF, all known throughout the bug bounty and pentesting ecosystems. In all, Nmap Automator supports the following scanning features:

Network: Shows all live hosts in the host's network (approximately 15 seconds). Port: Shows all open ports (approximately 15 seconds). Script: Runs a script scan on found ports (approximately 5 minutes). Full: Runs a full range port scan, then runs a thorough scan on new ports (approximately 5-10 minutes). UDP: Runs a UDP scan "requires sudo" (approximately 5 minutes). Vulns: Runs CVE scan and Nmap Vulns scan on all found ports (approximately 5-15 minutes). Recon: Suggests recon commands, then prompts to automatically run them. All: Runs all the scans (approximately 20-30 minutes).

For example, the -Network option allows to provide a single IP address and discover live hosts in the same subnet:

Nmap automation on remote hosts via Nmap Automator can be achieved with the help of the -r/--remote flag. Known as Remote Mode, this feature (still under development) was designed to harness Posix shell commands without relying on any external tools.

Installing Nmap Automator

Many of the ethical hacking tools required by Nmap Automator should already be part of popular distributions such as Kali Linux and Parrot OS. Besides S...

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

Last week we announced the general release of SecurityTrails SQL. And today we're excited to let you know that we've been working on improving the overall UX experience of many of our products with a new, unified design.

A new, unified look and feel

One of the first changes you'll notice is the updated sign in interface, distinguished by our brand new light-violet color scheme. As you can see, these before-and-after screenshots indicate some truly helpful improvements. These include significant changes to the colors we use as well as the presentation of our layout design.

Surface browser

As part of the new Surface browser palette, we're using high-contrast colors for the text, rounded borders and faded-style items on the left menu, and an organized approach for the rest of the pages that makes them easy on the eyes and a breath of fresh air for your research tasks. We're also introducing a new Dark theme that can be turned on by using a switch located near the footer: This dark mode will help to reduce eye strain by cutting down on direct light exposure. Some of our users already love it, finding interfaces and texts easier to visualize in dark mode than on a bright white screen.

ASR version 2

When it comes to Attack Surface Reduction, this redesign is a perfect fit for users seeking to locate the most important data in the blink of an eye, as you can see from the main ASR version 2 interface: All ASR version 2 pages also use the same style by default, highlighting information from your organization in a simple and appealing way. And it looks awesome on any screenshot you want to put in your report.

Console

The Console is also enhanced with rounded borders on corners and buttons, and our light violet backgrounds can be found on most menu areas as well, resulting in a dashboard that's solid, attractive and easier to navigate than ever before. Graphics on the console also look amazing with this new color palette, making interaction with stats, numbers and general text more simple and straightforward.

Our free web app

For those who love to enrich their security research by using our free app, we're happy to say that it has also received the same design updates, including the dark mode switch located on the lower left:

We would love to hear your feedback regarding the new UX changes for our products, console and free app. Get in touch with us, and most importantly, stay tuned—because we're preparing even more exciting UX improvements!

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

Last week we announced the general release of SecurityTrails SQL. And today we're excited to let you know that we've been working on improving the overall UX experience of many of our products with a new, unified design.

A new, unified look and feel

One of the first changes you'll notice is the updated sign in interface, distinguished by our brand new light-violet color scheme. As you can see, these before-and-after screenshots indicate some truly helpful improvements. These include significant changes to the colors we use as well as the presentation of our layout design.

Surface browser

As part of the new Surface browser palette, we're using high-contrast colors for the text, rounded borders and faded-style items on the left menu, and an organized approach for the rest of the pages that makes them easy on the eyes and a breath of fresh air for your research tasks. We're also introducing a new Dark theme that can be turned on by using a switch located near the footer: This dark mode will help to reduce eye strain by cutting down on direct light exposure. Some of our users already love it, finding interfaces and texts easier to visualize in dark mode than on a bright white screen.

ASR version 2

When it comes to Attack Surface Reduction, this redesign is a perfect fit for users seeking to locate the most important data in the blink of an eye, as you can see from the main ASR version 2 interface: All ASR version 2 pages also use the same style by default, highlighting information from your organization in a simple and appealing way. And it looks awesome on any screenshot you want to put in your report.

Console

The Console is also enhanced with rounded borders on corners and buttons, and our light violet backgrounds can be found on most menu areas as well, resulting in a dashboard that's solid, attractive and easier to navigate than ever before. Graphics on the console also look amazing with this new color palette, making interaction with stats, numbers and general text more simple and straightforward.

Our free web app

For those who love to enrich their security research by using our free app, we're happy to say that it has also received the same design updates, including the dark mode switch located on the lower left:

We would love to hear your feedback regarding the new UX changes for our products, console and free app. Get in touch with us, and most importantly, stay tuned—because we're preparing even more exciting UX improvements!

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

Last week we announced the general release of SecurityTrails SQL. And today we're excited to let you know that we've been working on improving the overall UX experience of many of our products with a new, unified design.

A new, unified look and feel

One of the first changes you'll notice is the updated sign in interface, distinguished by our brand new light-violet color scheme. As you can see, these before-and-after screenshots indicate some truly helpful improvements. These include significant changes to the colors we use as well as the presentation of our layout design.

Surface browser

As part of the new Surface browser palette, we're using high-contrast colors for the text, rounded borders and faded-style items on the left menu, and an organized approach for the rest of the pages that makes them easy on the eyes and a breath of fresh air for your research tasks. We're also introducing a new Dark theme that can be turned on by using a switch located near the footer: This dark mode will help to reduce eye strain by cutting down on direct light exposure. Some of our users already love it, finding interfaces and texts easier to visualize in dark mode than on a bright white screen.

ASR version 2

When it comes to Attack Surface Reduction, this redesign is a perfect fit for users seeking to locate the most important data in the blink of an eye, as you can see from the main ASR version 2 interface: All ASR version 2 pages also use the same style by default, highlighting information from your organization in a simple and appealing way. And it looks awesome on any screenshot you want to put in your report.

Console

The Console is also enhanced with rounded borders on corners and buttons, and our light violet backgrounds can be found on most menu areas as well, resulting in a dashboard that's solid, attractive and easier to navigate than ever before. Graphics on the console also look amazing with this new color palette, making interaction with stats, numbers and general text more simple and straightforward.

Our free web app

For those who love to enrich their security research by using our free app, we're happy to say that it has also received the same design updates, including the dark mode switch located on the lower left:

We would love to hear your feedback regarding the new UX changes for our products, console and free app. Get in touch with us, and most importantly, stay tuned—because we're preparing even more exciting UX improvements!

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

Last week we announced the general release of SecurityTrails SQL. And today we're excited to let you know that we've been working on improving the overall UX experience of many of our products with a new, unified design.

A new, unified look and feel

One of the first changes you'll notice is the updated sign in interface, distinguished by our brand new light-violet color scheme. As you can see, these before-and-after screenshots indicate some truly helpful improvements. These include significant changes to the colors we use as well as the presentation of our layout design.

Surface browser

As part of the new Surface browser palette, we're using high-contrast colors for the text, rounded borders and faded-style items on the left menu, and an organized approach for the rest of the pages that makes them easy on the eyes and a breath of fresh air for your research tasks. We're also introducing a new Dark theme that can be turned on by using a switch located near the footer: This dark mode will help to reduce eye strain by cutting down on direct light exposure. Some of our users already love it, finding interfaces and texts easier to visualize in dark mode than on a bright white screen.

ASR version 2

When it comes to Attack Surface Reduction, this redesign is a perfect fit for users seeking to locate the most important data in the blink of an eye, as you can see from the main ASR version 2 interface: All ASR version 2 pages also use the same style by default, highlighting information from your organization in a simple and appealing way. And it looks awesome on any screenshot you want to put in your report.

Console

The Console is also enhanced with rounded borders on corners and buttons, and our light violet backgrounds can be found on most menu areas as well, resulting in a dashboard that's solid, attractive and easier to navigate than ever before. Graphics on the console also look amazing with this new color palette, making interaction with stats, numbers and general text more simple and straightforward.

Our free web app

For those who love to enrich their security research by using our free app, we're happy to say that it has also received the same design updates, including the dark mode switch located on the lower left:

We would love to hear your feedback regarding the new UX changes for our products, console and free app. Get in touch with us, and most importantly, stay tuned—because we're preparing even more exciting UX improvements!

Every organization with a cybersecurity strategy has the goal of stopping cyber threats before they become real attacks and cause damage. Because of this, most cybersecurity strategies have turned to more proactive approaches, rather than relying only on reactive security measures.

Vulnerability assessment, the use of cyber intelligence feeds, attack surface management and other processes are all used to prevent threats from becoming security breaches. Organizations have also turned to solutions that detect and prevent cyberattacks by monitoring early indicators of attack in network traffic. After all, nearly all types of cyber threats use network communications as part of the attack. The concept of monitoring network traffic to detect anomalous activity has been around for decades, with intrusion detection systems (IDS), the go-to solution for this purpose. As networks and their threats advanced, so did the need for a solution that can combine detection and threat response. The technology that resulted from this are intrusion prevention systems.

What are intrusion prevention systems (IPS)?

If we go back to the analogy of an IDS being a security system in your house, then IPS would be the security guard who can actively put a halt to incoming threats. While the security system is important in that it can alert the guard of a potential threat, it can't take any action against it. An intrusion prevention system (IPS) is a network security solution that continuously monitors the traffic going in and out of an organization's network. It looks for potentially malicious activity and takes action against any such wrongdoing by alerting, stopping or dropping it from continuing. Since exploits can be executed rather quickly after a malicious actor gains initial access to a network, intrusion prevention systems carry out an automated response to a suspected threat, based on pre-established rules.

IPS is used as one of the measures in an incident response plan, and in terms of technology, organizations use IPS for identifying insider threats that can result in internal security policy issues or compliance violations. IPS solutions shine the most, though, when it comes to preventing external cyber threats.

Some of the most common network threats IPS is designed to prevent are:

DDoS attacks. Computer viruses. Brute force attacks. Zeroday exploits. Buffer overflow attacks. ARP spoofing.

IPS has become one of the founding blocks of many organizations' security strategies and infrastructures.

Evolution of IPS

In the early days of IPS technology, few organizations used it due to different concerns. IPS sat in line between an organization's network and the internet, and because early IPS systems relied on using a signature database against which they would match observed network traffic, the process had the potential to actually slow down network traffic—which certainly isn't ideal. Additionally, there were concerns over IPS blocking potentially harmless traffic; at that time, IPS would immediately block anomalous traffic whenever it was detected. Organizations would then run the risk of blocking traffic from actual prospects (also not ideal). The developing advancements in IPS, which led to what is commonly referred to as next-generation IPS, helped bridge these holes in functionality with faster deep-packet inspection, machine learning for detection and sandboxing and/or emulation capabilities. Today, we commonly see IPS as part of next-generation firewalls (NGFW).

This gives IPS more advanced abilities to take action and block malicious traffic and malware, and reconfigure the firewall itself to block future traffic of the same kind.

How does an intrusion prevention system work?

The main goal of intrusion prevention systems is to quickly identify suspicious activity, log relevant information and attempt to block that activity while it reports it to the security team. IPS stands on the perimeter of the network and provides active scanning ...

Cyber criminals target networks in the private and public sector every day, and their threat is growing. Cyber attacks are becoming more common, more menacing, and in the public sector, can compromise public services and put sensitive data at risk. It happens all the time in the private sector too: companies are attacked for trade secrets, customer information and other confidential details. Individuals aren’t spared either and are falling victim to identity theft, fraud and various other types of cybercrime.

For the prosecution of such acts, preserving and recovering digital evidence is absolutely critical. In the same way a "traditional" detective or law enforcement agent explores crimes in the physical or material sense, a cybercrime investigator delves into internet-based crimes. A cybercrime investigation is the process of investigating, analyzing and recovering digital forensics data from networks that have been attacked, in order to identify not only the perpetrators but their intentions as well. Cybercrime investigations are conducted by experts in criminal justice, national security and private security agencies, and cybersecurity investigators, experts and blue teams all play an indispensable role in preventing, monitoring, migrating and investigating all types of cybercrime against networks, servers and data in private organizations, as well as home devices.

Top 8 cybercrime investigation and digital forensics courses and certs

Cybersecurity investigators are highly knowledgeable in numerous aspects of cybercrime, including their different types, legal aspects, methods of protection, necessary investigation techniques, and digital forensics. In order to deal with cybercrime incidents in the appropriate manner, from incident response to acquisition and preservation of evidence and advanced forensic analysis, cybercrime investigators require a combination of education and experience to be successful. For aspiring as well as experienced cybercrime investigators seeking additional knowledge and education, courses and certifications provide a wise option. Security professionals working in other fields can also benefit from acquiring cybercrime investigation and digital forensics skills.

Some general information security certifications such as the Certified Information Systems Security Professional (CISSP) and Offensive Security Certified Professional (OSCP) can be highly useful for cybercrime and digital forensics investigators. Other, more specialized certifications and online courses in the field are also recognized in the industry. We rounded up our picks for the best cybercrime investigation courses and certifications, listed in no particular order. The list is more focused on vendor-neutral courses and certs so the well-known AccessData Certified Examiner certification didn't make this list.

1. The IFCI Expert Cybercrime Investigator (CCI) course

The Cybercrime Investigator's course (CCI) is the flagship training program of The International Fraternity of Cybercrime Investigators available on Udemy. Also known as the IFCI-CCI, this course provides the foundational knowledge needed to kickstart a cybercrime investigator's career, and then some. The CCI covers every aspect of a cybercrime investigation including intrusion investigations, incident response, attack vector identification, and cybercrime profiling, with hands-on labs emulating real-world scenarios. The main goal of the course is to arm aspiring cybercrime investigators with the knowledge and skills needed to perform their work successfully. The course features 13 sections with more than 100 lectures and 15 labs. The sections include:

Core concepts of computer forensics. Incident response and forensic acquisition. File deletion recovery. Email analysis. Internet activity analysis. Malware and network intrusion analysis. Dynamic malware analysis.

By taking the CCI cybercrime investigation course, students will be able to respond to cybercrime incidents, ...

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

Over the past few months, we’ve been perfecting our new SQL-like query language, one that will allow security teams to perform massive intelligence collection as well as automate their findings. Today, we’re excited to announce the general release of this powerful new product: Securitytrails SQL.

By contacting our Sales team, you will be able to use SecurityTrails SQL integrated as a Securitytrails API endpoint, inside Attack Surface Reduction, as well as in the Surfacebrowser SQL Explorer interface.

What does Securitytrails SQL look like?

Securitytrails SQL will empower you to collect data about any host, including domains, DNS records, Whois, SSL, HTTP, and the organization it belongs to, along with detailed IP data. For your convenience, this tool also supports a wide range of SQL operators and with it we provide full documentation complete with examples and technical assistance. Additionally, SurfaceBrowser SQL Explorer users can enjoy our SQL editor, which allows you to run queries, copy data from it, format and clear everything, as well as download results in JSON or CSV.

How can I use Securitytrails SQL?

You can use Securitytrails SQL to run different queries to get host, IP and SQL data. And how does the Securitytrails SQL look when used from SQL Explorer's visual editor? See it in action: Now let's look at some query examples you can run from your Securitytrails API. The following query will expose all subdomains from microsoft.com: In the same way, and by merely changing the SQL-query, you can fetch different data. To find all exposed development areas of subdomains ranked by Open PageRank, run: To locate self-signed SSL certificates, using GE.com for this example, run this query: You can find more SSL-based examples in the SQL Explorer: SSL Certificate Scraping Showcase blog post. If you want to find domains that redirect to a certain host—and here we used Securitytrails.com—use: Explore even more ways to query our HTTP header data inside SQL Explorer.

To find IPs with SSL certificates that contain a specific hostname in them, like Nike.com for instance, run: There is much more functionality to be discovered once you start playing with Securitytrails SQL. Security teams can use it to:

Automate detection of security issues. Map your entire digital infrastructure. Find critical SSL data. Detect open services. Improve phishing detection. Prevent data breaches. Find vulnerable operating systems and services.

Are you ready to explore Securitytrails SQL?

Find out how Securitytrails SQL can help you find critical data from any organizations within seconds—and take your recon and app automation to the next level!

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

Over the past few months, we’ve been perfecting our new SQL-like query language, one that will allow security teams to perform massive intelligence collection as well as automate their findings. Today, we’re excited to announce the general release of this powerful new product: Securitytrails SQL.

By contacting our Sales team, you will be able to use SecurityTrails SQL integrated as a Securitytrails API endpoint, inside Attack Surface Reduction, as well as in the Surfacebrowser SQL Explorer interface.

What does Securitytrails SQL look like?

Securitytrails SQL will empower you to collect data about any host, including domains, DNS records, Whois, SSL, HTTP, and the organization it belongs to, along with detailed IP data. For your convenience, this tool also supports a wide range of SQL operators and with it we provide full documentation complete with examples and technical assistance. Additionally, SurfaceBrowser SQL Explorer users can enjoy our SQL editor, which allows you to run queries, copy data from it, format and clear everything, as well as download results in JSON or CSV.

How can I use Securitytrails SQL?

You can use Securitytrails SQL to run different queries to get host, IP and SQL data. And how does the Securitytrails SQL look when used from SQL Explorer's visual editor? See it in action: Now let's look at some query examples you can run from your Securitytrails API. The following query will expose all subdomains from microsoft.com: In the same way, and by merely changing the SQL-query, you can fetch different data. To find all exposed development areas of subdomains ranked by Open PageRank, run: To locate self-signed SSL certificates, using GE.com for this example, run this query: You can find more SSL-based examples in the SQL Explorer: SSL Certificate Scraping Showcase blog post. If you want to find domains that redirect to a certain host—and here we used Securitytrails.com—use: Explore even more ways to query our HTTP header data inside SQL Explorer.

To find IPs with SSL certificates that contain a specific hostname in them, like Nike.com for instance, run: There is much more functionality to be discovered once you start playing with Securitytrails SQL. Security teams can use it to:

Automate detection of security issues. Map your entire digital infrastructure. Find critical SSL data. Detect open services. Improve phishing detection. Prevent data breaches. Find vulnerable operating systems and services.

Are you ready to explore Securitytrails SQL?

Find out how Securitytrails SQL can help you find critical data from any organizations within seconds—and take your recon and app automation to the next level!

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

Over the past few months, we’ve been perfecting our new SQL-like query language, one that will allow security teams to perform massive intelligence collection as well as automate their findings. Today, we’re excited to announce the general release of this powerful new product: Securitytrails SQL.

By contacting our Sales team, you will be able to use SecurityTrails SQL integrated as a Securitytrails API endpoint, inside Attack Surface Reduction, as well as in the Surfacebrowser SQL Explorer interface.

What does Securitytrails SQL look like?

Securitytrails SQL will empower you to collect data about any host, including domains, DNS records, Whois, SSL, HTTP, and the organization it belongs to, along with detailed IP data. For your convenience, this tool also supports a wide range of SQL operators and with it we provide full documentation complete with examples and technical assistance. Additionally, SurfaceBrowser SQL Explorer users can enjoy our SQL editor, which allows you to run queries, copy data from it, format and clear everything, as well as download results in JSON or CSV.

How can I use Securitytrails SQL?

You can use Securitytrails SQL to run different queries to get host, IP and SQL data. And how does the Securitytrails SQL look when used from SQL Explorer's visual editor? See it in action: Now let's look at some query examples you can run from your Securitytrails API. The following query will expose all subdomains from microsoft.com: In the same way, and by merely changing the SQL-query, you can fetch different data. To find all exposed development areas of subdomains ranked by Open PageRank, run: To locate self-signed SSL certificates, using GE.com for this example, run this query: You can find more SSL-based examples in the SQL Explorer: SSL Certificate Scraping Showcase blog post. If you want to find domains that redirect to a certain host—and here we used Securitytrails.com—use: Explore even more ways to query our HTTP header data inside SQL Explorer.

To find IPs with SSL certificates that contain a specific hostname in them, like Nike.com for instance, run: There is much more functionality to be discovered once you start playing with Securitytrails SQL. Security teams can use it to:

Automate detection of security issues. Map your entire digital infrastructure. Find critical SSL data. Detect open services. Improve phishing detection. Prevent data breaches. Find vulnerable operating systems and services.

Are you ready to explore Securitytrails SQL?

Find out how Securitytrails SQL can help you find critical data from any organizations within seconds—and take your recon and app automation to the next level!