Website OSINT

Methodology

• Search for any websites that connects back to your target website.

• What technologies does the website use.

  • Use: Wappalyzer

• Get Whois info

  • Who owns the website/domain

  • Nameservers

  • When was the domain registered

• Get website IP information

• Do reverse IP lookup to get any websites tied to the IP address

• Who is hosting the website (web hosting)

• Where is the website hosted (Location)

• Check if the website was cached somewhere (similar to wayback machine)

• Can you monitor website changes

  • Use Visual Ping

• What services are running on the web server where the website is hosted

  • Use: Wappalyzer

• Get website subdomains

  • Certificate search: Crt.sh

• Are there any Tag manager (Analytics code) that ties to the website (Google analytics)

• DNS records

  • MX records - What email are they using (Exchange, GSuite, etc.)

Google Dorking

• "[DOMAIN]": Displays all pages that includes the domain/website.

• site:[DOMAIN]: All pages from the given domain.

Shodan

• city:[CITY] port:[PORT] org:[ORG]: Checks for open port for an org in a city

city:Los Angeles port:3389 org:Verizon

Tools

• BuiltWith: https://builtwith.com/

  • Displays all web technologies that the website uses.

• Domain Dossier: https://centralops.net/co/

• DNSlytics: https://dnslytics.com/reverse-ip

• SpyOnWeb: https://spyonweb.com/

• Virus Total: https://www.virustotal.com/

  • Can provide useful information when scanning a website/domain

• Visual Ping: https://visualping.io/

  • Monitors website changes

• Back Link Watch: http://backlinkwatch.com/index.php

  • Checks where your website/domain was posted somewhere else.

• View DNS: https://viewdns.info/

  • Web related toolbox

• Urlscan.io: https://urlscan.io/

  • Scans the website and provide plenty of useful information

• DNSdumpster: https://dnsdumpster.com/

• Web Check: https://web-check.as93.net/

• Crt.sh: https://crt.sh/

• Shodan: https://shodan.io

• Wayback Machine: https://web.archive.org/

• WhoIs: https://www.whois.com/whois/

• Wappalyzer: https://www.wappalyzer.com/