Session 03 / 14 BugXploit Workshop

Day 3: Active vs. Passive Reconnaissance, Bugcrowd Target Scoping & OSINT Tooling

Report By: TheWH2 Instructors: Birendra Sah • Bishal Shrestha Institute: BugXploit (Koteshwor) Read Time: ~12 mins

Security Notice & Lab Scope

This session focused on open-source intelligence (OSINT) and legal attack surface mapping. All live target examples were evaluated strictly against public bug bounty guidelines (such as the Bugcrowd Tesla engagement) in compliance with documented Rules of Engagement.

Table of Contents

1. Core Concepts: Active vs. Passive Reconnaissance

In offensive security and penetration testing, Reconnaissance (Information Gathering) is the vital first phase. More than 70% of a successful penetration test or bug bounty assessment depends on how comprehensively the attack surface is discovered and mapped.

Instructor Birendra Sah introduced the core division between the two primary recon methodologies:

Stealth / Indirect

Passive Reconnaissance

Gathering intelligence about a target without directly interacting or sending network packets to the target’s infrastructure.

  • Uses public records, third-party databases, and search caches.
  • Completely invisible to the target’s Web Application Firewalls (WAF), IDS/IPS, and server logs.
  • Tools: Google Dorking, DNSDumpster, crt.sh, WHOIS, Wayback Machine, Shodan.
Direct / Interactive

Active Reconnaissance

Interacting directly with the target’s servers, network ports, or web applications to probe services, test inputs, and map live hosts.

  • Transmits probes, SYN packets, HTTP requests, or DNS queries directly to target IP addresses.
  • Leaves traceable footprints in access logs and can trigger WAF rate-limiting or SOC alerts.
  • Tools: Nmap, directory brute-forcers (ffuf, dirsearch), live port pinging, interactive browser tests.

2. Target Scoping on Bugcrowd: Tesla Engagement

Before conducting any reconnaissance, ethical hackers must identify the Rules of Engagement and strictly defined In-Scope vs. Out-of-Scope assets.

We navigated to the public Bugcrowd bounty page for Tesla:

Engagement URL: https://bugcrowd.com/engagements/tesla
Target: Tesla Global Web, Vehicle & Energy Product Infrastructure
View Bugcrowd Program

Why Target Scoping Matters:

  • In-Scope Assets: Primary domains and wildcard subdomains (e.g., *.tesla.com, *.tesla.cn, energy portals) where security reporting is authorized and rewarded.
  • Out-of-Scope Restrictions: Third-party hosted services, Denial of Service (DoS/DDoS) attacks, social engineering against employees, or physical attacks on superchargers/factories. Testing outside the scope is illegal and leads to platform bans.

3. Subdomain Enumeration via Subdomainfinder (c99.nl)

Subdomains represent expanded attack surfaces. While tesla.com is protected by enterprise WAFs and hardened configurations, internal subdomains (staging, admin portals, beta APIs, development Jenkins pipelines) often run forgotten, vulnerable software.

Subdomainfinder c99.nl
Visit Tool

What it does: An automated online OSINT aggregator that scrapes DNS records, search engine indexes, threat intelligence feeds, and historical web logs to discover active and inactive subdomains belonging to a root domain.

Benefits for Hackers: Instant list of subdomains with resolved IP addresses, HTTP response codes, and cloud hosting providers (AWS, Cloudflare, Akamai) without running noisy brute-force scripts locally.

4. DNS Topology & Attack Surface Mapping: DNSDumpster

DNS records reveal who manages the domain, where email is routed, and what internal name servers are utilized.

DNSDumpster
Visit Tool

What it does: A specialized domain research tool that discovers DNS records including A, MX, NS, SOA, and TXT records, and visually renders an interactive network topology map of the target organization's server infrastructure.

Key Benefits:

  • Discovers mail servers (MX) and name servers (NS) to identify third-party SaaS vendors.
  • Uncovers TXT records containing SPF configurations, DKIM verification keys, and legacy verification tokens.
  • Generates an Excel/XLS export and interactive node graph of interconnected hostnames and network ranges.

5. Google Dorking (Google Hacking Database - GHDB)

Google Dorking (advanced search engine operators) allows security researchers to filter out millions of generic web pages and zero in on sensitive documents, forgotten configuration files, and unlinked endpoints.

We practiced several core Google Dorks targeting the Tesla attack surface:

Google Dork Operator Purpose & Mechanism Security Implication
site:*.tesla.com Discovers all indexed subdomains under the root domain tesla.com. Maps out forgotten customer portals, localized market sites, and regional sub-sites.
site:*.tesla.com /signup Filters indexed Tesla subdomains specifically containing registration or sign-up endpoints. Identifies entry points for account creation vulnerabilities, user enumeration, and parameter testing.
site:*.tesla.com -www Excludes the main marketing website (www.tesla.com) to reveal all other subdomains. Eliminates noise so penetration testers can focus exclusively on secondary infrastructure.
site:tesla.com filetype:pdf OR filetype:xls OR filetype:docx Finds publicly indexed internal documents and spreadsheets. Can expose internal business processes, network layouts, and employee contact lists.
site:tesla.com inurl:admin OR inurl:login Searches for internal login interfaces, administrative dashboards, or single sign-on (SSO) gateways. Pinpoints authentication portals that may be vulnerable to default credentials or brute-force.
site:tesla.com ext:env OR ext:yaml OR ext:conf Searches for accidentally exposed server environment configurations. High-severity risk of database passwords, API secret keys, and AWS credentials leakage.

6. Certificate Transparency Logs via crt.sh

crt.sh (Certificate Search)
Visit Tool

What it does: A public search engine for Certificate Transparency (CT) logs. CT is an open framework where Certificate Authorities (CAs) like Let's Encrypt, DigiCert, and Sectigo must publicly log every single SSL/TLS certificate issued for any domain on the internet.

Query Syntax: Searching for %.tesla.com lists every certificate ever requested for any Tesla subdomain.

Why Hackers Love crt.sh:

  • Reveals brand-new staging and development subdomains the exact day developers request an SSL certificate—often weeks before the application is officially launched or listed in public DNS.
  • Historical CT records remain permanent even if the domain is later decommissioned, revealing old endpoints.

7. Domain Ownership & Registration: WHOIS & who.is

Domain registration records provide essential details regarding ownership, creation date, renewal timelines, and authoritative registrar contacts.

WHOIS.com whois.com

Provides authoritative lookup for ICANN domain registries, technical point of contact, administrative email, registrar name (e.g., MarkMonitor, GoDaddy), and name server delegations.

who.is who.is

Offers clean UI breakdowns of DNS records, domain status codes (ClientTransferProhibited), ASN organization numbers, and reverse-IP co-hosted domains.

Note: While modern privacy laws (GDPR) redact personal registrant names behind proxy guards, WHOIS remains crucial for discovering company registrar providers, expiration dates (for domain hijacking/takeover risks), and parent organizations.

8. Mail Servers & Reverse IP: MXToolbox SuperTool

MXToolbox SuperTool
Visit Tool

What it does: A comprehensive network diagnostic suite capable of performing deep MX (Mail Exchange) lookups, Reverse IP lookups (PTR), DNS propagation checks, and SMTP server health diagnostics.

Key Security Auditing Applications:

  • SPF & DMARC Validation: Checks whether the target domain has configured strict Sender Policy Framework (SPF) and DMARC policies (p=reject vs p=none). Weak policies allow attackers to spoof legitimate company emails.
  • Reverse IP Lookup: Identifies all other domains sharing the same server or IP address, opening secondary pivot avenues.
  • DNS Blacklist Check: Identifies if target mail servers are flagged for reputation issues or spam relays.

9. Email Spoofing Mechanics & Defense Analysis: Emkei.cz

Emkei.cz (Fake Mailer)
Visit Emkei

What it does: An online free fake mailer that sends emails with arbitrary sender addresses (From header spoofing) using direct SMTP connections without authentication.

How it was used in class: Birendra Sir demonstrated how unauthenticated SMTP allows anyone to craft an email claiming to originate from ceo@tesla.com or admin@target.com, illustrating why email authentication mechanisms are mandatory in defensive engineering.

Defensive Engineering Countermeasures:
  • SPF (Sender Policy Framework): Specifies authorized IP addresses permitted to send mail on behalf of the domain.
  • DKIM (DomainKeys Identified Mail): Cryptographically signs messages with a private key verified via public DNS.
  • DMARC (Domain-based Message Authentication): Instructs receiving mail servers to quarantine or reject spoofed emails failing SPF/DKIM validation.

10. In-Depth DNS Diagnostics: NsLookup.io

NsLookup.io
Visit Tool

What it does: A modern, zero-telemetry DNS query platform that performs real-time queries against authoritative name servers, Cloudflare (1.1.1.1), Google (8.8.8.8), and OpenDNS.

Penetration Testing Value:

  • Inspects IPv4 (A) and IPv6 (AAAA) records, CNAME alias chains, and Canonical Name pointers.
  • Detects DNS misconfigurations and broken CNAME pointers which can lead to Subdomain Takeover vulnerabilities (e.g., a CNAME pointing to an unclaimed AWS S3 bucket, GitHub Pages, or Zendesk helpdesk).

11. Historical Reconnaissance: Wayback Machine (archive.org)

Websites evolve constantly. Developers frequently remove links to sensitive endpoints from the main page navigation, but the underlying API routes or legacy login interfaces remain active on the web server!

Internet Archive Wayback Machine
Visit Archive

What it does: Indexes snapshots of billions of web pages dating back over two decades.

Targeted API & Endpoint Hunting: In class, we learned how querying targeted URL paths on web.archive.org reveals old, forgotten API structures, deprecated parameters, and development routes:

https://web.archive.org/web/*/https://tesla.com/*
https://web.archive.org/web/*/https://tesla.com/api/*
https://web.archive.org/web/*/https://tesla.com/api/user/*

Security Impact: Hackers frequently discover deprecated API v1 endpoints that lack modern rate limiting or token authentication, allowing bypasses against backend databases.

12. The Search Engine for the Internet of Everything: Shodan

Unlike Google, which crawls web page content and links, Shodan crawls the entire internet scanning every IP address and indexing service banners, open ports, operational metadata, and IoT devices.

Shodan Dashboard & Ecosystem
Shodan Dashboard

What it indexes: Webcams, routers, industrial control systems (SCADA), database servers (Elasticsearch, MongoDB), smart cars, medical devices, and exposed server ports worldwide.

A. Shodan Dorks & Filter Syntax

Shodan filters enable surgical queries across specific organizations, cities, operating systems, and ports: 

# Find servers belonging to an organization
org:"Tesla Motors"

# Find exposed HTTP servers in a specific country with specific headers
ssl:"Tesla" port:443

# Find unauthenticated MongoDB instances
"MongoDB Server Information" port:27017 -authentication

# Find open webcams and surveillance feeds
"default password" port:80,8080

# Filter by country, city, and product
product:"Apache httpd" country:"NP" city:"Kathmandu"

Reference Cheat Sheet: Shodan Dork Cheat Sheet on Scribd

B. Shodan CVE Database (cvedb.shodan.io)

We also explored cvedb.shodan.io, Shodan’s dedicated vulnerability intelligence search engine:

  • Cross-references Common Vulnerabilities and Exposures (CVEs) with live internet exposures.
  • Allows researchers to search a CVE (e.g., Log4j CVE-2021-44228, OpenSSL vulnerabilities) and immediately identify how many vulnerable systems remain publicly reachable on the global internet.
  • Provides EPSS (Exploit Prediction Scoring System) data and verified public exploit availability indicators.

13. Day 3 Key Takeaways & Methodology Summary

  • Passive Reconnaissance First: Always exhaust passive OSINT techniques before sending active packets. Passive recon is undetectable, legal, and creates an exhaustive footprint map.
  • Respect Target Scope: Always verify Bugcrowd/HackerOne engagement scopes (like Tesla) to avoid unauthorized actions.
  • Subdomain Aggregation: Cross-reference automated tools (c99 Subdomainfinder), Certificate Transparency logs (crt.sh), and DNS record aggregators (DNSDumpster) for complete coverage.
  • Google Dorking Power: Operators like site:, inurl:, and filetype: reveal forgotten endpoints, registration portals, and credential leaks.
  • Email Protection Triad: Emkei.cz demonstrates the fragility of raw SMTP; organizations must enforce strict SPF, DKIM, and DMARC reject policies to prevent spoofing.
  • Historical Discovery: The Wayback Machine lets testers reconstruct dead API endpoints (/api/user/) that might still be alive on unpatched backend servers.
  • Global IoT Visibility: Shodan and CVE DB turn internet banners into actionable intelligence without firing a single probe directly from your machine.
WARNING: Strictly For Educational & Defensive Purposes Only

All intelligence gathering, subdomain searching, and OSINT techniques documented here must be performed strictly within the bounds of applicable laws and authorized bug bounty program scopes. Sending unauthorized spoofed emails, performing intrusive scanning on out-of-scope targets, or exploiting identified vulnerabilities without written consent is illegal under the Electronic Transactions Act (ETA) of Nepal and international cybercrime legislation. TheWH2 and BugXploit promote ethical, white-hat security research.

Previous: Day 2 Workshop Overview Next: Day 4