Large-Scale Reconnaissance Methodology¶

# Define primary targets and scope boundaries
echo "Primary Target: nba.com" > scope.txt
echo "Include: *.nba.com, *.wnba.com, *.gleague.nba.com" >> scope.txt
echo "Exclude: Social media accounts, third-party CDNs" >> scope.txt

# Ensure all reconnaissance tools are available and updated
export PATH=$PATH:/home/pierce/go/bin
subfinder -version
assetfinder --help
httpx -version
nuclei -version

# Primary subdomain discovery with subfinder
subfinder -d nba.com -all -recursive -o nba_subdomains_subfinder.txt

# Supplementary discovery with assetfinder
assetfinder --subs-only nba.com > nba_subdomains_assetfinder.txt

# Combine and deduplicate results
cat nba_subdomains_*.txt | sort -u > nba_all_subdomains.txt

# Certificate transparency logs
curl -s "https://crt.sh/?q=%.nba.com&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u > nba_crt_subdomains.txt

# DNS bruteforcing for additional discovery
amass enum -passive -d nba.com -o nba_amass_subdomains.txt

# Merge all sources
cat nba_*_subdomains.txt | sort -u > nba_final_subdomains.txt

# Generate discovery statistics
echo "Total subdomains discovered: $(wc -l < nba_final_subdomains.txt)"
echo "Subfinder results: $(wc -l < nba_subdomains_subfinder.txt)"
echo "Assetfinder results: $(wc -l < nba_subdomains_assetfinder.txt)"
echo "Certificate transparency: $(wc -l < nba_crt_subdomains.txt)"

# Discover live web services
httpx -l nba_final_subdomains.txt -o nba_live_services.txt

# Enhanced fingerprinting with additional data
httpx -l nba_final_subdomains.txt \
    -title -tech-detect -status-code -content-length \
    -o nba_web_services.json -json

# Extract different service types from httpx output
jq -r 'select(.tech != null) | "\(.url) - \(.tech[])"' nba_web_services.json > nba_technology_stack.txt

# Categorize by response codes
jq -r 'select(.status_code == 200) | .url' nba_web_services.json > nba_200_services.txt
jq -r 'select(.status_code == 403) | .url' nba_web_services.json > nba_403_services.txt
jq -r 'select(.status_code == 404) | .url' nba_web_services.json > nba_404_services.txt

# Identify service patterns
grep -E "(api|dev|staging|test|admin)" nba_live_services.txt > nba_interesting_services.txt
grep -E "(cms|portal|dashboard|admin)" nba_live_services.txt > nba_admin_services.txt
grep -E "(cdn|static|assets|media)" nba_live_services.txt > nba_cdn_services.txt

# Network analysis
nmap -sn --top-ports 1000 -iL nba_ip_addresses.txt > nba_network_scan.txt

# Service port scanning for critical assets
nmap -sV -sC --top-ports 1000 $(head -20 nba_critical_ips.txt) > nba_detailed_scan.txt

# Extract and analyze technology patterns
grep -i "nginx\|apache\|cloudflare\|akamai" nba_technology_stack.txt | sort | uniq -c
grep -i "react\|angular\|vue\|wordpress\|drupal" nba_technology_stack.txt | sort | uniq -c

# Analyze IP geolocation (if needed)
while read ip; do
    curl -s "http://ip-api.com/json/$ip" | jq -r '"\(.query) - \(.country) - \(.org)"'
done < nba_unique_ips.txt > nba_geolocation.txt

# Comprehensive nuclei scan
nuclei -l nba_live_services.txt \
    -tags exposure,config,debug,files,logs \
    -severity medium,high,critical \
    -o nba_vulnerabilities.txt

# Specific scans for high-value targets
nuclei -l nba_admin_services.txt \
    -tags auth-bypass,sqli,xss,ssrf \
    -severity low,medium,high,critical \
    -o nba_admin_vulnerabilities.txt

# Create prioritized target lists
echo "=== HIGH PRIORITY TARGETS ===" > nba_investigation_priorities.txt
grep -E "(admin|api|dev|staging)" nba_live_services.txt >> nba_investigation_priorities.txt

echo -e "\n=== TECHNOLOGY-SPECIFIC TARGETS ===" >> nba_investigation_priorities.txt
grep -E "(graphql|api|cms)" nba_technology_stack.txt >> nba_investigation_priorities.txt

echo -e "\n=== ERROR RESPONSES ===" >> nba_investigation_priorities.txt
head -10 nba_403_services.txt >> nba_investigation_priorities.txt

# Extract JavaScript files from live services
while read url; do
    curl -s "$url" | grep -oE "https?://[^\"']*\.js" >> nba_js_files.txt
done < nba_200_services.txt

# Analyze JavaScript files for sensitive information
sort -u nba_js_files.txt | while read js_url; do
    echo "Analyzing: $js_url"
    curl -s "$js_url" | grep -iE "(api|key|secret|token|project.*id)" && echo "FOUND: $js_url"
done > nba_js_analysis.txt

#!/bin/bash
# Large-scale reconnaissance automation script

TARGET_DOMAIN=$1
OUTPUT_DIR="recon_${TARGET_DOMAIN}_$(date +%Y%m%d)"

mkdir -p "$OUTPUT_DIR"
cd "$OUTPUT_DIR"

# Phase 1: Subdomain Discovery
echo "[+] Starting subdomain discovery..."
subfinder -d "$TARGET_DOMAIN" -all -o subdomains_subfinder.txt
assetfinder --subs-only "$TARGET_DOMAIN" > subdomains_assetfinder.txt
cat subdomains_*.txt | sort -u > all_subdomains.txt

# Phase 2: Service Discovery
echo "[+] Discovering live services..."
httpx -l all_subdomains.txt -o live_services.txt
httpx -l all_subdomains.txt -json -o web_services.json

# Phase 3: Vulnerability Scanning
echo "[+] Running vulnerability scans..."
nuclei -l live_services.txt -tags exposure,config -o vulnerabilities.txt

# Phase 4: Reporting
echo "[+] Generating summary report..."
echo "Reconnaissance Summary for $TARGET_DOMAIN" > summary.txt
echo "=======================================" >> summary.txt
echo "Total subdomains: $(wc -l < all_subdomains.txt)" >> summary.txt
echo "Live services: $(wc -l < live_services.txt)" >> summary.txt
echo "Vulnerabilities found: $(wc -l < vulnerabilities.txt)" >> summary.txt

echo "[+] Reconnaissance complete. Results in $OUTPUT_DIR"

# Split large subdomain lists for parallel processing
split -l 100 all_subdomains.txt subdomain_chunk_

# Process chunks in parallel
for chunk in subdomain_chunk_*; do
    httpx -l "$chunk" -o "results_$(basename $chunk).txt" &
done
wait

# Combine results
cat results_subdomain_chunk_*.txt > all_results.txt

# Monitor resource usage during large scans
#!/bin/bash
while true; do
    echo "$(date): CPU: $(top -bn1 | grep "Cpu(s)" | awk '{print $2}') Memory: $(free -h | grep Mem | awk '{print $3}')"
    sleep 60
done > resource_usage.log &

# Rate limiting for respectful scanning
export HTTPX_RATE_LIMIT=50  # requests per second
export NUCLEI_RATE_LIMIT=30

# Generate comprehensive statistics
python3 << EOF
import json

# Load httpx results
with open('web_services.json') as f:
    services = [json.loads(line) for line in f]

# Analyze status codes
status_codes = {}
for service in services:
    code = service.get('status_code', 'unknown')
    status_codes[code] = status_codes.get(code, 0) + 1

print("Status Code Distribution:")
for code, count in sorted(status_codes.items()):
    print(f"  {code}: {count}")

# Analyze technologies
technologies = {}
for service in services:
    tech_list = service.get('tech', [])
    for tech in tech_list:
        technologies[tech] = technologies.get(tech, 0) + 1

print("\nTop Technologies:")
for tech, count in sorted(technologies.items(), key=lambda x: x[1], reverse=True)[:10]:
    print(f"  {tech}: {count}")
EOF

# Create visual representations of findings
python3 << EOF
import matplotlib.pyplot as plt
import json

# Load data and create charts
# (Implementation depends on specific visualization needs)
EOF

# Generate markdown report
cat << EOF > reconnaissance_report.md
# Large-Scale Reconnaissance Report
**Target**: $TARGET_DOMAIN
**Date**: $(date)

## Executive Summary
- **Total Subdomains**: $(wc -l < all_subdomains.txt)
- **Live Services**: $(wc -l < live_services.txt)
- **Vulnerabilities**: $(wc -l < vulnerabilities.txt)

## Key Findings
$(head -10 vulnerabilities.txt)

## Technology Stack
$(grep -i "nginx\|apache\|cloudflare" web_services.json | head -5)

## Recommendations
1. Address identified vulnerabilities
2. Review exposed development environments
3. Implement consistent security controls
EOF