All right, so now that we've got our lists and stuff we're going to install that's pronounced a mouse,
not be mouse.
All right.
So I just want to get that straight.
So this is the quintessential domenzain and asset discovery tool.
It's maintained by a WASP and it is indisputably the king of asset discovery.
Right.
There's a lot of money and time and resources behind this project.
It's just one of the fascinating stuff I know is probably its closest competitor finder, which is managed
now by Project Discovery.
So we're going to get into this tool.
You can see that there actually is a GitHub page and you could read through this and, you know, try
to call in the report, but you don't have to because it's included in our Calli applet.
And so before we actually jump into this and so I also want you to see if this is a WASP flagship project.
Right.
So this tool has brought a lot of value to the security community, bug bounty hunters.
Right.
Teamers penetration testers and researchers alike.
So let's get into this suburban Africa one.
You'll see that People has a bug bounty program which was launched in August of twenty eighteen.
And if you scroll down to the bottom.
And you look at SCOP, you'll see that Stadt people dotcom is in scope and they pay out for critical
vulnerabilities and it's eligible for bounty.
So what we're going to do is check that out.
Right.
So first we can run amass.
And Dignity Control A.
And I'm just going to change his bottom window and the top window up so that I can read the syntax of
one zero unless, you know.
You can see that we did have options, so if we just run it like that, usually what happens, a mass
attack each.
And now we have several options, right?
We're going to do it, got a brute to execute forcing after it searches the intelligence feeds it has.
Then we're going to give it a domain name, Dashty, the meaning value separated by commas, but we're
only going to give it one domain paperback on.
And then, of course.
If we go down a little bit further, you'll see we can add the sauce, which will do so.
You can see the source of the discovered name, you'll see where it came from.
And then lastly, we'll put in the word list, if you don't put in the word list, you don't use it
built in word list.
But we want to use all that text because it's the most robust.
Right.
We can go down here.
And then we can just put in, as our say, a couple of things, when you run a mass, you want to run
it with zero.
If not, it could crash.
That's what happened to me multiple times.
Number two, you could in person control holding down control of the press, the right arrow to attack.
Oh, indeed.
Something like people dotcom up a mess in this, which is output the results to a file when it's done.
And number three, the next thing that's important, when you're running a mouse, you're not going
to see output right away, which is going to look like nothing's happening.
Trust me, it is.
What I like to do is I run a mouse and then I let it work in the background while I then interactively,
you know, explore the web asset.
So I might have Spider running while I click through the different pages.
I try to log in to create an account, you know, look for crosscutting vulnerabilities and that sort
of thing.
So you don't want to just stare at a mouse that's running.
You want to let it run in the background and come back once it finishes.
So we will let this run and then we'll come back once it's done.
All right, so here's the results.
You can see what we have here.
We ran the enumeration and the brute.
Now, if we go back here.
You can see there are other modules besides the right everything to track down a database, and you
can then explore the relationships between different domains using visualization that's built into mouse,
and you can even track the differences between your campaigns.
And so let's say the first time you knew Marape outcome and you get a certain number of subdomains,
two weeks pass the second time you get a different set of sublimates, including some things that were
in the first run.
Well, the track will show you the differences and then you can just focus on those because that could
be new infrastructure that was set up.
And it's possible that there's less security controls around those.
You might find bugs there.
So over here is pretty cool.
So it shows you the source.
You can see we've got overflow.
That's a source.
We've got all these subdomains.
And the nice thing about a mouse is that notify the subdomain like, for example, galbi, it'll then
run go beat up people that come back through a mass, through all the intelligence feeds into, I find
another subdomain.
It just keeps doing this until it exhausts itself.
So it's very, very robust, as you can see how powerful this can be.
Right.
Look over subdomains.
A lot of them are staging, you know, make these development servers, you get down to the bottom,
actually shows you the breakdown by autonomous system number so you can get an idea of where their IP
space resides.
You can see they've got some cloud assets.
Amazon shut down even further.
You can see they're using Akamai.
They're using detox protection by Akamai or Amazon, so Microsoft Azure stuff.
So this is really, really, really good.
So let's say you want to actually save this content.
How would you do that if you didn't use the national output?
What you could do?
Let's go to the top.
This is an advanced Tmax feature.
OK, let's pay attention here.
What I can do is I can go here and I can type control a bracket.
Then a press.
Control space.
Now, I can select all this and just press one page down, I get everything I want, then what I can
do.
So now we've got everything here and we're going to do escape ships
and we can take a look at this file and we can do some magic on it so we can say, OK, we'll use this
right bracket as a delimiter.
And then we'll just print the second field.
Like, so we can have a rough list of demands if we can do like said that, it starts with one or more.
There are more spaces into the space right here, so it starts with zero more spaces.
This is the start with character, the place that was nothing.
He didn't need the techie.
So you put the whole thing in quotes.
There we go.
So now we've got rid of the leading spaces and then we can do like a sort of show with the unique names
and reverse it.
And of course, we could put that into people, clean up the mess.
Then tell.
When it comes to public.
So that's just pretty good.
Fifteen, about fifteen hundred.
So now you can see the beauty of the mess and next year we'll get into supplier by.