Manual - Favicon#

  • The favicon is a small icon displayed in the browser’s address bar or tab used for branding a website.
  • Sometimes when frameworks are used to build a website, a favicon that is part of the installation gets leftover, and if the website developer doesn’t replace this with a custom one, this can give us a clue on what framework is in use
  • OWASP host a database of common framework icons that you can use to check against the targets favicon https://wiki.owasp.org/index.php/OWASP_favicon_database.
# compare the hash against owasp database to know about the framework used in the application
curl https://static-labs.tryhackme.cloud/sites/favicon/images/favicon.ico | md5sum

# powershell
curl https://static-labs.tryhackme.cloud/sites/favicon/images/favicon.ico -UseBasicParsing -o favicon.ico
Get-FileHash .\favicon.ico -Algorithm MD5

Manual - Sitemap.xml#

  • the sitemap.xml file gives a list of every file the website owner wishes to be listed on a search engine
  • These can sometimes contain areas of the website that are a bit more difficult to navigate to or even list some old webpages that the current site no longer uses but are still working behind the scenes.

Manual - HTTP Headers#

  • When we make requests to the web server, the server returns various HTTP headers. These headers can sometimes contain useful information such as the webserver software and possibly the programming/scripting language in use.

Manual - OSINT - Wappalyzer#

  • Wappalyzer (https://www.wappalyzer.com/) is an online tool and browser extension that helps identify what technologies a website uses, such as frameworks, Content Management Systems (CMS), payment processors and much more, and it can even find version numbers as well.

OSINT - S3 Buckets#

  • S3 Buckets are a storage service provided by Amazon AWS, allowing people to save files and even static website content in the cloud accessible over HTTP and HTTPS. The owner of the files can set access permissions to either make files public, private and even writable.
  • The format of the S3 buckets is http(s)://{name}.s3.amazonaws.com where {name} is decided by the owner, such as tryhackme-assets.s3.amazonaws.com.
  • One common automation method is by using the company name followed by common terms such as {name}-assets, {name}-www, {name}-public, {name}-private, etc.

OSINT - SSL/TLS Certificates#