📑 Penetration Testing Methodology & Commands

This document outlines the methodology and tools used during the reconnaissance, scanning, and enumeration phases of the engagement against itsecgames.com. All commands are included with their purpose and notes.

---

Target: http://www.itsecgames.com
Date: September 2025
Prepared by: Shubhankar Gupta

---

Structure of the Report:
You can see the structure of the report: 👉 Structure.md

Final Report:
You can see the Final report: 👉 Final Report.md

---

Attack Chain Flow:

1. 🔍 WHOIS & DNS Discovery
2. 🌐 Subdomain Enumeration
3. 🗃️ Consolidation & Live Validation
4. 🔐 SSL/TLS Analysis
5. 🏗️ Technology Fingerprinting
6. 🛡️ WAF Detection
7. 📡 Header/Banner Inspection
8. ⚙️ Port & Service Enumeration
9. 📂 Web Directory & File Discovery

Methodology & Commands

1. 🔍 WHOIS & DNS Discovery

Commands:

whois itsecgames.com
dig itsecgames.com
dig -x 31.3.96.40
nslookup itsecgames.com
dig axfr itsecgames.com @ns53.domaincontrol.com
dig axfr itsecgames.com @ns54.domaincontrol.com
dnsrecon -d itsecgames.com -t axfr
host -l itsecgames.com ns53.domaincontrol.com

Purpose:

• Revealed registrar, hosting provider, IPs, and DNS records.
• Zone transfer attempts were tested (none succeeded).
• Basic DNS info gathered for further steps.

---

2. 🌐 Subdomain Enumeration

Commands:

amass enum -passive -d itsecgames.com
amass enum -active -d itsecgames.com
amass enum -brute -d itsecgames.com
fierce --domain itsecgames.com
dnsrecon -d itsecgames.com -t brt
dnsrecon -d itsecgames.com -D /usr/share/wordlists/dns/subdomains-top1mil-5000.txt -t brt
dnsenum itsecgames.com
sublist3r -d itsecgames.com
subfinder -d itsecgames.com | httpx -silent -status-code -title -tech-detect | grep 200

Purpose:

• Multiple subdomains discovered.
• HTTPX used to verify alive subdomains.

---

3. 🗃️ Subdomain Consolidation

Commands:

cat amass_passive.txt amass_active.txt subfinder.txt sublist3r.txt fierce.txt     | sort -u > consolidated_subdomains.txt

grep -oE "([a-zA-Z0-9_-]+\.)+[a-zA-Z]{2,}" consolidated_subdomains.txt | sort -u > domains.txt

cat domains.txt | httpx -silent -status-code -title -tech-detect -o httpx_alive.txt

cat httpx_alive.txt | grep 200 > domain_200_code.txt
cut -d' ' -f1 domain_200_code.txt | cut -d/ -f3 > live_domains.txt

Purpose:

• Consolidated results into one clean domain list.
• Filtered for alive domains (200 OK).

---

4. 🔐 SSL/TLS Scan

Commands:

echo | openssl s_client -connect itsecgames.com:443 | openssl x509 -noout -text
openssl s_client -connect itsecgames.com:443 -status

Purpose:

• Valid SSL certificate (Let’s Encrypt).
• TLSv1.2 and TLSv1.3 supported.
• OCSP stapling available.

---

5. 🏗️ Technology Fingerprinting

Commands:

whatweb http://www.itsecgames.com/

Purpose:

• Detected: Apache, PHP, HTML5.

---

6. 🛡️ WAF / Firewall Detection

Commands:

wafw00f http://www.itsecgames.com/

Purpose:

• No WAF detected (default Apache behavior).

---

7. 📡 Header & Banner Analysis

Commands:

curl -I http://www.itsecgames.com/
nikto -h http://www.itsecgames.com/
nikto -h http://www.itsecgames.com/ -ssl

Purpose:

• Apache banner exposed.
• Missing security headers (HSTS, CSP, X-Frame-Options).
• Nikto flagged outdated server configuration.

---

8. ⚙️ Port & Service Scanning

Commands:

nmap -sS -p- -T4 -oN nmap_allports.txt www.itsecgames.com
nmap -sC -sV -p- -O -oN nmap_versions_os.txt itsecgames.com
sudo nmap -sV -sC -p- -A -T4 -oN nmap_aggressive.txt itsecgames.com

Purpose:

• Discovered open ports and running services.
• OS fingerprinting enabled.
• Aggressive scan collected detailed info.

---

9. 📂 Web Directory & File Discovery

Commands:

sudo gobuster dir -u http://www.itsecgames.com/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -s 200,301,302,403 --status-codes-blacklist "" -t 20 -to 20s 2>/dev/null

sudo ffuf -u http://itsecgames.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt

Purpose:

• Directories and hidden endpoints discovered.
• Useful for identifying attack surface.

---

Final Notes

• Recon completed in a chained manner: Whois → DNS → Subdomains → Consolidation → SSL/TLS → Fingerprinting → WAF Detection → Headers → Nmap → Web Enumeration.
• Identified alive domains, services, banners, and potential weak security headers.
• Provides strong baseline for vulnerability assessment and exploitation phase.