Bug Bounty Recon: Horizontal Correlation.

Considering becoming a member on medium? Use this link at no extra cost to yourself, and support me 🙂 (https://medium.com/@nynan/membership)

Example: We start with domain.com but how do we find other domains owned by the same user? perhaps secretDomain.com or vulnerableDomain.com

The first step of effective bug bounty hunting is in depth reconnaissance; the first step of reconnaissance is Horizontal Correlation. The more assets you know about, the more you can attack. By expanding the attack surface, you are more likely to find vulnerabilities.

I have found four methods to find root domains:

1. The “WHOIS” method
2. Using CIDRs and ASNs
3. Google Dorks
4. researching Subsidiaries and Acquisitions

WHOIS method

Wikipedia tells us:

WHOIS (pronounced as the phrase “who is”) is a query and response protocol that is widely used for querying databases that store the registered users or assignees of an Internet resource, such as a domain name, an IP address block or an autonomous system, but is also used for a wider range of other information.

Or, in simple terms: The WHOIS protocol allows us to get information about a domain. We can use this information to find more domains.

Let’s run through an imaginary example:

1. we are targetting domain.com
2. we run the whois command on domain.com and discover the email that registered domain.com is “[email protected]”

1. We use a reverse WHOIS service, such as ViewDNS, to discover [email protected] has also registered secretDomain.com and personalDomain.com

We have increased our attack surface by 200%! And there is still the most valuable step to go: Iterate. Repeat the process with the new domains discovered to find possibly even more domains.

NOTE: Companies may try to hide this information. So make sure to check the information belongs to the target organisation and not an obfuscation company.

CIDRs and ASNs

Classless Inter-Domain Routing (CIDR) is a difficult, advanced but interesting concept. I would recommend doing some additional research, however for this article I will define it with:

• A CIDR Range is a range of IPs.

When a company has many domains it requires many IPs to map those domains to. And thus it will A CIDR is used to organise these by using consecutive IPs. A CIDR range is notated by a / and then a number. Eg, 127.0.0.0/24

An Autonomous System Number (ASN) is number representing an “area of the internet” it is made from a collection of CIDRs. Once more, ASNs are a complex topic and I recommend a more indepth research. Importantly for us: large companies will have their own ASNs, which we can use to find domains.

Let’s make this process clear with another imaginary example:

1. The target is domain.com
2. Use the digcommand on different subdomains to check what their ASNs are. dig a subdomain.domain.com +short
3. If lots of the subdomains are consistent with their ASN, we could assume that they own their own ASN.
4. Use a service like bgpview.io to get IPs from the ASNs you’ve found

The first three steps can be avoided if you use your research skills to find an organisations ASN(s). This is just one method. Very big organisations can have multiple ASNs, it pays dividends to do extra thorough research in this early stage of bug bounty hunting.

Google Dorks

Google Dorks (other dorks are available*) are pieces of text which give you more functionality to a search engine. They can allow us to discover secrets, other domains, and much more.

(*Other dorks include, Bing dorks, Yandex dorks, or any other search engine!)

In the list of the many google dorks, there is one specific one that allows for Horizontal Correlation. This dork is intext:.

How do we use this to find new domains? I’ll demonstrate in an example.

1. Go to the known target page.
2. Find something that would be common to all domains. This is often something overlooked, such as the copyright line in the footer, or a link to a Term’s and Conditions. For this example, let’s say we go to our imaginary target and we see “©2021 imaginaryCompany All rights reserved.” in the footer.

3. Copy this and put into the search engine intext:"©2021 imaginaryCompany All rights reserved.". We can see that a new domain has been discovered (newDomain.com)

BONUS TIP: If you’re hacking a target that owns a top level domain such as .gov or .mil, you can use the site:*.tld dork to find all the domains google has indexed. Eg, site:*.gov

Subsidiaries and Acquisitions

A Subsidiary Company is a company owned by a holding company. You may have heard of this in terms of a “Parent company” and “Child companies“

If the scope of your target is very broad, it may include subsidiary companies. We can use google, other search engines, or specific sites in order to find these.

Example: If we google “Yahoo subsidiaries” we see there is a child company names “Flurry”. This has expanded our target surface. (Always refer to the scope of engagement before pentesting a new asset).

An Acquisition is when a Company buys another company. This new company may also be included in the scope of the program.

Similarly to the subsidiary, we can use OSINT skills for acquisitions of a company to find new domains.

Example: If we google “Yahoo Acquisitions”, we find a whole wiki page dedicated to this topic, and we find many examples, eg “Flickr”.

Summary

By now you should have a long list of root domains which will be a strong foundation for your bug bounty process and will yield you more data to be used during the next stage, vertical correlation.

If you thought any of this information was useful, liking the article 👏 would be a free and easy way to support me. I look forward to posting more informational content.

Considering becoming a member on medium? Use this link at no extra cost to yourself, and support me 🙂 (https://medium.com/@nynan/membership)

DISCLAIMER: I take no responsibility for any actions committed by readers. Only perform enumeration on targets you have permission for. Always read and check the scope of a program for guidance. Horizontal Correlation often causes false positives, you should check you are allowed to target these before doing any more actions.