EH-26: Multi-Step Recon Challenge - OSINT Bertahap

echo "=== STEP 1: DNS Records ==*"
dig vuln.cybersecurity.or.id ANY +short 2>/dev/null

echo ""
echo "=== STEP 2: Subdomain Discovery ==*"
for sub in admin api dev mail backup test; do
  host "$sub.vuln.cybersecurity.or.id" 2>/dev/null | grep "has address"
done

echo ""
echo "=== STEP 3: Port Scan ==*"
for port in $(seq 1 100); do
  timeout 0.3 bash -c "echo > /dev/tcp/vuln.cybersecurity.or.id/$port" 2>/dev/null && echo "  PORT $port OPEN"
done

echo ""
echo "=== STEP 4: Technology Fingerprint ==*"
curl -sI http://vuln.cybersecurity.or.id 2>/dev/null | head -10

echo ""
echo "=== STEP 5: Certificate Transparency ==*"
echo "curl -s 'https://crt.sh/?q=%25.vuln.cybersecurity.or.id&output=json' | jq '.[].name_value'"

echo ""
echo "=== OUTPUT ==*"
echo "IP: xxx.xxx.xxx.xxx"
echo "Open Ports: 22, 80, 443"
echo "Web Server: Apache/2.4.41 (Ubuntu)"
echo "Subdomain: admin.vuln.cybersecurity.or.id (login page)"
echo "Tech: PHP 7.4, MySQL, WordPress"