HackerTarget

Passed the RHCE back in 2006, at the time was spending the days (and many nights) running high end RHEL systems. Stability wise everything was great, except issues with EMC drivers and booting from SAN. These were ironed out by vendor support - which is why it can pay to have that level of enterprise support; it just depends on your environment. These days, I use Ubuntu everywhere including here - http://hackertarget.com. It is just easier to quickly get up and running (not because its Free I could be using CentOS). So good job Red Hat, and good job Ubuntu!

A quick followup on this post from a month ago https://news.ycombinator.com/item?id=5873730 http://hackertarget.com/running-wordpress-patch-your-plugins/

https://hackertarget.com/as-ip-lookup/ Chuck 'Tencent' into the text box and execute.

`tshark` (from wireshark) sounds like a similar tool with pretty good protocol support (IIRC, it has been a long time since I've used it). By example: https://hackertarget.com/tshark-tutorial-and-filter-examples/

The website references its Wireshark article under "Wrapping Up": https://hackertarget.com/wireshark-tutorial-and-cheat-sheet/

You cannot hide anything on the internet anymore, the full IPv4 range is scanned regularly by multiple entities. If you open a port on a public IP it will get found. If it's a obscure non-standard port it might take longer, but if it's on any of the standard ports it will get probed very quickly and included tools like shodan.io The reason why I'm repeating this, is that not everyone knows this. People still (albeit less) put up elastic and mongodb instances with no authentication on public IP's. The second thing which isn't well known is the Certificate Transparency logs. This is the reason why you can't (without a wildcard cert) hide any HTTPS service. When you ask Let's Encrypt (or any CA actually) to generate veryobscure.domain.tld they will send that to the Certificate Transparency logs. You can find every certificate which was minted for a domain on a tool like https://crt.sh There are many tools like subdomain.center, https://hackertarget.com/find-dns-host-records/ comes to mind. The most impressive one I've seen, which found more much more than expected, is Detectify (which is a paid service, no affiliation), they seem to combine the passive data collection (like subdomain.center) with active brute to find even more subdomains. But you can probably get 95% there by using CT and a brute-force tool like https://github.com/aboul3la/Sublist3r