Tutorials

Hack secret keys, emails, subdomains, DNS of any company website

Posted on

There are many tools which are used in gathering information. These tools gather information but are not able to gather some secret information of target. There are various way to exploit any target. But there are some vital information which comes really helpful while exploiting target, explain ethical hacking investigators. So today we will show you a tool called photon.

According to ethical hacking researcher of International Institute of Cyber Security says that photon is useful in initial phase of pentesting.

Photon is a tool used in information gathering. This tool crawls on the target very fastly. Photon grabs information secret keys, emails, subdomains, DNS and many other information which can be used to exploit. For showing you we have tested this tool on Kali Linux 2018.4

  • Type git clone https://github.com/s0md3v/Photon.git
  • Type cd Photon
  • Type python photon.py 
root@kali:/home/iicybersecurity/Downloads/Photon# python photon.py
_  _          _      / _ / /    / /_  
     / // / _ / _ / /  / _     / / / / / // / // // / / / /   //   // //_/__/____// // v1.1.5

usage: photon.py [-h] [-u root] [-c cook] [-r regex] [-e export] [-o output]
                  [-l level] [-t threads] [-d delay] [-v]
                  [-s seeds [seeds …]] [--stdout std]
                  [--user-agent user_agent] [--exclude exclude]
                  [--timeout timeout] [--headers] [--dns] [--ninja] [--keys]
                  [--update] [--only-urls] [--wayback] 

optional arguments:
   -h, --help            show this help message and exit
   -u root, --url root   root url
   -c cook, --cookie cook
                         cookie
   -r regex, --regex regex
                         regex pattern
   -e export, --export export
                         export format
   -o output, --output output
                         output directory
   -l level, --level level
                         levels to crawl
   -t threads, --threads threads
                         number of threads
   -d delay, --delay delay
                         delay between requests
   -v, --verbose         verbose output
   -s seeds [seeds …], --seeds seeds [seeds …]
                         additional seed urls
   --stdout std          send variables to stdout
   --user-agent user_agent
                         custom user agent(s)
   --exclude exclude     exclude urls matching this regex
   --timeout timeout     http request timeout
   --headers             add headers
   --dns                 enumerate subdomains and dns data
   --ninja               ninja mode
   --keys                find secret keys
   --update              update photon
   --only-urls           only extract urls
   --wayback             fetch urls from archive.org as seeds
  • The above options are used while gathering information about the target.
  • Type python photon.py -u hack.me
  • -u is used to enter url.
root@kali:/home/iicybersecurity/Downloads/Photon# python photon.py -u hack.me
_  _          _      / _ / /    / /_  
     / // / _ / _ / /  / _     / / / / / // / // // / / / /   //   // //_/__/____// // v1.1.5

[~] Level 1: 1 URLs
 [!] Progress: 1/1
 [~] Level 2: 6 URLs
 [!] Progress: 6/6
 [~] Crawling 20 JavaScript files 

[!] Progress: 20/20 

[+] Internal: 8
 [+] Scripts: 20 

[+] External: 12 

[!] Total requests made: 27
 [!] Total time taken: 0 minutes 34 seconds
 [!] Requests per second: 0
 [+] Results saved in hack.me directory
  • After finishing, scanned results will save in local directory. The result will save as the name of the target.
  • Type ls
  • Type cd hack.me
  • Type ls 
root@kali:/home/iicybersecurity/Downloads/Photon# cd hack.me
 root@kali:/home/iicybersecurity/Downloads/Photon/hack.me# ls
 external.txt  internal.txt  scripts.txt
  • Above are the data which have been extract by photon. The above information can be used in other hacking activities.
  • For viewing any file type cat scripts.txt 
root@kali:/home/iicybersecurity/Downloads/Photon/hack.me# cat scripts.txt
 https://hack.me/assets/plugins/jquery-migrate-1.2.1.min.js
 https://hack.me/assets/plugins/bootstrap-modal/js/bootstrap-modal.js
 https://hack.me/assets/plugins/bootstrap-modal/js/bootstrap-modalmanager.js
 https://hack.me/js/cfg.js
 https://hack.me/assets/plugins/data-tables/DT_bootstrap.js
 https://hack.me/js/core.js
 https://hack.me/assets/plugins/jquery-1.10.2.min.js
 https://hack.me/js/errors.js
 https://hack.me/assets/scripts/signup.js
 https://hack.me/assets/scripts/html5-search.js
 https://hack.me/assets/plugins/back-to-top.js
 https://hack.me/assets/plugins/hover-dropdown.js
 https://hack.me/assets/plugins/jquery-slimscroll/jquery.slimscroll.min.js
 https://hack.me/assets/plugins/select2/select2.min.js
 https://hack.me/assets/plugins/bootstrap/js/bootstrap.min.js
 https://hack.me/assets/scripts/app.js
 https://hack.me/assets/plugins/respond.min.js
 https://hack.me/assets/scripts/trends.js
 https://hack.me/assets/plugins/data-tables/jquery.dataTables.js
 https://hack.me/assets/plugins/messages/messages.js
  • The above information shows that target is using what kind javascript plugins. These plugins information can be used to create exploits which can attack the target.
  • Type cat external.txt
  • Type cat internal.txt 
root@kali:/home/iicybersecurity/Downloads/Photon/hack.me# cat external.txt
 https://hack.dev/101163/mutillidae-23101.html
 http://www.elearnsecurity.com
 http://www.eLearnSecurity.com
 https://twitter.com/eLearnSecurity
 https://www.facebook.com/hackmeproject
 https://me.hack.me/developer.php
 https://me.hack.me/signup
 https://twitter.com/hackmeproject
 https://www.elearnsecurity.com/course/?sp_source=Hackme&sp_term=SidebarBanner
 https://me.hack.me/login
 https://hackmeproject.uservoice.com/
 https://twitter.com/Giutro
 root@kali:/home/iicybersecurity/Downloads/Photon/hack.me# cat internal.txt
 https://hack.me
 https://hack.me/trends/
 https://hack.me/
 https://hack.me/explore/
 https://hack.me/s/
 https://hack.me/faq
 https://hack.me/about
 https://hack.me/hackmeterms.txt
  • The above shows the internal and external links which can be used in other hacking activities.
  • Type python photon.py -u hack.me -t 5 –keys
  • -u is used to enter url.
  • -t is used to enter no. of threads.
  • –keys will find APIs.
root@kali:/home/iicybersecurity/Downloads/Photon# python photon.py -u hack.me -t 5 --keys
_  _          _      / _ / /    / /_  
     / // / _ / _ / /  / _     / / / / / // / // // / / / /   //   // //_/__/____// // v1.1.5

[~] Level 1: 1 URLs
 [!] Progress: 1/1
 [~] Level 2: 6 URLs
 [!] Progress: 6/6
 [~] Crawling 20 JavaScript files 

[!] Progress: 20/20 

[+] Internal: 8
 [+] Scripts: 20
 [+] External: 12 

[+] Keys: 7 

[!] Total requests made: 27
 [!] Total time taken: 0 minutes 21 seconds
 [!] Requests per second: 1
 [+] Results saved in hack.me directory
  • After finishing, scanned results will save in local directory.
  • The result will save as the name of the target.
  • Type ls
  • Type cd hack.me
  • Type ls
  • Type cat keys.txt 
root@kali:/home/iicybersecurity/Downloads/Photon# cd hack.me/
 root@kali:/home/iicybersecurity/Downloads/Photon/hack.me# ls
 external.txt  internal.txt  keys.txt  scripts.txt
 root@kali:/home/iicybersecurity/Downloads/Photon/hack.me# cat keys.txt
 https://hack.me/about: 8fLx6iJ7CUYx5Vn7Ib8mxg
 https://hack.me/: 8fLx6iJ7CUYx5Vn7Ib8mxg
 https://hack.me: 8fLx6iJ7CUYx5Vn7Ib8mxg
 https://hack.me/s/: hackmesSearchPaginationBody
 https://hack.me/faq: 8fLx6iJ7CUYx5Vn7Ib8mxg
 https://hack.me/explore/: 8fLx6iJ7CUYx5Vn7Ib8mxg
 https://hack.me/s/: 8fLx6iJ7CUYx5Vn7Ib8mxg
  • The above shows the api keys which are used by the target. The above information can be used in other hacking activities.
  • Type python photon.py -u 192.168.1.10 -t 10 –dns
  • -u is used to enter url.
  • -t is used to enter no. of threads.
  • –dns will find subdomains. 
root@kali:/home/iicybersecurity/Downloads/Photon# python photon.py -u 192.168.1.10 -t 10 --dns
_  _          _      / _ / /    / /_  
     / // / _ / _ / /  / _     / / / / / // / // // / / / /   //   // //_/__/____// // v1.1.5


[~] Level 1: 1 URLs
 [!] Progress: 1/1
 [~] Level 2: 39 URLs 

[!] Progress: 39/39
 [~] Crawling 38 JavaScript files
 [!] Progress: 38/38
 [+] Files: 2
 [+] Intel: 10
 [+] Internal: 251
 [+] Scripts: 38
 [+] External: 111
 [+] Fuzzable: 139
 [!] Total requests made: 78
 [!] Total time taken: 0 minutes 26 seconds
 [!] Requests per second: 2
 [~] Enumerating subdomains
 [!] 0 subdomains found
 [~] Generating DNS map
 [+] Results saved in 192.168.1.10 directory
  • After finishing, scanned results will save in local directory. The result will save as the name of the target.
  • Type ls
  • Type cd 192.168.1.10
  • Type ls
  • Type intel.txt 
root@kali:/home/iicybersecurity/Downloads/Photon# cd 192.168.1.10/
 root@kali:/home/iicybersecurity/Downloads/Photon/192.168.1.10# ls
 external.txt  files.txt  fuzzable.txt  intel.txt  internal.txt  scripts.txt
root@kali:/home/iicybersecurity/Downloads/Photon/192.168.1.10# cat intel.txt
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
  • The above query shows the extracted emails which can be used in other hacking activities.
  • Type cat files.txt 
root@kali:/home/iicybersecurity/Downloads/Photon/192.168.1.10# cat files.txt
 ./documentation/mutillidae-installation-on-xampp-win7.pdf
 images/lolhax.jpg
  • The above query shows the files that have been extracted from the target. This information can be used in other hacking activities.
  • python photon.py -u hack-yourself-first.com -t 10 –ninja
  • -u is used to enter url.
  • -t is used to enter no. of threads.
  • –ninja is used to make depth scan.
root@kali:/home/iicybersecurity/Downloads/Photon# python photon.py -u hack-yourself-first.com -t 10 --ninja
_  _          _      / _ / /    / /_  
     / // / _ / _ / /  / _     / / / / / // / // // / / / /   //   // //_/__/____// // v1.1.5

[+] URLs retrieved from robots.txt: 4
 [~] Level 1: 5 URLs
 [!] Progress: 5/5
 [~] Level 2: 14 URLs
 [!] Progress: 14/14
 [~] Crawling 5 JavaScript files 

[!] Progress: 5/5 

[+] Robots: 4
 [+] Internal: 30
 [+] Scripts: 5
 [+] External: 6 

[+] Fuzzable: 11 

[!] Total requests made: 24
 [!] Total time taken: 0 minutes 30 seconds
 [!] Requests per second: 0
 [~] Enumerating subdomains
 [!] 0 subdomains found
 [~] Generating DNS map
 [+] Results saved in hack-yourself-first.com directory
  • After finishing, scanned results will save in local directory. The result will save as the name of the target.
  • Type ls
  • Type cd 192.168.1.10
  • Type ls
  • Type intel.txt 
root@kali:/home/iicybersecurity/Downloads/Photon/hack-yourself-first.com# cat intel.txt
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
 [email protected]
  • The above query shows the extracted mail ids which can be used in other hacking activities.
  • This will also help to do social engineering attacks on target.
Related Items:, ,

Recommended for you

To Top

Pin It on Pinterest

Share This