1. Battalion: Automating Recon
Created by:
Stewart Olson
Patrick Garrity

2. Agenda Who are we? Anatomy of a Pentest Existing Tools & Issues
Introducing Battalion
Future Development
Questions!

3. Who are we? Stewart Olson - @Abraxassc2
Works at Nth Generation Computing
~5 years of experience in IT/Sysadmin
Recently focusing more exclusively on security
Pat Garrity
Works at Nerdery, Inc. as a Sr. software engineer
Published: Lock-Free Algorithms for Thread Safe Programming
Speaker at CIGCSE & MICS
This project is independent from our jobs

4. High-Level Pentesting Process

6. What is Battalion?
It was designed to answer the question, “Given a website and the companies name, what useful data can automatically be gathered?”, in short, it attempts to automate recon
Why?
Save time
Better allocate time and resources
Sift through large amounts of data for key information
How?
Use scripts, parsers, tools, and techniques to take resulting data from one action and present it as input for another tool

7. Where does Battalion fit in?
Recon (Duh?)
DNS Enumeration
Address Scavenging
Scanning
Open Ports?
Vulnerabilities?
Gaining Access
Exploiting vulnerabilities
Phishing, etc.
Reporting

8. Structure of Battalion
Some of Many Outputs:
Subdomain & IP Lists
Users involved in breaches
Open Ports
Versions of technologies and associated vulnerabilities
Two Simple Inputs:
Domain Name
Company Name

9. Battalion Domain Scanning Process (partial)
Collected Data
Vulnerabilities Data
Open Ports
WPscan data
Subdomain & IP Lists
Host data (apache, nginx, etc.)
API data on IPs and hostnames
More in place and more to come!

10. Brief Sample Domain Scan

11. Battalion User Scanning Process (partial)
Collected Data
Current and former employees
Whois Data
Likely valid addresses
addresses involved in breaches
Phishing targets and, coming soon, automated phishing campaigns
Breach Detection Process
Google dorks for past/current employees
Name to transformer
HaveIBeenPwned API response analysis for valid format detection
HaveIBeenPwned API for breaches

12. Existing Toolset Future Toolset Many Custom Scripts WPScan DNSRecon
EyeWitness
NMAP
DNSTwist
Ruby whois
Whatweb
TheHarvester
Shodan’s API
HaveIBeenPwned’s API
More custom tools
PassiveTotal API
Recon-ng
XSS Testing tools
Gobuster/Dirbuster
Metagoofil
Twitter API
SET
Joomscan
Better reports
More Dorks
More Scan Options
Passive->Aggressive
Integrate with other tools and services

13. Repository https://github.com/theabraxas/Battalion
Try Battalion!!!
Repository
Contributors Welcome!
Special Thanks:
@Viss @Sneakerhax @xcc @001SPARTaN
Questions: @AbraxasSC2 @eidolonPG