+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Hacking Tools and Programs (https://hackforums.net/forumdisplay.php?fid=10)
+---- Thread: Creating a B2B Recon/Attack tool (/showthread.php?tid=6293645)
Creating a B2B Recon/Attack tool - xicefri13 - Mar 4, 2025
Hey everyone!
I'm currently making a B2B specific tool suite and wanted to gather the communities opinions on what would be useful options, especially to differentiate it from other web application enumeration/attack tools.
The key is I want this tool focused on B2B. The standard idea of how to attack a B2b application is essentially the same as a consumer facing application, but the exact attack surfaces are different as I'm sure you are all aware.
So far for the modules i have planned to build in is:
Subdomain Enumeration
API
Techstack/SaaS fingerprinting
cloud Asset Misconfigurations
and then running into B2B-Specific vulnerabilities and developing/integrating tools specifically for attacking common technologies seen in this applications like saleforce, Hubspot, and Jira
my question for here is, are there any things that you guys would add? I'm aware I can do this with multiple tools and command line utilities ( and that some tools can do multiple aspects of what I'm trying to do) , but then what excuse would i have to make more ASCII art?
RE: Creating a B2B Recon/Attack tool - Monkeey - Mar 4, 2025
(Mar 4, 2025 09:39 AM)xicefri13 Wrote: Hey everyone!
I'm currently making a B2B specific tool suite and wanted to gather the communities opinions on what would be useful options, especially to differentiate it from other web application enumeration/attack tools.
The key is I want this tool focused on B2B. The standard idea of how to attack a B2b application is essentially the same as a consumer facing application, but the exact attack surfaces are different as I'm sure you are all aware.
So far for the modules i have planned to build in is:
Subdomain Enumeration
API
Techstack/SaaS fingerprinting
cloud Asset Misconfigurations
and then running into B2B-Specific vulnerabilities and developing/integrating tools specifically for attacking common technologies seen in this applications like saleforce, Hubspot, and Jira
my question for here is, are there any things that you guys would add? I'm aware I can do this with multiple tools and command line utilities ( and that some tools can do multiple aspects of what I'm trying to do) , but then what excuse would i have to make more ASCII art?
I hope you are not overlooking into 'databases'.
What about a module that checks exposed databases and it's vulnerabilities ?
RE: Creating a B2B Recon/Attack tool - xicefri13 - Mar 4, 2025
(Mar 4, 2025 09:48 AM)Monkeey Wrote: I hope you are not overlooking into 'databases'.
What about a module that checks exposed databases and it's vulnerabilities ?
ah yeah i was going to try to detect cloud database misconfigurations when doing the general cloud misconfiguration scanning, but i think you're right, I should have an individual database Exposure and Vulnerability module i can build out to cover more!
Thanks!
RE: Creating a B2B Recon/Attack tool - pyroe - Mar 4, 2025
there was db of dbs on breachforums but idk if they were fake or no :P
RE: Creating a B2B Recon/Attack tool - xicefri13 - Mar 4, 2025
(Mar 4, 2025 10:39 AM)pyroe Wrote: there was db of dbs on breachforums but idk if they were fake or no :P
not sure what a db of dbs would do for me in the case of this tool creation but feel free to elaborate. Im not looking for a specific database. Im looking to create a tool suite with various modules to attack B2B applications.
RE: Creating a B2B Recon/Attack tool - pyroe - Mar 4, 2025
[deleted] ............................