Archived domain URLs are one of the best ways to perform passive recon, as they tell us about the history of the website and its URLs. Sometimes, websites are changed but some old files and folders are left on the server; these may contain vulnerabilities and allow us to gain access. Archived.org and the Google Cache are the two services we can use to hunt for archived domain URLs.
Metasploit also has a built-in auxiliary for this purpose:
- We can use the enum_wayback keyword in the Search Modules screen to find the auxiliary we need:
- Clicking on the module, we will be redirected to the options page where we can enter the website domain name. Then, click Run Module:
A new task is created and the module runs successfully, printing the output it finds in the task window, as shown in the following screenshot:
Next, you will be introduced to Censys.