Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network
嗯，用户让我帮忙总结一篇文章的内容，控制在100个字以内，而且不需要用“文章内容总结”之类的开头。我先看看用户提供的文章内容。 这篇文章是关于InfoSec Write-ups的，里面有很多顶尖黑客写的报告，涵盖漏洞赏金、CTF比赛、虚拟机、硬件挑战和真实案例。还有订阅每周简报的链接。然后是关于追踪攻击者基础设施的指南，作者是Andrey Pautov，32分钟阅读时间，16小时前发布。 接下来是目录，介绍了基础设施转移的核心CTI技能，还有各种转移类型，比如域名转IP、被动DNS、IP转ASN/主机复用、TLS证书、子域模式枚举、Shodan/Censys/FOFA指纹识别、WHOIS分析等。还提到了工具栈、案例分析、自动化工作流程、常见错误以及面试准备的问题。 用户的需求是总结这篇文章的内容，控制在100字以内。所以我要抓住主要点：顶尖黑客的文章集合，涵盖漏洞赏金、CTF等；重点介绍追踪攻击者基础设施的方法，包括多种技术如DNS解析、证书分析和自动化工具。 还要注意不要使用特定的开头词，直接描述内容。确保语言简洁明了，在100字以内完成。 </think> 该文章介绍了如何通过多种技术追踪攻击者基础设施的方法，包括域名解析、被动DNS分析、IP到ASN关联、TLS证书利用等，并提供了完整的工具栈和实际案例演示。 2026-3-22 05:15:25 Author: infosecwriteups.com(查看原文) 阅读量:8 收藏

InfoSec Write-ups

A collection of write-ups from the best hackers in the world on topics ranging from bug bounties and CTFs to vulnhub machines, hardware challenges and real life encounters. Subscribe to our weekly newsletter for the coolest infosec updates: https://weekly.infosecwriteups.com/

Member-only story

The field manual for tracing attacker infrastructure — from one domain to dozens

32 min read

16 hours ago

--

Press enter or click to view image in full size

Table of Contents

  1. Introduction: Why Infrastructure Pivoting Is a Core CTI Skill
  2. The Mental Model: Why Attackers Leave Trails
  3. The Pivoting Workflow: Domain → IP → ASN → Certificates → Expanded Infrastructure
  4. Pivot Type 1: Domain → IP Resolution
  5. Pivot Type 2: Passive DNS — The History Book of the Internet
  6. Pivot Type 3: IP → ASN / Hosting Reuse
  7. Pivot Type 4: TLS Certificates — The Most Underused Pivot
  8. Pivot Type 5: Subdomain Patterns and Enumeration
  9. Pivot Type 6: Shodan / Censys / FOFA — Fingerprinting Infrastructure
  10. Pivot Type 7: WHOIS and Registration Pattern Analysis
  11. The Complete Tooling Stack
  12. Full Worked Example: Tracing a C2 Network End-to-End
  13. Automating the Workflow with Python
  14. Common Pivoting Mistakes and Dead Ends
  15. Interview-Ready: Answering “How Do You Discover…

InfoSec Write-ups

InfoSec Write-ups

Published in InfoSec Write-ups

A collection of write-ups from the best hackers in the world on topics ranging from bug bounties and CTFs to vulnhub machines, hardware challenges and real life encounters. Subscribe to our weekly newsletter for the coolest infosec updates: https://weekly.infosecwriteups.com/

Andrey Pautov

Andrey Pautov

Written by Andrey Pautov

Red Team-minded security researcher. AI-driven pentesting workflows, real tool output, troubleshooting, and a defender’s perspective on what to log and detect.

No responses yet


文章来源: https://infosecwriteups.com/infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-network-1295d50ec29c?source=rss----7b722bfd1b8d---4
如有侵权请联系:admin#unsafe.sh