External Recon

Find if a target company uses Google Workspace?

• https://www.google.com/a/targetdomain.com/ServiceLogin
  • replace the targetdomain.com with the target
  • ![[Attachments/Pasted image 20260304144928.png]]
• curl -# -L 'https://google.com/a/shopgigantic.com/ServiceLogin' | grep -q 'Sorry' && echo "domain is not using Google Workspace" || echo "Domain is using Google Workspace"
  • ![[Attachments/Pasted image 20260304145048.png]]

Find if target company uses GMAIL?

• curl -s 'https://dns.google.com/resolve?name=shopgigantic.com&type=MX' | jq
  • ![[Attachments/Pasted image 20260304145205.png]]
  • aspmx.l.google.com says it uses gmail.com

---

Identify Valid Users and Credentials

• Create potential valid email addresses
  • ./username-anarchy --suffix @shopgigantic.com Jane Smith > jane_smith_usernames.txt

Identify valid workspace users using Google Calendar

• ![[Attachments/Pasted image 20260304145836.png]]
• run through a list of email addresses and call the public calendar endpoint. return a 200 OK if there is a hit.
• even if a username is changed, the old username remains valid for some time
• ![[Attachments/Pasted image 20260304150102.png]]
• This Enumeration method cannot be detected.

Identify users using SMTP

• avoid connecting to smtp.gmail.com as it will require creds
• connect to aspxm.l.google.com that we found earlier as this handles unauth inbound mail.
• ![[Attachments/Pasted image 20260304150330.png]]
• ![[Attachments/Pasted image 20260304150519.png]]

  nc aspmx.l.google.com 25
  
  HELP example.com
  MAIL FROM: <tester@example.com>
  RCPT TO: <janes@shopgigantic.com>
  

• ![[Attachments/Pasted image 20260304150644.png]]
• Use - https://github.com/reacherhq/check-if-email-exists
  • ![[Attachments/Pasted image 20260304150746.png]]
• It also checks if the target mailbox is full or disabled.
  • important when running a phishing campaign
  • ![[Attachments/Pasted image 20260304152336.png]]

---