Scanning and Recon - Revision history

Booda: /* Reconnaissance */

2023-10-16T08:41:41Z

Reconnaissance

← Older revision		Revision as of 08:41, 16 October 2023
Line 18:		Line 18:

	* https://github.com/six2dez/reconftw \| [https://gist.github.com/jhaddix/141d9cb07ca0590dbc43389e0e4af98f Free scan config (no API)]		* https://github.com/six2dez/reconftw \| [https://gist.github.com/jhaddix/141d9cb07ca0590dbc43389e0e4af98f Free scan config (no API)]
			* https://github.com/Tib3rius/AutoRecon
	* https://github.com/AdmiralGaust/bountyRecon		* https://github.com/AdmiralGaust/bountyRecon
	* https://github.com/offhourscoding/recon		* https://github.com/offhourscoding/recon

Booda: /* Reconnaissance */

2023-09-20T13:58:12Z

Reconnaissance

← Older revision		Revision as of 13:58, 20 September 2023
Line 15:		Line 15:

	=== Reconnaissance ===		=== Reconnaissance ===
	Automated recon scripts which automates a lot of the boring aspects of recon for you. They can be used to run some cursory automated vulnerability checks like XSS, Open Redirects, SSRF, CRLF, LFI, SQLi, SSL tests, SSTI, DNS zone transfers. Also perform passive and active recon testing such as subdomain enumeration, credential bruteforce, permutations, certificate transparency, source code scraping, analytics, DNS records and directory fuzzing, dorking, ports scanning, screenshots, nuclei scanning on your targets and more. The best one is [https://github.com/six2dez/reconftw reconFTW] but we provide others for comparison.		Automated recon scripts which automates a lot of the boring aspects of recon for you. They can be used to run some cursory automated vulnerability checks like XSS, Open Redirects, SSRF, CRLF, LFI, SQLi, SSL tests, SSTI, DNS zone transfers. Also can perform passive and active recon testing such as subdomain enumeration, credential bruteforce, permutations, certificate transparency, source code scraping, analytics, DNS records and directory fuzzing, dorking, ports scanning, screenshots, nuclei scanning on your targets and more. The best one is [https://github.com/six2dez/reconftw reconFTW] but we provide others for comparison.

	* https://github.com/six2dez/reconftw \| [https://gist.github.com/jhaddix/141d9cb07ca0590dbc43389e0e4af98f Free scan config (no API)]		* https://github.com/six2dez/reconftw \| [https://gist.github.com/jhaddix/141d9cb07ca0590dbc43389e0e4af98f Free scan config (no API)]

Booda: /* Reconnaissance */

2023-09-20T01:47:38Z

Reconnaissance

← Older revision		Revision as of 01:47, 20 September 2023
Line 15:		Line 15:

	=== Reconnaissance ===		=== Reconnaissance ===
			Automated recon scripts which automates a lot of the boring aspects of recon for you. They can be used to run some cursory automated vulnerability checks like XSS, Open Redirects, SSRF, CRLF, LFI, SQLi, SSL tests, SSTI, DNS zone transfers. Also perform passive and active recon testing such as subdomain enumeration, credential bruteforce, permutations, certificate transparency, source code scraping, analytics, DNS records and directory fuzzing, dorking, ports scanning, screenshots, nuclei scanning on your targets and more. The best one is [https://github.com/six2dez/reconftw reconFTW] but we provide others for comparison.

	* https://github.com/six2dez/reconftw \| [https://gist.github.com/jhaddix/141d9cb07ca0590dbc43389e0e4af98f Free scan config (no API)]		* https://github.com/six2dez/reconftw \| [https://gist.github.com/jhaddix/141d9cb07ca0590dbc43389e0e4af98f Free scan config (no API)]
	* https://github.com/AdmiralGaust/bountyRecon		* https://github.com/AdmiralGaust/bountyRecon

Booda: Automated Recon

2023-09-20T01:39:18Z

Automated Recon

@@ Line 13: / Line 13: @@
 * Nuclei template to detect WAFs: https://github.com/projectdiscovery/nuclei-templates/blob/master/technologies/waf-detect.yaml
 * Detect WAFs using: <code>asnmap -org paypal -silent | dnsx -ptr -ro -silent | cdncheck -resp -silent</code>
 === Vulnerability scanners ===

Booda: /* Vulnerability scanners */

2023-09-20T01:32:59Z

Vulnerability scanners

← Older revision		Revision as of 01:32, 20 September 2023
Line 18:		Line 18:

	* Axiom distributes the load of your scanning tools across multiple servers. https://github.com/pry0cc/axiom \| [https://twitter.com/Jhaddix/status/1633936278222962688?cxt=HHwWgIDUkeuY9KwtAAAA Twitter Thread]		* Axiom distributes the load of your scanning tools across multiple servers. https://github.com/pry0cc/axiom \| [https://twitter.com/Jhaddix/status/1633936278222962688?cxt=HHwWgIDUkeuY9KwtAAAA Twitter Thread]
	* A fully automated recon tool (its great as a tool installer on a fresh VPS): https://github.com/six2dez/reconftw \| [https://gist.github.com/jhaddix/141d9cb07ca0590dbc43389e0e4af98f Free scan config (no API)]
	* Nuclei scanner: https://github.com/projectdiscovery/nuclei \| [https://blog.projectdiscovery.io/ultimate-nuclei-guide The Ultimate Guide to Finding Bugs With Nuclei]		* Nuclei scanner: https://github.com/projectdiscovery/nuclei \| [https://blog.projectdiscovery.io/ultimate-nuclei-guide The Ultimate Guide to Finding Bugs With Nuclei]
	** WordPress related Nuclei templates: https://github.com/topscoder/nuclei-wordfence-cve		** WordPress related Nuclei templates: https://github.com/topscoder/nuclei-wordfence-cve

Booda: /* Intercepting proxies */

2023-09-16T18:58:06Z

Intercepting proxies

← Older revision		Revision as of 18:58, 16 September 2023
Line 172:		Line 172:

	=== Intercepting proxies ===		=== Intercepting proxies ===
	* https://~~enlacehacktivista~~.org/~~index~~.~~php?title=Hacking_APIs#Intercepting_proxies~~		* https://mitmproxy.org
			* https://portswigger.net/burp
			* https://www.zaproxy.org
			* https://github.com/projectdiscovery/proxify

	== Exploitation ==		== Exploitation ==
	For automatic exploit tools and payloads, see [[exploitation]].		For automatic exploit tools and payloads, see [[exploitation]].

Booda: /* Word Lists */

2023-09-14T15:22:00Z

Word Lists

← Older revision		Revision as of 15:22, 14 September 2023
Line 118:		Line 118:
	* Subdomain enumeration word list: https://gist.github.com/jhaddix/f64c97d0863a78454e44c2f7119c2a6a		* Subdomain enumeration word list: https://gist.github.com/jhaddix/f64c97d0863a78454e44c2f7119c2a6a
	* Potentially dangerous files: https://github.com/Bo0oM/fuzz.txt		* Potentially dangerous files: https://github.com/Bo0oM/fuzz.txt
			* Download and search specific domain names using (only includes popular cloud providers): https://kaeferjaeger.gay/?dir=sni-ip-ranges
			** Search for and extract your targets domains: <code>cat ~/sni_ip_ranges/*.txt \| grep "\target\.com" \| awk -F'-- ' '{print $2}' \| tr ' ' '\n' \| tr '[' ' ' \| sed 's/ //' \| sed 's/\]//' \| sort -u</code>
			*** Extract only domains: <code>grep -E -o '[a-zA-Z0-9_-]+(\.[a-zA-Z0-9_-]+)+(\.[a-zA-Z]{2,})' ~/sni_ip_ranges/*.txt > domains.txt</code>

	=== Port scanners ===		=== Port scanners ===

Booda: /* Web Crawlers */

2023-09-10T15:24:58Z

Web Crawlers

← Older revision		Revision as of 15:24, 10 September 2023
Line 142:		Line 142:

	=== Web Crawlers ===		=== Web Crawlers ===
	Crawl a website, extract all URL endpoints and save them for further analysis. Useful for digging up parameters on websites to test for common vulnerabilities ([https://enlacehacktivista.org/index.php?title=Exploitation#Payloads XSS, SQLi, IDOR, RFI~~/LFI~~, etc])		Crawl a website, extract all URL endpoints and save them for further analysis. Useful for digging up parameters on websites to test for common vulnerabilities ([https://enlacehacktivista.org/index.php?title=Exploitation#Payloads XSS, SQLi, IDOR, LFI/RFI, etc])

	* https://github.com/projectdiscovery/katana		* https://github.com/projectdiscovery/katana

Booda: /* Word Lists */

2023-09-02T10:31:34Z

Word Lists

← Older revision		Revision as of 10:31, 2 September 2023
Line 117:		Line 117:
	* File and directory discovery word list: https://github.com/danielmiessler/SecLists/tree/master/Discovery/Web-Content		* File and directory discovery word list: https://github.com/danielmiessler/SecLists/tree/master/Discovery/Web-Content
	* Subdomain enumeration word list: https://gist.github.com/jhaddix/f64c97d0863a78454e44c2f7119c2a6a		* Subdomain enumeration word list: https://gist.github.com/jhaddix/f64c97d0863a78454e44c2f7119c2a6a
	* Download and search specific domain names using ('''only includes popular cloud providers'''): https://kaeferjaeger.gay/?dir=sni-ip-ranges
	** Search for and extract your targets domains: <code>cat ~/sni_ip_ranges/*.txt \| grep "\target\.com" \| awk -F'-- ' '{print $2}' \| tr ' ' '\n' \| tr '[' ' ' \| sed 's/ //' \| sed 's/\]//' \| sort -u</code>
	*** Extract only domains: <code>grep -E -o '[a-zA-Z0-9_-]+(\.[a-zA-Z0-9_-]+)+(\.[a-zA-Z]{2,})' ~/sni_ip_ranges/*.txt > domains.txt</code>
	* Potentially dangerous files: https://github.com/Bo0oM/fuzz.txt		* Potentially dangerous files: https://github.com/Bo0oM/fuzz.txt

Booda: /* Word Lists */

2023-08-14T01:13:31Z

Word Lists

← Older revision		Revision as of 01:13, 14 August 2023
Line 120:		Line 120:
	** Search for and extract your targets domains: <code>cat ~/sni_ip_ranges/*.txt \| grep "\target\.com" \| awk -F'-- ' '{print $2}' \| tr ' ' '\n' \| tr '[' ' ' \| sed 's/ //' \| sed 's/\]//' \| sort -u</code>		** Search for and extract your targets domains: <code>cat ~/sni_ip_ranges/*.txt \| grep "\target\.com" \| awk -F'-- ' '{print $2}' \| tr ' ' '\n' \| tr '[' ' ' \| sed 's/ //' \| sed 's/\]//' \| sort -u</code>
	*** Extract only domains: <code>grep -E -o '[a-zA-Z0-9_-]+(\.[a-zA-Z0-9_-]+)+(\.[a-zA-Z]{2,})' ~/sni_ip_ranges/*.txt > domains.txt</code>		*** Extract only domains: <code>grep -E -o '[a-zA-Z0-9_-]+(\.[a-zA-Z0-9_-]+)+(\.[a-zA-Z]{2,})' ~/sni_ip_ranges/*.txt > domains.txt</code>
			* Potentially dangerous files: https://github.com/Bo0oM/fuzz.txt

	=== Port scanners ===		=== Port scanners ===