Skip to content

Web

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History

Web

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
LogInBypass.md
LogInBypass.md
 
 
README.md
README.md
 
 
SQLInjection.md
SQLInjection.md
 
 

README.md

This note is written to Solve Web Application CTFs, Bug Bounty or Web App Penetration Testing.

Check my Bug Bounty Hunting Methodology to learn some bonus.

You can use my script Hackify to install tools and wordlist on your linux system.

Content

Installing Tools and Wordlists

  • HackiFy should be used to install important tools and wordlists. 
    git clone https://github.com/ZishanAdThandar/hackify.git
cd hackify
chmod +x hackify.sh; bash hackify.sh # tools
chmod +x wordlist.sh; bash wordlist.sh # wordlist
  • Top tools list: Remaining tools can be installed manually.

Finding Targets

Recon

Basic Recon

Subdomain Enumeration

  • Gobuster gobuster vhost -u http://monitorsthree.htb --append-domain -w /usr/share/seclists/Discovery/DNS/namelist.txt -r
  • ffuf ffuf -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt:FUZZ -fw 18 -mc all -ac -u http://domain.tld -H 'Host: FUZZ.domain.tld' [For vpn file and ctf]
  • ffuf ffuf -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt:FUZZ -fw 18 -mc all -ac -u http://FUZZ.domain.tld [For Real World]
  • subauto [Use Hackify to install subauto] subauto domain.tld [Very useful for real world subdomain enumeration.]

Cloudflare Bypass

Directory Busting

  • FeroxBuster feroxbuster -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt -u http://target.tld/
  • Recursive directory busting ffuf -w /usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-lowercase-2.3-big.txt -ic -recursion -recursion-depth 3 -u https://target.com/FUZZ
  • Directoryffuf -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt -u https://target.com/FUZZ/
  • dirsearch dirsearch -e php,html,txt -t 50 -u http://domain.tld/
  • Files ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-large-files.txt -u https://target.com/FUZZ/

Crawling

Parameter Fuzzing

  • arjun -u target.tlf=d
  • Burpsuite plugin parmafinder++
  • webarchive https://web.archive.org/cdx/search/cdx?url=*.domanin.tld&fl=original&collapse=urlkey
  • x8 Paramter Discovery
  • ffuf

Common file checks

  • robots.txt, secrets.txt, .well-known/security.txt, /.well-known/change-password, .well-known/openid-configuration, .well-known/assetlinks.json, .well-known/mta-sts.txt etc file could reveal sensetive informations
  • use dirb to find common files. dirb http://target.tld
  • Check source code for any sensetive information leak

Banner Grabbing

  • Wappalyzer, Builtwith
  • WhatWeb, nmap, Netcraft
  • wafw00f domain.tld
  • nikto -h domain.tld -Tuning b
  • curl -I domain.tld

Known Vulnerablity in Software or Services

  • Searching on Google
  • Using searchsploit
  • shodan
  • censys
  • We can also utilize online exploit databases to search for vulnerabilities, like Exploit DB, Rapid7 DB, or Vulnerability Lab.

Scanning

CMS Test

  • wpscan wpscan --url https://domain.tld/wordpress-blog/ -e u,ap --api-token=<API_TOKEN> Check https://wpscan.com/profile for api token.
  • Search for other CMS Scanner and use them on particular CMS
  • Known CVE: Check outdated or vulnerable version for any service or software using exploitdb and google.

Dorking

Automated Scan

  • Burp Suite Pro: with different extensions like HUNT by BugCrowd. Bug Bounty Pro could be used.
  • nuclei with nuclei-templates or external templates
    • nuclei template install (as root): nuclei -ut
    • nuclei command: nuclei -l httpsubdomain.txt -resume nuclei.txt -nmhe [rate-limit 10/second to avoid error of rapid request, -nmhe to skip error]
  • Acunetix Pro
    • Creating Acunetix CSV list from https links for i in $(cat domain.comhttpssubdomain.txt); do echo \"$i\", \" \"; done > domain.comacunetix.csv
  • Afrog afrog -T domain.comhttpsubs.txt
  • Owasp NetTracker
  • Wapiti [Linux]

Exploitation Tools

One Liners

Manual Testing

Manual Methods