Thread by @thebinarybot

I got around 10+ messages last week asking me for the tools I use in Bug Bounty.

So I thought why not make a thread on it.

Here's a list of my most used tools.

🧵👇

PS: This is my only my personal preference and I always experiment.
#bugbounty #infosec #recon #cybersecurity

1. Proxy

-> BurpSuite Community Edition

You really don't need BurpSuite Pro as a beginner. The community edition does almost everything you'd want to do. The only thing I've felt bad is not being able to save a project.

2. Fetch all subdomains

-> Amass

Quick Tip: Search with config file. Do more than just amass enum -d target.com

Link to config file: github.com/OWASP/Amass/bl…

3. Filter live subdomains

-> Httpx

Pipe your output after fetching URLs to httpx and probe the live domains

4. Port Scanner

-> Naabu

Nmap is great, but Naabu is better.

5. DNS Resolver

-> Dnsx

For wordlist, I'll try to create one of my own after inserting common words from the webpages. In unbearable circumstances, I use the best dns wordlist from assetnote.

6. Content Discovery/Fuzzing

-> Ffuf

Again, I'll curate my own wordlist and mix it with directory-list-2.3-medium.txt from gobuster.

7. Fingerprinting

-> Wappalyzer

Definitely comes handy sometimes. Would recommend it.

8. Spidering & Fetch Parameters

-> xnLinkFinder

You have to give it to this tool. The results have been pretty wonderful recently and the probing time is insanely fast.

I mostly use only these tools on a regular basis but under certain circumstances I'll intend to use other tools in the market for that specific purpose.

What major tool do you think I'm missing out?

// PS: I don't do vulnerability scanning, so please don't suggest Nuclei xD

That's a wrap!

If you enjoyed this thread:

1. Follow me @thebinarybot for more of these
2. RT the tweet below to share this thread with your audience

https://twitter.com/973520902343180288/status/1563504895109369856