Recon, the gathering of information about your target, is becoming more and more important! π§
Here are the tools to help you spot subdomains, vhosts, S3 buckets, parameters and more faster and more effective than the others π
[1οΈβ£] DNS
This DNS toolkit by @pdiscoveryio can do a lot! But let's focus on reverse DNS lookups π
Often, you have a huge list of IP addresses π
Just like resolving a domain to an IP, you can also try doing the opposite using PTR records!
Et voila! Domains to continue recon! π
[2οΈβ£] Amass
This network mapping tool by @owasp is incredible, but let's hone in on doing subdomain enumeration. πΈ
The main domains companies use are often well-secured. But what about the domain that nobody knows about? Those can be riddled with bugs! π
Let's find them! π
[3οΈβ£] @nmap
Nmap stands for "Network Mapper" and that's precisely what it does.
This 25-year-old tool is FAR from outdated!
Let's use Nmap to find out what's actually running on those endless machines you've enumerated so far! π
[4οΈβ£] VHostScan
This Python scanner by @codingo_ is an excellent tool for finding virtual hosts! π¨βπ»
What's that? Unlike subdomains, vhosts allow multiple applications to be hosted on a single server. π₯
This slightly esoteric feature means not many hunters are looking for this! π
[5οΈβ£] Httprobe
All this recon has given us many subdomains, but what now? π€·ββοΈ
This tool by @TomNomNom will help us find all the web servers running on these subdomains! π
[6οΈβ£] Waybackurls
Another tool by @TomNomNom can help us continue.
Instead of opting for active directory fuzzing, let's use the power of history to see what we can find on a target's website!
This tool uses the @waybackmachine to find new endpoints passively! π
[7οΈβ£] S3enum
This Go tool by @koenrh automates AWS S3 bucket enumeration.
Using this tool, you may be able to find the next big misconfiguration or overly permissive S3 bucket! π
[8οΈβ£] EyeWitness
If you're overwhelmed with endpoints, that's okay!
Let's bring some order to this madness using this tool by @FortyNorthSec πͺ
It allows you to organize endpoints depending on their return value quickly. Screenshots of the page are a bonus! πΌ
[9οΈβ£] Relative URL extractor
JavaScript files are recon goldmines! They sometimes reference very interesting relative URLs that you need to know about! π§
But manually going through 1000s of JS files, no! πͺ
Use this great tool by @jobertabma π
[1οΈβ£0οΈβ£] TruffleHog
If you're lucky, you may have found a git repository during your recon! π
Let's use this tool by @trufflesec to dig into it and uncover all secrets the repo has to hold! π
[1οΈβ£1οΈβ£] Arjun
Let's talk about enumerating GET parameters!
If you were thinking of brute-forcing thousands of them, then check out Arjun by @s0md3v π
It can check for thousands of GET params in under 50 requests! π€―
[1οΈβ£2οΈβ£] Wappalyzer
One last trick we'll give you is fingerprinting everything you find using @Wappalyzer π
This way, you know what you're dealing with and what exploit might or might not work! πͺ
𧡠And that's a wrap!
Note that there are alternatives to the tools we've showcased here, and looking around for something you like is highly recommended! π
Be sure to like this tweet and follow @intigriti if you want more of these threads! π
This is the thread I wish someone created for me when I started participating in bug bounty! π
Not everyone shares these methods... but
Here are a few tips to help you identify & exploit more IDOR vulnerabilities! π€
𧡠π
IDOR (insecure direct object reference) vulnerabilities are present in web services that directly reference a data object without proper access controls!
The data object can be anything, from sensitive fields that are stored in databases to files stored in a storage bucket.
Prefer a video instead? Watch our "IDOR In 100 seconds" explanation video on Youtube! π
Ever had to analyze JavaScript files using Burpsuite? π§
Here are 3 web extensions to help you out and find secrets, links and other sensitive data! π€
A thread 𧡠π
1οΈβ£ JS Miner
JS Miner is a Burpsuite Pro extension to help you analyze static files like JavaScript & JSON files found on your target for finding secrets, endpoints and other hard-coded sensitive data! π
Nomore403 is a Golang tool specifically designed to bypass pages behind a 403/40X status code! It features several bypasses including sending headers & HTTP methods to get access to protected pages! π€