Tweet

🇷🇴 cristi

Follow @CristiVlad25

Jan 21 • 13 tweets • 3 min read

Look for these file extensions in your pentests and appsec assessments.

(thread)

1. .env - commonly used to store environment variables, including sensitive information such as passwords and tokens.

2. .yml/.yaml - commonly used in configuration files for software written in programming languages like Ruby, Python and JavaScript.

3. .properties - commonly used to store configuration settings in Java-based applications.

4. .ini - configuration files used in Windows and other operating systems.

5. .config/.cfg/.conf/.cnf - configuration files used in Windows and other operating systems.

6. .plist - Property list files used in macOS and iOS to store application preferences and configuration settings.

7. .xml - commonly used for configuration and data exchange in various apps.

8. .json - commonly used for configuration and data exchange in various apps.

9. .key - commonly used to store private encryption keys.

10. .aws (folder) - used to store configuration settings for the AWS command-line interface (CLI).

11. .netrc - used to store login information for various network protocols, commonly used by the curl and wget command-line tools.

12. There are many more, yes! You can contribute to the list. Reply and let me know of others.

#pentesting #infosec #cybersecurity #hacking #bugbounty #bugbountytips #infosec #appsec

• • •

Missing some Tweet in this thread? You can try to force a refresh

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @CristiVlad25

🇷🇴 cristi

@CristiVlad25

Jan 22

Top Python Libraries used by Hackers

(thread)

1. socket: A library that provides low-level core networking services.

2. scapy: A powerful interactive packet manipulation library and tool.

Read 10 tweets

🇷🇴 cristi

@CristiVlad25

Jan 20

In this week's newsletter:

- iOS Pentesting | ChatGPT my Teacher | Recon -

(thread)

1. How I'm using ChatGPT as a virtual teacher. And of course, how you can use it too.

2. My greatest pentesting challenge for this week.

Read 5 tweets

🇷🇴 cristi

@CristiVlad25

Jan 19

Squeezing the juices out of robots.txt.

A fully automated workflow that you've never seen before.

(thread)

1. This script scrapes the disallowed paths from the robots.txt files of a list of domains and saves them to a single file. It also removes any unwanted entries and sorts the file in a particular way.

Can you write it yourself? Here’s how the script should look like.

2. Create a directory called "massrobots" in the pwd. This is where you'll save all the robots.txt files for later processing.

Read 15 tweets

🇷🇴 cristi

@CristiVlad25

Jan 19

@RealTryHackMe

The 4 Pentesting Learning Paths by @RealTryHackMe.

(thread)

1. CompTIA Pentest+ Pathway (Easy)

Gain hands-on exercises and practical exam preparation to prepare you for the CompTIA PenTest+ exam.

Go here: tryhackme.com/path-action/pe…

2. Jr Penetration Tester Pathway (Intermediate)

This pathway gives you with the practical skills to perform security assessments against web applications and enterprise infrastructure.

Go here: tryhackme.com/path-action/jr…

Read 6 tweets

🇷🇴 cristi

@CristiVlad25

Jan 18

2023 Hacker's Guide: How to Break into Pentesting and AppSec.

(thread)

@RealTryHackMe

1. Hands down, one of the best practical resources is @RealTryHackMe. I would take the "Complete Beginner" learning path, then the "Jr. Penetration Tester" path. It will get you off the ground in no time.

tryhackme.com/path-action/be…

@PortSwigger

2. Simultaneously, I would practice at @PortSwigger Academy. Personally, I'd focus on all things Broken Access Control.

portswigger.net/web-security/a…

Read 8 tweets