Don't know what to do in your recon? @KingOfBugbounty
#bugbountytips #bugbounty #reconnaissence
- [ ] Identify web server, technologies and database
- [ ] Subsidiary and Acquisition Enumeration
- [ ] Reverse Lookup
- [ ] Reverse Whois
- [ ] ASN & IP Space Enumeration
#bugbountytips #bugbounty #reconnaissence
- [ ] Identify web server, technologies and database
- [ ] Subsidiary and Acquisition Enumeration
- [ ] Reverse Lookup
- [ ] Reverse Whois
- [ ] ASN & IP Space Enumeration
- [ ] ReconFTW
- [ ] Github Recon
- [ ] Waf Detection
- [ ] CRAWLING
- [ ] gospider
- [ ] gau
- [ ] gauplus
- [ ] hakrawler
Service Enumeration
- [ ] Google Dork
Gathering Parameters
- [ ] Wordlist creation
- [ ] Metadata
- [ ] Github Recon
- [ ] Waf Detection
- [ ] CRAWLING
- [ ] gospider
- [ ] gau
- [ ] gauplus
- [ ] hakrawler
Service Enumeration
- [ ] Google Dork
Gathering Parameters
- [ ] Wordlist creation
- [ ] Metadata
- [ ] Screenshot → gowitness
- [ ] Searchsploits
- [ ] Directory Enumeration
-- [ ] ffuf
- [ ] wfuzz
- [ ] dirbuster
- [ ] gobuster
- [ ] dirsearch
JS File Analysis
JSFinder.sh
subjs | getjs
JS hardcoded APIs and secrets (secretfinder)
LinkFinder
- [ ] Searchsploits
- [ ] Directory Enumeration
-- [ ] ffuf
- [ ] wfuzz
- [ ] dirbuster
- [ ] gobuster
- [ ] dirsearch
JS File Analysis
JSFinder.sh
subjs | getjs
JS hardcoded APIs and secrets (secretfinder)
LinkFinder
api endpoints
Broken link hijacking (blc)
Locate admin and login panel
Nuclei template based recon
Subdomains from subdomains (altdns, flydns, goaltdns)
- [ ] Parameter Fuzzing
- [ ] Content Discovery
- [ ] Endpoints
- [ ] .git/HEAD → git exposed
- [ ] Login forms
Broken link hijacking (blc)
Locate admin and login panel
Nuclei template based recon
Subdomains from subdomains (altdns, flydns, goaltdns)
- [ ] Parameter Fuzzing
- [ ] Content Discovery
- [ ] Endpoints
- [ ] .git/HEAD → git exposed
- [ ] Login forms
- [ ] Login endpoints
- [ ] PORTSCANNING
- [ ] nmap
- [ ] masscan
- [ ] naabu
- [ ] dnsrecon → zonetransfer? → dnsrecon <target> -t axfr
favicon → shodan
Misconfigured Cloud Storage
WAYBACKURLS data
Use censys fofa, shodan
CVE SCAN
- [ ] PORTSCANNING
- [ ] nmap
- [ ] masscan
- [ ] naabu
- [ ] dnsrecon → zonetransfer? → dnsrecon <target> -t axfr
favicon → shodan
Misconfigured Cloud Storage
WAYBACKURLS data
Use censys fofa, shodan
CVE SCAN
جاري تحميل الاقتراحات...