N1NJ10

Web-Active

Resources

Commands

  • General
    • Fingerprinting
      • File & Extention Fuzzing 
        ffuf -w Discovery/Web-Content/web-extensions.txt:FUZZ -u http://154.57.164.77:30154/indexFUZZ
      • Explore JS & webarchive 
        ./wayback_crawler.sh -d facebook.com -e txt # My own script 
 
cat * | grep -Po "((http|https):\/\/)?(([\w.-]*)\.([\w]*)\.([A-z]))\w+" | sort -u | grep facebook.com # subdomains
cat * | grep -oh "\"\/[a-zA-Z0-9_/?=&]*\"" | sed -e 's/^"//' -e 's/"$//' | sort -u # endpoints 
 
js-beautify rocket-loader.min.js > beauty_rocket-loader.min.js
      • Parameters 
        arjun -u https://facebook.com --passive
 
echo facebook.com | gau --subs | grep '=' | unfurl keys | sort -u
 
ffuf -w  /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt -u http://faculty.academy.htb:30340/courses/linux-security.php7 -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs 774
      • Directories 
        ffuf -w /opt/useful/seclists/Discovery/Web-Content/common.txt -u http://test.academy.htb:31701/FUZZ -recursion -recursion-depth 2
    • Crawling 
      photon -u https://facebook.com -e json -o ./smartcrwl --wayback
 
katana -u https://facebook.com/CTSC -jc -c 3 -headless --no-sandbox -d 10 -kf -H 'Cookie: JSESSIONID=gph_lasdifj2389fjwe9ufhwe89fh234w'
 
gospider -s https://facebook.com/CTSC -H 'Cookie: JSESSIONID=gph_lasdifj2389fjwe9ufhwe89fh234w' --sitemap --robots -o ./crwl
 
python3 ReconSpider.py https://facebook.com # wget -O ReconSpider.zip https://academy.hackthebox.com/storage/modules/144/ReconSpider.v1.2.zip
    • Technologies 
      whatweb https://facebook.com/CTSC -a 4 -H 'Cookie: JSESSIONID=gph_lasdifj2389fjwe9ufhwe89fh234w'
 
curl -I inlanefreight.com
curl -I https://inlanefreight.com
 
 
wafw00f https://facebook.com
 
nikto -h facebook.com -Tuning b
    • Cloud or Server 
      host flaws.cloud # look at the IP's 
nslookup 52.218.201.195
  • Subdomain Enum
    • Prequisites 
      dnsvalidator -tL https://public-dns.info/nameservers.txt -threads 100 -o resolvers.txt
    • Bruteforce 
      shuffledns -d facebook.com -w best-dns-wordlist.txt -r resolvers.txt -mode bruteforce
 
gobuster dns -w best-dns-wordlist.txt -do facebook.com -t 50
 
ffuf -w /opt/useful/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u https://FUZZ.inlanefreight.com/
    • Hybard 
      subfinder -d facebook.com -rL resolvers.txt -all -o subfinder.txt -ip -nW
subfinder -d facebook.com -all -o juicy.txt
for domain in $(cat juicy.txt); do host $domain; done | grep "has address"
    • Subject Alternative Name (SAN) 
      true | openssl s_client -connect sub.facebook.com:443 2>/dev/null | openssl x509 -noout -text | grep "DNS" | tr ',' '\n' | cut -d ":" -f2
    • vhosts 
      ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://62.171.184.221 -H "Host: FUZZ.facebook.com"
ffuf -w /opt/useful/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb/ -H 'Host: FUZZ.academy.htb'
 
interlace -tL ips.txt -threads 10 -c "ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://_target_ -H 'Host: FUZZ.facebook.com' -fc 403,404,301,302 -o _target_-ffuf.txt"
 
gobuster vhost -u http://inlanefreight.htb:81 -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain 
gobuster vhost --url http://192.168.99.9:50092 -r -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain --domain inlanefreight.htb # The best
  • Automation
amass enum -active -d paypal.com
 
nuclei -target https://facebook.com/CTSC  -headless -H 'Cookie: JSESSIONID=gph_lasdifj2389fjwe9ufhwe89fh234w'
 
finalrecon --url https://facebook.com --full -dt 80 -T 5
 
# Misc : 
amass db -list
amass db -show -d owasp.org
amass viz -d3 -dir paypal
amass track -d paypal.com
  • Filtration
cat sub.txt | httpx -sc -cl --title -ip -favicon -o facebook-alive-subdomain.txt # live domains
 
cat facebook-alive-subdomain.txt | awk '{print $1}' > eyewitness_targets.txt
eyewitness -f eyewitness_targets.txt --web --timeout 50 -d screenshots
 
jq -r 'select(.status == 200) | .url + " " + (.status|tostring)' fero.json

Tools

Notes

Graph View

Backlinks