Subdomain Enumeration

echo "example.com" | subdog --all --silent | unew sub.txt

subfinder -d example.com -all -recursive -t 100 -timeout 30 -max-time 30 -silent | unew subdomains.txt

**cat urls.txt | favinfo --timeout 15s --json > results.json**

Port scanning

Naabu quickly identifies open ports across discovered subdomains, helping uncover additional services and expand the attack surface before HTTP enumeration.

cat subs.txt | naabu -duc -silent -passive ( fast and uses shodan db , when we have less time use this )

echo "134.122.89.61" | naabu -p - [ ACTIVE SCANNING ]

vyre and httpx

cat subs.txt | vyre --status-code --title --content-length --response-time ( faster than httpx, use this first to get alive ones and work on them first and run httpx after running vyre )

cat allsubs.txt | httpx -duc -silent -nc -sc -title -td -cl -ct | sort -t'[' -k3,3nr | unew -el -i httpx.txt
cat httpx.txt | awk '{print $1}' | dlevel --silent --max-level | unew -el -i alivesubs.txt
cat httpx.txt | grep -aEi 'IIS|fIIS Windows Server|Microsoft-IIS|Windows Server|3CX|phppgadmin|phpmyadmin|jetty|jboss|kibana|grafana|gitlab|kubernetes|citrix|symfony|jira|geoserver|rocketmq|Cisco|Joomla|kafka|pfSense|sonicwall|Jenkins|GlobalProtect|Sentinel|AEM|Airflow|Zimbra|CPanel|cacti|jellyfin|ActiveMQ|phpLDAPadmin' | unew -el -i interesting_tech_alivesubs.txt
cat httpx.txt | awk '{print $1}' | grep -aEi '(^|[.-])(admin|administrator|auth|login|signin|sso|oauth|portal|dashboard|panel|cpanel|webmail|mail|exchange|dev|develop|development|test|testing|qa|quality|staging|stage|beta|alpha|demo|sandbox|lab|labs|preprod|pre-prod|prod|production|app|api|backend|frontend|web|secure|internal|intranet|extranet|private|grafana|kibana|prometheus|nagios|zabbix|cacti|splunk|elk|logs|metrics|monitoring|status|health|analytics|git|gitlab|github|bitbucket|svn|jenkins|build|ci|deploy|deployment|pipeline|db|database|mysql|postgres|mongodb|redis|elastic|elasticsearch|sql|phpmyadmin|adminer|support|help|helpdesk|ticket|tickets|service|services|customer|client|crm|vpn|remote|rdp|ssh|ftp|sftp|webvpn|citrix|vmware|horizon|backup|backups|old|legacy|archive|temp|tmp|upload|uploads|file|files)(\.|$)' | unew -el -i interesting_alivesubs.txt

choose any one methodology from the above one.

fuzzing on status codes Always fuzz: 403 ( use way back machine ) 302 301 404 ( use way back machine ) 200

check 200 status codes first with highest content length first manually which gives us the jist about funtionalities of the website

Tech Detection

echo "<https://www.example.com>" | techfinder -mode best -silent

Content Discovery

cewl -d 2 -m 5 <https://www.footlocker.com> | grep -avi '^cewl' | unew wordlist.txt

echo "krazeplanet.com" | subdog --silent --all | tr '.' '\n' | unew wordlist.txt

directory fuzzing

Always fuzz:
403
302
301
404
200

If you found try these steps:
step1: shodan + fofa
step2: google dorking
step3: fuzzing with program based wordlists

site:status.asadcdn.com
<https://status.asadcdn.com/tools>

## Directory fuzzing
<https://labs.krazeplanet.com/admin>

## Extension fuzzing like:
ffuf -c -u <http://admin.kzlabs.store/FUZZ> -w word.txt -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" -v -e ".zip,.php,.jsp,.jspx,.asp,.aspx,.xml,.html,.bak,.log"
<https://labs.krazeplanet.com/xss/oldreflected/FUZZ.zip>
<https://labs.krazeplanet.com/xss/oldreflected/FUZZ.php>

## Login pages fuzzing/finding
<https://labs.krazeplanet.com/FUZZ> → <https://labs.krazeplanet.com/admin> ==> 200
<https://labs.krazeplanet.com/admin/FUZZ> → <https://labs.krazeplanet.com/admin/login.php> ==> 200

ffuf -c -u <https://sagadb.org/FUZZ> -w advanced_sensitive_wordlist.txt -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" -v -maxtime-job 60 -recursion -recursion-depth 2 -of json -o ffuf1.json

cat ffuf1.json | jq -r '.results | map(select(.status == 200)) | group_by(.length) | map(.[0]) | .[] | "\(.url)"' | unew

echo "<https://sagadb.org>" | ffufscan --wordlist advanced_sensitive_wordlist.txt --recursive --recursion-depth 2

image.png

when you found any directory visit it manually and then confirm the finding everytime

Vhost Fuzzing

  1. First create a baseline using a definitely nonexistent hostname:
curl -k -i -H "Host: [definitely-not-real-928374.eummena.org](<http://definitely-not-real-928374.eummena.org/>)" [<https://IP/>](<https://ip/>)

//example
curl -k -i -H "Host: definitely-not-real-928374.eummena.org" <https://67.207.77.89/>

image.png

Record:

  1. If the baseline is a clearly generic response (e.g. default Nginx page,generic gateway/error page), use its content length with -fs to filter the generic responses.
  2. If the baseline is a generic 403/404, run fuzzing WITHOUT -fs first. Compare the responses against the baseline.
  3. A different status/size/words/lines/body/headers can indicate a potentially interesting vhost.
  4. Manually validate interesting candidates before considering them confirmed vhosts.

SecLists wordlist

ffuf -u [<https://IP/>](<https://ip/>) -H "Host: [FUZZ.domain.com](<http://fuzz.domain.com/>)" -w /root/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -fs SIZE -k

//example
ffuf -u <https://67.207.77.89/> -H "Host: FUZZ.eummena.org" -w /root/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -fs 150 -k

Custom Thorfinn wordlist

ffuf -u [<https://IP/>](<https://ip/>) -H "Host: [FUZZ.domain.com](<http://fuzz.domain.com/>)" -w /root/bugbounty/domain/thorfinn-wordlist.txt -fs SIZE -k

//example
ffuf -u <https://95.217.230.172/> -H "Host: FUZZ.eummena.org" -w /root/bugbounty/eummena/thorfinn-wordlist.txt -fs 612 -k

Vhost → /etc/hosts

After discovering a vhost, check whether it resolves:

dig vhost.hostname

//example
dig zeus.hoare.ctfio.com

188.166.137.91    zeus.hoare.ctfio.com

Then access the vhost normally.

check this video for reference https://youtu.be/lUUL2dNQI5M

add -mc 405,415 for apis

xxxxxxx

Historical analysis

Waymore discovers historical URLs, parameters, JavaScript files, and hidden endpoints from public archives, helping uncover attack surfaces that are no longer linked but may still exist.

## Important note, you don't need to give subs.txt file this takes as wildcard:
echo "dell.com" | waymore -mode U -lr 3 -lcc 3 -f --stream | unew urls.txt

# cat httpx.txt
<https://admin.dell.com>
<https://ajhgfj.dell.com>

## Run this if main domain is not in inscope
cat httpx.txt | sed -e 's/https\?:\/\/\(www\.\)\?//' -e 's/:.*$//' | waymore -mode U -lr 3 -lcc 3 -f --stream | unew urls.txt

use the below command to find old legacy endpoints

grep -Ei '/(v[0-3]|v-1|v0\.[0-9]|beta|alpha|old|legacy|api|endpoint|vhost|gw|gateway|rpc|rest|graphql|gql|swagger|openapi|api-docs|wp-json|graphiql|playground|admin|debug|test|config|setup|export|download|upload|backup|dump|user|profile|invoice|payment|deprecated|obsolete|broken|fallback|patch|fix|temp|holder|internal|int|private|backend|b2b|m2m|upstream|origin|corp|soap|wsdl|xmlrpc|amf|remoting|odata|migrate|sync|transfer|import)/|\.(php|aspx|asp|jsp|jspx|py|pl|cgi|do|action|json|yaml|yml|wsdl|xml|axd|asmx|dll|bak|log)' urls.txt | sort -u > master_legacy_candidates.txt


grep -E '(\/\/|\.json\?|\.xml\?|api-[a-zA-Z0-9_-]+|dev-[a-zA-Z0-9_-]+)' urls.txt | sort -u >> master_legacy_candidates.txt

Active crawling

## Single URL:
echo "<https://www.dell.com>" | katana -duc -silent -nc -jc -concurrency 10 -parallelism 10 -depth 7 -timeout 30 -aff | unew katana_urls.txt

## Multiple URLs:
cat httpx.txt | katana -duc -silent -nc -jc -concurrency 10 -parallelism 10 -depth 7 -timeout 30 -aff | unew urls.txt

cat subs.txt | urlflux --silent | unew urls.txt

urlflux tool is combination of hakrawler and paramfinder

cat urls.txt | grep -aE '\.(php|jsp|jspa|asp|aspx|html)$' | egrep -av "=" | unew extension_endpoints.txt

cat urls.txt | grep -aEi '\.(log|zip|sql|old|bak|backup|gz|tgz|tar|rar|7z|bz2|xz|db|sqlite|sqlite3|mdb|accdb|db3|dump|sqlitedb|csv|tsv|xls|xlsx|ods|pdf|doc|docx|ppt|pptx|pem|key|crt|csr|p12|pfx|jks|keystore|env|ini|conf|config|cfg|cnf|yaml|yml|toml|properties|xml|json|lock|swp|tmp|temp|orig|save|copy|disabled|inc|dist|sample|example|git|svn|hg|ps1|sh|bash|zsh|kdbx|md|txt|cache|history|passwd|htpasswd|htaccess)(\?|$)' urls.txt

MySQL, Ngnix, PHP, wordpress

### i am working on my own project that uses these above techs
### write an custom 500+ wordlist for directory fuzzing so i can check for directories fuzzing that are sensitive to find more vulnerability and help them to fix

Jenkins, Swagger UI, IIS Windows Server, Kibana

### i am working on my own project that uses these above techs
### write an custom 500+ wordlist for directory fuzzing so i can check for directories fuzzing that are sensitive to find more vulnerability and help them for fixing the bug

ends with .log, .zip, .sql, .old

### i am working on my own project that usese these above techs
### write an custom 500+ wordlist for directory fuzzing so i can check for directories fuzzing that are sensitive to find more vulnerability and help in them fix

js urls finding

cat targets.txt | jscrawler --complete -o javascript_files.txt

use jsluice here ( use this jsluice and jscrawler and grep all js files from urls.txt and unew them and give it to secyra )

cat jslinks.txt | secyra

X8

x8 -u <https://kzlabs.com/6.php> -X GET --disable-progress-bar -w wordlist.txt

for target in $(cat endpoints.txt);do x8 -u $target -X GET POST --disable-progress-bar -w wordlist.txt;done

use params.txt wordlist if you dont have time.

if you have time use the wordlist generation commands in the content discovery section and use that specific wordlist.

x8scan

echo "<https://wstp.kzlabs.store/6.php>" | x8scan -w /root/params.txt

Dorking