Bug Bounty - GitBook

@GitBook_s/Footer Recon Dork/Advanced Variations

1. Remove Noise — Exclude Known Domains © [COMPANY]. All rights reserved. -site:www.example.com -site:blog.example.com -site:docs.example.com 2. Find Hidden Subdomains (within a parent domain) © [COMPANY]. All rights reserved. site:*.example.com 3. Find Different Parent Domains (not subdomains) © [COMPANY]. All rights reserved. -site:example.com -site:*.example.com 4. "Powered by" — Vendor Recon "Powered by" "[COMPANY]" -site:github.com -site:linkedin.com 5. Filetype Targeted — Leaked Internal Docs © [COMPANY]. All rights reserved. filetype:pdf confidential 6. Error Pages / Stack Traces "Copyright © [COMPANY]" inurl:error intext:"stack trace" 7. XLS/XLSX Dump (Employee Data) © [COMPANY]. All rights reserved. filetype:xls filetype:xlsx

تشکر از rimon به خاطر کمکش @Error28244

کسی می دونه ، چطوری یا با چی متن رو اینجوری کشویی نشون بدم

🚀 #NEW_IP 👑 📌لیست اول⬇️

2.21.2.58 2.21.2.89 2.23.168.7 5.160.13.85 81.12.72.218 2.23.168.96 92.123.106.96 2.23.168.144 2.23.168.213 2.23.168.254 2.23.170.80 37.255.133.30 104.103.65.50 63.141.252.203 142.54.178.211 185.137.25.214 185.200.232.40 185.200.232.41 185.200.232.49

🗄🗄🗄🗄🗄🗄🗄🗄🗄🗄 📌لیست دوم ⬇️

23.46.188.232 2.18.63.55 172.104.203.186 2.22.248.153 23.205.49.151 23.216.77.65 23.204.104.169 23.60.189.39 23.201.236.247 23.218.215.231 23.201.234.189 23.54.10.142 23.55.90.216 23.78.62.233 23.210.232.83 23.208.243.78 23.218.61.69 23.76.204.218 23.54.98.161 23.37.226.181 23.222.18.209 23.214.209.120 23.196.105.97 23.78.35.160 23.197.52.209 23.221.191.143 2.16.1.152 2.16.6.28 2.16.1.147 2.16.10.162 2.16.1.210 2.16.1.192 2.16.16.182 2.16.6.32 2.16.16.185 2.16.106.18 2.16.106.34 2.16.106.28 23.58.223.195 96.16.248.176 23.55.110.48 2.19.126.93 184.51.252.151 23.207.210.79 184.24.77.25 184.24.57.13 104.108.238.182 23.211.236.207 23.64.59.26 2.23.167.144 23.67.129.53 2.22.112.199 96.16.249.6 2.19.51.178 23.219.79.77 96.16.248.179 23.210.253.96 96.16.248.174 23.62.230.166 104.69.222.105 23.207.210.77 23.220.72.69 2.19.181.9 2.21.173.64 2.21.173.50 104.108.237.97 184.86.103.142 184.51.96.7 2.21.243.203 95.101.35.66 184.86.103.223 184.26.3.238 23.55.96.244 23.36.15.81 96.16.248.147 2.22.144.29 2.23.167.185 2.22.144.12 96.16.248.146 162.159.81.132 23.215.2.5 96.17.206.201 23.215.2.22 23.47.124.153 2.17.100.145 2.22.144.39 23.55.163.80 2.23.167.26 173.223.29.67 23.65.117.219 23.65.124.104 184.85.137.131 184.30.157.239 184.86.103.13 104.80.48.203 2.21.173.25 23.50.104.247 2.23.97.234 96.16.248.145 2.18.190.7 96.16.248.151 23.214.144.96 2.16.19.129 2.23.168.47 2.16.220.191 2.21.2.67 2.21.2.59 2.23.168.144 2.21.2.58 2.21.2.10 2.21.2.89 2.21.2.98 2.21.2.64 2.21.2.122 2.23.168.250 2.21.2.43 2.21.2.107 2.21.2.56 2.23.168.174 2.23.168.96 23.208.64.159 23.59.29.16 23.59.29.58 184.26.54.40 184.26.13.91 23.54.210.170 23.44.201.206 23.221.28.5 23.44.201.206 23.220.163.205 23.209.46.33 23.10.34.11 23.39.185.35 23.32.152.106 23.218.232.181 23.206.188.212 2.21.2.89 23.208.222.120 23.48.203.248 23.44.201.136 23.44.201.151 23.44.201.149 2.21.2.58 23.3.90.48 23.44.201.41 2.19.204.184 23.218.232.188 23.44.201.12 23.212.253.227 23.201.31.155 23.220.163.203 23.44.201.185 23.52.116.66 23.44.201.17 23.62.54.24 23.218.239.132 23.39.149.69 23.52.40.147 23.58.95.144 2.16.244.58 23.212.253.137 2.17.106.176 23.62.54.137 2.17.106.5 23.203.134.233 23.212.253.232 23.206.188.197 23.44.201.170 23.54.127.39 23.214.170.83 23.52.40.89 23.55.176.73 23.202.229.140 23.215.56.61 2.17.106.166 23.222.126.108 184.25.85.224 23.1.241.123 23.3.90.43 184.26.13.91 23.54.210.170 104.83.198.44 92.123.102.153 184.51.252.134 23.48.23.195 23.53.40.147 184.51.252.176 2.18.64.212 172.104.251.198 2.18.79.101 23.216.77.181 23.207.210.77 92.123.102.89 23.216.77.80 23.207.210.84 96.16.53.132 23.53.40.139 23.48.165.70 2.21.20.143 23.43.85.155 23.48.23.184 23.207.210.83 23.209.125.169 23.48.23.172 2.21.240.22 23.55.110.82 23.216.77.35 23.58.95.138 23.33.40.149 23.48.23.146 184.30.157.239 23.209.125.145 92.123.102.130 23.53.40.121 23.48.23.11 23.201.248.171 23.209.125.27 23.48.23.176 23.48.23.133 23.207.210.86 23.55.161.151 92.123.103.89 2.23.7.34 23.207.210.80 23.48.23.165 23.48.23.173 23.48.23.156 23.55.110.74 173.222.107.202 23.204.152.160 2.23.97.120 23.48.23.148 23.55.110.68 23.36.162.206 2.18.79.95 2.22.89.10 2.18.64.7 2.22.89.45 23.55.110.78 23.53.40.105

🗄🗄🗄🗄🗄🗄🗄🗄🗄🗄 📌لیست سوم ⬇️

23.77.7.74 92.123.128.176 104.109.250.232 92.123.106.90 92.123.102.160 104.103.72.80 96.16.248.159 104.89.170.140 184.86.103.158 104.126.37.176 72.246.28.215 23.73.2.75 184.51.133.123 88.221.168.204 88.221.169.205 96.16.122.137 104.103.72.50 23.72.248.210

🗄🗄🗄🗄🗄🗄🗄🗄🗄🗄 👈  دانلود «شیر و خورشید» و نحوه اتصال 🗄🗄🗄🗄🗄🗄🗄🗄🗄🗄 ⭐ @ARGO_VPNN ✅

@GitBook_s/Footer Recon Dork

© [COMPANY]. All rights reserved.

Real-world example:

© Google. All rights reserved.

This dork returns pages that include the company's standard copyright footer. Since most companies (especially large ones) use a consistent footer template across all their domains and subdomains, this simple search can reveal: - Forgotten subdomains - Staging / dev environments - Internal tools exposed to the internet - CDN, static asset, or API endpoints - Regional/country-specific domains (e.g., google.co.id, google.de)

@GitBook_s/Reverse DNS Lookup Methods PHP

php -r 'echo gethostbyaddr("8.8.8.8") . PHP_EOL;'

Ruby

ruby -r socket -e 'p Socket.getnameinfo(Socket.sockaddr_in(0, "8.8.8.8"))' | jq -r '.[0]'

dnsx

echo 8.8.8.8 | dnsx -ptr -ro -silent

host command

host 8.8.8.8 | awk '{print $5}'

Nmap

nmap -R 8.8.8.8 | grep "Nmap scan report for " | awk '{print $5}'

@GitBook_s/Reverse DNS Lookup Methods dig command

dig -x 8.8.8.8 +short

nslookup command

nslookup 8.8.8.8 | grep name | awk '{print $4}'

hakrevdns

echo 8.8.8.8 | hakrevdns | awk '{print $2}'

ipinfo

ipinfo 8.8.8.8 -f hostname | grep -v hostname

Python

python3 -c "import socket; print(socket.getfqdn('8.8.8.8'))"

@GitBook_s/Sans SEC504 https://faresbltagy.gitbook.io/footprintinglabs/sans-sec504

یعنی رفرنس خواندن خیلی بده

voorivex's stories ی نصیحت از یاشار . . .

@GitBook_s GitHub Recon - It’s Really Deep

@GitBook_s Bug Bounty Bootcamp #39: PDF SSRF and Blind Exfiltration — When Headless Browsers Become Your Data Mule

Blind SSRF exfiltration flow @GitBook_s

#SSRF: PDF iframe Injection @GitBook_s

<iframe> SSRF in generated PDFs #SSRF @GitBook_s

PHP Info Page Exposure. There's a lot of sensitive information that can be obtained from an exposed PHP Info page, from configuration secrets to exposed user session cookies. For example, when chained with XSS, this can lead to a full account takeover. #Recon #XSS #InformationDisclosure @GitBook_s

other ways to break out of an <option> tag. Default: </option></select>PAYLOAD Alternative: <input>PAYLOAD <select>PAYLOAD @GitBook_s

Expose Secrets in JS for url in $(cat js-urls.txt); do curl -s $url | grep -E -i "api_key|secret|token|apikey|auth" done Look for hardcoded API keys, JWTs, tokens — possible full account takeover or privilege escalation. @GitBook_s

@GitBook_s/ Biscuit's Bug Bounty Playbook Mains Learn Android Bug Bounty Learn Thick Client Pentesting Bug Bounty Reports & Articles Exploiting Technologies https://oreobiscuit.gitbook.io/introduction