ch0ic3/AllAboutBugBounty
1
0
Fork 0
mirror of https://github.com/daffainfo/AllAboutBugBounty.git synced 2024-12-18 18:36:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
master
AllAboutBugBounty/Reconnaissance/Scope.md
Muhammad Daffa 5ac45ada2b Added Joomla and SSRF, and doing some major changes
2022-07-09 22:35:32 +07:00

66 lines
2.5 KiB
Markdown
Raw Permalink Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

* ### __Small Scope__
Only Specific URLs are part of Scope. This usually includes staging/dev/testing or single URLs.
- [x] Directory Enumeration
- [x] Technology Fingerprinting
- [x] Port Scanning
- [x] Parameter Fuzzing
- [x] Wayback History
- [x] Known Vulnerabilities
- [x] Hardcoded Information in JavaScript
- [x] Domain Specific GitHub & Google Dorking
- [x] Broken Link Hijacking
- [x] Data Breach Analysis
- [x] Misconfigured Cloud Storage
* ### __Medium Scope__
Usually the scope is wild card scope where all the subdomains are part of scope
- [x] Subdomain Enumeration
- [x] Subdomain Takeover
- [x] Probing & Technology Fingerprinting
- [x] Port Scanning
- [x] Known Vulnerabilities
- [x] Template Based Scanning (Nuclei/Jeales)
- [x] Misconfigured Cloud Storage
- [x] Broken Link Hijacking
- [x] Directory Enumeration
- [x] Hardcoded Information in JavaScript
- [x] GitHub Reconnaissance
- [x] Google Dorking
- [x] Data Breach Analysis
- [x] Parameter Fuzzing
- [x] Internet Search Engine Discovery (Shodan, Censys, Spyse, etc.)
- [x] IP Range Enumeration (If in Scope)
- [x] Wayback History
- [x] Potential Pattern Extraction with GF and automating further for XSS, SSRF, etc.
- [x] Heartbleed Scanning
- [x] General Security Misconfiguration Scanning
* ### __Large Scope__
Everything related to the Organization is a part of Scope. This includes child companies, subdomains or any labelled asset owned by organization.
- [x] Tracking & Tracing every possible signatures of the Target Application (Often there might not be any history on Google related to a scope target, but you can still crawl it.) ​
- [x] Subsidiary & Acquisition Enumeration (Depth – Max)​
- [x] Reverse Lookup
- [x] ASN & IP Space Enumeration and Service Identification​
- [x] Subdomain Enumeration
- [x] Subdomain Takeover
- [x] Probing & Technology Fingerprinting
- [x] Port Scanning
- [x] Known Vulnerabilities
- [x] Template Based Scanning (Nuclei/Jeales)
- [x] Misconfigured Cloud Storage
- [x] Broken Link Hijacking
- [x] Directory Enumeration
- [x] Hardcoded Information in JavaScript
- [x] GitHub Reconnaissance
- [x] Google Dorking
- [x] Data Breach Analysis
- [x] Parameter Fuzzing
- [x] Internet Search Engine Discovery (Shodan, Censys, Spyse, etc.)
- [x] IP Range Enumeration (If in Scope)
- [x] Wayback History
- [x] Potential Pattern Extraction with GF and automating further for XSS, SSRF, etc.
- [x] Heartbleed Scanning
- [x] General Security Misconfiguration Scanning
- [x] And any possible Recon Vector (Network/Web) can be applied.​
Source: [Link](https://www.xmind.net/m/hKKexj/)
Reference in New Issue View Git Blame Copy Permalink