137 lines
5.8 KiB
Markdown
137 lines
5.8 KiB
Markdown
# Bug Hunting Methodology
|
|
|
|
## Passive recon
|
|
|
|
* Using [Shodan](https://www.shodan.io/) to detect similar app
|
|
|
|
```bash
|
|
can be integrated with nmap (https://github.com/glennzw/shodan-hq-nse)
|
|
nmap --script shodan-hq.nse --script-args 'apikey=<yourShodanAPIKey>,target=<hackme>'
|
|
```
|
|
|
|
* Using [The Wayback Machine](https://archive.org/web/) to detect forgotten endpoints
|
|
|
|
```bash
|
|
look for JS files, old links
|
|
curl -sX GET "http://web.archive.org/cdx/search/cdx?url=<targetDomain.com>&output=text&fl=original&collapse=urlkey&matchType=prefix"
|
|
```
|
|
|
|
* Using [The Harvester](https://github.com/laramies/theHarvester)
|
|
|
|
```python
|
|
python theHarvester.py -b all -d domain.com
|
|
```
|
|
|
|
* Look for private information in [GitHub]() repos with [GitRob](https://github.com/michenriksen/gitrob.git)
|
|
```bash
|
|
gitrob analyze johndoe --site=https://github.acme.com --endpoint=https://github.acme.com/api/v3 --access-tokens=token1,token2
|
|
```
|
|
|
|
* Perform Google Dorks search
|
|
|
|
|
|
## Active recon
|
|
|
|
### Network discovery
|
|
|
|
* Subdomains enumeration
|
|
* Enumerate already found subdomains: [projectdiscovery/subfinder](https://github.com/projectdiscovery/subfinder): `subfinder -d hackerone.com`
|
|
* Permutate subdomains: [infosec-au/altdns](https://github.com/infosec-au/altdns)
|
|
* Bruteforce subdomains: [Josue87/gotator](https://github.com/Josue87/gotator)
|
|
* Subdomain takeovers: [EdOverflow/can-i-take-over-xyz](https://github.com/EdOverflow/can-i-take-over-xyz)
|
|
|
|
* Network discovery
|
|
* Scan IP ranges with `nmap`, [robertdavidgraham/masscan](https://github.com/robertdavidgraham/masscan) and [projectdiscovery/naabu](https://github.com/projectdiscovery/naabu)
|
|
* Discover services, version and banners
|
|
|
|
* Review latest acquisitions
|
|
|
|
* ASN enumeration
|
|
* [projectdiscovery/asnmap](https://github.com/projectdiscovery/asnmap): `asnmap -a AS45596 -silent`
|
|
|
|
* DNS Zone Transfer
|
|
```ps1
|
|
host -t ns domain.local
|
|
domain.local name server master.domain.local.
|
|
|
|
host master.domain.local
|
|
master.domain.local has address 192.168.1.1
|
|
|
|
dig axfr domain.local @192.168.1.1
|
|
```
|
|
|
|
### Web discovery
|
|
|
|
* Locate `robots.txt`, `security.txt`, `sitemap.xml` files
|
|
* Retrieve comments in source code
|
|
* Discover URL: [tomnomnom/waybackurls](https://github.com/tomnomnom/waybackurls)
|
|
* Search for `hidden` parameters: [PortSwigger/param-miner](https://github.com/PortSwigger/param-miner)
|
|
|
|
* List all the subdirectories and files with `gobuster` or `ffuf`
|
|
```ps1
|
|
# gobuster -w wordlist -u URL -t threads
|
|
./gobuster -u http://example.com/ -w words.txt -t 10
|
|
```
|
|
|
|
* Find backup files with [mazen160/bfac](https://github.com/mazen160/bfac)
|
|
```bash
|
|
bfac --url http://example.com/test.php --level 4
|
|
bfac --list testing_list.txt
|
|
```
|
|
|
|
* Map technologies: Web service enumeration using [projectdiscovery/httpx](https://github.com/projectdiscovery/httpx) or Wappalyzer
|
|
* Gather favicon hash, JARM fingerprint, ASN, status code, services and technologies (Github Pages, Cloudflare, Ruby, Nginx,...)
|
|
|
|
* Take screenshots for every websites using [sensepost/gowitness](https://github.com/sensepost/gowitness)
|
|
|
|
* Automated vulnerability scanners
|
|
* [projectdiscovery/nuclei](https://github.com/projectdiscovery/nuclei): `nuclei -u https://example.com`
|
|
* [Burp Suite's web vulnerability scanner](https://portswigger.net/burp/vulnerability-scanner)
|
|
* [sullo/nikto](https://github.com/sullo/nikto): `./nikto.pl -h http://www.example.com`
|
|
|
|
* Manual Testing: Explore the website with a proxy:
|
|
* [Caido - A lightweight web security auditing toolkit](https://caido.io/)
|
|
* [ZAP - OWASP Zed Attack Proxy](https://www.zaproxy.org/)
|
|
* [Burp Suite - Community Edition](https://portswigger.net/burp/communitydownload)
|
|
|
|
|
|
## Looking for Web vulnerabilities
|
|
|
|
* Explore the website and look for vulnerabilities listed in this repository: SQL injection, XSS, CRLF, Cookies, ....
|
|
* Test for Business Logic weaknesses
|
|
* High or negative numerical values
|
|
* Try all the features and click all the buttons
|
|
* [The Web Application Hacker's Handbook Checklist](https://gist.github.com/gbedoya/10935137) copied from http://mdsec.net/wahh/tasks.html
|
|
|
|
* Subscribe to the site and pay for the additional functionality to test
|
|
|
|
* Inspect Payment functionality - [@gwendallecoguic](https://twitter.com/gwendallecoguic/status/988138794686779392)
|
|
> if the webapp you're testing uses an external payment gateway, check the doc to find the test credit numbers, purchase something and if the webapp didn't disable the test mode, it will be free
|
|
|
|
From https://stripe.com/docs/testing#cards : "Use any of the following test card numbers, a valid expiration date in the future, and any random CVC number, to create a successful payment. Each test card's billing country is set to U.S. "
|
|
e.g :
|
|
|
|
Test card numbers and tokens
|
|
|
|
| NUMBER | BRAND | TOKEN |
|
|
| :------------- | :------------- | :------------- |
|
|
| 4242424242424242 | Visa | tok_visa |
|
|
| 4000056655665556 | Visa (debit) | tok_visa_debit |
|
|
| 5555555555554444 | Mastercard | tok_mastercard |
|
|
|
|
International test card numbers and tokens
|
|
|
|
| NUMBER | TOKEN | COUNTRY | BRAND |
|
|
| :------------- | :------------- | :------------- | :------------- |
|
|
| 4000000400000008 | tok_at | Austria (AT) | Visa |
|
|
| 4000000560000004 | tok_be | Belgium (BE) | Visa |
|
|
| 4000002080000001 | tok_dk | Denmark (DK) | Visa |
|
|
| 4000002460000001 | tok_fi | Finland (FI) | Visa |
|
|
| 4000002500000003 | tok_fr | France (FR) | Visa |
|
|
|
|
|
|
## References
|
|
|
|
* [[BugBounty] Yahoo phpinfo.php disclosure - Patrik Fehrenbach](http://blog.it-securityguard.com/bugbounty-yahoo-phpinfo-php-disclosure-2/)
|
|
* [Nmap CheatSheet - HackerTarget](https://hackertarget.com/nmap-cheatsheet-a-quick-reference-guide/)
|