Recon Slides by Anon_Y0gi

The slides for Recon for BugBounty webinar dated at 5th March 2023 on hacklido

Transcript

1. Recon For Bug Bounty H A C K L I D O . C O M
2. WHOAMI? Security Analyst Pursuing MBBS Part-time Bug bounty hunter Agnibha Dutta Anon_Y0gi eJPT Certified Successfully Hacked and Secured: Sony Acronis NASA + 20 other companies https://twitter.com/AnonY0gi https://www.youtube.com/@y0gisec
3. WHAT IS RECONNAISSANCE? The Reconnaissance is one of the most important aspect of penetration testing. Its also known as Recon. Recon will help you to increase attack surface area and may allow you to get more vulnerabilities but ultimate goal is to dig deep in the target Recon = Increase in Attack surface = More vulnerabilities Recon = Finding untouched endpoints = Less duplicates Recon = Sharpening your axe before attack
4. SUBDOMAIN ENUMERATION Subdomain enumeration is the process of finding subdomains for one or more domain. Tools used: Visual Recon: VirusTotal, subdomainfinder.c99.nl https://crt.sh/?q=%25.target.com https://securitytrails.com/list/apex_domain/target.com https://www.shodan.io/search?query=Ssl.cert.subject.CN%3A%22t arget.com%22 Amass Dnsx Subfinder Chaos AssetFinder
5. SUBDOMAIN ENUMERATION amass enum -passive -norecursive -noalts -df domians.txt -o subs-list.txt dnsx -silent -d $domain -w ~/wordlist.txt -o ~/dnsbrute.txt cat domain.txt | dnsgen - | massdns -r ~/resolvers.txt -o S -w alive.txt
6. FILTERING THE SUBDOMAINS WITH HTTPX httpx -l domain.txt -timeout 13 -o domain-probe.txt PORT SCANNING naabu -list sub-list.txt -top-ports 1000 -exclude-ports 80,443,21,22,25 -o ports.txt naabu -list sub-list.txt -p - -exclude-ports 80,443,21,22,25 -o ports.txt cat domain-subs.txt | aquatone -ports xlarge -scan-timeout 300 -out aquatone.txt
7. SUBDOMAIN OF SUBDOMAIN ENUMERATION One of the rare things people search of. Tools used: Subbrute: https://github.com/TheRook/subbrute altdns: https://github.com/infosec-au/altdns Usage: ./altdns.py -i subdomains.txt -o data_output -w words.txt -r -s output.txt
8. SCREENSHOT TOOLS Capable of taking screenshots of websites to view offline anytime. Tools used: Eyewitness: https://github.com/FortyNorthSecurity/EyeWitness httpscreenshot: https://github.com/breenmachine/httpscreenshot
9. BROADENING YOUR SCOPE More targets lead to more option which ultimately lead to more opportunities. Crunchbase bgp.he.net tools.whoisxmlapi.com https://whois.arin.net
10. WHAT TO DO AFTER ENUMERATION? | Collecting URLs Waybackurls: https://github.com/tomnomnom/waybackurls Gau: https://github.com/lc/gau for i in $(cat domain-subs.txt);do gau $i | egrep -vE "\.(woff | woff2 | ttf | toff | eot | webp | gif | tiff | bmp | wav | png | jpg | jpeg | svg | ico | css | mp4 | m4v)" | httpx -silent -fc 404 | tee -a domain-archive.txt;done https://web.archive.org/cdx/search/cdx?url=*.target.com&fl=original&collapse= urlkey
11. After collecting URLs, curl out the responses of the URLs and grep for the following URLs: drive.google docs.google /spreadsheets/d/ /document/d/ TIPS AND TRICKS By Aditya_Shende cat domains.txt | katana -silent | while read url; do cu=$(curl -s $url | grep -E '(drive. google | docs. google | spreadsheet\/d | document.\/d\/)';echo -e "==> $url" "\n"" $cu"; done
12. TIPS AND TRICKS Using SQLidetector to search for sqli Tool Link: https://github.com/eslam3kl/SQLiDetector
13. Shodan: https://www.shodan.io/ SHODAN FOR RECON ssl:"target[.]com" 200 http.title:"dashboard" --unauthenticated dashboard org:"target.com" x-jenkins 200 --- unauthenticated jenkins server ssl:"target.com" 200 proftpd port:21 --- proftpd port:21 org:"target.com" http.html:zabbix --- CVE-2022-24255 Main & Admin Portals: Authentication Bypass org:"target.com" http.title:"phpmyadmin" ----php my admin ssl:"target.com" http.title:"BIG-IP ---F5 BIG-IP using CVE-2020-5902 Shodan Dork: How I found XSS by searching in Shodan - Writeup
14. Censys: https://www.censys.io/ CENSYS FOR RECON Let’s fuck waf using Origin IP: My approach on censys By Deepak Dhiman
15. ffuf: https://github.com/ffuf/ffuf FUZZING FOR SENSITIVE FILES & DIRECTORIES FFUF-ing RECON Writeup on FFuf for i in `cat host.txt`; do ffuf -u $i/FUZZ -w wordlist.txt -mc 200,302,401 -se ;done Tip: Fuzz for "/wp-content/debug.log" || Sometimes they contain SQL error, which can be chained.
16. y0gi.hacklido.com /y0gi.zip - hacklido.zip – admin.zip – backup.zip y0gi.hacklido.com/y0gi/y0gi.zip - hacklido.zip – admin.zip – backup.zip y0gi. hacklido.com/hacklido/y0gi.zip - hacklido.zip – admin.zip – backup.zip y0gi. hacklido.com/admin/y0gi.zip - hacklido.zip – admin.zip – backup.zip y0gi.hacklido.com FINDING SOURCE/BACKUP FILES Tool: https://github.com/musana/fuzzuli Credit: GodfatherOrwa
17. Find Sensitive Data in Cloud storage: site:http://s3.amazonaws.com "target[.]com" site:http://blob.core.windows.net "target[.]com" site:http://googleapis.com "target[.]com" site:http://drive.google.com "target[.]com" Github Leaks for AWS, Jira, Okta, etc: Org:"target" pwd/pass/passwd/password "target.atlassian" pwd/pass/passwd/password "target.okta" pwd/pass/passwd/password "Jira.target" pwd/pass/passwd/password Also search in Google groups, Gitlabs. Trivial Tricks: GOOGLE & GITHUB DORKING Credit: GodfatherOrwa
18. Collect all js file ".js" Filter js file: " httpx -content-type | grep 'application/javascript'" Perform Nuclei scan "nuclei -t /root/nuclei-templates/exposures/" Grep all urls from wayback or gau. JAVASCRIPT[JS] FILES RECON Collect all endpoints from Js files & Create a wordlist from those. Craft a POST request with any parameter. Use that request to fuzz for sensitive directory. Js Recon Tip: Tools: JSFSCAN , Jsminer {Burp Extension} , Trufflehog
19. Sudomy: https://github.com/Screetsec/Sudomy SOME AUTOMATION FRAMEWORKS Reconftw: https://github.com/six2dez/reconftw
20. Some data are intended, No bug here. Verify Data Don't get angry, You may lose bonds with good program Reported > Invalid Your crafting and exploits are gold. Make it high as you can Yes, They do accept Third Party Money going no where. Don't message constant to team Be humble with Program
21. QNA SESSION https://twitter.com/AnonY0gi https://www.youtube.com/@y0gisec
22. THANK YOU W W W . H A C K L I D O . C O M