Web App Recon on 🕸 Spider Man-ual

Subdomains

Mon, 01 Jan 0001 00:00:00 +0000

https://crt.sh

https://securitytrails.com/

subfinder -d target.com | tee subdomains.txt

Add as many API key as you can to take the best of the tool

amass enum -d target.com

Prompt:

Run subfinder + crt.sh for target.com, probe with httpx, rank results by attack surface priority, flag takeover candidates

Mon, 01 Jan 0001 00:00:00 +0000

httpx -status-code -title -tech-detect -list subdomains.txt

gau target.com

Including subdomains

gau --subs target.com

Mon, 01 Jan 0001 00:00:00 +0000

Browser Extension

whatweb -a 3 https://target.com

jxscout -u https://target.com

Mon, 01 Jan 0001 00:00:00 +0000

hostname:target.com

Admin panel

org:"Target Inc" http.title:"admin"

Database files

http.html:"index of /" http.html:"database"

Config files

http.html:"index of /" http.html:".xml"

Use GitHub advanced search to find API_KEY in the target org

./gitgot.py -q "org:target API_KEY"

Mon, 01 Jan 0001 00:00:00 +0000

Subdomain Enum

bbot -t target.com -f subdomain-enum

Subdomain with basic web scan

bbot -t evilcorp.com -f subdomain-enum web-basic

Everything BBOT can run

bbot -t evilcorp.com -f subdomain-enum email-enum cloud-enum web-basic -m nmap gowitness nuclei --allow-deadly