web2-recon

# WEB2 RECON PIPELINE Full asset discovery from nothing to a prioritized URL list ready for hunting. --- ## SETUP (one-time) ```bash # 1. Set your Chaos API key (get free key at chaos.projectdiscovery.io) export CHAOS_API_KEY="your-key-here" # Add to ~/.zshrc or ~/.bashrc for persistence: echo 'export CHAOS_API_KEY="your-key-here"' >> ~/.zshrc # 2. Update nuclei templates (run weekly) nuclei -update-templates # 3. Configure subfinder with API keys for more sources mkdir -p ~/.config/subfinder cat > ~/.config/subfinder/config.yaml << 'EOF' # Get free keys at: virustotal.com, securitytrails.com, censys.io, shodan.io virustotal: [YOUR_VT_KEY] securitytrails: [YOUR_ST_KEY] censys_apiid: YOUR_CENSYS_ID censys_secret: YOUR_CENSYS_SECRET shodan: [YOUR_SHODAN_KEY] EOF # 4. Verify all tools installed which subfinder httpx dnsx nuclei katana waybackurls gau dalfox ffuf anew gf interactsh-client ``` --- ## THE 5-MINUTE RULE > If a target shows nothing interesting after 5 minutes of recon, move on. Don't burn hours on dead surface. **5-minute kill signals:** - All subdomains return 403 or static marketing pages - No API endpoints visible in URLs - No JavaScript bundles with interesting endpoint paths - nuclei returns 0 medium/high findings - No forms, no authentication, no user data --- ## STANDARD RECON PIPELINE ### Pre-Hunt: Always Run First ```bash TARGET="target.com" # Step 0: Passive — crt.sh certificate transparency (no API key needed) curl -s "https://crt.sh/?q=%.${TARGET}&output=json" \ | jq -r '.[].name_value' \ | sed 's/\*\.//g' \ | sort -u > /tmp/subs.txt echo "[+] crt.sh: $(wc -l < /tmp/subs.txt) subdomains" # Step 1: Chaos API (ProjectDiscovery — most comprehensive source) curl -s "https://dns.projectdiscovery.io/dns/$TARGET/subdomains" \ -H "Authorization: $CHAOS_API_KEY" \ | jq -r '.[]' >> /tmp/subs.txt echo "[+] Chaos returned $(wc -l < /tmp/subs.txt) subdomains" # Step 2: subfinder (passive multi-source) subfinder -d $TARGET -silent | anew /tmp/subs.txt assetfinder --subs-only $TARGET | anew /tmp/subs.txt echo "[+] Total subdomains after all sources: $(wc -l < /tmp/subs.txt)" # Step 3: DNS resolution + live host check cat /tmp/subs.txt | dnsx -silent | httpx -silent -status-code -title -tech-detect | tee /tmp/live.txt echo "[+] Live hosts: $(wc -l < /tmp/live.txt)" # Step 4: URL crawl cat /tmp/live.txt | awk '{print $1}' | katana -d 3 -jc -kf all -silent | anew /tmp/urls.txt # Step 5: Historical URLs echo $TARGET | waybackurls | anew /tmp/urls.txt gau $TARGET --subs | anew /tmp/urls.txt echo "[+] Total URLs: $(wc -l < /tmp/urls.txt)" # Step 6: Nuclei scan nuclei -l /tmp/live.txt -t ~/nuclei-templates/ -severity critical,high,medium -o /tmp/nuclei.txt ``` ### Output to Organized Directory ```bash TARGET="target.com" RECON_DIR="recon/$TARGET" mkdir -p $RECON_DIR # All outputs go here: /tmp/subs.txt → $RECON_DIR/subdomains.txt /tmp/live.txt → $RECON_DIR/live-hosts.txt /tmp/urls.txt → $RECON_DIR/urls.txt /tmp/nuclei.txt → $RECON_DIR/nuclei.txt ``` --- ## ATTACK SURFACE TRIAGE ### Find Interesting Targets in URL List ```bash # Parameters worth testing cat /tmp/urls.txt | grep -E "[?&](id|user|file|path|url|redirect|next|src|token|key|api_key)=" | tee /tmp/interesting-params.txt # API endpoints cat /tmp/urls.txt | grep -E "/api/|/v1/|/v2/|/v3/|/graphql|/rest/|/gql" | tee /tmp/api-endpoints.txt # File upload endpoints cat /tmp/urls.txt | grep -E "upload|file|attachment|document|image|avatar|photo|media" | tee /tmp/uploads.txt # Admin/internal paths cat /tmp/urls.txt | grep -E "/admin|/internal|/debug|/test|/staging|/dev|/management|/console" | tee /tmp/admin-paths.txt # Authentication endpoints cat /tmp/urls.txt | grep -E "/oauth|/login|/auth|/sso|/saml|/oidc|/callback|/token" | tee /tmp/auth-paths.txt ``` ### gf Patterns (Quick Classification) ```bash # Install gf patterns: https://github.com/tomnomnom/gf cat /tmp/urls.txt | gf xss | tee /tmp/xss-candidates.txt cat /tmp/urls.txt | gf ssrf | tee /tmp/ssrf-candidates.txt cat /tmp/urls.txt | gf idor | tee /tmp/idor-candidates.txt cat /tmp/urls.txt | gf sqli | tee /tmp/sqli-candidates.txt cat /tmp/urls.txt | gf redirect | tee /tmp/redirect-candidates.txt cat /tmp/urls.txt | gf lfi | tee /tmp/lfi-candidates.txt cat /tmp/urls.txt | gf rce | tee /tmp/rce-candidates.txt # User-controlled CSS surface (themes, profile pages, HTML email renderers, # rich-text editors, PDF generators). gf has no pattern for this — grep manually: cat /tmp/urls.txt | grep -iE "theme|profile|signature|customize|email|invoice|pdf|render|markdown" \ | tee /tmp/css-injection-candidates.txt # → if any hit, run web2-vuln-classes **CSS Injection** ``` --- ## JS ANALYSIS ### SecretFinder (API keys, tokens in JS bundles) ```bash # Activate venv source ~/tools/SecretFinder/.venv/bin/activate # Scan a single JS file python3 ~/tools/SecretFinder/SecretFinder.py -i "https://target.com/static/js/main.js" -o cli # Scan all JS URLs found in recon cat /tmp/urls.txt | grep "\.js$" | head -50 | while read url; do echo "=== $url ===" python3 ~/tools/SecretFinder/SecretFinder.py -i "$url" -o cli 2>/dev/null done deactivate ``` ### LinkFinder (Endpoints hidden in JS) ```bash source ~/tools/LinkFinder/.venv/bin/activate # Single JS file python3 ~/tools/LinkFinder/linkfinder.py -i "https://target.com/app.js" -o cli # All pages (crawls JS from HTML) python3 ~/tools/LinkFinder/linkfinder.py -i "https://target.com" -d -o cli deactivate ``` --- ## DIRECTORY FUZZING ### ffuf — Standard Fuzzing ```bash # Directory discovery on a live host ffuf -u "https://target.com/FUZZ" \ -w ~/wordlists/common.txt \ -mc 200,201,204,301,302,307,401,403 \ -ac \ -t 40 \ -o /tmp/ffuf-dirs.json # API endpoint discovery ffuf -u "https://target.com/api/FUZZ" \ -w ~/wordlists/api-endpoints.txt \ -mc 200,201,204,301,302 \ -ac \ -t 20 # IDOR fuzzing with authenticated request # Create req.txt with Authorization: Bearer TOKEN ffuf -request /tmp/req.txt \ -request-proto https \ -w <(seq 1 10000) \ -fc 404 \ -ac \ -t 10 ``` --- ## TARGET SCORING — GO / NO-GO Score before spending time. Skip if score < 4. | Criterion | Points | |---|---| | Max bounty >= $5K | +2 | | Large user base (>100K) or handles money | +2 | | Program launched < 60 days ago | +2 | | Complex features: API, OAuth, file upload, GraphQL | +1 | | Recent code/feature changes (GitHub, changelog) | +1 | | Private program (less competition) | +1 | | Tech stack you know | +1 | | Source code available | +1 | | Prior disclosed reports to study | +1 | **< 4:** Skip **4-5:** Only if nothing better available **6-8:** Good — spend 1-3 days **>= 9:** Excellent — spend up to 1 week ### Pre-Dive Hard Kill Signals 1. Max bounty < $500 → not worth your time 2. All recent reports are N/A or duplicate → hunters saturated it 3. Scope is only a static marketing page → no attack surface 4. Company < 5 employees with no revenue → won't pay 5. Explicitly excludes your planned bug class in rules --- ## TECH STACK DETECTION (2 min) ```bash # Response headers reveal backend curl -sI https://target.com | grep -iE "server|x-powered-by|x-aspnet|x-runtime|x-generator" # Common signals: # Server: nginx + X-Powered-By: PHP/7.4 → PHP backend # Server: gunicorn OR X-Powered-By: Express → Python/Node.js # X-Powered-By: ASP.NET → .NET # Server: Apache Tomcat → Java # X-Runtime: Ruby → Ruby on Rails # Framework from JS bundle paths: # /_next/static/ → Next.js # /static/js/main.chunk.js → CRA (React) # /packs/ → Ruby on Rails + Webpacker # /__nuxt/ → Nuxt.js (Vue) ``` ### Stack → Primary Bug Class Map | Stack | Hunt First | Hunt Second | |---|---|---| | Ruby on Rails | Mass assignment | IDOR (`:id` routes) | | Django | IDOR (ModelViewSet, no object perms) | SSTI (mark_safe) | | Flask | SSTI (render_template_string) | SSRF (requests lib) | | Laravel | Mass assignment ($fillable) | IDOR (Eloquent, no ownership) | | Express (Node.js) | Prototype pollution | Path traversal + debug surface (`/_debug`, `/__debug__`) → web2-vuln-classes "Error Disclosure / Debug Endpoints" | | Spring Boot | Actuator endpoints → web2-vuln-classes "Error Disclosure / Debug Endpoints" for full surface | SSTI (Thymeleaf) | | ASP.NET | ViewState deserialization (if encrypted, also test padding-oracle path → web2-vuln-classes **Padding Oracle & Crypto Misuse**) | Open redirect (ReturnUrl) | | Next.js | SSRF via Server Actions + `/_next/data/` / `/_next/static/chunks/` → web2-vuln-classes "Error Disclosure / Debug Endpoints" | Open redirect via redirect() | | GraphQL | Introspection → auth bypass on mutations | IDOR via node(id:) | | WordPress | Plugin SQLi | REST API auth bypass | | SPA frameworks (React / Vue / Svelte / Angular) | DOM XSS sinks via state/router → web2-vuln-classes section 3 "postMessage Testing" for cross-frame entry points | Client-side route auth bypass (role check only in JS) | --- ## CONTINUOUS MONITORING SETUP Set up once per target. Alerts you before other hunters. ### New Subdomain Alerts (daily cron) ```bash #!/bin/bash TARGET="target.com" KNOWN="/tmp/$TARGET-subs-known.txt" subfinder -d $TARGET -silent > /tmp/$TARGET-subs-fresh.txt curl -s "https://dns.projectdiscovery.io/dns/$TARGET/subdomains" \ -H "Authorization: $CHAOS_API_KEY" \ | jq -r '.[]' >> /tmp/$TARGET-subs-fresh.txt # Diff against known NEW=$(comm -23 <(sort /tmp/$TARGET-subs-fresh.txt) <(sort $KNOWN 2>/dev/null)) if [ -n "$NEW" ]; then echo "NEW SUBDOMAINS: $NEW" echo "$NEW" >> $KNOWN fi # Schedule: crontab -e → 0 8 * * * /bin/bash ~/monitors/subs-watch.sh ``` ### GitHub Commit Watch ```bash #!/bin/bash REPO="TargetOrg/target-app" LAST_SHA="/tmp/$REPO-last-sha.txt" CURRENT=$(curl -s "https://api.github.com/repos/$REPO/commits?per_page=1" | jq -r '.[0].sha') KNOWN=$(cat $LAST_SHA 2>/dev/null) if [ "$CURRENT" != "$KNOWN" ]; then echo "New commit on $REPO: $CURRENT" echo $CURRENT > $LAST_SHA # Get changed files curl -s "https://api.github.com/repos/$REPO/commits/$CURRENT" \ | jq -r '.files[].filename' | grep -E "auth|middleware|route|permission|role|admin" fi # Schedule: */30 * * * * /bin/bash ~/monitors/github-watch.sh ``` --- ## PORT SCANNING (often skipped — don't skip) ```bash # naabu — fast port scanner from ProjectDiscovery # Finds non-standard ports: 8080, 8443, 3000, 8888, 9000, etc. cat /tmp/live.txt | awk '{print $1}' | naabu -port 80,443,8080,8443,3000,4000,5000,8000,8888,9000,9090,9200,6379 -silent | tee /tmp/open-ports.txt # Why this matters: admin panels, debug services, internal APIs often run on alt ports