Skip to main content

Bug Boundy Methodology, Tools & Resources

Start by defining a clear objective, such as exploiting a remote code execution (RCE) vulnerability or bypassing authentication on your target. Then, consider how you can achieve this goal using various attack vectors like XSS, SSRF, or others - these are simply tools to help you reach your objective.
Use the target as how a normal user would, while browsing keep these questions in mind:

1)How does the app pass data?
2)How/where does the app talk about users?
3)Does the app have multi-tenancy or user levels?
4)Does the app have a unique threat model?
5)Has there been past security research & vulnerabilities?
6)How does the app handle XSS, CSRF, and code injection?




Bug Boundy playlist in my channel:

crt.sh

crt.sh is used in bug bounty to discover subdomains of a target by searching for SSL/TLS certificates issued for the domain, which often reveal assets not listed publicly.

ffuf is a fast web fuzzer written in Go that allows typical directory discovery. Url path/parameter fuzzer.
 

OSINT:  spiderfoot

This package contains an open-source intelligence (OSINT) automation tool.
SpiderFoot can be used offensively, i.e. as part of a black-box penetration test to gather information about the target, or defensively to identify what information.

spiderfoot -l 127.0.0.1:5001
This launches the web server interface accessible at http://127.0.0.1:5001

In the web interface:

  • Click on "New Scan".
  • Enter the target (e.g., domain, IP, email, etc.).
  • Configure the modules to enable specific types of information gathering (e.g., WHOIS lookups, subdomain discovery, or data breaches).
  • Adjust scan options (e.g., depth, threading, API keys for external services).

Seclist (Password List)

SecLists is a comprehensive collection of penetration testing resources, including wordlists for usernames, passwords, URLs, APIs, fuzzing, and more, essential for security assessments.

Nuclei templates 

Nuclei is a fast, customizable, and open-source vulnerability scanner that uses YAML-based templates for detecting security issues. 

haveibeenpwned

Brute force the login endpoints with common passwords found in haveibeenpwned’s Pwned Passwords API

bbr

An open-source tool to aid in command line-driven generation of bug bounty reports based on user-provided templates. Useful for piping reporting from one application to another (such as an automatic submission tool).

APKLeaks

Video Tutorial:

Scanning APK files for URIs, endpoints & secrets.
APKLeaks helps find sensitive data like API keys, passwords, private certificates, and other secrets embedded in Android APK files. 
how to install

python3  apkleaks.py  -f   ~/Downloads/<app-to-test-android.apk >

KeyHacks: validate API keys

KeyHacks shows methods to validate different API keys found on a Bug Bounty Program or a pentest.

nuclei token-spray

update or install nuclei

Test an API key against many API service endpoints

# Running token-spray templates against a single token to test
nuclei -t token-spray/ -var token=random-token-to-test -esc

# Running token-spray templates against a file containing multiple new line delimited tokens
nuclei -t token-spray/ -var token=file_with_tokens.txt

If not working, Enable debugging to understand why no results are being returned:

nuclei -t /opt/token-spray/ -var token=tocken   -esc -debug -vv


apktool

A tool for reverse engineering 3rd party closed binary Android apps.
root@kali:~# apktool   d   <app_file.apk>


MobSF/Mobile-Security-Framework-MobSF

Video Tutorial:

Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile.

Quick setup with docker:


sudo docker pull opensecurity/mobile-security-framework-mobsf:latest
sudo docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest      

# Default username and password: mobsf/mobsf

#Dynamic Analysis 
sudo docker run -it --rm \
    -p 8000:8000 \
    -p 1337:1337 \
    -e MOBSF_ANALYZER_IDENTIFIER=127.0.0.1:6555 \
    opensecurity/mobile-security-framework-mobsf:latest

Before running the command setup Genymotion here




KiteRunner Api scanning

Kiterunner is a tool that is capable of not only performing traditional content discovery at lightning fast speeds, but also bruteforcing routes/endpoints in modern applications.  

#vedio#
#list all wordlist
kr wordlist list
# Run
kr scan <url> -A <name form wordlist>
kr scan  http://example.com  -A raft-small-words

kr scan http://localhost -A apiroutes-240528 

#save only the hashes and remove duplicates
cat output.txt | grep -oE '[a-zA-Z0-9]{20,}' > hashes.txt


sort hashes.txt | uniq > temp.txt && mv temp.txt hashes.txt

GAU (GetAllUrls)

GAU (GetAllUrls) focuses primarily on historical URLs and subdomains in web applications. It comes pre-installed in Kali Linux.

waymore

 Waymore is to find even more links from the Wayback Machine than other existing tools like gau.

Acunetix crack

Acunetix is an end-to-end web security scanner that offers a 360 view of an organization’s security.

Caido

Caido is a web application security tool like Burp Suite or OWASP ZAP.


Retire.js

Retire.js extension is a popular tool for scanning JavaScript libraries for known vulnerabilities.

Scavenger

Plugin in Burp, a custom wordlist generator.



Burpsuite-Professional crack

Burp Suite Professional is a comprehensive, commercial tool widely used by security professionals, ethical hackers, and bug bounty hunters to test the security of web applications. It is developed by PortSwigger

chmod +x install.sh
./install.sh

change font

Kage

Kage is a Graphical User Interface for Metasploit Meterpreter and Session Handler.

# Download source code
git clone https://github.com/WayzDev/Kage.git

# Install dependencies and run kage
cd Kage
yarn # or npm install
yarn run dev # or npm run dev

# to build project
yarn run build

nip.io (Test SSRF)
nip.io maps 
<anything>[.-]<IPAddress>.nip.io in "dot", "dash" or "hexadecimal" notation to the corresponding <IP Address>:
  • dot notation: magic.127.0.0.1.nip.io
  • dash notation: magic-127-0-0-1.nip.io
  • hexadecimal notation: magic-7f000001.nip.io

Search default credentials

pip3 install defaultcreds-cheat-sheet

creds search tomcat



bbscope: Tool Github link

The quickest way to generate a scope to hack on. bbscope is a powerful scope aggregation tool for all major bug bounty platforms:

HackerOne

Bugcrowd

Intigriti

Immunefi

YesWeHack

For example, after installing the tool, you could run this command to fetch all BBP & VDP scope from Bugcrowd and save them in the bugcrowd-scope.txt.

bbscope bc -E "your_bugcrowd_email" -P "your_bugcrowd_password" -o u | tee bugcrowd-scope.txt

Portswigger Extensions

Request Minimizer:

    This extension performs HTTP request minimization. It deletes parameters that are not relevant, such as random ad cookies and cache-busting nonces, etc..


Download the jython-standalone-2.7.4.jar file. Go to Settings > Extensions > Python environment & add the jar file.
Now, restart Burp Suite.

Now, install the minimizer extension.




TruffleHog Extension:



Labels:

Comments

Post a Comment

Popular posts from this blog

CISCO devises configuration commands & info CCNA 200–301

  Repository with all the labs and necessary screenshots: GitHub — AdithyakrishnaV/CCNA_200–301: CCNA 200–301 Practical LABS. CCNA (Cisco Certified Network… CCNA 200–301 Practical LABS. CCNA (Cisco Certified Network Associate) is an information technology (IT) certification… github.com Configure the hostname : Router>en Router #conf t Router (config) #hostname R1 R1 (config)# en  is the shortcut for  enable  command. “ennable” is used to enter Privileged EXEC mode conf t  is the shortcut for  configure terminal command. Used to enter the global configuration mode delete or remove Just put a no in front, it is same across all devices. R1(config)#no interface g0 /0.20 show ip interface Checks the status of the interfaces R1(config) #do show ip interface brief Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 unassigned YES unset administratively down down GigabitEthernet0/1 unassigned ...
Post a Comment
Read more

API Bug Bounty Hunting: Reconnaissance and Reverse Engineering an API

  In order to target APIs, you must first be able to find them.APIs meant for consumer use are meant to be easily discovered. Typically, the API provider will market their API to developers who want to be consumers. So, it will often be very easy to find APIs, just by using a web application as an end-user. The goal here is to find APIs to attack and this can be accomplished by discovering the API itself or the API documentation. Bug Boundy Methodology, Tools & Resources Start by defining a clear objective, such as exploiting a remote code execution (RCE) vulnerability or bypassing… adithyakrishnav.blogspot.com Reconnaissance Passive Reconnaissance It is obtaining information about a target without directly interacting with the target’s systems. Google Dorking Firstly, google search for “<app name> API”. intitle:” api” site:”google.com” inurl:”/api/v2" site:”google.com” inurl:”/api/v1" intext:”index of /” inurl:json site:”google.com” intitle:”index.of” intext:”api.t...
Post a Comment
Read more