my-methodology/index.html at main · LAW6ZX7/my-methodology · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>My Methodology for Recon</title>
  <link href="https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap" rel="stylesheet">
  <style>
    body {
      font-family: 'Roboto', sans-serif;
      margin: 40px;
    }
    h1 {
      font-size: 48px;
      font-weight: bold;
      color: #333;
    }
    h2, h3 {
      font-size: 36px;
      font-weight: bold;
      color: #444;
    }
    p, li {
      font-size: 18px;
      line-height: 1.6;
    }
    code {
      background-color: #f4f4f4;
      padding: 5px 10px;
      font-size: 16px;
      font-family: monospace;
    }
    pre {
      background-color: #f4f4f4;
      padding: 20px;
      font-size: 16px;
      font-family: monospace;
      border-radius: 5px;
      overflow-x: auto;
    }
  </style>
</head>
<body>

  <h1>My Methodology for Recon:</h1>

  <h2>1. Starting with Subdomain Enumeration:</h2>
  <p>I use tools like: <strong>subfinder</strong>, <strong>sublist3r</strong>, <strong>amass</strong>, <strong>assetfinder</strong>, <strong>crt.sh</strong>.</p>
  <p>Command to sort and filter out duplicates:</p>
  <pre><code>subfinder -d target.com | sublist3r -d target.com -o - | amass enum -passive -d target.com | assetfinder --subs-only target.com | sort -u > subdomains.txt</code></pre>

  <h2>2. Next, I move on to using the httpx tool to bring all the active subdomains:</h2>
  <p>Command to get active subdomains:</p>
  <pre><code>cat subdomains.txt | httpx -ports 443,80,8080,8000,8888 -status-code -mc 200,403,400,500 | sort -k2 | uniq | tee httpx_results.txt</code></pre>

  <h2>3. Then, I use waybackurls, katana, and gau to gather all the parameters, URLs, old URLs, and filter them:</h2>
  <p>Command to gather and filter URLs:</p>
  <pre><code>cat httpx_results.txt | waybackurls; cat httpx_results.txt | gau; cat httpx_results.txt | katana -silent -jc -d 5) | httpx -ports 443,80,8080,8000,8888 -status-code -mc 200,403,400,500 | sort -k2 | uniq | tee cleanurls.txt</code></pre>

  <h2>4. Next, I grep for JavaScript URLs and save them using the following command:</h2>
  <p>Command to extract JS URLs:</p>
  <pre><code>cat cleanurls.txt | grep ".js" | sort -u | tee js_urls.txt</code></pre>

  <h2>5. Afterward, I use automation tools like:</h2>
  <p><strong>Nuclei</strong>, <strong>Dalfox</strong>, <strong>sqlmap</strong>, <strong>secretfinder</strong> for JS URLs.</p>

  <h2>6. Then, I start manual hunting and try to grep all parameters that may be vulnerable:</h2>
  <p>Command to find parameters:</p>
  <pre><code>cat cleanurls.txt | grep "?"</code></pre>

  <h2>7. I use gf-patterns tools to bring only the subs I want to test. For example:</h2>
  <p>Command for XSS:</p>
  <pre><code>cat cleanurls.txt | gf xss | tee xss_params.txt</code></pre>
  <p>Command for SQLi:</p>
  <pre><code>cat cleanurls.txt | gf sqli | tee sqli_params.txt</code></pre>
  <p>Command for LFI:</p>
  <pre><code>cat cleanurls.txt | gf lfi | tee lfi_params.txt</code></pre>

  <h2>8. I start checking each category one by one, looking for vulnerabilities such as XSS, LFI, SSRF, SQLi, Command Injection, and Path Traversal.</h2>
  <p>I inject each parameter with a payload for one of these vulnerabilities. If there is any CSP, I try to bypass it. If I can't, I move on to the next parameter.</p>

  <h2>9. To gather important extensions and save them in one file:</h2>
  <p>Command to extract extensions:</p>
  <pre><code>cat urls.txt | grep -Eo '\.(php|aspx|jsp|json|zip|tar|bak|log|conf|ini|sql|xml|csv|yaml|env|config)(\?|$)' | sort -u > extensions.txt</code></pre>

  <h2>10. I don't forget the Arjun tool to search for hidden parameters in the extensions.txt file:</h2>
  <p>Command to run Arjun:</p>
  <pre><code>arjun -i urls.txt -o arjun_results.txt</code></pre>

  <h2>11. After all that, I fire up Burp Suite to look for:</h2>
  <p>File Upload, BAC, IDOR, Business Logic, Race Condition, OTP Bypass, and any other vulnerabilities that you couldn't find with tools or that require deep thinking and patience.</p>

  <h2>12. If I encounter 403, 400, or 500 status code pages, I move on to fuzzing. I only use dirsearch for fuzzing:</h2>
  <p>Command to run fuzzing:</p>
  <pre><code>dirsearch -u target.com</code></pre>

  <h2>13. I have a lot of things in my mind, but I am tired. Perhaps one day I can write my complete and ultimate methodology.</h2>

</body>
</html>