feat: new web app notes

Author: syselement

peh/1-intro/README.md

@@ -1,5 +1,7 @@
 # 1. Introduction & Networking
 
+---
+
 ## Intro
 
 **Ethical hackers** are *allowed and hired* to try to hack into an organization by assessing its security posture.

peh/2-lab/README.md

@@ -1,5 +1,7 @@
 # 2. Lab Set Up, Linux & Python
 
+---
+
 ## Lab Set Up
 
 > **Virtualizers**

peh/3-eth-hack/capstone.md

@@ -1,4 +1,4 @@
-# Capstone Labs
+# Capstone Practical Labs
 
 Import all the [VMs](https://drive.google.com/drive/folders/1xJy4ozXaahXvjbgTeJVWyY-eUGIKgCj1) into [VMWare Workstation Pro (free)](https://support.broadcom.com/group/ecx/productdownloads?subfamily=VMware%20Workstation%20Pro) or Virtualbox and change Network adapter to `NAT`.
 

peh/3-eth-hack/recon.md

@@ -127,6 +127,57 @@ amass enum -d syselement.com
 
 ➡️ [httprobe](https://github.com/tomnomnom/httprobe) - take a list of domains and probe for working (alive) http and https servers
 
+➡️ [assetfinder](https://github.com/tomnomnom/assetfinder) - find domains and subdomains related to a given domain
+
+```bash
+# Go is necessary (installed via pimpmykali.sh)
+go get -u github.com/tomnomnom/assetfinder
+
+# or in Kali
+sudo apt install assetfinder
+```
+
+```bash
+assetfinder syselement.com
+
+assetfinder --subs-only tesla.com
+```
+
+### Automated domain recon script
+
+- Little `bash` script for sub-domains hunting
+
+```bash
+#!/bin/bash
+
+url=$1
+
+if [ ! -d "$url" ]; then
+	mkdir $url
+fi
+
+if [ ! -d "$url/recon" ]; then
+	mkdir $url/recon
+fi
+
+# Assetfinder
+echo "[+] Harvesting subdomains with assetfinder..."
+assetfinder $url >> $url/recon/assets.txt
+# get only subdomains containing $url
+cat $url/recon/assets.txt | grep $1 >> $url/recon/final.txt
+rm $url/recon/assets.txt
+
+# Amass
+# echo "[+] Harvesting subdomains with amass..."
+# amass enum -d $url >> $url/recon/f.txt
+# sort -u $url/recon/f.txt >> $url/recon/final.txt
+# rm $url/recon/f.txt
+
+
+```
+
+
+
 ---
 
 ## Website technologies

peh/6-webapp/1-web-lab.md

@@ -0,0 +1 @@
+# Web App Lab Setup

peh/6-webapp/2-web-sqli.md

@@ -0,0 +1,2 @@
+# Web App - SQL Injection
+

peh/6-webapp/3-web-xss.md

@@ -0,0 +1,2 @@
+# Web App - XSS
+

peh/6-webapp/4-web-cmd-injection.md

@@ -0,0 +1,2 @@
+# Web App - Command Injection
+

peh/6-webapp/5-web-file-upload.md

@@ -0,0 +1,2 @@
+# Web App - Insecure File Upload
+

peh/6-webapp/6-web-auth-attacks.md

@@ -0,0 +1,2 @@
+# Web App - Authentication Attacks
+