Skip to main content

Search Shelves Books Sign up Log in

Book Navigation

Bug Bounty Path
Mitre ATT&CK: Recon
Technical OSINT Tools
- What is OSINT?
- Tools
- Shodan
- Huntr
- HackerOne
- Maltego
- Recon-ng Framework
- Ahmia.fi
- Wayback Machine
- theHarvester
- TinEye
- OSINT Framework
Find Subdomains
Name Service Takeover
- Lepus
- CNAME Records
Wayback for URLS
End Point Discovery
Port Scanning
GitHub Recon
- Rengine
WebApps Opportunities
WebApp Tools

Books

Bug Bounty Path

WebApps Opportunities

Arjun for hidden end p...

Arjun for hidden end point discovery

Details

Revision #1

Created 1 year ago by labadmin

Updated 1 year ago by labadmin

Actions

Revisions

Back to top

Active Scanning

Consists of

Gathering Host Information

Gather Identity Information

Gather Network Information

Gather Org Information

Open Technical Infomation

References

What is OSINT?

Tools

Shodan

Huntr

HackerOne

Maltego

Recon-ng Framework

Ahmia.fi

Wayback Machine

theHarvester

TinEye

OSINT Framework

FFUF Tool

Lepus Tool

tomnomnom tools in Rengine

theFuzz (formerly known as fuzzywuzzy)

Lepus

CNAME Records

NMAP

MASSCAN: Mass IP port scanner

Naabu (in Rengine)

Rengine

Cross-origin resource sharing (CORS)

Password Reset Vulnerability

SNMP and HOST Header Injection

Clickjacking via IFRAME

Access Controls and Parameter Tampering

Burp Proxy Histroy for endpoint discovery

Arjun for hidden end point discovery

CSRF Discovery/Detection

SSRF Parameter Detection/Discovery

XSS and SSTI Discovery/Detection

Rate Limits

Directory Brute-Force

HTTP Request Smuggling

Open Redirect via WaybackURLs

Social-SignOn Bypass

Possible DOS vial multiple Cookies injection

File Upload via CSRF, XSS, SSRF, RCE, LFI, XXE

Buffer Overflow

AMASS (in Rengine?)

Nuclei (in Regine)

GoSpider

gau (get all urls)

Nikto

Arjun for hidden end point discovery