View source for Scanning and Recon

These tools will scan web applications for vulnerabilities and misconfigurations, remember that they will cause a lot of traffic making lots of requests. Using APIs will advance your scanning but may cost $$$.

'''NOTE: This is not an exhaustive list.'''

=== WAF detect ===
Your target may have a web application firewall (WAF) which might try to prevent scanning, exploitation and other security tests. It's important that we can identify what WAF is in place so we can try and bypass it. Some targets might be vulnerable and normally an exploit would work however the WAF is preventing the exploit from popping the box. You can try to encode the payload ([https://portswigger.net/burp/documentation/desktop/tools/decoder Burpsuite is good for this]) amongst other things to bypass the WAF.

* Blog: https://labs.detectify.com/2022/05/09/discovering-the-origin-host-to-bypass-waf
* Blog: https://blog.yeswehack.com/yeswerhackers/web-application-firewall-bypass
* Identify and fingerprint web application firewalls: https://github.com/EnableSecurity/wafw00f
* Detect and bypass web application firewalls: https://github.com/Ekultek/WhatWaf
* Everything about web application firewalls (educational): https://github.com/0xInfection/Awesome-WAF
* Nuclei template to detect WAFs: https://github.com/projectdiscovery/nuclei-templates/blob/master/technologies/waf-detect.yaml

=== Vulnerability scanners ===
To quickly cover a lot of ground it's a good idea to scan your target using vulnerability scanners as they might be able to discover a vulnerability or misconfiguration that you can't find. To avoid WAFs make sure to use a list of random user-agent strings and a residential proxy list if possible and maybe encode some payloads.

* Axiom distributes the load of your scanning tools across multiple servers. https://github.com/pry0cc/axiom | [https://twitter.com/Jhaddix/status/1633936278222962688?cxt=HHwWgIDUkeuY9KwtAAAA Twitter Thread]
* A fully automated recon tool (its great as a tool installer on a fresh VPS): https://github.com/six2dez/reconftw | [https://gist.github.com/jhaddix/141d9cb07ca0590dbc43389e0e4af98f Free scan config (no API)]
* Nuclei offers scanning for a variety of protocols, it offers powerful and flexible templating which can be used to perform all kinds of security checks against a target: https://github.com/projectdiscovery/nuclei | [https://blog.projectdiscovery.io/ultimate-nuclei-guide The Ultimate Guide to Finding Bugs With Nuclei]
* Use Osmedeus to build your own reconnaissance system (Great for scanning large amount of target hosts): https://github.com/osmedeus/osmedeus-base [Free and Paid]
* CMS Detection and Exploitation suite - Scan WordPress, Joomla, Drupal and over 180 other CMSs: https://github.com/Tuhinshubhra/CMSeeK
* The Swiss Army knife for automated Web Application Testing: https://github.com/jaeles-project/jaeles | [https://jaeles-project.github.io Jaeles Scanner]
* Attack Surface Management Platform, used to discover hidden assets and vulnerabilities: https://github.com/1N3/Sn1per
* Enumerate subdomains and vulnerability scan them: <code>[https://github.com/projectdiscovery/subfinder subfinder] -d nasa.gov -silent | httpx -silent | nuclei -silent -s critical,high,medium,low -o vulns.txt</code>
* Wordpress CMS specific vulnerability scanner, version detection, plugin enumeration and user account bruteforce tool: https://github.com/wpscanteam/wpscan | [https://github.com/wpscanteam/wpscan/wiki/WPScan-User-Documentation WPScan Documentation] [Free and paid]
* Joomla CMS specific vulnerability scanner: https://github.com/OWASP/joomscan
* Drupal CMS specific vulnerability scanner: https://github.com/immunIT/drupwn
* Watch [https://www.youtube.com/watch?v=kCLDqvDnGzA Catalan police union hack] to learn how to utilize ZAP to discover vulnerabilities: https://www.zaproxy.org
* Pyfiscan is a web-application vulnerability and version scanner which can be used to locate out-dated versions of common web-applications: https://github.com/fgeek/pyfiscan
* https://github.com/rapid7/metasploit-framework | [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Metasploit%20-%20Cheatsheet.md Metasploit - Cheatsheet]
* User-Agent , X-Forwarded-For and Referer SQLI Fuzzer: https://github.com/root-tanishq/userefuzz
* Nmap Scripting Engine (NSE) can be used to perform version detection, network discovery and vulnerability scan/exploitation: https://nmap.org/book/man-nse.html | [https://nmap.org/book/nse.html Nmap Scripting Engine] | [https://github.com/nmap/nmap/tree/master/scripts Scripts]
* Scan for SQLi/XSS/LFI/RFI and other common vulnerabilities: https://github.com/v3n0m-Scanner/V3n0M-Scanner
* Quickly discover the attack surface, and identify vulnerabilities: https://github.com/yogeshojha/rengine

=== Subdomain enumeration ===
Enumerate your targets top level domain (TLD) as part of your recon to identify entry points in your targets infrastructure. Pay special attention to interesting subdomains such as test, dev, backup, etc. Your targets subdomains may also be running out of date software, subdomains might not be behind a WAF where the main page will be, less or no authentication where there should be and more vulnerabilities may exist as opposed to the TLD.

* https://github.com/OWASP/Amass
* https://github.com/aboul3la/Sublist3r
* You can also try using [https://github.com/six2dez/reconftw reconftw] for a more comprehensive subdomain enumeration, using different tools and techniques. <code>./reconftw.sh -d nasa.gov -s</code>
* https://github.com/projectdiscovery/subfinder
* Subdomain enumeration dork: <code>[https://www.google.com/search?q=site:.nasa.gov site:.nasa.gov]</code>
* https://github.com/projectdiscovery/shuffledns
* https://github.com/projectdiscovery/dnsx
* https://github.com/infosec-au/altdns
* https://github.com/resyncgg/ripgen
* 

==== Subdomain takeover ====
A subdomain takeover allows us to gain control over a misconfigured or abandoned subdomain. This is done by exploiting vulnerabilities in DNS settings, expired or deleted services, or incomplete migrations. Once control is established, we can employ social engineering tactics such as phishing, this could be hosting phishing pages on legitimate company subdomains that are already trusted by employees.

* https://github.com/EdOverflow/can-i-take-over-xyz
* https://github.com/Ice3man543/SubOver
* https://github.com/projectdiscovery/nuclei-templates/tree/main/http/takeovers
* https://www.hackerone.com/application-security/guide-subdomain-takeovers

==== Subdomain monitoring ====
Monitor your target for new subdomains whenever they pop up. Sometimes developers will create a new and temporary subdomain for testing and development, be notified whenever this happens. Include vulnerability scanners into the below bash script such as nuclei to automate some security testing as well.

* https://github.com/projectdiscovery/subfinder
* https://github.com/tomnomnom/anew
* https://github.com/projectdiscovery/notify

<pre>
while true;
do
  subfinder -silent -dL domains.txt -all | anew subdomains.txt | notify;
sleep 3600;
done
</pre>

=== Content discovery ===
Find endpoints, URLs, Parameters, Resources and much more with content discovery.

* https://github.com/praetorian-inc/fingerprintx
* https://github.com/projectdiscovery/httpx
* https://github.com/tomnomnom/waybackurls
* Find AWS S3 buckets and test their permissions: https://github.com/gwen001/s3-buckets-finder
* Scan for open S3 buckets and dump the contents: https://github.com/sa7mon/S3Scanner
* Chrome extension that lists Amazon S3 Buckets while browsing: https://github.com/AlecBlance/S3BucketList

==== Fuzzing ====
* https://github.com/sullo/nikto
* https://github.com/epi052/feroxbuster
* https://github.com/OJ/gobuster
* https://github.com/ffuf/ffuf
* https://github.com/maurosoria/dirsearch

=== Word Lists ===
Word lists can be used in your content discovery when performing directory bruteforcing and subdomain bruteforcing.

* All the best word lists for different tools and content discovery goals: https://wordlists.assetnote.io
* Repository of many different kinds of word lists: https://github.com/danielmiessler/SecLists
* Quickly generate context-specific wordlists for content discovery from lists of URLs or paths : https://github.com/ameenmaali/wordlistgen
* Content discovery URLs and files word list: https://gist.github.com/jhaddix/b80ea67d85c13206125806f0828f4d10
* File and directory discovery word list: https://github.com/danielmiessler/SecLists/tree/master/Discovery/Web-Content
* Subdomain enumeration word list: https://gist.github.com/jhaddix/f64c97d0863a78454e44c2f7119c2a6a

=== Port scanners ===
When performing a port scan pay special attention to non-standard ports.

* https://github.com/nmap/nmap
* https://github.com/projectdiscovery/naabu
* https://github.com/robertdavidgraham/masscan
* https://github.com/zmap/zmap
* https://github.com/RustScan/RustScan

=== Technology scanners ===
'''NOTE: using browser add-ons will change your browser fingerprint and reduce anonymity.'''

When performing a penetration test we will want to know what technology is running on the target and what version it's running as so that later we can start looking for possible working [https://www.kali.org/tools/exploitdb/#searchsploit public exploits].

* https://www.wappalyzer.com
* https://www.whatruns.com
* https://builtwith.com
* https://github.com/urbanadventurer/whatweb
* https://github.com/rverton/webanalyze
* <code>subfinder -d nasa.gov -silent | httpx -silent | nuclei -t technologies -silent</code>

=== Web Crawlers ===
Crawl a website, extract all URL endpoints and save them for further analysis.

* https://github.com/projectdiscovery/katana
* https://github.com/jaeles-project/gospider
* https://github.com/hakluke/hakrawler
* https://www.zaproxy.org
* https://github.com/edoardottt/cariddi

=== ASN scanners ===
Map out an organizations network ranges using ASN information.

* https://github.com/projectdiscovery/asnmap
* https://github.com/banviktor/asnlookup
* <code>[https://github.com/OWASP/Amass amass] intel -asn [https://bgp.he.net/search?search%5Bsearch%5D=nasa&commit=Search AS21556]</code>
* <code>echo 'nasa' | [https://github.com/j3ssie/Metabigor metabigor] net --org -v</code>
* <code>echo '[https://bgp.he.net/search?search%5Bsearch%5D=nasa&commit=Search AS21556]' | [https://github.com/j3ssie/Metabigor metabigor] net --asn -v</code>
* <code>amass intel -active -org nasa -max-dns-queries 2500 | awk -F, '{print $1}' ORS=',' | sed 's/,$//' | xargs -P3 -I@ -d ',' amass intel -active -asn @ -max-dns-queries 2500| sort -u</code>

=== Google hacking ===
Refine your google searches (also works on Bing and DuckDuckGo) to discover paths, files, vulnerabilities, endpoints, login portals and technology.
* (Book) Google Hacking for Penetration Testers 3rd Edition
* https://github.com/Proviesec/google-dorks
* https://www.exploit-db.com/google-hacking-database
* https://dorksearch.com

=== Intercepting proxies ===
* https://enlacehacktivista.org/index.php?title=Hacking_APIs#Intercepting_proxies

== Exploitation ==
For automatic exploit tools and payloads, see [[exploitation]].