+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: Websites RECON !! (/showthread.php?tid=6247434)
Websites RECON !! - Th3GodFather - Jul 23, 2023
RECON AND GET MORE INFO ABOUT YOUR TARGET fire
1 -use Dig: Stands for Domain Information Groper , Dns lookup by querying name servers and displaying the result to you!! ( dig target.com)
2- GoBack In Time -> To see Old Files Like robots.txt and urls ( search for tool in github or visit their website )
SUB-DOMAINS DISCOVER
-> gobuster dir -w /usr/share/wordlists/dirb/common.txt -u target.com
-> Sublist3r usage : python sublis3r.py -d target.com -p 80 443 GITHUB LINK
-> KnockPy Usage: ./knockpy target.com GITHUB LINK
GOOGLE DORK
site:target.com -site www.target.com
ONLINE DNS TOOLS LIKE :
https://dnsdumpster.com/
https://searchdns.netcraft.com/
BONUS fire : https://github.com/infosec-au/altdns
Usage: ./altdns.py -i subdomains.txt -o data_output -w words.txt -r -s output.txt
SUBDOMAIN VALIDATION :
--> https://github.com/RedSiege/EyeWitness
provide a list of all subdomains and it will give you like a report with screenshots of all sub-domain
Usage: ./EyeWitness.py -f subdomain.txt
BONUS ++ brain :
--> Censys: is another great online tool that will give you juicy information about your target!!
censys.io: https://censys.io/
--> Photon: is basically a data extraction tool which helps us find many useful information from the websites.
Usage: python3 photon.py -u target.com — keys — dns
Download: https://github.com/s0md3v/Photon
Good Luck👍
RE: Websites RECON !! - anihil - Jul 23, 2023
thanks in advance . sir
RE: Websites RECON !! - PITI - Jul 23, 2023
gobuster vhost -u domain.com -w awesome_wordlist.txt -v
amass -active -brute -o hosts.txt -d domain.com
curl -s "https://www.virustotal.com/ui/domains/HOST/subdomains?limit=40" | grep -Po "((http|https):\/\/)?(([\w.-]*)\.([\w]*)\.([A-z]))\w+" | sort -u
curl https://sonar.omnisint.io/subdomains/domain.com
curl -s https://dns.bufferover.run/dns?q=.HOST.com | jq -r .FDNS_A[] | cut -d',' -f2 | sort -u
gau --subs domain.com | unfurl -u domains
gau --subs domain.com | cut -d "/" -f 3 | sort -u
--------------------------------------------------------------------------------
FUZZ: 😈
feroxbuster --url https://www.DOMAIN.com/ -w ~/tools/Wordlists/fuzz.txt --silent -s 200 301 302 --redirects --methods POST,GET,PUT,PATCH,DELETE -k
gobuster -u <targetip> -w /usr/share/seclists/Discovery/Web_Content/common.txt -s '200,204,301,302,307,403,500' -e
gobuster dir -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt -t 100 -x txt,php,csv,md,json,js,html,py,sh -u http://domain
wfuzz -c -w /usr/share/seclists/Fuzzing/LFI/LFI-LFISuite-pathtotest-huge.txt --hc 404 --hh 206 http://domain/index.php?file=FUZZ
RE: Websites RECON !! - Th3GodFather - Jul 23, 2023
(Jul 23, 2023 09:25 AM)PITI Wrote: gobuster vhost -u domain.com -w awesome_wordlist.txt -v
amass -active -brute -o hosts.txt -d domain.com
curl -s "https://www.virustotal.com/ui/domains/HOST/subdomains?limit=40" | grep -Po "((http|https):\/\/)?(([\w.-]*)\.([\w]*)\.([A-z]))\w+" | sort -u
curl https://sonar.omnisint.io/subdomains/domain.com
curl -s https://dns.bufferover.run/dns?q=.HOST.com | jq -r .FDNS_A[] | cut -d',' -f2 | sort -u
gau --subs domain.com | unfurl -u domains
gau --subs domain.com | cut -d "/" -f 3 | sort -u
--------------------------------------------------------------------------------
FUZZ: 😈
feroxbuster --url https://www.DOMAIN.com/ -w ~/tools/Wordlists/fuzz.txt --silent -s 200 301 302 --redirects --methods POST,GET,PUT,PATCH,DELETE -k
gobuster -u <targetip> -w /usr/share/seclists/Discovery/Web_Content/common.txt -s '200,204,301,302,307,403,500' -e
gobuster dir -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt -t 100 -x txt,php,csv,md,json,js,html,py,sh -u http://domain
wfuzz -c -w /usr/share/seclists/Fuzzing/LFI/LFI-LFISuite-pathtotest-huge.txt --hc 404 --hh 206 http://domain/index.php?file=FUZZ
Thank you I will Add that to my experience