narsi-04a0 / keyhacks

Keyhacks is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid.

RESOURCES

MEGA LINKS

WINDOWS

7

https://mega.nz/file/7Iw3zKKQ#h-5xKsQSF-vhIALBiGJeHO8uCr6SG0AQ-bNXg8ujVKo

10

https://mega.nz/folder/PFoRAaTJ#lo6rs7Urz-bADufghIWOVg

DEBUGGING

https://developers.google.com/web/tools/chrome-devtools/javascript/

NMAP

https://resources.infosecinstitute.com/topic/nmap/

ASSET DISCOVERY

https://hackertarget.com/7-nmap-nse-scripts-recon/

ASSET DISCOVERY

https://github.com/random-robbie/bruteforce-lists

SPIDERING

https://book.hacktricks.xyz/pentesting/pentesting-web#web-api-guidance

WEBSITES

STATUS CHECKER

https://httpstatus.io

ONLINE TEST OF A ZONE TRANSFER THAT WILL ATTEMPT TO GET ALL DNS RECORDS FOR A TARGET DOMAIN. THE ZONE TRANSFER WILL BE TESTED AGAINST ALL NAME SERVERS (NS) FOR A DOMAIN.

https://hackertarget.com/zone-transfer/

DOMAIN NAME SYSTEM SECURITY EXTENSIONS (DNSSE)

https://dnssec-analyzer.verisignlabs.com/

EXIF GEOLOCATION DATA NOT STRIPPED FROM UPLOADED IMAGES

http://exif.regex.info/exif.cgi

TO TEST FOR SECURITY HEADERS

https://securityheaders.com/

GOOGLE DORKS

https://dorks.faisalahmed.me/

CERTIFICATE CHECKER

https://www.sslchecker.com/sslchecker

PASSIVE INFORMATION GATHERING

https://spyse.com

FREE DOMAIN RESEARCH TOOL THAT CAN DISCOVER HOSTS RELATED TO A DOMAIN

https://dnsdumpster.com

RECON REPORT OF PUBLIC BUGBOUNTY PROGRAMS

https://chaos.projectdiscovery.io/#/