tz0385 / acomplete-guide-to-dir-brute-force-admin-panel-and-api-endpoints Goto Github PK
View Code? Open in Web Editor NEWThis project forked from emadshanab/acomplete-guide-to-dir-brute-force-admin-panel-and-api-endpoints
This project forked from emadshanab/acomplete-guide-to-dir-brute-force-admin-panel-and-api-endpoints
A complete guide to dir brute force,admin panel and API endpoints:- 1:- Intro. 2:- Tools repos. 3:- Wordlists collection. 4:- Tips. 1:- Intro:- Befor you start your attack you have to know what is the tech is running on the site to save your time. There is a lot of programs that identify the tech such as:- 1:- httpx - https://github.com/projectdiscovery/httpx 2:- wappalyzer - https://www.wappalyzer.com/ 3:- whatweb - https://github.com/urbanadventurer/WhatWeb 4:- BuiltWith - https://builtwith.com/ 5:- Netcraft - https://www.netcraft.com/ 6:- WhatRuns - https://www.whatruns.com/ 7:- PageXray - https://chrome.google.com/webstore/detail/pagexray/aedmpdookgbneegaeajpoldpnpfbpmlb?hl=en 8:- SimilarTech - https://www.similartech.com/ 9:- What CMS - https://whatcms.org/ Now after you get information about the website you can decide which wordlist will work. There are many programs will do the job for you if you know how to use it correctly ---------------------------------------------------------------------------------------------------------------- Lets start with dirsearch ( my favorite) :- The simple usage is :- python3 dirsearch.py -u https://target Now you notice we hav not point any wordlist to dirsearch becaust by defulte will look for dicc.txt on the db floder and use it. Now we want to use our cusotm wordlist:- python3 dirsearch.py -u https://target -w /root/wordlist Now lets say we have a php site and we want to brute forc php extension you need to add -e option and add php. python3 dirsearch.py -e php -u https://target -w /path/to/wordlist You can add more than one extension like js,html ect. If dirsearch found an endpoint lets call it admin, dirsearch have an option called Recursive scan it means it will brute after that endpiont:- Just give it the depth and add the option -r with threads option -t 20 python3 dirsearch.py -e php -u https://target -r --recursion-depth 3 --exclude-subdirs image/,css/ --recursion-status 200-399 Dirseach have an option to send every request to burpsuite or any proxy you want just add the proxy ip and port and exclud some responses like 429 python3 dirsearch.py -e php,html,js -u https://target -x 400,403,429 --proxy 127.0.0.1:8080 You can use dirsearch to find backup files like this python3 dirsearch.py -e conf,config,bak,backup,swp,old,db,sql,asp,aspx,aspx~,asp~,py,py~,rb,rb~,php,php~,bak,bkp,cache,cgi,conf,csv,html,inc,jar,js,json,jsp,jsp~,lock,log,rar,old,sql,sql.gz,sql.zip,sql.tar.gz,sql~,swp,swp~,tar,tar.bz2,tar.gz,txt,wadl,zip,log,xml,js,json -u https://target For more usage check the dirseach repo. ---------------------------------------------------------------------------------------------------------------- ffuf:- A go program but faster than dirsearch and you can find the usage on the github page. https://danielmiessler.com/study/ffuf/ DirBuster:- you can find the usage on the github page ---------------------------------------------------------------------------------------------------------------- Find admin panel:- 1:- Using google dorks. site:target.com inurl:admin | administrator | adm | login | l0gin | wp-login intitle:"login" "admin" site:target.com intitle:"index of /admin" site:target.com inurl:admin intitle:admin intext:admin 2:- Using httpx and a wordlist:- httpx -l hosts.txt -paths /root/admin-login.txt -threads 100 -random-agent -x GET,POST -tech-detect -status-code -follow-redirects -title -content-length httpx -l hosts.txt-ports 80,443,8009,8080,8081,8090,8180,8443 -paths /root/admin-login.txt -threads 100 -random-agent -x GET,POST -tech-detect -status-code -follow-redirects -title -content-length 3:- Using some programs:- https://github.com/the-c0d3r/admin-finder https://github.com/RedVirus0/Admin-Finder https://github.com/mIcHyAmRaNe/okadminfinder3 https://github.com/penucuriCode/findlogin https://github.com/fnk0c/cangibrina ---------------------------------------------------------------------------------------------------------------- Find API endpoints:- Kiterunner https://blog.assetnote.io/2021/04/05/contextual-content-discovery/ https://github.com/assetnote/kiterunner/releases/download/v1.0.1/kiterunner_1.0.1_linux_amd64.tar.gz https://wordlists-cdn.assetnote.io/data/kiterunner/routes-large.kite.tar.gz https://wordlists-cdn.assetnote.io/data/kiterunner/routes-small.kite.tar.gz https://wordlists-cdn.assetnote.io/rawdata/kiterunner/routes-large.json.tar.gz https://wordlists-cdn.assetnote.io/rawdata/kiterunner/routes-small.json.tar.gz # Just have a list of hosts and no wordlist kr scan hosts.txt -A=apiroutes-210328:20000 -x 5 -j 100 --fail-status-codes 400,401,404,403,501,502,426,411 # You have your own wordlist but you want assetnote wordlists too kr scan target.com -w routes.kite -A=apiroutes-210328:20000 -x 20 -j 1 --fail-status-codes 400,401,404,403,501,502,426,411 # Bruteforce like normal but with the first 20000 words kr brute https://target.com/subapp/ -A=aspx-210328:20000 -x 20 -j 1 # Use a dirsearch style wordlist with %EXT% kr brute https://target.com -w dirsearch.txt -x 20 -j 1 -exml,asp,aspx,ashx -D kr brute <hosts-file> -w wordlist.txt -e asp,aspx,cfm,xml -x20 -j250 -A=apiroutes-210228 kr kb replay -w routes.kite "POST 500 [ 40, 5, 1] https://redacted/user/create 0cc39f768fe347ac930d8fc3f6b5bf2e4b6be41e" --proxy http://localhost:8080 API Scanning # single target kr scan https://target.com:8443/ -w routes.kite -A=apiroutes-210228:20000 -x 10 --ignore-length=34 # single target, but you want to try http and https kr scan target.com -w routes.kite -A=apiroutes-210228:20000 -x 10 --ignore-length=34 # a list of targets kr scan targets.txt -w routes.kite -A=apiroutes-210228:20000 -x 10 --ignore-length=34 Vanilla Bruteforcing kr brute https://target.com -A=raft-large-words -A=apiroutes-210228:20000 -x 10 -d=0 --ignore-length=34 -ejson,txt # this will use the first 20000 lines in the api routes wordlist kr scan targets.txt -A=apiroutes-210228:20000 -x 10 --ignore-length=34 # this will use the first 10 lines in the aspx wordlist kr brute targets.txt -A=aspx-210228:10 -x 10 --ignore-length=34 -easp,aspx ---------------------------------------------------------------------------------------------------------------- 3:- Tips:- Genetate your custom wordlist:- Lets say you are hunting on indeed program and this program use the same code on all the subdomains and to save time we need to generat a wordlist for indeed. We will use gau to make this wordlist with unufurl and will exclude some extensions. gau -subs indeed.com | unfurl -u keys | tee -a wordlist.txt ; gau -subs indeed.com | unfurl -u paths|tee -a ends.txt; sed 's#/#\n#g' ends.txt | sort -u | tee -a wordlist.txt | sort -u ;rm ends.txt | sed -i -e 's/\.css\|\.png\|\.jpeg\|\.jpg\|\.svg\|\.gif\|\.wolf\|\.bmp//g' wordlist.txt ---------------------------------------------------------------------------------------------------------------- Custom wordlist from robots.txt- Thanks to https://twitter.com/remonsec/status/1410481151433576449 step 1- httpx -l urls.txt -paths /robots.txt -silent -o robots-url.txt step 2- for url in $(cat robots-url.txt);do http -b $url | grep 'Disallow' | awk -F ' ' '{print $2}' | cut -c 2- | anew robot-words.txt;done ---------------------------------------------------------------------------------------------------------------- Extract endpoints form js files:- https://gist.github.com/fuckup1337/49484c35c8ad8ae1d165ffe7d71375eb ---------------------------------------------------------------------------------------------------------------- IIS Short Name Scanner v2.3.9 A scanner for IIS short file name (8.3) disclosure vulnerability by using the tilde (~) character Usage:- - Example 0 (to see if the target is vulnerable): java -jar iis_shortname_scanner.jar http://example.com/folder/ - Example 1 (uses no thread - very slow): java -jar iis_shortname_scanner.jar 2 0 http://example.com/folder/new%20folder/ - Example 2 (uses 20 threads - recommended): java -jar iis_shortname_scanner.jar 2 20 http://example.com/folder/new%20folder/ - Example 3 (saves output in a text file): java -jar iis_shortname_scanner.jar 0 20 http://example.com/folder/new%20folder/ > c:\results.txt - Example 4 (bypasses IIS basic authentication): java -jar iis_shortname_scanner.jar 2 20 http://example.com/folder/AuthNeeded:$I30:$Index_Allocation/ - Example 5 (using a new config file): java -jar iis_shortname_scanner.jar 2 20 http://example.com/folder/ newconfig.xml - Example 6 (scanning multiple targets using a linux box): ./multi_targets.sh scope.txt 1 ---------------------------------------------------------------------------------------------------------------- SAML dir brute force:- if you’re testing a website and it’s redirect to Onelogin. No problems just tracing the SAML request and decode it to find the hidden website in the request. Buggy Internal website:- https://twitter.com/Alra3ees/status/1259969808969469954 SAML tracer https://addons.mozilla.org/en-US/firefox/addon/saml-tracer/ SAML Decoder https://www.samltool.com/decode.php ---------------------------------------------------------------------------------------------------------------- 2:- Tools repos:- https://github.com/maurosoria/dirsearch https://github.com/ffuf/ffuf https://github.com/s0md3v/Breacher https://github.com/KajanM/DirBuster https://github.com/epi052/feroxbuster https://github.com/assetnote/kiterunner https://github.com/Raz0r/aemscan https://github.com/0ang3el/aem-hacker https://github.com/irsdl/IIS-ShortName-Scanner ---------------------------------------------------------------------------------------------------------------- 3:- Wordlists:- https://github.com/six2dez/OneListForAll https://wordlists.assetnote.io/ https://github.com/random-robbie/bruteforce-lists https://github.com/Bo0oM/fuzz.txt https://github.com/drtychai/wordlists https://github.com/emadshanab/SAP-wordlist https://github.com/emadshanab/Huge_DIR_wordlist https://github.com/emadshanab/971-MB-content_discovery_wordlist https://github.com/emadshanab/Combined-Wordlists https://github.com/emadshanab/wordlistsbyNahamsec https://github.com/emadshanab/WordLists-20111129 https://github.com/Karanxa/Bug-Bounty-Wordlists https://github.com/chrislockard/api_wordlist https://github.com/tauh33dkhan/ApiWordlist https://github.com/bishal0x01/api_wordlist https://github.com/fuzzdb-project/fuzzdb https://github.com/danielmiessler/SecLists https://github.com/1N3/IntruderPayloads https://github.com/cujanovic/dirsearch-wordlist https://github.com/Droidzzzio/EnumerationList https://github.com/brycedrennan/wordlists https://github.com/SilverPoision/a-full-list-of-wordlists https://github.com/hypn/custom-wordlists https://github.com/huntergregal/dir_list https://github.com/bashexplode/directory-wordlists https://github.com/JavierOlmedo/UltimateCMSWordlists https://github.com/ZephrFish/Wordlists https://github.com/emadshanab/admin-login https://github.com/dewhurstsecurity/api_paths https://github.com/clarkvoss/Drupal-Dir-Search https://github.com/xajkep/wordlists https://github.com/emadshanab/Adobe-Experience-Manager ---------------------------------------------------------------------------------------------------------------- 4:- Tips:- https://www.infosecmatter.com/bug-bounty-tips/ https://github.com/dwisiswant0/awesome-oneliner-bugbounty https://github.com/KingOfBugbounty/KingOfBugBountyTips Good luck.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.