rpriven
4ff6f7be6c
Content behind a JS shell — crawl JS with katana or capture with mitmproxy/Burp, then replay the internal call with session cookie + CSRF header. Co-Authored-By: Kai <kai@djeditech.com>
76 lines
2.2 KiB
Text
76 lines
2.2 KiB
Text
% web, webapp, burp, fuzzing
|
|
|
|
# Directory fuzzing with ffuf
|
|
ffuf -u http://<target>/FUZZ -w <wordlist>
|
|
|
|
# Directory fuzzing with extensions
|
|
ffuf -u http://<target>/FUZZ -w <wordlist> -e .php,.html,.txt,.bak
|
|
|
|
# Subdomain fuzzing
|
|
ffuf -u http://FUZZ.<domain> -w <wordlist> -H "Host: FUZZ.<domain>"
|
|
|
|
# POST parameter fuzzing
|
|
ffuf -u http://<target>/login -X POST -d "username=admin&password=FUZZ" -w <wordlist>
|
|
|
|
# Filter by status code
|
|
ffuf -u http://<target>/FUZZ -w <wordlist> -fc 404
|
|
|
|
# Filter by response size
|
|
ffuf -u http://<target>/FUZZ -w <wordlist> -fs 0
|
|
|
|
# Gobuster directory scan
|
|
gobuster dir -u http://<target> -w <wordlist>
|
|
|
|
# Gobuster with extensions
|
|
gobuster dir -u http://<target> -w <wordlist> -x php,html,txt
|
|
|
|
# Nikto scan
|
|
nikto -h http://<target>
|
|
|
|
# WhatWeb (technology detection)
|
|
whatweb http://<target>
|
|
|
|
# SQLMap basic
|
|
sqlmap -u "http://<target>/page.php?id=1" --batch
|
|
|
|
# SQLMap dump database
|
|
sqlmap -u "http://<target>/page.php?id=1" --dbs --batch
|
|
|
|
# SQLMap dump tables
|
|
sqlmap -u "http://<target>/page.php?id=1" -D <database> --tables --batch
|
|
|
|
# XSS test payload
|
|
<script>alert('XSS')</script>
|
|
|
|
# Curl with POST data
|
|
curl -X POST http://<target>/login -d "username=admin&password=test" -v
|
|
|
|
# Curl with cookies
|
|
curl http://<target> -b "session=<cookie>"
|
|
|
|
# Curl with headers
|
|
curl http://<target> -H "Authorization: Bearer <token>"
|
|
|
|
# --- Hidden API recon: content behind a JS shell ---
|
|
# Page renders blank to curl/wget? The content loads from an internal API the
|
|
# page's JavaScript calls after render. Find that call and replay it yourself.
|
|
|
|
# Crawl the site's JS for endpoints (ProjectDiscovery katana)
|
|
katana -u https://<target> -jc -silent | grep -iE 'api|graphql|\.json'
|
|
|
|
# Or watch the exact call live, then copy it as curl (mitmproxy / Burp intercept)
|
|
mitmproxy
|
|
|
|
# Replay the internal call with your session cookie + any CSRF header
|
|
# (CSRF header value often must match the session cookie, e.g. JSESSIONID)
|
|
curl -s -b <cookiejar> -H "csrf-token: <token>" -H "user-agent: <ua>" "<api_url>"
|
|
|
|
$ target: echo ""
|
|
$ domain: echo ""
|
|
$ wordlist: echo "/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt"
|
|
$ database: echo ""
|
|
$ cookie: echo ""
|
|
$ token: echo ""
|
|
$ cookiejar: echo "cookies.txt"
|
|
$ ua: echo "Mozilla/5.0"
|
|
$ api_url: echo ""
|