Approach

• Recon

• Sub Domain

• Public Exploits

• Assest Discovery

• Google Search

• Censys

  • censys.io

    • Look for SSL certificates

      • 443.https.tls.certificate.parsed.extensions.subject_alt_name.dns_name:bugcrowd.com

    • Look for Internal certificates

      • "COMPANY" + internal (get creative) => might allow you to find a company internal subdomain or IP address not mentioned anywhere

• Shodan

• Web Archive

• Sensitive info from public resources - github, gist, pastebin , Trello , google sites , google groups , prezi , scribd , slideshare , online IDE's , github wiki , Graffana , zookeeper

• Trello - https://www.freecodecamp.org/news/discovering-the-hidden-mine-of-credentials-and-sensitive-information-8e5ccfef2724/

• https://twitter.com/imhaxormad/status/1118289299152072706

• OSINT - https://twitter.com/payloadartist/status/1066641639534297088

• Javascript Recon / Client Side Recon

• Reverse DNS / Whois

• Virtual Host https://twitter.com/HusseiN98D/status/1158503813399142401

• Retrive HTTP Status - https://twitter.com/HusseiN98D/status/1159912979695116293

• Broken link hijacking

• Reffere Header Check

• Rate Limiting

• BFAC - BFAC (Backup File Artifacts Checker): An automated tool that checks for backup artifacts that may disclose the web-application's source code. - https://github.com/mazen160/bfac

• Bruteforce GET / POST methods

• Vhost bruteforcing

• vhost 0 https://twitter.com/nnwakelam/status/1114122122534641664

• vhost - https://twitter.com/rez0__/status/1254588390114287617

  Use ffuf for vhosting on every new domain to find hidden servers/admin panels: ffuf -c -u https://target .com -H “Host: FUZZ” -w vhost_wordlist.txt #BugBountyTips #BugBountyTip #BugBounty

• content discovery - For Content Discovery : gau, Paramspider, Waybackurl, httpx, Subfinder, sublist3r,

• urlscan.io Get directory and files from@urlscanio public scans for fun & profit url(){ gron "https://urlscan.io/api/v1/search/?q=domain:$1…" | grep 'url' | gron --ungron } $source .bash_profile $url http://target.com Make sure you have@TomNomNom gron installed​