BUG BOUNTY TOOLS
Active Tools:
- Burp Suite : Identify and exploit security vulnerabilities in a web application using Burp Suite.
- OWASP ZAP (Zed Attack Proxy) : Scan a target website for common vulnerabilities using OWASP ZAP:
zap-cli --zap-path /path/to/zap.sh -v active-scan -t https://targetwebsite.com - w3af : Perform a web application scan for XSS vulnerabilities using w3af:
w3af_console -s xss https://targetwebsite.com - Arachni : Run a web vulnerability scan with Arachni:
arachni https://targetwebsite.com - SQLMap : Detect and exploit SQL injection vulnerabilities in a web application:
sqlmap -u "https://targetwebsite.com/vulnerable_page?id=1" --dbs
- Dirb / Dirbuster : Brute-force directories and files on a web server using Dirb:
dirb https://targetwebsite.com /path/to/wordlist.txt - ZAP : Use OWASP ZAP to actively scan a target website for vulnerabilities:
zap-cli --zap-path /path/to/zap.sh -v active-scan -t https://targetwebsite.com - Nuclei : Run security scans on a target using Nuclei templates:
nuclei -target targetwebsite.com -t ~/nuclei-templates/ - sqlninja : Exploit SQL injection vulnerabilities with sqlninja:
sqlninja -m DNS -d vulnerable_db -i /path/to/injection/file
- FFuF (Fuzz Faster U Fool) : Fuzz directories on a web server using FFuF:
ffuf -w /path/to/wordlist.txt -u https://targetwebsite.com/FUZZ
- Subjack : Scan a list of subdomains for takeover vulnerabilities using Subjack:
subjack -w subdomains.txt -t 100 -v
- dalfox : Perform parameter analysis and find XSS vulnerabilities using dalfox:
dalfox pipe 'echo "https://targetwebsite.com/?param=value"' -o output.txt
- Gitleaks : Scan a Git repository for sensitive information using Gitleaks:
gitleaks --repo=https://github.com/username/repo
- Arjun : Discover parameters and paths for JavaScript files using Arjun:
python3 arjun.py -u https://targetwebsite.com
- Corsy : Scan a list of URLs for CORS misconfigurations using Corsy:
python3 corsy.py -i urls.txt -t 10
- ksubdomain : Enumerate subdomains using ksubdomain:
ksubdomain -d targetdomain.com
- XSStrike : Detect and exploit XSS vulnerabilities using XSStrike:
python3 xsstrike.py -u https://targetwebsite.com
- tplmap : Exploit SSTI vulnerabilities using tplmap:
python3 tplmap.py -u "https://targetwebsite.com/?param=value"
- Snyk (partially active, used to identify vulnerabilities) : Scan a project’s dependencies for vulnerabilities using Snyk:
snyk test /path/to/project
Passive tools:
- Subfinder : Use Subfinder to passively enumerate subdomains of a target domain:
subfinder -d targetdomain.com -silent
- Amass : Enumerate subdomains of a target domain with Amass:
amass enum -d targetdomain.com
- SubOver : Identify potential subdomain takeover vulnerabilities using SubOver:
subover -l subdomains.txt
- Rapid7 Heisenberg Cloud : Discover cloud services associated with a domain using Heisenberg Cloud:
heisenberg-cloud example.com
- Sublist3r : Enumerate subdomains of a target domain using Sublist3r:
python sublist3r.py -d targetdomain.com
- Assetnote Leaks : Search for sensitive data leaks using Assetnote Leaks:
python3 assetnote_leaks.py search targetdomain.com
- Sn1per : Perform passive information gathering using Sn1per:
sn1per -s targetdomain.com
- Gasmask : Prevent DNS leaks on macOS using Gasmask:
sudo open -a Gasmask
- MassDNS : Perform bulk DNS lookups using MassDNS:
massdns -r /path/to/resolvers.txt -t A -o S -w output.txt domains.txt
- github-search : Search for sensitive data in GitHub repositories using github-search:
python github_search.py -t GITHUB_TOKEN targetdomain.com - Github-Dorks : Use Github-Dorks to search for sensitive data in GitHub repositories:
python github-dorks.py -d targetdomain.com -t GITHUB_TOKEN
JavaScript Vulnerability Discovery:
- JSLint : Identify potential JavaScript code quality issues with JSLint:
jslint /path/to/javascript.js - JSParser : Parse JavaScript files and extract potential endpoints using JSParser:
jsparser -u https://targetwebsite.com
Privilege Escalation:
- WinPEAS : Run WinPEAS on a Windows system for privilege escalation checks:
powershell -c "IEX(New-Object Net.WebClient).downloadString('https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/raw/master/winPEAS/winPEASbat/winPEAS.bat')"
- BeRoot : Check for Linux misconfigurations and privilege escalation paths using BeRoot:
./BeRoot.sh
- Linux Exploit Suggester : Suggest potential Linux exploits for privilege escalation:
./les.sh
- Unix-PrivEsc-check : Run Unix-PrivEsc-check to identify common privilege escalation vectors:
./unix-privesc-check standard
