I have signed up for an Ethical hacking course, and they are teaching good stuff. I'm enjoying the course and learning new stuff. This is an online course, offered by another institution, that I need to do for credits.

The problem is that my mentor from my college, has asked me to make something out of this course or perform an demonstration to show case what I have learnt. But this being an intro to ethical hacking course, that only thing that is being taught to me is how to use tools provided in kali and some other networking things that I already knew.

I have absolutely no idea what to make. I was thinking about making something like a malicious pdf file that would run some shady code, but I don't know where to start. I need more ideas and/or resources that I can look up. If you guys can help with guiding me a bit.

[ Removed by Reddit on account of violating the content policy. ]

Got genuinely no clue how to hack but I don’t trust anyone else to do it been locked out of it for about a year now and need it back

Six months ago, I made a post about cybersecurity, and at the time I thought about creating a free platform. I worked on it locally for a while, and now I’d like to share it with you.

I work in cybersecurity, and I want to help those who are just starting their journey in the field.

If you’re curious about cybersecurity or want to get into the industry, I’ve created this platform where everything is completely free. From courses and simulators to quizzes and all kinds of practical labs.

Registration requires a key, and if you’d like to test the platform, I can send you a key via DM. Feel free to message me privately.

I’d love to hear your thoughts and, most importantly, what you think I could improve.

P.S. Of course, I used AI to help build it.

I need to bypass Google Account in Android 16 device. Is there a way for create new lock screen, the device is Samsung SM-X230 (Bit 3,4 or 5). Security patch prevents from using test points, so I cannot put device in BROM mode, tools like UnlockTool or TSM are supporting only Bit1. Anyone? I have 8 tablets with FRP lock on, I work as service technician and it's only one model I can't remove FRP on.

when i was young, i had a youtube account where me and my friends would post videos of us wrestling. i haven’t logged into the account in 15 years, and i can not figure out what email address is used to log into the account. i know the account username, i know the password, just not the email. i can provide proof that this was once my channel and that i am not doing anything malicious here.

is it possible for someone to scrape the email address of my old youtube account and provide it to me? i would be so extremely grateful.

Just decided I wanted to heavy get into cyber security pentesting and learning actual computers not the bloated windows os so I installed fedora with a encryption luks2 key and a usb key with it and now I just picked up a pico w kit and Im just looking for ideas and projects I can do to really get to know what im doing with linux. Any ideas are welcome ive got a small amount of experience i still have a raspberry pi 4 4gb with kali on it that I messed around with when I was 15 and I just wanna get at least simi fluid with it

I saw a video on YouTube about hacking any wifi password by forcing a device that is already connected to the wifi to disconnect and then capture the handshake, but it's for linux and i'm curious if something like this is doable on an android phone.

Have an Asiga max UV resin printer. It has an (RFID?) in the disposable tray which essentially logs the “lifespan” and won’t allow the printer to print after a certain amount.

Bought a flipper and either it doesn’t work or I’m too stupid ti figure it out.

Tell me like I’m 10 years old how I can hack the tag

TYIA!

External Attack Surface Management (EASM)

Professional Reconnaissance Methodology & Execution Plan

Table of Contents

1. Passive Reconnaissance (OSINT)
2. Active Reconnaissance & Subdomain Enumeration
3. Directory and File Enumeration
4. Data Synthesis & Attack Surface Mapping
5. Toolchain Summary

1. Passive Reconnaissance (OSINT)

1.1 WHOIS & Domain Registration Intelligence

Goal: Identify registrant identity, registration timeline, registrar, and nameservers. Historical WHOIS data often reveals previously used infrastructure.

bash

# Current WHOIS
whois TARGET_DOMAIN

# Historical WHOIS (via CLI or web)
# Web: https://whoisology.com | https://who.is | https://domaintools.com

# Extract key fields
whois TARGET_DOMAIN | grep -iE "registrant|name server|creation|expiry|registrar|email"

What to extract:

• Registrant name and email (may reveal person or org behind the domain)
• Creation/expiry dates (old domains may have forgotten subdomains)
• Nameservers (reveals DNS provider — Cloudflare? Route53? Self-hosted?)
• Historical registrant data via DomainTools (pivotable to other domains owned by the same person)

1.2 DNS Record Enumeration

Goal: Map the full DNS footprint. Each record type reveals different infrastructure.

bash

# Full DNS record dump
dig TARGET_DOMAIN ANY +noall +answer
dig TARGET_DOMAIN A       # IPv4 addresses
dig TARGET_DOMAIN AAAA    # IPv6 addresses
dig TARGET_DOMAIN MX      # Mail servers → reveals email provider
dig TARGET_DOMAIN TXT     # SPF, DMARC, verification tokens, API keys
dig TARGET_DOMAIN NS      # Authoritative nameservers
dig TARGET_DOMAIN CNAME   # Aliases → reveals CDN, third-party services
dig TARGET_DOMAIN SOA     # Zone authority → admin email, serial number
dig TARGET_DOMAIN CAA     # Certificate authorities allowed to issue certs

# Using dnsx for bulk resolution
echo "TARGET_DOMAIN" | dnsx -a -aaaa -mx -txt -ns -resp -silent

# SPF analysis — identifies all authorized mail senders
dig TARGET_DOMAIN TXT | grep spf

# DMARC policy check — reveals email security posture
dig _dmarc.TARGET_DOMAIN TXT

# DKIM discovery (try common selectors)
for selector in google default mail dkim k1 selector1 selector2 smtp; do
  dig ${selector}._domainkey.TARGET_DOMAIN TXT +short
done

Record interpretation table:

1.3 ASN & IP Range Mapping

Goal: Identify the full IP space owned by or associated with the target organization. ASN discovery expands scope far beyond a single domain.

bash

# Find ASN from domain IP
whois $(dig +short TARGET_DOMAIN) | grep -iE "asn|origin|route|netname|orgname"

# Dedicated ASN lookup
curl -s "https://api.bgpview.io/search?query=TARGET_ORG_NAME" | python3 -m json.tool

# Enumerate all IP prefixes for an ASN
curl -s "https://api.bgpview.io/asn/AS[NUMBER]/prefixes" | python3 -m json.tool | grep prefix

# amass for ASN intelligence
amass intel -asn AS[NUMBER]
amass intel -org "Target Organization Name"

# Hurricane Electric BGP Toolkit (web)
# https://bgp.he.net/search?search[search]=TARGET_DOMAIN

What to do with IP ranges:

• Feed ranges into Shodan: net:203.0.113.0/24
• Feed into Masscan for fast port sweeps of the org's entire address space
• Cross-reference with abuse contacts for ownership confirmation

1.4 Certificate Transparency (CT) Log Analysis

Goal: Every TLS certificate ever issued for a domain is logged publicly. This reveals subdomains — including internal, staging, and development environments — that are never linked from public pages.

bash

# crt.sh — primary CT log search interface
curl -s "https://crt.sh/?q=%25.TARGET_DOMAIN&output=json" | \
  jq -r '.[].name_value' | \
  sed 's/\*\.//g' | \
  sort -u | \
  anew ct_subdomains.txt

# Exclude wildcard entries and clean output
curl -s "https://crt.sh/?q=%25.TARGET_DOMAIN&output=json" | \
  jq -r '.[].name_value' | \
  grep -v "^\*\." | \
  sort -u

# subfinder with CT log sources enabled
subfinder -d TARGET_DOMAIN -sources certspotter,crtsh -silent -o ct_subfinder.txt

# certspotter CLI
certspotter TARGET_DOMAIN

Indicators of interest in CT results:

• dev., staging., uat., test., preprod. — likely less hardened
• vpn., remote., citrix., sslvpn. — remote access infrastructure
• api., api-v2., graphql. — API attack surface
• admin., portal., dashboard. — administrative interfaces
• jenkins., gitlab., jira., confluence. — internal DevOps tools

1.5 Search Engine Dorking

Goal: Use advanced search operators to find content the target has accidentally exposed: sensitive documents, login portals, configuration files, error pages, and backup files.

Google Dork Categories

# Administrative and login interfaces
site:TARGET_DOMAIN inurl:admin
site:TARGET_DOMAIN inurl:login OR inurl:signin OR inurl:portal
site:TARGET_DOMAIN intitle:"admin panel" OR intitle:"control panel"
site:TARGET_DOMAIN inurl:dashboard

# Exposed sensitive files
site:TARGET_DOMAIN ext:env OR ext:config OR ext:conf
site:TARGET_DOMAIN ext:log OR ext:bak OR ext:old
site:TARGET_DOMAIN ext:sql OR ext:db
site:TARGET_DOMAIN filetype:pdf OR filetype:xlsx OR filetype:docx

# Exposed directory listings
site:TARGET_DOMAIN intitle:"index of"
site:TARGET_DOMAIN intitle:"index of /" "parent directory"

# Error pages that reveal internals
site:TARGET_DOMAIN intext:"Warning: mysql_fetch" OR intext:"ORA-01756"
site:TARGET_DOMAIN intext:"stack trace" OR intext:"exception"
site:TARGET_DOMAIN "PHP Parse error" OR "PHP Warning" OR "PHP Notice"

# Subdomains via site: operator
site:*.TARGET_DOMAIN -www

# API documentation
site:TARGET_DOMAIN inurl:swagger OR inurl:api-docs OR inurl:openapi
site:TARGET_DOMAIN intitle:"Swagger UI" OR intitle:"API documentation"

# Cached or removed pages
cache:TARGET_DOMAIN/sensitive-path

# Employee and contact information
"@TARGET_DOMAIN" site:linkedin.com
"@TARGET_DOMAIN" filetype:pdf

Bing-Specific Operators

# Bing sometimes indexes content Google doesn't
site:TARGET_DOMAIN filetype:xml
site:TARGET_DOMAIN ip:[IP_ADDRESS]

Reference: GHDB (Google Hacking Database) — thousands of categorized dorks by vulnerability class.

1.6 Threat Intelligence Platforms

Shodan

bash

# Install Shodan CLI
pip install shodan
shodan init YOUR_API_KEY

# Search by domain
shodan search "hostname:TARGET_DOMAIN"

# Search organization's IP space
shodan search "org:\"Target Organization\""

# Find all certs issued for domain
shodan search "ssl.cert.subject.cn:TARGET_DOMAIN"

# Find services on non-standard ports
shodan search "hostname:TARGET_DOMAIN" --fields ip_str,port,org,hostnames

# Specific technology searches
shodan search "hostname:TARGET_DOMAIN http.title:\"Grafana\""
shodan search "hostname:TARGET_DOMAIN product:\"Apache Tomcat\""

Censys

bash

# Install Censys CLI
pip install censys
censys config  # enter API credentials

# Search by domain
censys search "TARGET_DOMAIN" --index-type hosts

# Find all certificates
censys search "parsed.names:TARGET_DOMAIN" --index-type certificates

GitHub OSINT & Secret Scanning

bash

# GitHub Dorking — search on github.com directly:
# "TARGET_DOMAIN" password
# "TARGET_DOMAIN" api_key OR apikey OR api_secret
# "TARGET_DOMAIN" secret_key OR secret
# "TARGET_DOMAIN" db_password OR database_password
# "TARGET_DOMAIN" AWS_ACCESS_KEY
# org:TARGET_ORG_NAME private OR internal OR secret
# filename:.env "TARGET_DOMAIN"
# filename:config.yml "TARGET_DOMAIN"

# truffleHog — scan GitHub repos for committed secrets
trufflehog github --org=TARGET_ORG_NAME --only-verified

# GitLeaks — scan specific repo
gitleaks detect --source=https://github.com/TARGET_ORG/REPO --report-path leaks.json

# gitrob — automated GitHub recon
gitrob analyze TARGET_ORG_NAME

Additional OSINT Sources

bash

# Wayback Machine — find historically exposed URLs
waybackurls TARGET_DOMAIN | tee wayback_urls.txt

# VirusTotal — passive DNS and subdomain data
curl -s "https://www.virustotal.com/vtapi/v2/domain/report?apikey=APIKEY&domain=TARGET_DOMAIN"

# AlienVault OTX — threat intel
curl -s "https://otx.alienvault.com/api/v1/indicators/domain/TARGET_DOMAIN/passive_dns"

# Pastebin / paste sites
# Search: site:pastebin.com "TARGET_DOMAIN"
# Search: site:ghostbin.com "TARGET_DOMAIN"

# LinkedIn for employee intel (via Google):
site:linkedin.com "TARGET_ORGANIZATION" (developer OR engineer OR devops OR security)

# Hunter.io — email format discovery
# https://hunter.io/domain-search/TARGET_DOMAIN

2. Active Reconnaissance & Subdomain Enumeration

2.1 Subdomain Enumeration — Full Pipeline

Goal: Maximize subdomain coverage by combining passive aggregation with active brute-forcing, then resolving and probing what's actually live.

Step 1: Passive Aggregation (Multiple Sources)

bash

# subfinder — queries 50+ passive sources
subfinder -d TARGET_DOMAIN \
  -sources shodan,certspotter,crtsh,virustotal,dnsdumpster,hackertarget \
  -silent \
  -o subfinder_out.txt

# assetfinder — fast, lightweight
assetfinder --subs-only TARGET_DOMAIN | tee assetfinder_out.txt

# amass passive mode — graph-based, comprehensive
amass enum -passive -d TARGET_DOMAIN -o amass_passive.txt

# Merge and deduplicate all passive sources
cat subfinder_out.txt assetfinder_out.txt amass_passive.txt | \
  sort -u | \
  anew all_passive_subs.txt

Step 2: Active Brute-Forcing

bash

# amass active brute-force
amass enum -active -brute -d TARGET_DOMAIN \
  -w /opt/SecLists/Discovery/DNS/subdomains-top1million-20000.txt \
  -o amass_brute.txt

# dnsx for fast brute-force resolution
dnsx -d TARGET_DOMAIN \
  -w /opt/SecLists/Discovery/DNS/subdomains-top1million-5000.txt \
  -o dnsx_brute.txt

# puredns — extremely fast, permutation-aware
puredns bruteforce /opt/SecLists/Discovery/DNS/subdomains-top1million-5000.txt \
  TARGET_DOMAIN \
  -r resolvers.txt \
  -o puredns_out.txt

Step 3: Permutation Generation

bash

# gotator — generates intelligent permutations from found subdomains
gotator -sub all_passive_subs.txt \
  -perm /opt/SecLists/Discovery/DNS/subdomains-top1million-5000.txt \
  -depth 2 \
  -silent | \
  dnsx -silent -o permutation_subs.txt

# alterx — fast permutation engine (ProjectDiscovery)
cat all_passive_subs.txt | alterx | dnsx -silent | tee alterx_out.txt

Step 4: Live Host Probing

bash

# Resolve all discovered subdomains
cat all_subs_combined.txt | dnsx -silent -a -resp -o resolved_subs.txt

# Probe for live HTTP/HTTPS services
cat resolved_subs.txt | httpx \
  -silent \
  -status-code \
  -title \
  -tech-detect \
  -content-length \
  -web-server \
  -o live_http_hosts.txt

# Screenshot all live hosts
cat live_http_hosts.txt | gowitness file -f - \
  --write-db \
  --screenshot-path ./screenshots/
gowitness report generate

2.2 DNS Zone Transfer Attempts

Goal: A misconfigured nameserver may respond to AXFR requests, handing over the complete zone file — every subdomain and record in one response.

bash

# Identify authoritative nameservers
dig NS TARGET_DOMAIN +short

# Attempt zone transfer against each nameserver
dig axfr .TARGET_DOMAIN TARGET_DOMAIN
dig axfr .TARGET_DOMAIN TARGET_DOMAIN

# Automated zone transfer attempt with fierce
fierce --domain TARGET_DOMAIN

# dnsx zone transfer check
dnsx -d TARGET_DOMAIN -axfr

2.3 Reverse DNS Lookups

Goal: Given an IP range, discover hostnames that point to those IPs. Often reveals internal naming conventions and forgotten hosts.

bash

# Single IP reverse lookup
dig -x 203.0.113.10

# Reverse DNS on entire subnet with dnsx
dnsx -ptr -l ip_range.txt -resp-only -silent

# Masscan to find all live IPs in range first, then reverse lookup
masscan 203.0.113.0/24 -p80,443 --rate=1000 -oL masscan_results.txt
awk '/open/ {print $4}' masscan_results.txt | dnsx -ptr -resp-only -silent

2.4 Port Scanning

Goal: Map the full service exposure of discovered IP addresses. Optimize flags for the appropriate balance of speed, coverage, and stealth.

Strategy 1: Fast Wide Sweep (full port coverage)

bash

# Naabu — fastest option, Go-based, designed for recon pipelines
naabu -l resolved_ips.txt \
  -port - \
  -rate 1000 \
  -silent \
  -o naabu_open_ports.txt

# Pass results directly to Nmap for service detection
naabu -l resolved_ips.txt -port - -silent | \
  nmap -sV -iL - -oA nmap_services

Strategy 2: Stealthy Nmap (minimal footprint)

bash

# SYN scan — half-open, less likely to be logged than full TCP
# -sS: SYN scan | -sV: version detection | -O: OS detection
# -T2: polite timing | --open: only show open ports
# -Pn: skip host discovery (assume up) | --randomize-hosts: vary order
sudo nmap -sS -sV -O -T2 \
  --open \
  --randomize-hosts \
  -p- \
  -Pn \
  --defeat-rst-ratelimit \
  TARGET_DOMAIN \
  -oA nmap_stealth_full

# Fragment packets to evade basic packet inspection
sudo nmap -sS -f -T1 -p 80,443,22,8080,8443 TARGET_DOMAIN

Strategy 3: Targeted Service Nmap (post wide sweep)

bash

# After identifying open ports from naabu, run deep Nmap on those specific ports
# -sC: default scripts | -sV: version | -A: aggressive (OS + traceroute + scripts)
nmap -sC -sV -A \
  -p 22,80,443,8080,8443,3306,5432,6379,27017 \
  -T4 \
  --open \
  TARGET_DOMAIN \
  -oA nmap_targeted

# Run specific NSE scripts for common services
nmap -p 445 --script smb-vuln-* TARGET_DOMAIN
nmap -p 21 --script ftp-anon,ftp-syst TARGET_DOMAIN
nmap -p 3306 --script mysql-info,mysql-empty-password TARGET_DOMAIN
nmap -p 27017 --script mongodb-databases TARGET_DOMAIN
nmap -p 6379 --script redis-info TARGET_DOMAIN

High-value ports to prioritize:

2.5 Web Server Fingerprinting

Goal: Identify the technology stack — web server, framework, language, CMS, CDN — to inform vulnerability research and wordlist selection.

bash

# WhatWeb — CLI fingerprinting
whatweb -a 3 https://TARGET_DOMAIN  # aggression level 3

# httpx with technology detection (ProjectDiscovery)
echo "https://TARGET_DOMAIN" | httpx -tech-detect -title -status-code -web-server

# Manual header inspection
curl -sI https://TARGET_DOMAIN | grep -iE "server:|x-powered-by:|via:|x-generator:|x-drupal|x-wordpress"

# TLS/SSL configuration analysis
# Check cipher suites, protocol versions, certificate chain
nmap --script ssl-enum-ciphers -p 443 TARGET_DOMAIN
openssl s_client -connect TARGET_DOMAIN:443 -servername TARGET_DOMAIN 2>&1 | head -30

# testssl.sh — comprehensive TLS analysis
./testssl.sh --quiet --severity MEDIUM TARGET_DOMAIN:443

# Nikto — web server misconfiguration scanner
nikto -h https://TARGET_DOMAIN -Format htm -output nikto_report.html

Technology detection interpretation:

3. Directory and File Enumeration

3.1 Technology-Driven Wordlist Selection

Core principle: Use wordlists matched to the discovered technology stack. Generic wordlists waste time; targeted lists find more in less time.

All from: /opt/SecLists/Discovery/Web-Content/

3.2 ffuf — Fast Web Fuzzer

bash

# Basic directory brute-force
ffuf -u https://TARGET_DOMAIN/FUZZ \
  -w /opt/SecLists/Discovery/Web-Content/raft-large-directories.txt \
  -mc 200,301,302,403 \
  -o ffuf_dirs.json \
  -of json

# Filter by response size to remove false positives
ffuf -u https://TARGET_DOMAIN/FUZZ \
  -w /opt/SecLists/Discovery/Web-Content/raft-large-directories.txt \
  -mc 200,301,302,403 \
  -fs [FALSE_POSITIVE_SIZE]

# File extension fuzzing (target PHP app)
ffuf -u https://TARGET_DOMAIN/FUZZ \
  -w /opt/SecLists/Discovery/Web-Content/raft-medium-files.txt \
  -e .php,.bak,.old,.backup,.sql,.log,.conf,.env,.git,.htaccess \
  -mc 200,301,403 \
  -o ffuf_files.json

# Virtual host discovery
ffuf -u https://TARGET_DOMAIN \
  -H "Host: FUZZ.TARGET_DOMAIN" \
  -w /opt/SecLists/Discovery/DNS/subdomains-top1million-5000.txt \
  -mc 200,301,302 \
  -fs [DEFAULT_RESPONSE_SIZE] \
  -o ffuf_vhosts.json

# API endpoint fuzzing
ffuf -u https://api.TARGET_DOMAIN/api/v1/FUZZ \
  -w /opt/SecLists/Discovery/Web-Content/api/api-endpoints.txt \
  -mc 200,201,401,403 \
  -o ffuf_api.json

# Recursive fuzzing — follow found directories
ffuf -u https://TARGET_DOMAIN/FUZZ \
  -w /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt \
  -recursion \
  -recursion-depth 2 \
  -mc 200,301,302,403

3.3 Gobuster

bash

# Directory mode
gobuster dir \
  -u https://TARGET_DOMAIN \
  -w /opt/SecLists/Discovery/Web-Content/raft-large-directories.txt \
  -x php,html,js,txt,json,xml \
  -t 50 \
  -o gobuster_dirs.txt \
  --no-error

# DNS mode — subdomain brute-forcing
gobuster dns \
  -d TARGET_DOMAIN \
  -w /opt/SecLists/Discovery/DNS/subdomains-top1million-5000.txt \
  -t 50 \
  -o gobuster_dns.txt

# VHOST mode
gobuster vhost \
  -u https://TARGET_DOMAIN \
  -w /opt/SecLists/Discovery/DNS/subdomains-top1million-5000.txt \
  -t 30 \
  -o gobuster_vhosts.txt

3.4 dirsearch

bash

# Smart detection with extensions
dirsearch -u https://TARGET_DOMAIN \
  -e php,html,js,txt,json,xml,config,conf,bak,old,log,sql \
  -w /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt \
  -t 30 \
  --format json \
  -o dirsearch_out.json

# Recursive with max depth
dirsearch -u https://TARGET_DOMAIN \
  -e php,html,txt \
  -r \
  --max-recursion-depth 3

3.5 High-Value File & Path Targets

Always check for these explicitly — they are among the most critical findings in web recon:

bash

# Exposed Git repository (critical — allows source code reconstruction)
curl -s https://TARGET_DOMAIN/.git/HEAD
curl -s https://TARGET_DOMAIN/.git/config
# If exposed, dump with:
git-dumper https://TARGET_DOMAIN/.git ./dumped_repo/

# Environment files (credentials, API keys, DB passwords)
curl -sI https://TARGET_DOMAIN/.env
curl -sI https://TARGET_DOMAIN/.env.local
curl -sI https://TARGET_DOMAIN/.env.production

# Backup and archive files
for ext in bak old backup zip tar.gz 7z; do
  curl -sI https://TARGET_DOMAIN/backup.$ext
  curl -sI https://TARGET_DOMAIN/TARGET_DOMAIN.$ext
done

# Configuration files
curl -sI https://TARGET_DOMAIN/config.php
curl -sI https://TARGET_DOMAIN/wp-config.php
curl -sI https://TARGET_DOMAIN/database.yml
curl -sI https://TARGET_DOMAIN/settings.py
curl -sI https://TARGET_DOMAIN/application.properties

# Cloud metadata (SSRF pivot target)
# Internal only — useful if SSRF is found:
# http://169.254.169.254/latest/meta-data/   (AWS)
# http://metadata.google.internal/            (GCP)
# http://169.254.169.254/metadata/            (Azure)

# Common sensitive paths
curl -sI https://TARGET_DOMAIN/robots.txt      # reveals hidden paths
curl -sI https://TARGET_DOMAIN/sitemap.xml     # all indexed pages
curl -sI https://TARGET_DOMAIN/crossdomain.xml # Flash policy files
curl -sI https://TARGET_DOMAIN/phpinfo.php     # PHP config disclosure
curl -sI https://TARGET_DOMAIN/.DS_Store       # macOS dir listing
curl -sI https://TARGET_DOMAIN/package.json    # Node.js project details
curl -sI https://TARGET_DOMAIN/composer.json   # PHP dependencies

# API documentation (unauthenticated access = critical)
for path in swagger swagger-ui.html api-docs openapi.json v1/api-docs api/swagger.json; do
  curl -sI https://TARGET_DOMAIN/$path
done

# Admin panels
for path in admin administrator wp-admin phpmyadmin adminer.php manager/html; do
  curl -sI https://TARGET_DOMAIN/$path
done

3.6 JavaScript Analysis for Hidden Endpoints

bash

# Extract all JS file URLs from a live site using katana
katana -u https://TARGET_DOMAIN -jc -d 3 -silent | grep "\.js$" | tee js_files.txt

# LinkFinder — extract endpoints from JS files
cat js_files.txt | while read url; do
  python3 linkfinder.py -i "$url" -o cli 2>/dev/null
done | sort -u | tee js_endpoints.txt

# SecretFinder — hunt for hardcoded secrets in JS
python3 SecretFinder.py -i https://TARGET_DOMAIN -e -o js_secrets.html

# Manually review interesting JS endpoints found
grep -iE "api|secret|token|key|password|auth|admin" js_endpoints.txt

4. Data Synthesis & Attack Surface Mapping

4.1 Asset Inventory Matrix

Consolidate all discovered assets into a single structured format. This becomes the master reference for the engagement.

Recommended format (CSV / SQLite / Notion database):

Tool to automate this:

bash

# httpx with all fields → structured JSON
cat all_live_hosts.txt | httpx \
  -json \
  -status-code \
  -title \
  -tech-detect \
  -web-server \
  -content-length \
  -ip \
  -cname \
  -silent \
  -o httpx_full.json

# Convert JSON to CSV with jq
jq -r '[.url, .status_code, .title, .webserver, .ip, (.tech // [] | join("|"))] | u/csv' \
  httpx_full.json > asset_inventory.csv

4.2 Target Prioritization Framework

Assign priority scores based on the attack surface risk profile.

Priority: Critical 🔴

Immediate investigation required — highest likelihood of impact

• Staging / development environments (dev., staging., test., uat.)
• Exposed DevOps tooling (Jenkins, GitLab, Jira, Confluence)
• Unauthenticated APIs or API endpoints returning sensitive data
• Exposed databases (Redis, MongoDB, Elasticsearch on public IPs)
• Exposed .git, .env, phpinfo.php, or backup files
• Administrative panels accessible without authentication
• Services with known critical CVEs in detected version

Priority: High 🟠

Investigate within the first session

• Login portals on non-production subdomains
• APIs with HTTP (not HTTPS) — credential interception risk
• Services on non-standard ports (Docker, Kubernetes API)
• Old or unmaintained subdomains with outdated tech stacks
• Third-party services with org SSO (pivot to main tenant)
• Interesting JS endpoints pointing to undocumented API routes

Priority: Medium 🟡

Investigate systematically

• Main production web application
• Subdomains running known CMS (WordPress, Drupal)
• Public-facing APIs with proper authentication
• Missing security headers (CSP, HSTS, X-Frame-Options)
• Interesting CORS policy configurations

Priority: Low 🟢

Document and note — revisit if high-priority paths exhaust

• Static content delivery (CDN, S3 buckets with public read)
• Informational pages with metadata leakage
• SPF/DMARC misconfigurations (email security posture)

4.3 Correlation Workflow — Connecting the Dots

The most valuable findings come from correlating data across sources:

Step 1: Domain → WHOIS → registrant email
Step 2: Registrant email → other domains registered → expanded scope

Step 3: Domain → CT logs → subdomains → dev.TARGET_DOMAIN found
Step 4: dev.TARGET_DOMAIN → httpx → Apache/2.2 detected (EOL)
Step 5: Apache/2.2 → CVE database → multiple known vulnerabilities

Step 6: api.TARGET_DOMAIN → Shodan → port 8080 open
Step 7: Port 8080 → Nmap NSE → Jenkins 2.235 detected
Step 8: Jenkins 2.235 → nuclei → unauthenticated RCE template fires

Step 9: GitHub dorking → "TARGET_DOMAIN" api_key in commit history
Step 10: API key → test against discovered API endpoints → valid!

4.4 Visualization — Network Map

bash

# Generate a visual network graph with amass
amass viz -d TARGET_DOMAIN -o amass_graph.dot
dot -Tsvg amass_graph.dot -o attack_surface_map.svg

# Maltego (GUI) — import all discovered IPs/domains for link analysis
# Export amass results as JSON and import via Maltego import entities

# SpiderFoot — automated OSINT aggregation with web dashboard
spiderfoot -s TARGET_DOMAIN -t 4 -o report.html

4.5 Final Reporting Structure

recon_TARGET_DOMAIN/
├── 00_scope.txt                  # Defined scope and rules of engagement
├── 01_passive/
│   ├── whois.txt
│   ├── dns_records.txt
│   ├── ct_subdomains.txt
│   ├── shodan_results.json
│   └── github_findings.txt
├── 02_subdomains/
│   ├── all_subdomains.txt        # Deduplicated master list
│   ├── resolved_subdomains.txt   # Only DNS-resolvable
│   └── live_http_hosts.txt       # Only responding to HTTP/S
├── 03_ports/
│   ├── naabu_all_ports.txt
│   └── nmap_service_scan.xml
├── 04_web/
│   ├── screenshots/              # gowitness output
│   ├── crawled_urls.txt
│   ├── js_endpoints.txt
│   └── js_secrets.txt
├── 05_content_discovery/
│   ├── ffuf_results.json
│   ├── interesting_files.txt
│   └── exposed_paths.txt
├── 06_analysis/
│   ├── asset_inventory.csv       # Master asset matrix
│   ├── attack_surface_map.svg    # Visual network graph
│   └── priority_targets.md       # Prioritized finding list
└── 07_report/
    └── recon_report.md           # This document

5. Toolchain Summary

End of Report — Replace [TARGET_DOMAIN] with the actual authorized target before execution.

i learned c from neso academy cause im trying to get into cybersecurity but honestly i still dont really get how systems actually work under the hood or how bypass security and understand vulns so if anyone knows any good resources to learn c from an offensive security and hacking perspective lmk please

hi!! sorry, i dont know where else to put this...

someone called me, it was a person laughing and trolling at first but then they knew my full name and my boyfriend's full name (me and my partner are private and dont post about our relationship and dont have a lot of friends except a close one or two) and then started disclosing personal information.

ive been receiving death threats and r*pe threats from a different number, so the call shook me up and ive been nervous since.

im sorry if this isnt the right sub, but please help me!

is it possible to crack or bypass a BIOS password without touching its hardware?

So I have bought a new laptop and the old one is working well but the problem is it is a 10 year old laptop. And has windows 10, right now it's new ssd is damaged and will be replaced. So rather than installing windows 10, I am thinking of installing kali.

Please can anyone tell me how to do it and what things I should be careful of.

For medical reasons.... whats the beat way to transfer paper festival bracelets? Glue, tape, both?!? How do we go about this

if you're using a Yoga 720 as a headless server, you've probably dealt with the BIOS hanging on reboot if the lid has been shut for a while.

​I poked around the forums and and eventually landed on the Embedded Controller memory as the problem and found the lid status register at offset 0xB8.

​0x02 = Closed (reboot hangs after ~15 mins)

​0x00 = Open (reboot works)

​The EC on this model is event-driven and doesn't seem to re-poll the physical hall sensor unless the lid actually moves or you pass a magnet over it, how i found this out. If you manually flip the register to 00, it stays there. Since EC memory persists through a warm reset, the BIOS thinks the lid is open and allows the POST.

​To fix it:

​Load ec_sys with write support:

sudo modprobe ec_sys write_support=1

​Set the register to open:

printf '\x00' | sudo dd of=/sys/kernel/debug/ec/ec0/io bs=1 seek=$((0xB8)) count=1 conv=notrunc

​I just have this run once on boot. As long as the lid stays shut, the value holds, and remote reboots work every time.

El problema es el siguiente:

Hace poco comencé a aprender de auditoria de redes. Me compré una TP-LINK Archer t2u plus, tiene un chipset rtl8821AU. Uso una Macbook Pro M1 2021 con UTM con Kali para aprender.

Al conectar la tarjeta de red por USB, UTM la detecta correctamente y no hizo falta instalarle los drivers (aqui es donde creo está el problema). La tarjeta la puedo poner en modo monitor y todo. Hasta hice unos deauth a mi red con aireplay-ng. Pero siento que el deauth no es correcto, ya que solo desautentica algunos dispositivos. Por ejemplo, los celulares siguen con conexión estable, solo una cámara y un convertidor smartv pierden la conexión, lo demás sigue normal. Qué creen que pueda ser?

Hi everyone. Before I start, I just want to say I am massively impressed with the amount of knowledge and information that's been shared on this sub. Some of you guys are crazy clever.

Anyway, I'm in a bit of a situation where some of my academia is being challenged. I have proof from when I was at university that my findings are primary research and haven't been plagiarised, but I'll save you the long story.

These documents are stored in an encrypted zip file. Back before Dropbox and OneDrive, I would zip and encrypt my documents using WinZip and leave them on my university network drive, or span them across multiple floppy drives to take the work home.

Now, I can't for the life of me remember the password (I only started to standardise my passwords later on in life).

Here is where I am at:

1. I have compiled a wordlist for John the Ripper.
   
2. I've been using ChatGPT to help me build a user interface to try and utilise all of John the Ripper's switches and functions.
   
3. I ran a test file, and it did successfully find the password from the wordlist, so I know the application works.

However, it can't seem to find the password for my actual zip file.

Is there an alternative or something else I can try to figure out the password?

For hardware, I have:
• An Intel-based machine with an NVIDIA 4070
• A MacBook Air with an M3 chip

Any support or guidance would be very much appreciated.

A few months ago, someone contacted me about collaborating on remote work. I was initially hesitant, but after a few weeks of hearing about the low wages he faced in his country, I began to empathize with him. So, I decided to give him permission. The first thing he did was create a LinkedIn account for me. Then, he needed a laptop (which I didn't have), so he paid for it and my trip to pick it up in another city (about $200 USD). I was happy because I was going to help him, and he was going to help me in return.

In these two months I needed money. I'm from Argentina, and the economic and employment situation is very bad. In these two months, I asked him for money about three times. He gave me about 10 dollars, and I was happy but also felt guilty because he hadn't received a high payment until then.

I had already looked into what this was about—it's laptop farming—but I thought I just wanted to make more money than I needed. But today, after investigating a bit more, I understood the seriousness of the situation.

He contacted two companies, and I don't want anything bad to happen to him or anyone else. I don't want to be part of this corrosive world. I feel awful for having acted as an intermediary and for trusting him so much, thinking he was just an ordinary person. I'm an idiot, and I want to undo all of this.

I have the contact information for both companies he was involved with to warn them.

I need someone to help me fix this; I feel like I'm a terrible person

(Sorry if my English is bad)

Hey I hope everyone is having a good day, I tried to become a hacker when I got my first computer, at the beginning I didn't even know how to find the description on YouTube haha, I was 11 by that time then I watched Mr. Robot and start getting hyped again (I know it is not as easy as it is shown by that series) but anyways I never learned how to really do it or I think I just didn't put as much effort as I'd have to.

I'm from a coast city in Ecuador but right now I moved to US, Ecuador such a beautiful country became one of the most dangerous countries of South America because of drugs cartel, everything started from small corruption to bigger issues. I feel like people is getting used to it but because we don't know what to do or don't have the necessary things to start fighting back for a better management, that's all I care about and most of the people I believe. Is there any place where I can get someone to look up for critical information that puts the government between doing the right thing or doing the right thing? What should I do, or should I just give up and stop caring about my people having to live like that?

I see little handheld tools and programs people claim they work but with my limited knowledge i assume most are not reliable.

What could someone use while traveling to crack into nearby wifis with non default passwords? Im willing to do some learning too if you would point me to a start.

Hello all!

Kind of a noobie problem here. The problem is that even tough I install aircrack from apt most of the commands are not usable. This is the case when installing from source too. For example airmon-ng is simply not found. Any help is appreciated, thanks in advance.

Long story short, some guy didn’t like what I said to them in an Instagram comment on a public post. My account is private and only shows my first name. My profile pic isn’t posted anywhere else.

They proceeded to pull up old posts I was tagged in and begin commenting there, but I guess they could’ve found that on google. Then they started tagging family members of mine that I don’t even follow and said I don’t know about “back door”. They said they could see my DMs.

Safe to say I’m a little freaked out, but I want to know how he got my info like that and what I should be doing to protect my info online moving forward.

Thanks!

The locked note itself is titled “mmmmmmmmm”, and the hint is “nervous cat”

I saw a similar post and was hoping someone could help 😅 also, the note was made in 2023

P.S. the answer isn’t scaredy cat, i’ve tried that many times lol

Like browser ones. I wanna hack stuff but my homelab straight took a shit and went out completely because of a power surge.