UNDERCODE COMMUNITY

🦑 Tool: DirBuster - Directory and File Bruteforcing

DirBuster is a multi-threaded Java application used to brute-force directories and files on web servers. It's typically used to find hidden resources that might expose vulnerabilities in web applications.

---

### Basic Usage Command:

java -jar dirbuster.jar -u http://example.com -l /path/to/wordlist.txt

Explanation:
- java -jar dirbuster.jar: Runs the DirBuster Java application.
- -u http://example.com: Specifies the target URL to scan.
- -l /path/to/wordlist.txt: Specifies the path to the wordlist containing potential directory and file names.

---

### Example: Specifying a Custom HTTP Port

java -jar dirbuster.jar -u http://example.com:8080 -l /path/to/wordlist.txt

Explanation:
- http://example.com:8080: Scans a target on a specific port (8080 in this case), useful if the web server is running on a non-standard port.

---

### Example: Brute Forcing with Multiple Threads

java -jar dirbuster.jar -u http://example.com -l /path/to/wordlist.txt -t 50

Explanation:
- -t 50: Specifies 50 concurrent threads to speed up the brute-forcing process.

---

### Example: Saving Results to a File

java -jar dirbuster.jar -u http://example.com -l /path/to/wordlist.txt -o /path/to/output.txt

Explanation:
- -o /path/to/output.txt: Saves the scan results to the specified output file (output.txt).

---

### Example: Using a Proxy

java -jar dirbuster.jar -u http://example.com -l /path/to/wordlist.txt -p 127.0.0.1:8080

Explanation:
- -p 127.0.0.1:8080: Routes traffic through a proxy server (useful for anonymizing the scan or debugging).

---

### Important Notes:
1. DirBuster is a powerful tool for penetration testers looking to discover hidden files and directories on a target.
2. Always ensure you have proper authorization to scan the target server, as unauthorized brute-forcing is illegal and unethical.

5 viewsUNDERCODER, 15:24

UNDERCODE COMMUNITY

Forwarded from Exploiting Crew (Pr1vAt3)

🦑 Tool: Wfuzz - Web Application Fuzzing Tool

Wfuzz is a web application vulnerability scanner used to perform fuzzing attacks. It is commonly used for brute-forcing web applications to find hidden directories, files, and parameters that could be vulnerable to attacks like SQL injection or file inclusion.

---

### Basic Usage Command:

wfuzz -c -z file,/path/to/wordlist.txt -u http://example.com/FUZZ

Explanation:
- wfuzz: Runs the Wfuzz tool.
- -c: Enables colorized output for easier reading of results.
- -z file,/path/to/wordlist.txt: Specifies a wordlist for fuzzing.
- -u http://example.com/FUZZ: The target URL where FUZZ is the placeholder for words in the wordlist to be tested.

---

### Example: Fuzzing Multiple Parameters

wfuzz -c -z file,/path/to/wordlist.txt -u http://example.com/page.php?id=FUZZ&user=admin

Explanation:
- id=FUZZ&user=admin: Fuzzes the id parameter while keeping the user parameter fixed.

---

### Example: Fuzzing HTTP Headers

wfuzz -c -z file,/path/to/wordlist.txt -H "X-Secret: FUZZ" http://example.com

Explanation:
- -H "X-Secret: FUZZ": Fuzzes a custom HTTP header (X-Secret) by injecting different words from the wordlist.

---

### Example: Using a Proxy for Traffic

wfuzz -c -z file,/path/to/wordlist.txt -u http://example.com/FUZZ --proxy http://127.0.0.1:8080

Explanation:
- --proxy http://127.0.0.1:8080: Routes the fuzzing traffic through a proxy for anonymity or to capture the traffic.

---

### Example: Brute Force Directories

wfuzz -c -z dir,/path/to/dirlist.txt -u http://example.com/FUZZ

Explanation:
- -z dir,/path/to/dirlist.txt: Fuzzes directory names from the specified wordlist to discover hidden directories on the server.

---

### Example: Fuzzing with Recursive Mode

wfuzz -c -z file,/path/to/wordlist.txt -u http://example.com/FUZZ -r

Explanation:
- -r: Enables recursive fuzzing, where Wfuzz continues fuzzing on discovered directories or files.

---

### Important Notes:
1. Wfuzz is highly effective for brute-forcing hidden parameters and files in web applications.
2. Always obtain explicit permission to perform fuzzing and penetration tests, as unauthorized scanning can be illegal.

11 viewsUNDERCODER, 15:25

UNDERCODE COMMUNITY

Forwarded from DailyCVE

🔴 #GitHub CLI Vulnerability: Path Traversal via Malicious Workflow Artifact (#CVE-TBD) (Critical)

https://dailycve.com/github-cli-vulnerability-path-traversal-via-malicious-workflow-artifact-cve-tbd-critical/

@daily_cve

DailyCVE

GitHub CLI Vulnerability: Path Traversal via Malicious Workflow Artifact (CVE-TBD) (Critical) - DailyCVE

2024-12-04 Platform: GitHub CLI Version: Prior to 2.63.1 Vulnerability: Path Traversal Severity: Critical Date: November 2024 (estimated) What Undercode Says: […]

12 viewsDC, 15:40

✨ Continue Reading 🦑 Main Channel

UNDERCODE COMMUNITY

Forwarded from DailyCVE

🔴 CyberPanel, Command Injection Vulnerability, #CVE-2024-51378 (Critical)

https://dailycve.com/cyberpanel-command-injection-vulnerability-cve-2024-51378-critical/

@daily_cve