If you are using an ARM Processor, you will need to add the --arm flag to all Install/Run scripts ./run.sh --arm
Core Modules The Ars0n Framework's Core Modules are used to determine the basic scanning logic. Each script is designed to support a specific recon methodology based on what the user is trying to accomplish. Wildfire At this time, the Wildfire script is the most widely used Core Module in the Ars0n Framework. The purpose of this module is to allow the user to scan multiple targets that allow for testing on any subdomain discovered by the researcher. How it works: The user adds root domains through the Graphical User Interface (GUI) that they wish to scan for hidden subdomains Wildfire sorts each of these domains based on the last time they were scanned to ensure the domain with the oldest data is scanned first Wildfire scans each of the domains using the Sub-Modules based on the flags provided by the user. Most Wildfire scans take between 8 and 48 hours to complete against a single domain if all Sub-Modules are being run. Variations in this timing can be caused by a number of factors, including the target application and the machine running the framework. Also, please note that most data will not show in the GUI until the scan has completed. It's best to try and run the scan overnight or over a weekend, depending on the number of domains being scanned, and return once the scan has complete to move from Recon to Enumeration (https://www.kitploit.com/search/label/Enumeration). Running Wildfire: Graphical User Interface (GUI) Wildfire can be run from the GUI using the Wildfire button on the dashboard. Once clicked, the front-end will use the checkboxes on the screen to determine what flags should be passed to the scanner. Please note that running scans from the GUI still has a few bugs and edge cases that haven't been sorted out. If you have any issues, you can simply run the scan form the CLI. Command Line Interface (CLI) All Core Modules for The Ars0n Framework are stored in the /toolkit directory. Simply navigate to the directory and run wildfire.py with the necessary flags. At least one Sub-Module flag must be provided. python3 wildfire.py --start --cloud --scan
Slowburn Unlike the Wildfire module, which requires the user to identify target domains to scan, the Slowburn module does that work for you. By communicating with APIs for various bug bounty hunting platforms, this script will identify all domains that allow for testing on any discovered subdomain. Once the data has been populated, Slowburn will randomly choose one domain at a time to scan in the same way Wildfire does. Please note that the Slowburn module is still in development and is not considered part of the stable alpha release. There will likely be bugs and edge cases encountered by the user. In order for Slowburn to identify targets to scan, it must first be initialized. This initialization step collects the necessary data from various API's and deposits them into a JSON file stored locally. Once this initialization step is complete, Slowburn will automatically begin selecting and scanning one target at a time. To initalize Slowburn, simply run the following command: python3 slowburn.py --initialize
Once the data has been collected, it is up to the user whether they want to re-initialize the tool upon the next scan. Remember that the scope and targets on public bug bounty programs can change frequently. If you choose to run Slowburn without initializing the data, you may be scanning domains that are no longer in scope for the program. It is strongly recommended that Slowburn be re-initialized each time before running. If you choose not to re-initialize the target data, you can run Slowburn using the previously collected data with the following command: python3 slowburn.py
Core Modules The Ars0n Framework's Core Modules are used to determine the basic scanning logic. Each script is designed to support a specific recon methodology based on what the user is trying to accomplish. Wildfire At this time, the Wildfire script is the most widely used Core Module in the Ars0n Framework. The purpose of this module is to allow the user to scan multiple targets that allow for testing on any subdomain discovered by the researcher. How it works: The user adds root domains through the Graphical User Interface (GUI) that they wish to scan for hidden subdomains Wildfire sorts each of these domains based on the last time they were scanned to ensure the domain with the oldest data is scanned first Wildfire scans each of the domains using the Sub-Modules based on the flags provided by the user. Most Wildfire scans take between 8 and 48 hours to complete against a single domain if all Sub-Modules are being run. Variations in this timing can be caused by a number of factors, including the target application and the machine running the framework. Also, please note that most data will not show in the GUI until the scan has completed. It's best to try and run the scan overnight or over a weekend, depending on the number of domains being scanned, and return once the scan has complete to move from Recon to Enumeration (https://www.kitploit.com/search/label/Enumeration). Running Wildfire: Graphical User Interface (GUI) Wildfire can be run from the GUI using the Wildfire button on the dashboard. Once clicked, the front-end will use the checkboxes on the screen to determine what flags should be passed to the scanner. Please note that running scans from the GUI still has a few bugs and edge cases that haven't been sorted out. If you have any issues, you can simply run the scan form the CLI. Command Line Interface (CLI) All Core Modules for The Ars0n Framework are stored in the /toolkit directory. Simply navigate to the directory and run wildfire.py with the necessary flags. At least one Sub-Module flag must be provided. python3 wildfire.py --start --cloud --scan
Slowburn Unlike the Wildfire module, which requires the user to identify target domains to scan, the Slowburn module does that work for you. By communicating with APIs for various bug bounty hunting platforms, this script will identify all domains that allow for testing on any discovered subdomain. Once the data has been populated, Slowburn will randomly choose one domain at a time to scan in the same way Wildfire does. Please note that the Slowburn module is still in development and is not considered part of the stable alpha release. There will likely be bugs and edge cases encountered by the user. In order for Slowburn to identify targets to scan, it must first be initialized. This initialization step collects the necessary data from various API's and deposits them into a JSON file stored locally. Once this initialization step is complete, Slowburn will automatically begin selecting and scanning one target at a time. To initalize Slowburn, simply run the following command: python3 slowburn.py --initialize
Once the data has been collected, it is up to the user whether they want to re-initialize the tool upon the next scan. Remember that the scope and targets on public bug bounty programs can change frequently. If you choose to run Slowburn without initializing the data, you may be scanning domains that are no longer in scope for the program. It is strongly recommended that Slowburn be re-initialized each time before running. If you choose not to re-initialize the target data, you can run Slowburn using the previously collected data with the following command: python3 slowburn.py
Sub-Modules The Ars0n Framework's Sub-Modules are designed to be leveraged by the Core Modules to divide the Recon & Enumeration phases into specific tasks. The data collected in each Sub-Module is used by the others to expand your picture of the target's attack surface. Fire-Starter Fire-Starter is the first step to performing recon against a target domain. The goal of this script is to collect a wealth of information about the attack surface of your target. Once collected, this data will be used by all other Sub-Modules to help the user identify a specific URL that is potentially vulnerable. Fire-Starter works by running a series of open-source tools to enumerate hidden subdomains, DNS records, and the ASN's to identify where those external entries are hosted. Currently, Fire-Starter works by chaining together the following widely used open-source tools: Amass Sublist3r Assetfinder Get All URL's (GAU) Certificate Transparency Logs (CRT) Subfinder ShuffleDNS GoSpider Subdomainizer These tools cover a wide range of techniques to identify hidden subdomains, including web scraping, brute force, and crawling to identify links and JavaScript (https://www.kitploit.com/search/label/JavaScript) URLs. Once the scan is complete, the Dashboard will be updated and available to the user. Most Sub-Modules in The Ars0n Framework requre the data collected from the Fire-Starter module to work. With this in mind, Fire-Starter must be included in the first scan against a target for any usable data to be collected. Fire-Cloud Coming soon... Fire-Scanner Fire-Scanner uses the results of Fire-Starter and Fire-Cloud to perform Wide-Band Scanning (https://www.linkedin.com/feed/update/urn:li:activity:6849314055283466240/) against all subdomains and cloud services that have been discovered from previous scans. At this stage of development, this script leverages Nuclei (https://github.com/projectdiscovery/nuclei) almost exclusively for all scanning. Instead of simply running the tool, Fire-Scanner breaks the scan down into specific collections of Nuclei Templates (https://github.com/projectdiscovery/nuclei-templates) and scans them one by one. This strategy helps ensure the scans are stable and produce consistent results, removes any unnecessary or unsafe scan checks, and produces actionable results. Troubleshooting The vast majority of issues installing and/or running the Ars0n Framework are caused by not installing the tool on a clean installation of Kali Linux. It is important to remember that, at its core, the Ars0n Framework is a collection of automation scripts designed to run existing open-source tools. Each of these tools have their own ways of operating and can experience unexpected behavior if conflicts emerge with any existing service/tool running on the user's system. This complexity is the reason why running The Ars0n Framework should only be run on a clean installation of Kali Linux. Another very common issue users experience is caused by MongoDB not successfully installing and/or running on their machine. The most common manifestation of this issue is the user is unable to add an initial FQDN and simply sees a broken GUI. If this occurs, please ensure that your machine has the necessary system requirements to run MongoDB. Unfortunately, there is no current solution if you run into this issue. Frequently Asked Questions Coming soon...
Download Ars0N-Framework (https://github.com/R-s0n/ars0n-framework)
Download Ars0N-Framework (https://github.com/R-s0n/ars0n-framework)
OSCP Review
A look back at the road to obtaining the Offensive Security Certified Professional, having had some time to recover!Continue reading on Medium »
Read more...
A look back at the road to obtaining the Offensive Security Certified Professional, having had some time to recover!Continue reading on Medium »
Read more...
Medium
OSCP Review
A look back at the road to obtaining the Offensive Security Certified Professional, having had some time to recover!
A look back at the road to obtaining the Offensive Security Certified Professional, having had some time to recover!Continue reading on Medium » (https://medium.com/@nosignalrightnow/oscp-review-3a9568bf9c5d?source=rss------bug_bounty-5)
IDOR Exploit: A Tale of Account Takeover
https://danial1337.medium.com/idor-exploit-a-tale-of-account-takeover-51ab2c47c246?source=rss------bug_bounty-5
Introduction:Continue reading on Medium » (https://danial1337.medium.com/idor-exploit-a-tale-of-account-takeover-51ab2c47c246?source=rss------bug_bounty-5)
https://danial1337.medium.com/idor-exploit-a-tale-of-account-takeover-51ab2c47c246?source=rss------bug_bounty-5
Introduction:Continue reading on Medium » (https://danial1337.medium.com/idor-exploit-a-tale-of-account-takeover-51ab2c47c246?source=rss------bug_bounty-5)
How I Found a Vulnerability in Apple: A Journey of Discovery and Impact
Imagine uncovering a flaw in one of the world’s most secure tech ecosystems. That’s exactly what happened to me. I’m Husnain Suleman, a…Continue reading on Medium »
Read more...
Imagine uncovering a flaw in one of the world’s most secure tech ecosystems. That’s exactly what happened to me. I’m Husnain Suleman, a…Continue reading on Medium »
Read more...
Medium
How I Found a Vulnerability in Apple: A Journey of Discovery and Impact
Imagine uncovering a flaw in one of the world’s most secure tech ecosystems. That’s exactly what happened to me. I’m Husnain Suleman, a…
CVE-2024–24919: Zero-Day Vulnerability leads to unauthorized Information Disclosure in Checkpoint
Check Point has issued a urgent warning regarding a zero-day vulnerability discovered in its Network Security gateway products. This…Continue reading on Medium »
Read more...
Check Point has issued a urgent warning regarding a zero-day vulnerability discovered in its Network Security gateway products. This…Continue reading on Medium »
Read more...
Medium
CVE-2024–24919: Zero-Day Vulnerability leads to unauthorized Information Disclosure in Checkpoint
Check Point has issued a urgent warning regarding a zero-day vulnerability discovered in its Network Security gateway products. This…
How I Found a Vulnerability in Apple: A Journey of Discovery and Impact
https://medium.com/@husnainsuleman/how-i-found-a-vulnerability-in-apple-a-journey-of-discovery-and-impact-0e55f14eef75?source=rss------bug_bounty-5
https://medium.com/@husnainsuleman/how-i-found-a-vulnerability-in-apple-a-journey-of-discovery-and-impact-0e55f14eef75?source=rss------bug_bounty-5
Imagine uncovering a flaw in one of the world’s most secure tech ecosystems. That’s exactly what happened to me. I’m Husnain Suleman, a…Continue reading on Medium » (https://medium.com/@husnainsuleman/how-i-found-a-vulnerability-in-apple-a-journey-of-discovery-and-impact-0e55f14eef75?source=rss------bug_bounty-5)
CVE-2024–24919: Zero-Day Vulnerability leads to unauthorized Information Disclosure in Checkpoint
https://codewithvamp.medium.com/cve-2024-24919-zero-day-vulnerability-leads-to-unauthorized-information-disclosure-in-checkpoint-97873b47d160?source=rss------bug_bounty-5
https://codewithvamp.medium.com/cve-2024-24919-zero-day-vulnerability-leads-to-unauthorized-information-disclosure-in-checkpoint-97873b47d160?source=rss------bug_bounty-5
Check Point has issued a urgent warning regarding a zero-day vulnerability discovered in its Network Security gateway products. This…Continue reading on Medium » (https://codewithvamp.medium.com/cve-2024-24919-zero-day-vulnerability-leads-to-unauthorized-information-disclosure-in-checkpoint-97873b47d160?source=rss------bug_bounty-5)
Advanced Web Cache Poisoning
In my recent blog post, I briefly explained the concept of a web cache poisoning (WCP) attack.Continue reading on Medium »
Read more...
In my recent blog post, I briefly explained the concept of a web cache poisoning (WCP) attack.Continue reading on Medium »
Read more...
Medium
Advanced Web Cache Poisoning
In my recent blog post, I briefly explained the concept of a web cache poisoning (WCP) attack. In this entry, we will delve deeper into how…
Advanced Web Cache Poisoning
https://medium.com/@majix_de/advanced-web-cache-poisoning-e6e17d5290ce?source=rss------bug_bounty-5
https://medium.com/@majix_de/advanced-web-cache-poisoning-e6e17d5290ce?source=rss------bug_bounty-5
In my recent blog post, I briefly explained the concept of a web cache poisoning (WCP) attack.Continue reading on Medium » (https://medium.com/@majix_de/advanced-web-cache-poisoning-e6e17d5290ce?source=rss------bug_bounty-5)
كيفية استخدام أداة ParamSpider — لبرنامج الجوائز الأمنية (Bug Bounty)
https://gentilsecurity.medium.com/%D9%83%D9%8A%D9%81%D9%8A%D8%A9-%D8%A7%D8%B3%D8%AA%D8%AE%D8%AF%D8%A7%D9%85-%D8%A3%D8%AF%D8%A7%D8%A9-paramspider-%D9%84%D8%A8%D8%B1%D9%86%D8%A7%D9%85%D8%AC-%D8%A7%D9%84%D8%AC%D9%88%D8%A7%D8%A6%D8%B2-%D8%A7%D9%84%D8%A3%D9%85%D9%86%D9%8A%D8%A9-bug-bounty-c1361d476c4a?source=rss------bug_bounty-5
https://gentilsecurity.medium.com/%D9%83%D9%8A%D9%81%D9%8A%D8%A9-%D8%A7%D8%B3%D8%AA%D8%AE%D8%AF%D8%A7%D9%85-%D8%A3%D8%AF%D8%A7%D8%A9-paramspider-%D9%84%D8%A8%D8%B1%D9%86%D8%A7%D9%85%D8%AC-%D8%A7%D9%84%D8%AC%D9%88%D8%A7%D8%A6%D8%B2-%D8%A7%D9%84%D8%A3%D9%85%D9%86%D9%8A%D8%A9-bug-bounty-c1361d476c4a?source=rss------bug_bounty-5