Scans web applications for second-order subdomain takeover (https://www.kitploit.com/search/label/Subdomain%20Takeover) by crawling (https://www.kitploit.com/search/label/Crawling) the app, and collecting URLs (and other data) that match certain rules, or respond in a certain way.
Installation From binary Download a prebuilt binary from the releases page (https://github.com/mhmdiaa/second-order/releases/latest) and unzip it. From source Go version 1.17 is recommended. go install -v github.com/mhmdiaa/second-order@latest
Docker docker pull mhmdiaa/second-order
Command line options Directory to save results in (default "output") -threads int Number of threads (default 10)"> -target string
Target URL
-config string
Configuration file (default "config.json")
-depth int
Depth to crawl (default 1)
-header value
Header name and value separated by a colon 'Name: Value' (can be used more than once)
-insecure
Accept untrusted SSL/TLS certificates
-output string
Directory to save results in (default "output")
-threads int
Number of threads (default 10)
Configuration File Example configuration files are in config (https://github.com/mhmdiaa/second-order/blob/master/config) LogQueries: A map of tag-attribute queries that will be searched for in crawled pages. For example, "a": "href" means log every href attribute of every a tag. LogNon200Queries: A map of tag-attribute queries that will be searched for in crawled pages, and logged only if they contain a valid URL that doesn't return a 200 status code. LogInline: A list of tags whose inline content (between the opening and closing tags) will be logged, like title and script Output All results are saved in JSON files that specify what and where data was found The results of LogQueries are saved in attributes.json {
"https://example.com/": {
"input[name]": [
"user",
"id",
"debug"
]
}
}
The results of LogNon200Queries are saved in non-200-url-attributes.json {
"https://example.com/": {
"script[src]": [
"https://cdn.old_abandoned_domain.com/app.js",
]
}
}
The results of LogInline are saved in inline.json {
"https://example.com/": {
"title": [
"Example - Home"
]
},
"https://example.com/login": {
"title": [
"Example - login"
]
}
}
Usage Ideas This is a list of tips and ideas (not necessarily related to second-order subdomain (https://www.kitploit.com/search/label/Subdomain) takeover) on what to use Second Order for. Check for second-order subdomain takeover: takeover.json (https://github.com/mhmdiaa/second-order/blob/master/config/takeover.json). (Duh!) Collect inline and imported JS code: javascript.json (https://github.com/mhmdiaa/second-order/blob/master/config/javascript.json). Find where a target hosts static files cdn.json (https://github.com/mhmdiaa/second-order/blob/master/config/cdn.json). (S3 buckets, anyone?) Collect names to build a tailored parameter bruteforcing (https://www.kitploit.com/search/label/Bruteforcing) wordlist: parameters.json (https://github.com/mhmdiaa/second-order/blob/master/config/parameters.json). Feel free to contribute more ideas! References https://shubs.io/high-frequency-security-bug-hunting-120-days-120-bugs/#secondorder https://edoverflow.com/2017/broken-link-hijacking/
Download Second-Order (https://github.com/mhmdiaa/second-order)
___________________________
@hacking_Attack
@Hacking_Video
Installation From binary Download a prebuilt binary from the releases page (https://github.com/mhmdiaa/second-order/releases/latest) and unzip it. From source Go version 1.17 is recommended. go install -v github.com/mhmdiaa/second-order@latest
Docker docker pull mhmdiaa/second-order
Command line options Directory to save results in (default "output") -threads int Number of threads (default 10)"> -target string
Target URL
-config string
Configuration file (default "config.json")
-depth int
Depth to crawl (default 1)
-header value
Header name and value separated by a colon 'Name: Value' (can be used more than once)
-insecure
Accept untrusted SSL/TLS certificates
-output string
Directory to save results in (default "output")
-threads int
Number of threads (default 10)
Configuration File Example configuration files are in config (https://github.com/mhmdiaa/second-order/blob/master/config) LogQueries: A map of tag-attribute queries that will be searched for in crawled pages. For example, "a": "href" means log every href attribute of every a tag. LogNon200Queries: A map of tag-attribute queries that will be searched for in crawled pages, and logged only if they contain a valid URL that doesn't return a 200 status code. LogInline: A list of tags whose inline content (between the opening and closing tags) will be logged, like title and script Output All results are saved in JSON files that specify what and where data was found The results of LogQueries are saved in attributes.json {
"https://example.com/": {
"input[name]": [
"user",
"id",
"debug"
]
}
}
The results of LogNon200Queries are saved in non-200-url-attributes.json {
"https://example.com/": {
"script[src]": [
"https://cdn.old_abandoned_domain.com/app.js",
]
}
}
The results of LogInline are saved in inline.json {
"https://example.com/": {
"title": [
"Example - Home"
]
},
"https://example.com/login": {
"title": [
"Example - login"
]
}
}
Usage Ideas This is a list of tips and ideas (not necessarily related to second-order subdomain (https://www.kitploit.com/search/label/Subdomain) takeover) on what to use Second Order for. Check for second-order subdomain takeover: takeover.json (https://github.com/mhmdiaa/second-order/blob/master/config/takeover.json). (Duh!) Collect inline and imported JS code: javascript.json (https://github.com/mhmdiaa/second-order/blob/master/config/javascript.json). Find where a target hosts static files cdn.json (https://github.com/mhmdiaa/second-order/blob/master/config/cdn.json). (S3 buckets, anyone?) Collect names to build a tailored parameter bruteforcing (https://www.kitploit.com/search/label/Bruteforcing) wordlist: parameters.json (https://github.com/mhmdiaa/second-order/blob/master/config/parameters.json). Feel free to contribute more ideas! References https://shubs.io/high-frequency-security-bug-hunting-120-days-120-bugs/#secondorder https://edoverflow.com/2017/broken-link-hijacking/
Download Second-Order (https://github.com/mhmdiaa/second-order)
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles|Raj Chandel's Blog
Corrosion: 2 VulnHub Walkthrough
Proxy Programmer's Corrosion: 2 is a Vulnhub medium machine. We can download the lab from here. This lab is designed for experienced CTF players who want to put their abilities to the test in a variety of situations. So, let's get started and see how we can split things down into smaller chunks. Pentest Methodology● netdiscover● nmap● dirb● fcrackzip● metasploit● /etc/shadow● john● ssh● python library hijacking● root flagTo begin, we must use the netdiscovercommand to scan the network for the target machine's IP address.netdiscoverThe victim's IP address in this case is 192.168.1.186.Nmapto help us move this process along. To see all of the services stated, we need to know which ones are now available.nmap -sV 192.168.1.186According to the nmap output, we have: EnumerationLet's begin by looking at the http service on port 80. There's nothing strange about that; it's just an Apache server page.https://blogger.googleusercontent.com/img/a/AVvXsEj54r-dtA2Td_EreVBny2CnBsqg297VfT88nOhnFmg8CJirwXme8CkHlvtf9Q6mfDTbMAkajh6wNryxyw_eEE6fZTz2rHTC6GOHQ56AnElwXg3auNh8NBw4u7vPpmGpSVx_MstpZgd0WfPykQ0niRWjC7TBGkyyuEw9Z03lW15eJarU_B1iAT74Ikt0cg=s16000 Next, we looked at the Tomcat server, which was listening on port 8080. It's a straightforward page with nothing suspicious on it.dirb directory brute force method to find some knowledge. Smash!! We discovered a directory containing abackup zip file.dirb http://192.168.1.186:8080/ -X .php,.ziphttps://blogger.googleusercontent.com/img/a/AVvXsEivYUcRnvTmVMoAefYSQDiTk8ObWNULLNYpj3evT59FuIoO39u2GOqtfpypZ8-jv676-H0X2UxmF7EgkYr3MtNPplBZlwye3F405YGP522yoZPMV0x8462KI5de3jiyiEMLwb5LE-fmhvMc_sq28uA_qki39HqOKIXOofn_eiFBICTC08GFWfSYJQVQlA=s16000 The backup zip fileis then downloaded using the wget command. Following that, we attempted to study this file, but it was password protected.wget http://192.168.1.186:8080/backup.ziphttps://blogger.googleusercontent.com/img/a/AVvXsEgM1XNQw9_EzbADCJTb-wlaBJEoQisGsd3EeAY1cBkKj1i2ajrzdytKfXAruWt_CGAiN5V69FQ86WmEUwrxmxDhIZhwn1X9ky52RWBf2PUa_MvNsnLb_9TExlMPwc-g19QJI6Ized9Hg9DVa_MWHLr2yjWk8xWWWCHDYVH4f6t0alPwsRoQ3-qR3SjJDQ=s16000 Next, we'll use the fcrackziputility to crack this pass[...]
___________________________
@hacking_Attack
@Hacking_Video
Corrosion: 2 VulnHub Walkthrough
Proxy Programmer's Corrosion: 2 is a Vulnhub medium machine. We can download the lab from here. This lab is designed for experienced CTF players who want to put their abilities to the test in a variety of situations. So, let's get started and see how we can split things down into smaller chunks. Pentest Methodology● netdiscover● nmap● dirb● fcrackzip● metasploit● /etc/shadow● john● ssh● python library hijacking● root flagTo begin, we must use the netdiscovercommand to scan the network for the target machine's IP address.netdiscoverThe victim's IP address in this case is 192.168.1.186.Nmapto help us move this process along. To see all of the services stated, we need to know which ones are now available.nmap -sV 192.168.1.186According to the nmap output, we have: EnumerationLet's begin by looking at the http service on port 80. There's nothing strange about that; it's just an Apache server page.https://blogger.googleusercontent.com/img/a/AVvXsEj54r-dtA2Td_EreVBny2CnBsqg297VfT88nOhnFmg8CJirwXme8CkHlvtf9Q6mfDTbMAkajh6wNryxyw_eEE6fZTz2rHTC6GOHQ56AnElwXg3auNh8NBw4u7vPpmGpSVx_MstpZgd0WfPykQ0niRWjC7TBGkyyuEw9Z03lW15eJarU_B1iAT74Ikt0cg=s16000 Next, we looked at the Tomcat server, which was listening on port 8080. It's a straightforward page with nothing suspicious on it.dirb directory brute force method to find some knowledge. Smash!! We discovered a directory containing abackup zip file.dirb http://192.168.1.186:8080/ -X .php,.ziphttps://blogger.googleusercontent.com/img/a/AVvXsEivYUcRnvTmVMoAefYSQDiTk8ObWNULLNYpj3evT59FuIoO39u2GOqtfpypZ8-jv676-H0X2UxmF7EgkYr3MtNPplBZlwye3F405YGP522yoZPMV0x8462KI5de3jiyiEMLwb5LE-fmhvMc_sq28uA_qki39HqOKIXOofn_eiFBICTC08GFWfSYJQVQlA=s16000 The backup zip fileis then downloaded using the wget command. Following that, we attempted to study this file, but it was password protected.wget http://192.168.1.186:8080/backup.ziphttps://blogger.googleusercontent.com/img/a/AVvXsEgM1XNQw9_EzbADCJTb-wlaBJEoQisGsd3EeAY1cBkKj1i2ajrzdytKfXAruWt_CGAiN5V69FQ86WmEUwrxmxDhIZhwn1X9ky52RWBf2PUa_MvNsnLb_9TExlMPwc-g19QJI6Ized9Hg9DVa_MWHLr2yjWk8xWWWCHDYVH4f6t0alPwsRoQ3-qR3SjJDQ=s16000 Next, we'll use the fcrackziputility to crack this pass[...]
___________________________
@hacking_Attack
@Hacking_Video
Blogspot
Corrosion: 2 VulnHub Walkthrough
Hacking Articles is a very interesting blog about information security, penetration testing and vulnerability assessment managed by Raj Chandel.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles|Raj Chandel's Blog
Intelligence HacktheBox Walkthrough
IntroductionIntelligence is a CTF Windows box with difficulty rated as “medium” on the HackTheBox platform. The machine covers OSINT, AD attacks, and silver ticket for privilege escalation.Table of ContentEnumerationsvc_int$ExploitationPrivilege EscalationNetwork ScanningThe dedicated IP address of the machine is 10.129.163.131. We’ll run a nmap scan on this machine’s IP.nmap -sV -p- 10.129.163.131We found many ports open; 53 - DNS, 80 - HTTP and 445- SMB caught our eye.EnumerationImmediately headed over to SMB and tried listing shares without password but it was not fruitful.echo "Jose.Williams" > usernames> usernames usernames ___________________________
@hacking_Attack
@Hacking_Video
Intelligence HacktheBox Walkthrough
IntroductionIntelligence is a CTF Windows box with difficulty rated as “medium” on the HackTheBox platform. The machine covers OSINT, AD attacks, and silver ticket for privilege escalation.Table of ContentEnumerationsvc_int$ExploitationPrivilege EscalationNetwork ScanningThe dedicated IP address of the machine is 10.129.163.131. We’ll run a nmap scan on this machine’s IP.nmap -sV -p- 10.129.163.131We found many ports open; 53 - DNS, 80 - HTTP and 445- SMB caught our eye.EnumerationImmediately headed over to SMB and tried listing shares without password but it was not fruitful.echo "Jose.Williams" > usernames> usernames usernames ___________________________
@hacking_Attack
@Hacking_Video
Blogspot
Intelligence HacktheBox Walkthrough
Hacking Articles is a very interesting blog about information security, penetration testing and vulnerability assessment managed by Raj Chandel.
Hacking Articles|Raj Chandel's Blog
Corrosion: 2 VulnHub Walkthrough
___________________________
@hacking_Attack
@Hacking_Video
Corrosion: 2 VulnHub Walkthrough
___________________________
@hacking_Attack
@Hacking_Video
Blogspot
Corrosion: 2 VulnHub Walkthrough
Hacking Articles is a very interesting blog about information security, penetration testing and vulnerability assessment managed by Raj Chandel.
Hacking Articles|Raj Chandel's Blog
Intelligence HacktheBox Walkthrough
___________________________
@hacking_Attack
@Hacking_Video
Intelligence HacktheBox Walkthrough
___________________________
@hacking_Attack
@Hacking_Video
Blogspot
Intelligence HacktheBox Walkthrough
Hacking Articles is a very interesting blog about information security, penetration testing and vulnerability assessment managed by Raj Chandel.
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
Second-Order - Subdomain Takeover Scanner
https://blogger.googleusercontent.com/img/a/AVvXsEgz5g4s_jFchyq-aXIg1HOkqs2KHEkl8dNtPx0IBlI7cROTelnD1UPIa5GnaRLCQht5nfD0JMAu9JY2FWtfgn87FKTsyOtDjNPWRhIVZRHVqb35zEDS4WGH9iVHPvMwnnB7OPZQP6KhVAlxndCacjUcM69Cq-FABIfNVQdzUcXTXJOocEbYUXsEDu7p=w640-h350 Scans web applications for second-order subdomain takeover by crawling the app, and collecting URLs (and other data) that match certain rules, or respond in a certain way. InstallationFrom binaryDownload a prebuilt binary from the releases page and unzip it. From sourceGo version 1.17 is recommended.
*
*
*
* The results of
* Check for second-order subdomain takeover: takeover.json. (Duh!)
* Collect inline and imported JS code: javascript.json.
* Find where a target hosts static files cdn.json. (S3 buckets, anyone?)
* Collect names to build a tailored parameter bruteforcing wordlist: parameters.json.
* Feel free to contribute more ideas! Referenceshttps://shubs.io/high-frequency-security-bug-hunting-120-days-120-bugs/#secondorder https://edoverflow.com/2017/broken-link-hijacking/ Download Second-Order
___________________________
@hacking_Attack
@Hacking_Video
Second-Order - Subdomain Takeover Scanner
https://blogger.googleusercontent.com/img/a/AVvXsEgz5g4s_jFchyq-aXIg1HOkqs2KHEkl8dNtPx0IBlI7cROTelnD1UPIa5GnaRLCQht5nfD0JMAu9JY2FWtfgn87FKTsyOtDjNPWRhIVZRHVqb35zEDS4WGH9iVHPvMwnnB7OPZQP6KhVAlxndCacjUcM69Cq-FABIfNVQdzUcXTXJOocEbYUXsEDu7p=w640-h350 Scans web applications for second-order subdomain takeover by crawling the app, and collecting URLs (and other data) that match certain rules, or respond in a certain way. InstallationFrom binaryDownload a prebuilt binary from the releases page and unzip it. From sourceGo version 1.17 is recommended.
go install -v github.com/mhmdiaa/second-order@latest Dockerdocker pull mhmdiaa/second-order Command line optionsDirectory to save results in (default "output") -threads int Number of threads (default 10)">-target string
Target URL
-config string
Configuration file (default "config.json")
-depth int
Depth to crawl (default 1)
-header value
Header name and value separated by a colon 'Name: Value' (can be used more than once)
-insecure
Accept untrusted SSL/TLS certificates
-output string
Directory to save results in (default "output")
-threads int
Number of threads (default 10) Configuration FileExample configuration files are in config*
LogQueries: A map of tag-attribute queries that will be searched for in crawled pages. For example, "a": "href"means log every hrefattribute of every atag.*
LogNon200Queries: A map of tag-attribute queries that will be searched for in crawled pages, and logged only if they contain a valid URL that doesn't return a 200status code.*
LogInline: A list of tags whose inline content (between the opening and closing tags) will be logged, like titleand scriptOutputAll results are saved in JSON files that specify what and where data was found* The results of
LogQueriesare saved in attributes.json{
"https://example.com/": {
"input[name]": [
"user",
"id",
"debug"
]
}
} * The results of LogNon200Queriesare saved in non-200-url-attributes.json{
"https://example.com/": {
"script[src]": [
"https://cdn.old_abandoned_domain.com/app.js",
]
}
} * The results of LogInlineare saved in inline.json{
"https://example.com/": {
"title": [
"Example - Home"
]
},
"https://example.com/login": {
"title": [
"Example - login"
]
}
} Usage IdeasThis is a list of tips and ideas (not necessarily related to second-order subdomain takeover) on what to use Second Order for.* Check for second-order subdomain takeover: takeover.json. (Duh!)
* Collect inline and imported JS code: javascript.json.
* Find where a target hosts static files cdn.json. (S3 buckets, anyone?)
* Collect names to build a tailored parameter bruteforcing wordlist: parameters.json.
* Feel free to contribute more ideas! Referenceshttps://shubs.io/high-frequency-security-bug-hunting-120-days-120-bugs/#secondorder https://edoverflow.com/2017/broken-link-hijacking/ Download Second-Order
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Second-Order - Subdomain Takeover Scanner
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Cronos | HackTheBox writeup
https://cdn-images-1.medium.com/max/1003/1*tXuI0tsXQq8zTw3_ue9niA.png
Happy Sunday! It is time for yet another writeup in the OSCP prep spirit. This time it is the “Cronos” box.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Cronos | HackTheBox writeup
https://cdn-images-1.medium.com/max/1003/1*tXuI0tsXQq8zTw3_ue9niA.png
Happy Sunday! It is time for yet another writeup in the OSCP prep spirit. This time it is the “Cronos” box.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Cronos | HackTheBox writeup
Happy Sunday! It is time for yet another writeup in the OSCP prep spirit. This time it is the “Cronos” box.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Let’s play a game: Hack the Juice Shop
https://cdn-images-1.medium.com/max/600/0*Q-7k1kNGCD8Nh6EW.png
Security, a buzzword for some companies and a priority for others. We hear of so many security breaches, but we still do not find the time…
Continue reading on TestAutonation »
___________________________
@hacking_Attack
@Hacking_Video
Let’s play a game: Hack the Juice Shop
https://cdn-images-1.medium.com/max/600/0*Q-7k1kNGCD8Nh6EW.png
Security, a buzzword for some companies and a priority for others. We hear of so many security breaches, but we still do not find the time…
Continue reading on TestAutonation »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Let’s play a game: Hack the Juice Shop
Security, a buzzword for some companies and a priority for others. We hear of so many security breaches, but we still do not find the time…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
InsurAce.io Biweekly Updates (Jan 10 — Jan 23)
https://cdn-images-1.medium.com/max/832/1*Oe0jcXiSNl5u3wAU1grCqQ.png
Check the project progress from Jan 10 to Jan 23.
Continue reading on InsurAce.io Blog »
___________________________
@hacking_Attack
@Hacking_Video
InsurAce.io Biweekly Updates (Jan 10 — Jan 23)
https://cdn-images-1.medium.com/max/832/1*Oe0jcXiSNl5u3wAU1grCqQ.png
Check the project progress from Jan 10 to Jan 23.
Continue reading on InsurAce.io Blog »
___________________________
@hacking_Attack
@Hacking_Video
Medium
InsurAce.io Biweekly Updates (Jan 10 — Jan 23)
Check the project progress from Jan 10 to Jan 23.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
HackTheBox — Backdoor Walkthrough
https://cdn-images-1.medium.com/max/702/1*j-RvugRZ-9ErPS53aLPsZw.png
Hi folks! In today's write-up, I'll describe my experience playing with the Backdoor HackTheBox machine, which is not the hardest one.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
HackTheBox — Backdoor Walkthrough
https://cdn-images-1.medium.com/max/702/1*j-RvugRZ-9ErPS53aLPsZw.png
Hi folks! In today's write-up, I'll describe my experience playing with the Backdoor HackTheBox machine, which is not the hardest one.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
HackTheBox — Backdoor Walkthrough
Hi folks! In today's write-up, I'll describe my experience playing with the Backdoor HackTheBox machine, which is not the hardest one.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Without Permit: Multichain’s exploit explained
https://cdn-images-1.medium.com/max/2312/1*4GCKLregfgjnkzinTd7izA.png
A few days ago Multichain’s users were hacked by several attackers groups, all abusing the same vulnerability in Multichain (previously…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Without Permit: Multichain’s exploit explained
https://cdn-images-1.medium.com/max/2312/1*4GCKLregfgjnkzinTd7izA.png
A few days ago Multichain’s users were hacked by several attackers groups, all abusing the same vulnerability in Multichain (previously…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Without Permit: Multichain’s exploit explained
A few days ago Multichain’s users were hacked by several attackers groups, all abusing the same vulnerability in Multichain (previously…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Solid Metasploit
https://cdn-images-1.medium.com/max/924/0*GJ_cwLYF-ScU_Vmv
Penetration testing of the corporate network using Metasploit
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Solid Metasploit
https://cdn-images-1.medium.com/max/924/0*GJ_cwLYF-ScU_Vmv
Penetration testing of the corporate network using Metasploit
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Solid Metasploit
Penetration testing of the corporate network using Metasploit