Kali Linux Tutorials
Crawpy : Yet Another Content Discovery Tool

Crawpy is Yet another content discovery tool written in python.

What makes this tool different than others:

* It is written to work asynchronously which allows reaching to maximum limits. So it is very fast.
* Calibration mode, applies filters on its own
* Has bunch of flags that helps you fuzz in detail
* Recursive scan mode for given status codes and with depth
* Report generations, you can later go and check your results
* Multiple url scans

Example reports

Example reports can be found here

https://morph3sec.com/crawpy/example.html
https://morph3sec.com/crawpy/example.txt

Installation

git clone https://github.com/morph3/crawpy
pip3 install -r requirements.txt
or
python3 -m pip install -r requirements.txt

Usage

morph3 ➜ crawpy/ [main✗] λ python3 crawpy.py –help
usage: crawpy.py [-h] [-u URL] [-w WORDLIST] [-t THREADS] [-rc RECURSIVE_CODES] [-rp RECURSIVE_PATHS] [-rd RECURSIVE_DEPTH] [-e EXTENSIONS] [-to TIMEOUT] [-follow] [-ac] [-fc FILTER_CODE] [-fs FILTER_SIZE] [-fw FILTER_WORD] [-fl FILTER_LINE] [-k] [-m MAX_RETRY]
[-H HEADERS] [-o OUTPUT_FILE] [-gr] [-l URL_LIST] [-lt LIST_THREADS] [-s] [-X HTTP_METHOD] [-p PROXY_SERVER]
optional arguments:
-h, –help show this help message and exit
-u URL, –url URL URL
-w WORDLIST, –wordlist WORDLIST
Wordlist
-t THREADS, –threads THREADS
Size of the semaphore pool
-rc RECURSIVE_CODES, –recursive-codes RECURSIVE_CODES
Recursive codes to scan recursively Example: 301,302,307
-rp RECURSIVE_PATHS, –recursive-paths RECURSIVE_PATHS
Recursive paths to scan recursively, please note that only given recursive paths will be scanned initially Example: admin,support,js,backup
-rd RECURSIVE_DEPTH, –recursive-depth RECURSIVE_DEPTH
Recursive scan depth Example: 2
-e EXTENSIONS, –extension EXTENSIONS
Add extensions at the end. Seperate them with comas Example: -x .php,.html,.txt
-to TIMEOUT, –timeout TIMEOUT
Timeouts, I suggest you to not use this option because it is procudes lots of erros now which I was not able to solve why
-follow, –follow-redirects
Follow redirects
-ac, –auto-calibrate
Automatically calibre filter stuff
-fc FILTER_CODE, –filter-code FILTER_CODE
Filter status code
-fs FILTER_SIZE, –filter-size FILTER_SIZE
Filter size
-fw FILTER_WORD, –filter-word FILTER_WORD
Filter words
-fl FILTER_LINE, –filter-line FILTER_LINE
Filter line
-k, –ignore-ssl Ignore untrusted SSL certificate
-m MAX_RETRY, –max-retry MAX_RETRY
Max retry
-H HEADERS, –headers HEADERS
Headers, you can set the flag multiple times.For example: -H “X-Forwarded-For: 127.0.0.1”, -H “Host: foobar”
-o OUTPUT_FILE, –output OUTPUT_FILE
Output folder
-gr, –generate-report
If you want crawpy to generate a report, default path is crawpy/reports/.txt
-l URL_LIST, –list URL_LIST
Takes a list of urls as input and runs crawpy on via multiprocessing -l ./urls.txt
-lt LIST_THREADS, –list-threads LIST_THREADS
Number of threads for running crawpy parallely when running with list of urls
-s, –silent Make crawpy not produce output
-X HTTP_METHOD, –http-method HTTP_METHOD
HTTP request method
-p PROXY_SERVER, –proxy PROXY_SERVER
Proxy server, ex: ‘http://127.0.0.1:8080’

Examples

python3 crawpy.py -u https://facebook.com/FUZZ -w ./common.txt -k -ac -e .php,.html
python3 crawpy.py -u https://google.com/FUZZ -w ./common.txt -k -fw 9,83 -rc 301,302 -rd 2 -ac
python3 crawpy.py -u https://morph3sec.com/FUZZ -w ./common.txt -e .php,.html -t 20 -ac -k
python3 crawpy.py -u https://google.com/FUZZ -w ./common.txt -ac -gr
python3 crawpy.py -u https://google.com/FUZZ -w ./common.txt -ac -gr -o /tmp/test.txt
sudo python3 crawpy.py -l urls.txt -lt 20 -gr -w ./common.txt -t 20 -o custom_reports -k -ac -s
python3 crawpy.py -u https://google.com/FUZZ -w ./common.txt -ac -gr -rd 1 -rc 302,301 -rp admin,backup,support -k Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
ClusterFuzzLite : Simple Continuous Fuzzing That Runs In CI

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Am I being scammed ?

Got a suspicious text from a email in my messenger. It has a text message saying ??? At the bottom and a owl.exe link at the top, like he put a lot of spaces or tabs in the middle. What is this text ? Super high and worried it may be blackmail

submitted by /u/_Just_Myself
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Accidentally added my teacher to my class groupchat

Hi im so dead I accidentally added my professor to my class groupchat in messenger wherein my classmates would rant about professors. I am worried they might get exposed. The professor that was accidentally added was removed immediately. I don’t know what to do anymore. I think my only option is to hack into the account and delete the groupchat. Help please. Anyone knows how to hack?

submitted by /u/MilkshakeIcecream
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

My First Bug is P1 in Just 3 Minute
https://medium.com/@Akash0x0/my-first-bug-is-p1-in-just-3-minute-667839b3844f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Hacker’s and Security Guys that is My first article on how to find a P1 bugContinue reading on Medium » (https://medium.com/@Akash0x0/my-first-bug-is-p1-in-just-3-minute-667839b3844f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

2fa Bypass by changing Request method to DELETE
https://medium.com/@arthbajpai277/2fa-bypass-by-changing-request-method-to-delete-500fd0ed12b8?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Everyone My name is Arth Bajpai, I’m from Lucknow, India, and I’m back with my third write-up about a 2fa Bypass which I Found a…Continue reading on Medium » (https://medium.com/@arthbajpai277/2fa-bypass-by-changing-request-method-to-delete-500fd0ed12b8?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

TrustRecruit — BUG BOUNTY

TrustRecruit will be allocating 750,000 TRT of the total supply of $TRT tokens to successful bounty hunters.Continue reading on Medium »
Read more...

Hacking on Medium
Small Businesses are Big Targets for Cybercriminals

https://cdn-images-1.medium.com/max/1254/1*MZ5SUcQlgZE2zHoqAFqt2Q.jpeg
When it comes to cybersecurity, small businesses can no longer afford to turn a blind eye. Larger organizations have invested in…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
My First Bug is P1 in Just 3 Minute

https://cdn-images-1.medium.com/max/600/1*8HgMFYhGoRCoTa8UF25yuQ.jpeg
Hello Hacker’s and Security Guys that is My first article on how to find a P1 bug

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Our Analysis of the $80M Qubit Finance Exploit

https://cdn-images-1.medium.com/max/980/1*ZykJVofuaxpX8Txhy-0ufw.png
Brief analysis of the Qubit Finance incident.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

TrustRecruit — BUG BOUNTY
https://medium.com/@trustrecruit2022/trustrecruit-bug-bounty-2555b9d73fa1?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

TrustRecruit will be allocating 750,000 TRT of the total supply of $TRT tokens to successful bounty hunters.Continue reading on Medium » (https://medium.com/@trustrecruit2022/trustrecruit-bug-bounty-2555b9d73fa1?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video