Hello GUYS,Continue reading on Medium » (https://dhakalbibek.medium.com/story-about-more-than-3-5-million-pii-leakage-in-yahoo-78f98bf69b49?source=rss------bug_bounty-5)

Hacking on Medium
Nuevo error de Linux en el módulo de firewall de Netfilter permite a los atacantes obtener acceso…

https://cdn-images-1.medium.com/max/849/0*ggnAjCvamzrDcZuZ
PUBLICADO EN 14 MARZO, 2022POR EHACKING

Continue reading on Medium »

Hacking on Medium
Cryptocurrency Exchange Hacks: how to secure customers from stealing their funds

https://cdn-images-1.medium.com/max/1200/1*V5IhJl0ogDmF8Rv_WYHQTw.png
With growing popularity and mass adoption of crypto assets, the amount of funds flowing to centralized exchanges have been increasing as…

Continue reading on Medium »

Open Redirect via Sendgrid Email Misconfiguration

Hello developer , bug hunter and cyber security enthusiast. In this opportunity i wanna show you my first Bug Bounty writeup from one of a…Continue reading on System Weakness »
Read more...

The story of 3 bugs that lead to Unauthorized RCE — Pascom Systems

A detailed post on how I chained 3 vulnerabilities (A path traversal, An SSRF in an external piece of software, and a post-authentication…Continue reading on Medium »
Read more...

Solution to my $20 egg hunt (Part 1)

Last week, I posted an article titled “There’s $20 hidden in this post”. Here’s how to solve the first part of it…Continue reading on Medium »
Read more...

How I access other domains in infinityfree.net using Directory Traversal

Hi, it’s me again haha Kurt Russelle Marmol aka xkurtph, Web Developer (noobie) and Security Researcher.Continue reading on Medium »
Read more...

From Recon via Censys and DNSdumpster, to Getting P1 by Login Using Weak Password — “password”

A simple story when Allah allowed me to get P1 by combining several issues, one of which was related to “weak credentials”.Continue reading on InfoSec Write-ups »
Read more...

My Pentest Log -10- (A Little Tip)

Greetings to all from Khrysokeras,Continue reading on Medium »
Read more...

How I Made The BBC Hall Of Fame 3 Times

Happy Monday to anyone reading this write up. Today I am going to describe how I was able to make the BBC Hall Of Fame 3 times. My…Continue reading on Medium »
Read more...

SQL Injection at Spotify
https://eslam3kl.medium.com/sql-injection-at-spotify-d19e0861ddf0?source=rss------bug_bounty-5

Story about more than 3.5 million PII leakage in Yahoo!!!

Hello GUYS,Continue reading on Medium »
Read more...

SQL Injection at Spotify.Continue reading on Medium » (https://eslam3kl.medium.com/sql-injection-at-spotify-d19e0861ddf0?source=rss------bug_bounty-5)

SQL Injection at Spotify

SQL Injection at Spotify.Continue reading on Medium »
Read more...

Hacking Articles
A Detailed Guide on httpx

Introductionhttpx is a fast web application reconnaissance tool coded in go by www.projectidscovery.io. With a plethora of multiple modules effective in manipulating HTTP requests and filtering out responses, it is proving to be an effective tool in Bug Bounty Hunter’s arsenal. While tools like curl already exist that can perform almost all the features covered in this tool, httpx has its own place among the analysts because of its speed and ease of access. You can download the source code from here. Table of content* Installation of go version 1.17
* Installation of httpx
* Basic usage
* Subdomain enum using subfinder and scanac
* Content probes
* Content comparers
* Content filters
* Rates and timeouts
* Show responses and requests
* Filtering for SQL injections
* Filtering for XSS reflections
* Web page fuzzing
* File output
* TCP/IP customizations
* Post login
* HTTP methods probe
* Routing through proxy
* Conclusion Installation of go version 1.17Installation and proper running of httpx tool depends on go version 1.17. You can download, extract, add go in environment variables as follows. I am using Kali on amd64 architecture. Please feel free to download the appropriate package for your system on go.dev/dl
wget https://go.dev/dl/go1.17.8.linux-amd64.tar.gz
tar -C /usr/local/ -xzf go1.17.8.linux-amd64.tar.gz
Please make sure that you add the following lines in ~/.zshrc file:
#go variables
export GOPATH=/root/go-workspace
export GOROOT=/usr/local/go
PATH=$PATH:$GOROOT/bin/:$GOPATH/bin
After you have added the lines, zshrc file can be loaded with the source command and then we’ll be ready to go. If all goes well, the “go version” command will give version 1.17.8 as output.
source ~/.zshrc
go version
https://blogger.googleusercontent.com/img/a/AVvXsEg9AlSPddp5OUP_eU8i-3YbkJlkZJQELrrftSGwMmXT5lYo3-YZMV3QCLPK8BG1PH6c3p6IKS-ra1HACHLrGFwdx56x2fCsJR6xbQzMQankB_t01kYJ7ZQLFGl5aBZWZ-dnDBQzF5Uw_2m37KQ62BmKRR8ZWVWOmq5nMQ0PiXeNjBUJ9BMrMiDMiblRfg=s16000 Installation of httpxInstallation of the tool is also possible by cloning the github repository and using a makefile to compile but we have an easier alternative. We can use go install to do the same like:
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
https://blogger.googleusercontent.com/img/a/AVvXsEjxO12ZcCBpqMjShSZDpioqub4yeqXqeR6x1ecum7XOuXIsn4DX8DUM1PuFaOcO5DdM20TYt9I5LHkMAJqXbDyV3aDvj5d3wROMhdAYMjRlDtnT8VNQpaSznN7AFHdq-Q-rrRQi53ElM0B1xFL6Jap_wwA_H3Zmz_AZVCkHYT4AyWrhs3RYul_Y25CsHw=s16000

Once done, you can now run the tool. Help menu can be popped up to check the installation success
httpx --help
https://blogger.googleusercontent.com/img/a/AVvXsEgQLt7Z5uf7fSqnkq2bX7Pp0sE8QNdVxj-uyi_ZHLji4PyrwM1LzY7c6aVhGQbH3C7ZZJo4hrJxKXr5C-lwlULWSsJ6dDZyjKFLhmyI5MEtZ8BmiGkIuwtp2F0-_JwJh6A6mJcGUlYPI85CNwPvfV4fGe9BFME4N2gTMS5oaRWNn6p1w-a1HdkPg6pWmA=s16000 Basic UsageHttpx tool accepts STDIN input for scanning. Here, we run a blank scan that only hits the server and does nothing and then the same scan with some basic options.

-title: displays the title of the webpage

-status-code: displays the response code. 200 being valid or OK status while 404 being the code for not found

-tech-detect: detects technology running behind the webpage

-follow-redirects: Enables following redirects and scans the following page too
echo "http://testphp.vulnweb.com" | httpx
echo "http://testphp.vulnweb.com" | httpx -title -status-code -tech-detect -follow-redirects
https://blogger.googleusercontent.com/img/a/AVvXsEg75NMZ3dVd_eJ8SGIUvdw9JiHUZUm9IGz5xyH7owm4SDgMqiHocUXSqxL7Ph3fltfSYKxxb9Izqv_2m65W085tcXWZKrysSRJiDuBusKUKUzCQJABsBJSUEu54wnhneq0HHEQJLx2qZV_UEwgwlLd96Mj8DfRL16871RQwqeMkIiAxt3_sbL8xB-OqYw=s16000

The same can be run on a list of websites that can be fed to the tool [...]

using “-l” option
httpx -l list -title -status-code -tech-detect -follow-redirects
https://blogger.googleusercontent.com/img/a/AVvXsEh2PsDI6akzQXDF5CtJUaG8OSIRmlPsY3RjODmFEC5SEs-Yo-DWKCDpnPHZTDPFHoLf5iazUjPdquCR4FnL5NCkUtlm7WrLiHHjw5WvJf8qtD99Dx2XR4dQnQfesgj3h4RdzXMNki6XLiH15cZTu9x012t6EvDfhri5OzJtbKB432VaZoo3hFOWlaW58g=s16000 Subdomain enum using subfinder and scanSubfinder is another tool developed by projectdiscovery.io that enumerates and outputs subdomains. We can feed the STDOUT of subfinder to httpx and scan all the subdomains like so:
subfinder -d vulnweb.com | httpx -title -status-code -tech-detect -follow-redirects
https://blogger.googleusercontent.com/img/a/AVvXsEhogbTv2cwBoMFX7WbSt8Jl4RpzIjPS4L92plBtV6RJo90N4qsFVHdMS3I5igzroL-UZv9yicPmggfl_deW9HbbX8t1ZMpQlj8EZs5DBipeiSbCnkrq1UKD0h3WoyfAymxdZWePYPUl-dIU5N0VcVHKrTd_n-HeOLBJGDevQsTwMaYuHEkhWRRoI4NNfQ=s16000 Content probeThere are various modules that can refine how a response is rendered which is called a “probe.” These help us refine scan results. For example,

-sc: show HTTP response status code

-path: a specified path to check if it exists or not
httpx -l list -path /robots.txt -sc
https://blogger.googleusercontent.com/img/a/AVvXsEhBz-txjviQHX-e11ncrjLMjXu_6wsHxWKnHcmp2IAV0QR3ug59B-_qaBzeOXGgqaVYFu9eVgSV8CzlRuZvSD7LyvGWs1Cr0WfaQHm5uVj4l094Z60oRFwAbUObKdIClePcYd8W3NICnU5nQ70cAycTC2LEbFd1gNK3pLlINKpi_Y8rlIZ3X7pGNOhp9A=s16000

httpx could be run using docker as well. Here, we feed a list of all subdomains as STDIN to httpx:
cat list | docker run -i projectdiscovery/httpx -title -status-code -tech-detect -follow-redirects
https://blogger.googleusercontent.com/img/a/AVvXsEh-XPURpyC8xXqFxGg6UNnCrbXqElwXFtX-HXOpZxI2UB6EVdnfHgn9US0hYrZm-5guT6palhNmVjBPdHrS1IhYCj944dU8sJtATPHGyRkmlbcNl9qzWZ1_A6Z2YELYe67jgsHnQLEgIhG8PEEfilgff5NtQ_zAZLddk-vnJFJZifl52Zig2U84_XPB6w=s16000

There are various other probes that help us render better outputs

-location: website where redirected. Here, observe how http becomes https

-cl: displays the content length of the resulting web page

-ct: content type of the resulting web page. Mostly HTML
echo "http://google.co.in" | httpx -sc -cl -ct -location
https://blogger.googleusercontent.com/img/a/AVvXsEjX5m-5IIDpQnK4vh-zXDF45KHcr4IiYFHI2i76Ah3dRAfEv6Gb_0St-7D0Af4bZFXRyedM7hLMDQQKxKQmuHTCCJq-IqCQFEgA63WEStdYZjDE6dtWZrv08GQj4C8J3SL0iocbswolJsk29HueFFhPRGzQ6N2n_4hPohWMmwS5Dx31oKDAlQqaG6CvOQ=s16000

Some probes that are helpful for analysts and in-depth analysis

-favicon: fetches mmh3 hash of /favicon.ico file

-rt: shows the response time

-server: displays the server version and build

-hash: shows the webpage’s content’s hash
echo "http://testphp.vulnweb.com" | httpx -favicon -rt -server -hash sha256
https://blogger.googleusercontent.com/img/a/AVvXsEjZ4_gZGM2YiSWLLFpMnFBgEfInyjEY2zhP4IQD55ehgblIDr4ET8ESNpzkJO11T9YAgGE48kNl2kxWQ7timGaA78TfdTi0b5IdpaP7SVejfCeGLfUSIjuBBriMUGon-AdXArmd-lgZorhdMyocgJoeKjT3m4e6NS7rU6AQkwTlUZyE6PJ5Hor3qXytOQ=s16000

-probe: displays the status of a single scan (success/failed)

-ip: displays the IP of the webserver

-cdn: displays the CDN/WAF if present
echo "https://shodan.io" | httpx -probe -ip -cdn
https://blogger.googleusercontent.com/img/a/AVvXsEgiy_dzmg2AKJXJcHBU-Ekct5tgcJNK51hU_eFMGSS4ZBnKFN057ZH_OSRzzG33V3Ey9cD7c96PwT-RKxbxigPeZBUDIOfjQQs6T0jBIVw1LYRsVwUYTKp6RzedqW51iJghenxQ3f87B4AL0r_tSdH_s7swP7ybRGzbDJjnQhZ29NxUHbQhRcWm_UXc-A=s16000

-lc: displays the line count of scanned web page

-wc: displays the word count of scanned web page
echo "http://testphp.vulnweb.com" | httpx -lc -wc
https://blogger.googleusercontent.com/img/a/AVvXsEhoXJxtpYiFzctnrh8CeC9zXCVI-QeDlh7mFcnLVhH2Y0vyytWc1oM-pxr1zOThqxXDJGBhJ-pxCC72WdJBphE3wTaignfE0LPrrzMY-2SOAd1jjwBt7zYnq1V5nyxV_bzBzHy-NUW8jerWVOh45sbV5dJDN4I-Vn3xWeyW4dAuQJjGr5a4qhednPPx7Q=s16000 Content comparersThere are various comparers available in the tool that help us shortlist down an [...]

output. These are very helpful to trim down a list of unexpected output. For example,

-mc: matches the HTTP response code with the codes supplied in the list
cat list | httpx -mc 200,301,302 -sc
https://blogger.googleusercontent.com/img/a/AVvXsEiAEZYYStgLEMFENS2zsdDYkhkjksXUTef_8TtiasZDc5CSrBU9mFkmOPSfUqWWc2jzDGzWDpjc7hP8Vkp8fzLHFA7cxpmSOnvAUt2yYJa74ZMcXkRu-s7bFUJbB8JMd-zuZlUvd1sqtAAdFt8vQAu_nmCdDsXvF5rtfjQmMzdShc8XpGADuUArifd8RA=s16000

-mlc: matches the line count with input provided
cat list | httpx -mlc 110 -lc
https://blogger.googleusercontent.com/img/a/AVvXsEhDFuXjn7TUOgMZrzkClN2bus5cveZxdHxq-D8bA3tBcqks7d7LUxCONWgf_iT3HPRla9nvGYtjwGPvqNk5y8F1VxfFPMAHDnJmBbjk9bwP1S0uAJczXWUJnyTkfSllBXzpCHvjySb36llAyyc1MvznQ4WYmikEmA26LKb8vf18TIp_l2fI3NJrmYLnWw=s16000

-cl: displays the content length of a webpage

-ml: matches the content length with the input provided and displays only the results matching the content length
cat list | httpx -ml 3563 -cl
https://blogger.googleusercontent.com/img/a/AVvXsEhSR_kOwZcqSWfOZ82H4VlEJ1G5-LixVZzOYtYEpC310ydx2bmVwrA3MCGTP-BN4UBbHG5X1A4-4bYu1E6rLML1i2H4zwNQl_NeIPxYMvFJHfjwhq-AOr6qfqYnqMVg1WDsgvF4_e9dUoUPPsesYV72gMnxaZLiZ3oMnNwOnLTEIFZxj1RNXhomckpeyw=s16000

-mwc: matches the word count and displays only the results with the same word count
cat list | httpx -mwc 580 -wc
https://blogger.googleusercontent.com/img/a/AVvXsEiUGGTLTtQTIcfsIANfEkAk7gN_DSbc7vUCQjg1wVsFAKzsJ_1D_1MBlrO48hNF1EtiaeBQb_PwHJjZf4nT78sf8DWSuFOyMhCJDmcuw76_H94XYbQehlFDAHtJDD5Pfn_UDdPMVtcBff7SjyLRNgvsE45GzjktYdVsFdX8iNuxTtxeuvYYrztNEtH4Hw=s16000

-ms: displays only the results where text on a page matches the provided string. Here, pages with “login” in their text are loaded
cat list | httpx -ms "login"
https://blogger.googleusercontent.com/img/a/AVvXsEj97pwpigLNnt3kDhKKp7nZnNdZ_Bd3-SCYMDgJmFcKeeUOmf7fZfe928WCCiCFhWDC_gY3S9oTzz6PMmza05PYCee5rX862gE0TyzaD3x3l3GQoMfGUzSP9HKtQs8ZoXQ4E9HufEzJsDMrQzcRk85SCkA7dZGOHEH29AmkctIRN2Hr-AhGapELgCKaWQ=s16000

-er: extract regular expressions. Displays only the results where the resulting pages match the regex pattern provided. An example regex is \w which compares the provided string with the resulting page’s output.
echo "http://testphp.vulnweb.com" | httpx -er "\w test"
https://blogger.googleusercontent.com/img/a/AVvXsEggV7SxthocXjWoEhSGAQ6VuUqA8D5WlSLQCq46MZ9zHiHjx1gtoN5AZpjTo-ak7sQ2DDQv4qWK11WDB93iqshrtLKb3zFY9nShvLVWhMV13CRHeKPkseSaKJUKvrks3gHRuhKs4Sewv6unu9Dm80o3-C5vwl9xf3eTeSP0nziOgSD_XMkV8p8yElnWQQ=s16000

Here, you can see the output stands like u test, o test. The tool has filtered the following text and displayed it in output:

https://blogger.googleusercontent.com/img/a/AVvXsEjgu0WAIPzvIZAw7-WoCQLGbEpUPglE4iMQPL6QslgEF2_6oGrOp_1fbCScQAc3ttylpWQriA8oL5gLpAlbDiXmJ-ZR0Pu_mIGQdDqU6TsKcqY693VEsm4G2Dl7gEMeOi5GMpdcoQrpUTkaGmhcwo3oidTjt-WRX34RCLEUp2QibQGjv8qbJ3hnOqZlag=s16000 Content filtersVarious filters are available at disposal in the tool that eliminates the results upon matching the criteria/condition provided. For example,

-fc: filters code. Tool only displays status codes not listed by fc (404 here so only 200 is visible)
cat list | httpx -sc
cat list | httpx -sc -fc 404
https://blogger.googleusercontent.com/img/a/AVvXsEhuiFqokWVCnPiYTu3U0W29vl5t2s15ICqn8GCZERknvk5CPePhRV58vzot-2jTMD9Ybpt8c6O1Hej6aU5zVC6yclwQPCVtDLnbfvtVzx7lCRBQj_ADi8hsK2UUH_mXd-LvBxYgkQGxw4xkKbePMm5mrPsYedptqF6RckjclBi150IASOjqawriSEdeng=s16000

-fl: filters content length. Here, 16 and 12401 is filtered so all the output except these two are visible
cat list | httpx -cl -fl 16,12401
https://blogger.googleusercontent.com/img/a/AVvXsEih9BMUuXOhzJrCoFFa0MMWplbDHzpqt_84dy4W4aCVMlrWoGDczG6NLes1P1sBqpPfbsEpJHHeUMBWD_hR9l8Uk912FyKBnZoTV35eK4PH4-ryN3aijGshgxCxkDh3ZYSnPcLcA4kwxtO3AAzLkp_NJ5tFl2U0N3CIXMJwVMmo-7Wl8OMAf9tFnS8f-w=s16000

-fwc: filters the word count. Here, 3 and 580 is filtered so all the output except these two are visible
cat list | h[...]

ttpx -wc -fwc 3,580
https://blogger.googleusercontent.com/img/a/AVvXsEgy2FOoxte3XNKFtNiDFFU8NVtVx9iRwxFNFupJ_YeqcJon1LMaCsxmbNU9HE0c8A4pSxaOW8Ge7xxjoOoy66-taMX_IKn-S8BtoRfkw5BrBL3sZbYodPEH4durITeoVvt_UvRPLEYs3bhZx9DFVyhUF95qkbr_tJy9SA8JolkWnG1DAuW_74hlGyltAA=s16000

-flc: filter line count. Here, 2 and 89 is filtered so all the output except these two are visible
cat list | httpx -lc -flc 2,89
https://blogger.googleusercontent.com/img/a/AVvXsEiqDNezwvf_adtN4LyoVa6J2Z_jHDGFjhN4bswa6-P9VkGN6YlYkO4utdj9KahtPHwzcATHxorSZapOUmChDqe64nI0QMBUUN6HwmIePq-52NKjCCbbfNSD692e9tRrpy7DxO_KWDxTYv5BlaHqku4SW2Mn6XHr8C2LPp7yqZYgF8y-UGNJcgjirkWExg=s16000

-fs: filter the output with the provided string. Here, “test” is provided, so webpages not containing the string “test” is displayed. This string must only be in the text on the web page.
cat list | httpx -fs test
https://blogger.googleusercontent.com/img/a/AVvXsEhJqz_5zPOIFn6lygNP2lwBvI44t9QCMUGZ0B2vsrZ79Xlk--NhYQraGMFyiQ3If_9_q6wkTfv6DiYwbGZWoj37Fsk1EgDgQGqZbebaijF8grcoK8uJRUA-9otYN9uYHEYrpGeT23NDGAOjyBcwupOm9ICLpbvCqD_YfvqPBp1pcwzuMgOFe6IMuEP0zQ=s16000

-ffc: favicon filter. Only the output with favicons that are not “-215994923” is displayed.
cat list | httpx -favicon -ffc -215994923
https://blogger.googleusercontent.com/img/a/AVvXsEgBonM7jOl_tDlKHTViJdsc8wr4tmitSIQVpyUFdrqLcWTES00NrrKuSQOFNHEj2RKZJd_km-obcTVr0o9Vx4JmwkmAfSRN65c2IQNuNdYjPbA1HuQqZDaaj9r6veyvZzjxFLy5pSHGazkhKibdYwz_N1BbDlrMOmWEcWx3fbbod2kvWIEsthLOsOJ-Hg=s16000 Rates and TimeoutsThere are various modules that let a user play around with the rate of scan and throttle the speed of the same. Some of these options are:

-t: specify the number of threads used for the scan. Can be as high as 150. Default 50.

-rl: specifies the rate limit in requests per second

-rlm: specifies the rate limit in requests per minute
cat list | httpx -sc -probe -t 10 -rl 1 -rlm 600
https://blogger.googleusercontent.com/img/a/AVvXsEhjJQ68aqHALxLer1B3W19CHa5ZC7Y1q3_rMOJOv21T2ZyHytNzPGdRgARhzFqiC6nw9nqpfGgYbyUoc3KdVj7DWRVdg-vcCnAgwRlneXG69V9HOvmCG_ndaZmP7NkBkQzzCpkPS6MTkYAYBvGqXlqhBWoOXkhedPk9qiQHaif_oOz2XSONXqOjOGgsug=s16000

-timeout: To abort the scan in specified seconds

-retries: Number of retries before aborting the scan
cat list | httpx -sc -probe -threads 50 -timeout 60 -retries 5
https://blogger.googleusercontent.com/img/a/AVvXsEhUM3UxpMU4hMxayxYKcnLrdyyUZASZsQU1gfqJyx5c1vQf46LHdcDxG8qv6yU316nR3yrQxA7whGOeyhKO5ONYcnT0ia-2i8hM61Y7A4gvw7FXXKhVTpDxHfe-GAytA7aZN8xY6JDpUkgbT3MaBhQI5g6nTPAFlOaEDoxg-C1riucyg8eFNw0Xe4AQMg=s16000 Show Responses and RequestsHttpx crafts and sends out http requests in real-time and then post-processes the results. These requests and corresponding responses can be viewed as well. For example,

-debug: it shows requests and responses to a webpage in CLI
echo "http://testphp.vulnweb.com" | httpx -debug
https://blogger.googleusercontent.com/img/a/AVvXsEhCGEvpG_qThOHAnTf1Df2IqKC2Mxcc6mdCIpwpFt_99unLTXkQETb65Is786ADWIb6mj0delHprSvdsj6ppzgyG9lz_VaLj1dIcqC2JwzwBtxR6EhYNn0GOFwUtBHckN5XcxRb0NwLlBL8Jz5aDaMy_IN1YPUic9lfgBy7MfXoKBjgoF7rRk5eZsd_IQ=s16000

-debug-req: Displays the outgoing HTTP request

-debug-resp: Displays the corresponding HTTP response

https://blogger.googleusercontent.com/img/a/AVvXsEgwFPwm2Cye9r3CwN-ijP8qjTYzPL4M-fISRnlTys9IxDXXrotJlRDWWhxzg7o9SwffHKciGHlI3iyIdFtRZu8-6BAKkFlRkHZEWdjBA4l3jZKBgGwIGbzie73nUUmjdXVYcYJ7JdSiHhsLpsSCDjkq_mmw388x3V_R9n0M6N37Zcj0TQlu8b0CvWrvUw=s16000

-stats: displays the current scan stats including completion percentage
cat list | httpx -stats
https://blogger.googleusercontent.com/img/a/AVvXsEiCmkBdmNuiXfKRO-3mW-5dP_MffgfcdP9hIsxqoX4cgJ7ocKrPvjt8MaypzIPE0-nh8TP844h-ftiOdV8yh1_OccYKntVJJF6qoHzMAyYCGSy_rDbyEXYu5iU1Ka8iZmFxPQ-fUGrKZML35NYCuaYGV05Wwam7vsi5Bh-vaVT-siCRb1bxjguBpLYW_Q=s16000 Filtering for SQL InjectionsAs we know that some types of SQL injections are reflected in the code output. We can detect[...]

such injections by filtering the output of a web page. In error-based SQLi, an error is thrown which is reflected in the output page. As you can see in the command below we have used -ms filter to compare and find such pages. Ideally, an attacker can give a list of input and find common SQLi vulnerabilities in a similar way. In the output below, where the vuln is found, httpx displays that website’s name.
echo "http://testphp.vulnweb.com" | httpx -path "/listproducts.php?cat=1’" -ms "Error: You have an error in your SQL syntax;"
https://blogger.googleusercontent.com/img/a/AVvXsEhAu9RTErg8tosLtBEdTr_GazHPR2pQWI70rlwTCm-PHiUw4sUr5XZs8sZuhegnoxHLeXqjUC6AmMtkV1ZdcX6IsSjUjJTqFQov0m21tAsNrUlhF__PhMxTGFDgHGO_LUYKDc3vaQKGE57GHRPpPxkO-JhCyq_FnYJQgncOrAF0yyqYgTn7ZQBPqaqwYg=s16000 Filtering for XSS reflectionsReflected XSS by definition gets reflected in the web page’s output.

https://blogger.googleusercontent.com/img/a/AVvXsEjUSBjJcN33oq2ekAdJkMtRcMCUGBk_CRED_fIrLj7ka-g3dV0DyPdvKr9lW39sPdJ82NvIqwC94Es-BHnu0agzgYgbHegLy0o8DADavyo9matoST36ZTdTkQ7pmQxA4dCqJb40UCHIiyplngelIAtf0oSw-x_4PlafvFM9g5acGR3xdVw03B_APK__pg=s16000

An attacker can input a list of websites and then a list of path to check for reflected XSS in bunches. In the example below, the “-ms” module is used which is supposed to match the output webpage’s text content with the input provided. Since reflected XSS is shown in the output, the tool displays the name of the webpage where this vulnerability (payload output in the code) is observed.
echo "http://testphp.vulnweb.com" | httpx -path "/listproducts.php?cat=" -ms ""
https://blogger.googleusercontent.com/img/a/AVvXsEg0SATrZaFiM5GJXKVT7W6_cRC9cwlTFUlqLoiznGO587GPps-BmRLWdoryW8_wIIxd5Utqw61-ojOtRRiWex977abgeewSDnFby0xyctmnaRly6aS1OkKxCTvA_L8K94xVZODz0mIQgwjRIwf0L2Mn5009GXbBwgYXoQVMNpDErwhikPUBOGKstdkYHA=s16000 Web Page FuzzingHttpx is a great tool that can be used to fuzz web pages. “-path” module can be used to provide the name of the file to be fuzzed for existence on the server.

-path: path/list of paths to probe
echo "http://testphp.vulnweb.com" | httpx -probe -sc -path "/login.php"
https://blogger.googleusercontent.com/img/a/AVvXsEh46SKO1qFjbjumDukvGLqeQ_Uv2DYcig36OnG6ErQCDRNgyFNwdYudjn-9T8AD7jTjlsGH1mQameb8dgnaPDaU9uUFAc-eVP97fV9qyKs2QKuaWiaG0hr6qC2zdZ4iKokHzGW-H6ml_jYvZDevILYHG4WjORJs91bLPOMoPiJAVDkikXRcbis1QxkhOw=s16000 File outputThe scan results provided by the tool can also be exported for convenience. The most basic output is a text file with just webpages in every line. This can be useful for a variety of occasions while pentesting. Such modules are:

-o: Saves a result in a text output file
cat list | httpx -sc -o /root/results.txt
cat results.txt
https://blogger.googleusercontent.com/img/a/AVvXsEhYlMet5wQkj1NKhxsCoGoGKpEwo6UY7f5Sh1SrBFef_Pvuye8-rzLIHcyPCqnosZSFc-MmTRUUS7kmYvimsyjyETsUgOANDQ190b8jnHuBZ0QK3b1L7ddAxjsrqji_vinEnBrXXm2_Zu9w2kga_peO4CfDOymiu3DaEFQhSscSdsjqOgCbHXSb5Qy4iA=s16000

The same results can be saved in other formats too. Like,

-csv: Stores the scan results in CSV format. Default scan includes almost all of the content probes.
cat list | httpx -sc -csv -o /root/results.csv
cat results.csv
https://blogger.googleusercontent.com/img/a/AVvXsEhRhIkcza7HMa4gOb5lQlmNplkIvp53BX2yHx5BBGgat8zXSf-bDKl5J7UWeptJXv5anfwgHZmwmFEH3BOIsWxeXddtjaLLUaw2ityaYmU2NPZQF3AfNEykLv9jHkV7zKGmW38P1J7FyCQbX7h0z0LbASN300FFoSaZo_HXHhMfpv4D8Yt2eIBGT5FoFQ=s16000

-json: Stores the scan results in json format. Default scan includes almost all the content probes
cat list | httpx -sc -json -o /root/results.json
https://blogger.googleusercontent.com/img/a/AVvXsEhMoED5fGV0xKP9VQUi5K5eUWrQZ2JKGsZd3YZ1tqjr4RmGT4ogcepIZ3cx0YH-ZGOvKcjZ4BcuRp6pq4YtLJMzA00H0h0-egVcZpvwphsqfI2X5nlkvmB7vRUD2xliL38cMkuIpQwnj7974A3lnHl4u3VNtaZrCHLvKHyj9nDTqKLHHM9drcJcoAhirg=s16000

-srd: stores corresponding HTTP responses in custom directory with naming: “URL.txt”
cat list | httpx -[...]