Hacking Articles Tips Tricks Videos Tutorials
wing page too<o:p echo "http://testphp.vulnweb.com" | httpx<o:pecho "http://testphp.vulnweb.com" | httpx -title -status-code -tech-detect -follow-redirects<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEg75NMZ3dVd_eJ8SGIUvdw9JiHUZUm9IGz5xyH7owm4SDgM…
BU-Ekct5tgcJNK51hU_eFMGSS4ZBnKFN057ZH_OSRzzG33V3Ey9cD7c96PwT-RKxbxigPeZBUDIOfjQQs6T0jBIVw1LYRsVwUYTKp6RzedqW51iJghenxQ3f87B4AL0r_tSdH_s7swP7ybRGzbDJjnQhZ29NxUHbQhRcWm_UXc-A=s16000 -lc: displays the line count of scanned web page<o:p
-wc: displays the word count of scanned web page<o:p echo "http://testphp.vulnweb.com" | httpx -lc -wc<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhoXJxtpYiFzctnrh8CeC9zXCVI-QeDlh7mFcnLVhH2Y0vyytWc1oM-pxr1zOThqxXDJGBhJ-pxCC72WdJBphE3wTaignfE0LPrrzMY-2SOAd1jjwBt7zYnq1V5nyxV_bzBzHy-NUW8jerWVOh45sbV5dJDN4I-Vn3xWeyW4dAuQJjGr5a4qhednPPx7Q=s16000 Content comparers<o:pThere are various comparers available in the tool that help us shortlist down an output. These are very helpful to trim down a list of unexpected output. For example,<o:p
-mc: matches the HTTP response code with the codes supplied in the list<o:p cat list | httpx -mc 200,301,302 -sc<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiAEZYYStgLEMFENS2zsdDYkhkjksXUTef_8TtiasZDc5CSrBU9mFkmOPSfUqWWc2jzDGzWDpjc7hP8Vkp8fzLHFA7cxpmSOnvAUt2yYJa74ZMcXkRu-s7bFUJbB8JMd-zuZlUvd1sqtAAdFt8vQAu_nmCdDsXvF5rtfjQmMzdShc8XpGADuUArifd8RA=s16000 -mlc: matches the line count with input provided<o:p cat list | httpx -mlc 110 -lc<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhDFuXjn7TUOgMZrzkClN2bus5cveZxdHxq-D8bA3tBcqks7d7LUxCONWgf_iT3HPRla9nvGYtjwGPvqNk5y8F1VxfFPMAHDnJmBbjk9bwP1S0uAJczXWUJnyTkfSllBXzpCHvjySb36llAyyc1MvznQ4WYmikEmA26LKb8vf18TIp_l2fI3NJrmYLnWw=s16000 -cl: displays the content length of a webpage<o:p
-ml: matches the content length with the input provided and displays only the results matching the content length<o:p cat list | httpx -ml 3563 -cl<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhSR_kOwZcqSWfOZ82H4VlEJ1G5-LixVZzOYtYEpC310ydx2bmVwrA3MCGTP-BN4UBbHG5X1A4-4bYu1E6rLML1i2H4zwNQl_NeIPxYMvFJHfjwhq-AOr6qfqYnqMVg1WDsgvF4_e9dUoUPPsesYV72gMnxaZLiZ3oMnNwOnLTEIFZxj1RNXhomckpeyw=s16000 -mwc: matches the word count and displays only the results with same word count<o:p cat list | httpx -mwc 580 -wc<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiUGGTLTtQTIcfsIANfEkAk7gN_DSbc7vUCQjg1wVsFAKzsJ_1D_1MBlrO48hNF1EtiaeBQb_PwHJjZf4nT78sf8DWSuFOyMhCJDmcuw76_H94XYbQehlFDAHtJDD5Pfn_UDdPMVtcBff7SjyLRNgvsE45GzjktYdVsFdX8iNuxTtxeuvYYrztNEtH4Hw=s16000 -ms: displays only the results where text on a page matches the provided string. Here, pages with “login” in their text are loaded<o:p cat list | httpx -ms "login"<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEj97pwpigLNnt3kDhKKp7nZnNdZ_Bd3-SCYMDgJmFcKeeUOmf7fZfe928WCCiCFhWDC_gY3S9oTzz6PMmza05PYCee5rX862gE0TyzaD3x3l3GQoMfGUzSP9HKtQs8ZoXQ4E9HufEzJsDMrQzcRk85SCkA7dZGOHEH29AmkctIRN2Hr-AhGapELgCKaWQ=s16000 -er: extract regular expressions. Displays only the results where resulting pages match the regex pattern provided. An example regex is \w which compares the provided string with the resulting page’s output.<o:p echo "http://testphp.vulnweb.com" | httpx -er "\w test"<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEggV7SxthocXjWoEhSGAQ6VuUqA8D5WlSLQCq46MZ9zHiHjx1gtoN5AZpjTo-ak7sQ2DDQv4qWK11WDB93iqshrtLKb3zFY9nShvLVWhMV13CRHeKPkseSaKJUKvrks3gHRuhKs4Sewv6unu9Dm80o3-C5vwl9xf3eTeSP0nziOgSD_XMkV8p8yElnWQQ=s16000 Here, you can see the output stands like u test, o test. The tool has filtered the following text and displayed in output:<o:p https://blogger.googleusercontent.com/img/a/AVvXsEjgu0WAIPzvIZAw7-WoCQLGbEpUPglE4iMQPL6QslgEF2_6oGrOp_1fbCScQAc3ttylpWQriA8oL5gLpAlbDiXmJ-ZR0Pu_mIGQdDqU6TsKcqY693VEsm4G2Dl7gEMeOi5GMpdcoQrpUTkaGmhcwo3oidTjt-WRX34RCLEUp2QibQGjv8qbJ3hnOqZlag=s16000 Content filters<o:pVarious filters are available at disposal in the tool that eliminates the results upon matching the criteria/condition provided. For example,<o:p
-fc: filters code. Tool only displays status codes not listed by fc (404 here so only 200 is visible)&l[...]
-wc: displays the word count of scanned web page<o:p echo "http://testphp.vulnweb.com" | httpx -lc -wc<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhoXJxtpYiFzctnrh8CeC9zXCVI-QeDlh7mFcnLVhH2Y0vyytWc1oM-pxr1zOThqxXDJGBhJ-pxCC72WdJBphE3wTaignfE0LPrrzMY-2SOAd1jjwBt7zYnq1V5nyxV_bzBzHy-NUW8jerWVOh45sbV5dJDN4I-Vn3xWeyW4dAuQJjGr5a4qhednPPx7Q=s16000 Content comparers<o:pThere are various comparers available in the tool that help us shortlist down an output. These are very helpful to trim down a list of unexpected output. For example,<o:p
-mc: matches the HTTP response code with the codes supplied in the list<o:p cat list | httpx -mc 200,301,302 -sc<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiAEZYYStgLEMFENS2zsdDYkhkjksXUTef_8TtiasZDc5CSrBU9mFkmOPSfUqWWc2jzDGzWDpjc7hP8Vkp8fzLHFA7cxpmSOnvAUt2yYJa74ZMcXkRu-s7bFUJbB8JMd-zuZlUvd1sqtAAdFt8vQAu_nmCdDsXvF5rtfjQmMzdShc8XpGADuUArifd8RA=s16000 -mlc: matches the line count with input provided<o:p cat list | httpx -mlc 110 -lc<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhDFuXjn7TUOgMZrzkClN2bus5cveZxdHxq-D8bA3tBcqks7d7LUxCONWgf_iT3HPRla9nvGYtjwGPvqNk5y8F1VxfFPMAHDnJmBbjk9bwP1S0uAJczXWUJnyTkfSllBXzpCHvjySb36llAyyc1MvznQ4WYmikEmA26LKb8vf18TIp_l2fI3NJrmYLnWw=s16000 -cl: displays the content length of a webpage<o:p
-ml: matches the content length with the input provided and displays only the results matching the content length<o:p cat list | httpx -ml 3563 -cl<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhSR_kOwZcqSWfOZ82H4VlEJ1G5-LixVZzOYtYEpC310ydx2bmVwrA3MCGTP-BN4UBbHG5X1A4-4bYu1E6rLML1i2H4zwNQl_NeIPxYMvFJHfjwhq-AOr6qfqYnqMVg1WDsgvF4_e9dUoUPPsesYV72gMnxaZLiZ3oMnNwOnLTEIFZxj1RNXhomckpeyw=s16000 -mwc: matches the word count and displays only the results with same word count<o:p cat list | httpx -mwc 580 -wc<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiUGGTLTtQTIcfsIANfEkAk7gN_DSbc7vUCQjg1wVsFAKzsJ_1D_1MBlrO48hNF1EtiaeBQb_PwHJjZf4nT78sf8DWSuFOyMhCJDmcuw76_H94XYbQehlFDAHtJDD5Pfn_UDdPMVtcBff7SjyLRNgvsE45GzjktYdVsFdX8iNuxTtxeuvYYrztNEtH4Hw=s16000 -ms: displays only the results where text on a page matches the provided string. Here, pages with “login” in their text are loaded<o:p cat list | httpx -ms "login"<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEj97pwpigLNnt3kDhKKp7nZnNdZ_Bd3-SCYMDgJmFcKeeUOmf7fZfe928WCCiCFhWDC_gY3S9oTzz6PMmza05PYCee5rX862gE0TyzaD3x3l3GQoMfGUzSP9HKtQs8ZoXQ4E9HufEzJsDMrQzcRk85SCkA7dZGOHEH29AmkctIRN2Hr-AhGapELgCKaWQ=s16000 -er: extract regular expressions. Displays only the results where resulting pages match the regex pattern provided. An example regex is \w which compares the provided string with the resulting page’s output.<o:p echo "http://testphp.vulnweb.com" | httpx -er "\w test"<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEggV7SxthocXjWoEhSGAQ6VuUqA8D5WlSLQCq46MZ9zHiHjx1gtoN5AZpjTo-ak7sQ2DDQv4qWK11WDB93iqshrtLKb3zFY9nShvLVWhMV13CRHeKPkseSaKJUKvrks3gHRuhKs4Sewv6unu9Dm80o3-C5vwl9xf3eTeSP0nziOgSD_XMkV8p8yElnWQQ=s16000 Here, you can see the output stands like u test, o test. The tool has filtered the following text and displayed in output:<o:p https://blogger.googleusercontent.com/img/a/AVvXsEjgu0WAIPzvIZAw7-WoCQLGbEpUPglE4iMQPL6QslgEF2_6oGrOp_1fbCScQAc3ttylpWQriA8oL5gLpAlbDiXmJ-ZR0Pu_mIGQdDqU6TsKcqY693VEsm4G2Dl7gEMeOi5GMpdcoQrpUTkaGmhcwo3oidTjt-WRX34RCLEUp2QibQGjv8qbJ3hnOqZlag=s16000 Content filters<o:pVarious filters are available at disposal in the tool that eliminates the results upon matching the criteria/condition provided. For example,<o:p
-fc: filters code. Tool only displays status codes not listed by fc (404 here so only 200 is visible)&l[...]
Hacking Articles Tips Tricks Videos Tutorials
BU-Ekct5tgcJNK51hU_eFMGSS4ZBnKFN057ZH_OSRzzG33V3Ey9cD7c96PwT-RKxbxigPeZBUDIOfjQQs6T0jBIVw1LYRsVwUYTKp6RzedqW51iJghenxQ3f87B4AL0r_tSdH_s7swP7ybRGzbDJjnQhZ29NxUHbQhRcWm_UXc-A=s16000 -lc: displays the line count of scanned web page<o:p -wc: displays the word…
t;o:p cat list | httpx -sc<o:pcat list | httpx -sc -fc 404<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhuiFqokWVCnPiYTu3U0W29vl5t2s15ICqn8GCZERknvk5CPePhRV58vzot-2jTMD9Ybpt8c6O1Hej6aU5zVC6yclwQPCVtDLnbfvtVzx7lCRBQj_ADi8hsK2UUH_mXd-LvBxYgkQGxw4xkKbePMm5mrPsYedptqF6RckjclBi150IASOjqawriSEdeng=s16000 -fl: filters content length. Here, 16 and 12401 is filtered so all the output except these two are visible<o:p cat list | httpx -cl -fl 16,12401<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEih9BMUuXOhzJrCoFFa0MMWplbDHzpqt_84dy4W4aCVMlrWoGDczG6NLes1P1sBqpPfbsEpJHHeUMBWD_hR9l8Uk912FyKBnZoTV35eK4PH4-ryN3aijGshgxCxkDh3ZYSnPcLcA4kwxtO3AAzLkp_NJ5tFl2U0N3CIXMJwVMmo-7Wl8OMAf9tFnS8f-w=s16000 -fwc: filters the word count. Here, 3 and 580 is filtered so all the output except these two are visible<o:p cat list | httpx -wc -fwc 3,580<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgy2FOoxte3XNKFtNiDFFU8NVtVx9iRwxFNFupJ_YeqcJon1LMaCsxmbNU9HE0c8A4pSxaOW8Ge7xxjoOoy66-taMX_IKn-S8BtoRfkw5BrBL3sZbYodPEH4durITeoVvt_UvRPLEYs3bhZx9DFVyhUF95qkbr_tJy9SA8JolkWnG1DAuW_74hlGyltAA=s16000 -flc: filter line count. Here, 2 and 89 is filtered so all the output except these two are visible<o:p cat list | httpx -lc -flc 2,89<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiqDNezwvf_adtN4LyoVa6J2Z_jHDGFjhN4bswa6-P9VkGN6YlYkO4utdj9KahtPHwzcATHxorSZapOUmChDqe64nI0QMBUUN6HwmIePq-52NKjCCbbfNSD692e9tRrpy7DxO_KWDxTYv5BlaHqku4SW2Mn6XHr8C2LPp7yqZYgF8y-UGNJcgjirkWExg=s16000 -fs: filter the output with the provided string. Here, “test” is provided, so webpages not containing the string “test” is displayed. This string must only be in the text on web page.<o:p cat list | httpx -fs test<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhJqz_5zPOIFn6lygNP2lwBvI44t9QCMUGZ0B2vsrZ79Xlk--NhYQraGMFyiQ3If_9_q6wkTfv6DiYwbGZWoj37Fsk1EgDgQGqZbebaijF8grcoK8uJRUA-9otYN9uYHEYrpGeT23NDGAOjyBcwupOm9ICLpbvCqD_YfvqPBp1pcwzuMgOFe6IMuEP0zQ=s16000 -ffc: favicon filter. Only the output with favicons that are not “-215994923” are displayed.<o:p cat list | httpx -favicon -ffc -215994923<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgBonM7jOl_tDlKHTViJdsc8wr4tmitSIQVpyUFdrqLcWTES00NrrKuSQOFNHEj2RKZJd_km-obcTVr0o9Vx4JmwkmAfSRN65c2IQNuNdYjPbA1HuQqZDaaj9r6veyvZzjxFLy5pSHGazkhKibdYwz_N1BbDlrMOmWEcWx3fbbod2kvWIEsthLOsOJ-Hg=s16000 Rates and Timeouts<o:pThere are various modules that lets a user play around with the rate of scan and throttle the speed of the same. Some of these options are:<o:p
-t: specify the number of threads used for scan. Can be as high as 150. Default 50.<o:p
-rl: specifies the rate limit in requests per second<o:p
-rlm: specifies the rate limit in requests per minute<o:p cat list | httpx -sc -probe -t 10 -rl 1 -rlm 600<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhjJQ68aqHALxLer1B3W19CHa5ZC7Y1q3_rMOJOv21T2ZyHytNzPGdRgARhzFqiC6nw9nqpfGgYbyUoc3KdVj7DWRVdg-vcCnAgwRlneXG69V9HOvmCG_ndaZmP7NkBkQzzCpkPS6MTkYAYBvGqXlqhBWoOXkhedPk9qiQHaif_oOz2XSONXqOjOGgsug=s16000 -timeout: To abort the scan in specified seconds<o:p
-retries: Number of retries before aborting the scan<o:p cat list | httpx -sc -probe -threads 50 -timeout 60 -retries 5<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhUM3UxpMU4hMxayxYKcnLrdyyUZASZsQU1gfqJyx5c1vQf46LHdcDxG8qv6yU316nR3yrQxA7whGOeyhKO5ONYcnT0ia-2i8hM61Y7A4gvw7FXXKhVTpDxHfe-GAytA7aZN8xY6JDpUkgbT3MaBhQI5g6nTPAFlOaEDoxg-C1riucyg8eFNw0Xe4AQMg=s16000 Show Responses and Requests<o:pHttpx crafts and sends out http requests in real time and then post processes the results. These requests and corresponding responses can be viewed as well. For example,<o:p
-debug: it shows request and response to a webpage in CLI<o:p echo “http://testphp.vulnweb.com” | httpx -debug<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhCGEvpG_qThOHAnTf1Df2IqKC2Mxcc6m[...]
-t: specify the number of threads used for scan. Can be as high as 150. Default 50.<o:p
-rl: specifies the rate limit in requests per second<o:p
-rlm: specifies the rate limit in requests per minute<o:p cat list | httpx -sc -probe -t 10 -rl 1 -rlm 600<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhjJQ68aqHALxLer1B3W19CHa5ZC7Y1q3_rMOJOv21T2ZyHytNzPGdRgARhzFqiC6nw9nqpfGgYbyUoc3KdVj7DWRVdg-vcCnAgwRlneXG69V9HOvmCG_ndaZmP7NkBkQzzCpkPS6MTkYAYBvGqXlqhBWoOXkhedPk9qiQHaif_oOz2XSONXqOjOGgsug=s16000 -timeout: To abort the scan in specified seconds<o:p
-retries: Number of retries before aborting the scan<o:p cat list | httpx -sc -probe -threads 50 -timeout 60 -retries 5<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhUM3UxpMU4hMxayxYKcnLrdyyUZASZsQU1gfqJyx5c1vQf46LHdcDxG8qv6yU316nR3yrQxA7whGOeyhKO5ONYcnT0ia-2i8hM61Y7A4gvw7FXXKhVTpDxHfe-GAytA7aZN8xY6JDpUkgbT3MaBhQI5g6nTPAFlOaEDoxg-C1riucyg8eFNw0Xe4AQMg=s16000 Show Responses and Requests<o:pHttpx crafts and sends out http requests in real time and then post processes the results. These requests and corresponding responses can be viewed as well. For example,<o:p
-debug: it shows request and response to a webpage in CLI<o:p echo “http://testphp.vulnweb.com” | httpx -debug<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhCGEvpG_qThOHAnTf1Df2IqKC2Mxcc6m[...]
Hacking Articles Tips Tricks Videos Tutorials
t;o:p cat list | httpx -sc<o:pcat list | httpx -sc -fc 404<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhuiFqokWVCnPiYTu3U0W29vl5t2s15ICqn8GCZERknvk5CPePhRV58vzot-2jTMD9Ybpt8c6O1Hej6aU5zVC6yclwQPCVtDLnbfvtVzx7lCRBQj_ADi8hsK2UUH_mXd-LvBxYgkQGxw4xkK…
dCIpwpFt_99unLTXkQETb65Is786ADWIb6mj0delHprSvdsj6ppzgyG9lz_VaLj1dIcqC2JwzwBtxR6EhYNn0GOFwUtBHckN5XcxRb0NwLlBL8Jz5aDaMy_IN1YPUic9lfgBy7MfXoKBjgoF7rRk5eZsd_IQ=s16000 -debug-req: Displays the outgoing HTTP request<o:p
-debug-resp: Displays the corresponding HTTP response<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgwFPwm2Cye9r3CwN-ijP8qjTYzPL4M-fISRnlTys9IxDXXrotJlRDWWhxzg7o9SwffHKciGHlI3iyIdFtRZu8-6BAKkFlRkHZEWdjBA4l3jZKBgGwIGbzie73nUUmjdXVYcYJ7JdSiHhsLpsSCDjkq_mmw388x3V_R9n0M6N37Zcj0TQlu8b0CvWrvUw=s16000 -stats: displays the current scan stats including completion percentage<o:p cat list | httpx -stats<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiCmkBdmNuiXfKRO-3mW-5dP_MffgfcdP9hIsxqoX4cgJ7ocKrPvjt8MaypzIPE0-nh8TP844h-ftiOdV8yh1_OccYKntVJJF6qoHzMAyYCGSy_rDbyEXYu5iU1Ka8iZmFxPQ-fUGrKZML35NYCuaYGV05Wwam7vsi5Bh-vaVT-siCRb1bxjguBpLYW_Q=s16000 Filtering for SQL Injections<o:pAs we know that some types of SQL injections are reflected in the code output. We can detect such injections by filtering the output of a web page. In error based SQLi, an error is thrown which is reflected in the output page. As you can see in the command below we have used -ms filter to compare and find such pages. Ideally, an attacker can give a list of input and find common SQLi vulnerabilities in the similar way. In the output below, where the vuln is found, httpx displays that website’s name.<o:p echo “http://testphp.vulnweb.com” | httpx -path “/listproducts.php?cat=1’” -ms “Error: You have an error in your SQL syntax;”<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhAu9RTErg8tosLtBEdTr_GazHPR2pQWI70rlwTCm-PHiUw4sUr5XZs8sZuhegnoxHLeXqjUC6AmMtkV1ZdcX6IsSjUjJTqFQov0m21tAsNrUlhF__PhMxTGFDgHGO_LUYKDc3vaQKGE57GHRPpPxkO-JhCyq_FnYJQgncOrAF0yyqYgTn7ZQBPqaqwYg=s16000 Filtering for XSS reflections<o:pReflected XSS by definition gets reflected in the web page’s output. <o:p https://blogger.googleusercontent.com/img/a/AVvXsEjUSBjJcN33oq2ekAdJkMtRcMCUGBk_CRED_fIrLj7ka-g3dV0DyPdvKr9lW39sPdJ82NvIqwC94Es-BHnu0agzgYgbHegLy0o8DADavyo9matoST36ZTdTkQ7pmQxA4dCqJb40UCHIiyplngelIAtf0oSw-x_4PlafvFM9g5acGR3xdVw03B_APK__pg=s16000 An attacker can input a list of websites and then a list of path to check for reflected XSS in bunches. In the example below, “-ms” module is used which is supposed to match the output webpage’s text content with the input provided. Since reflected XSS is shown in output, tool displays the name of the webpage where this vulnerability (payload output in the code) is observed.<o:p echo "http://testphp.vulnweb.com" | httpx -path "/listproducts.php?cat=" -ms ""<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEg0SATrZaFiM5GJXKVT7W6_cRC9cwlTFUlqLoiznGO587GPps-BmRLWdoryW8_wIIxd5Utqw61-ojOtRRiWex977abgeewSDnFby0xyctmnaRly6aS1OkKxCTvA_L8K94xVZODz0mIQgwjRIwf0L2Mn5009GXbBwgYXoQVMNpDErwhikPUBOGKstdkYHA=s16000 Web Page Fuzzing<o:pHttpx is a great tool which can be used to fuzz web pages. “-path” module can be used to provide the name of the file to be fuzzed for existence on the server.<o:p
-path: path/list of paths to probe<o:p echo “http://testphp.vulnweb.com” | httpx -probe -sc -path “/login.php”<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEh46SKO1qFjbjumDukvGLqeQ_Uv2DYcig36OnG6ErQCDRNgyFNwdYudjn-9T8AD7jTjlsGH1mQameb8dgnaPDaU9uUFAc-eVP97fV9qyKs2QKuaWiaG0hr6qC2zdZ4iKokHzGW-H6ml_jYvZDevILYHG4WjORJs91bLPOMoPiJAVDkikXRcbis1QxkhOw=s16000 File output<o:pThe scan results provided by the tool can also be exported for convenience. The most basic output is a text file with just webpages in every line. This can be useful for a variety of occasions while pentesting. Such modules are:<o:p
-o: Saves a result in a text output file<o:p cat list | httpx -sc -o /root/results.txt<o:pcat results.txt<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhYlMet5wQkj1NKhxsCoGoGKpEwo6UY7f5Sh1SrBFef_Pvuye8-rzL[...]
-debug-resp: Displays the corresponding HTTP response<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgwFPwm2Cye9r3CwN-ijP8qjTYzPL4M-fISRnlTys9IxDXXrotJlRDWWhxzg7o9SwffHKciGHlI3iyIdFtRZu8-6BAKkFlRkHZEWdjBA4l3jZKBgGwIGbzie73nUUmjdXVYcYJ7JdSiHhsLpsSCDjkq_mmw388x3V_R9n0M6N37Zcj0TQlu8b0CvWrvUw=s16000 -stats: displays the current scan stats including completion percentage<o:p cat list | httpx -stats<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiCmkBdmNuiXfKRO-3mW-5dP_MffgfcdP9hIsxqoX4cgJ7ocKrPvjt8MaypzIPE0-nh8TP844h-ftiOdV8yh1_OccYKntVJJF6qoHzMAyYCGSy_rDbyEXYu5iU1Ka8iZmFxPQ-fUGrKZML35NYCuaYGV05Wwam7vsi5Bh-vaVT-siCRb1bxjguBpLYW_Q=s16000 Filtering for SQL Injections<o:pAs we know that some types of SQL injections are reflected in the code output. We can detect such injections by filtering the output of a web page. In error based SQLi, an error is thrown which is reflected in the output page. As you can see in the command below we have used -ms filter to compare and find such pages. Ideally, an attacker can give a list of input and find common SQLi vulnerabilities in the similar way. In the output below, where the vuln is found, httpx displays that website’s name.<o:p echo “http://testphp.vulnweb.com” | httpx -path “/listproducts.php?cat=1’” -ms “Error: You have an error in your SQL syntax;”<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhAu9RTErg8tosLtBEdTr_GazHPR2pQWI70rlwTCm-PHiUw4sUr5XZs8sZuhegnoxHLeXqjUC6AmMtkV1ZdcX6IsSjUjJTqFQov0m21tAsNrUlhF__PhMxTGFDgHGO_LUYKDc3vaQKGE57GHRPpPxkO-JhCyq_FnYJQgncOrAF0yyqYgTn7ZQBPqaqwYg=s16000 Filtering for XSS reflections<o:pReflected XSS by definition gets reflected in the web page’s output. <o:p https://blogger.googleusercontent.com/img/a/AVvXsEjUSBjJcN33oq2ekAdJkMtRcMCUGBk_CRED_fIrLj7ka-g3dV0DyPdvKr9lW39sPdJ82NvIqwC94Es-BHnu0agzgYgbHegLy0o8DADavyo9matoST36ZTdTkQ7pmQxA4dCqJb40UCHIiyplngelIAtf0oSw-x_4PlafvFM9g5acGR3xdVw03B_APK__pg=s16000 An attacker can input a list of websites and then a list of path to check for reflected XSS in bunches. In the example below, “-ms” module is used which is supposed to match the output webpage’s text content with the input provided. Since reflected XSS is shown in output, tool displays the name of the webpage where this vulnerability (payload output in the code) is observed.<o:p echo "http://testphp.vulnweb.com" | httpx -path "/listproducts.php?cat=" -ms ""<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEg0SATrZaFiM5GJXKVT7W6_cRC9cwlTFUlqLoiznGO587GPps-BmRLWdoryW8_wIIxd5Utqw61-ojOtRRiWex977abgeewSDnFby0xyctmnaRly6aS1OkKxCTvA_L8K94xVZODz0mIQgwjRIwf0L2Mn5009GXbBwgYXoQVMNpDErwhikPUBOGKstdkYHA=s16000 Web Page Fuzzing<o:pHttpx is a great tool which can be used to fuzz web pages. “-path” module can be used to provide the name of the file to be fuzzed for existence on the server.<o:p
-path: path/list of paths to probe<o:p echo “http://testphp.vulnweb.com” | httpx -probe -sc -path “/login.php”<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEh46SKO1qFjbjumDukvGLqeQ_Uv2DYcig36OnG6ErQCDRNgyFNwdYudjn-9T8AD7jTjlsGH1mQameb8dgnaPDaU9uUFAc-eVP97fV9qyKs2QKuaWiaG0hr6qC2zdZ4iKokHzGW-H6ml_jYvZDevILYHG4WjORJs91bLPOMoPiJAVDkikXRcbis1QxkhOw=s16000 File output<o:pThe scan results provided by the tool can also be exported for convenience. The most basic output is a text file with just webpages in every line. This can be useful for a variety of occasions while pentesting. Such modules are:<o:p
-o: Saves a result in a text output file<o:p cat list | httpx -sc -o /root/results.txt<o:pcat results.txt<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhYlMet5wQkj1NKhxsCoGoGKpEwo6UY7f5Sh1SrBFef_Pvuye8-rzL[...]
Hacking Articles Tips Tricks Videos Tutorials
dCIpwpFt_99unLTXkQETb65Is786ADWIb6mj0delHprSvdsj6ppzgyG9lz_VaLj1dIcqC2JwzwBtxR6EhYNn0GOFwUtBHckN5XcxRb0NwLlBL8Jz5aDaMy_IN1YPUic9lfgBy7MfXoKBjgoF7rRk5eZsd_IQ=s16000 -debug-req: Displays the outgoing HTTP request<o:p -debug-resp: Displays the corresponding…
IHcyPCqnosZSFc-MmTRUUS7kmYvimsyjyETsUgOANDQ190b8jnHuBZ0QK3b1L7ddAxjsrqji_vinEnBrXXm2_Zu9w2kga_peO4CfDOymiu3DaEFQhSscSdsjqOgCbHXSb5Qy4iA=s16000 The same results can be saved in other formats too. Like,<o:p
-csv: Stores the scan results in CSV format. Default scan includes almost all of the content probes.<o:p cat list | httpx -sc -csv -o /root/results.csv<o:pcat results.csv<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhRhIkcza7HMa4gOb5lQlmNplkIvp53BX2yHx5BBGgat8zXSf-bDKl5J7UWeptJXv5anfwgHZmwmFEH3BOIsWxeXddtjaLLUaw2ityaYmU2NPZQF3AfNEykLv9jHkV7zKGmW38P1J7FyCQbX7h0z0LbASN300FFoSaZo_HXHhMfpv4D8Yt2eIBGT5FoFQ=s16000 -json: Stores the scan results in json format. Default scan includes almost all the content probes<o:p cat list | httpx -sc -json -o /root/results.json<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhMoED5fGV0xKP9VQUi5K5eUWrQZ2JKGsZd3YZ1tqjr4RmGT4ogcepIZ3cx0YH-ZGOvKcjZ4BcuRp6pq4YtLJMzA00H0h0-egVcZpvwphsqfI2X5nlkvmB7vRUD2xliL38cMkuIpQwnj7974A3lnHl4u3VNtaZrCHLvKHyj9nDTqKLHHM9drcJcoAhirg=s16000 -srd: stores corresponding HTTP responses in custom directory with naming: “URL.txt”<o:p cat list | httpx -sc -o /root/results.txt -srd /root/responses<o:pcat /root/responses/rest.vulnweb.com.txt<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjC5DI04Er_J5Ie4ouhW0YGJRzvGVzMCqGSDE5xM3iR9-jNWcIUSoJlImg823gTiTWjT5ih8NJpSGPN9svTQXQA2_IqvVDwFs-FzVRl54r_ZBg326lpi3f14i6vpTb0m-ipDw3ia-SCDXCQ37TzhKb8DIz8VZviHSy1F-6JfcY6-5b0xQJXHAcYR3eUig=s16000 TCP/IP customizations<o:pSome filters are available to conduct an in-depth reconnaissance. These filters are extremely helpful in cases where an attacker needs to conduct basic network level reconnaissance too.<o:p
-pa: probes all IPs associated with the same host provided. Often same website is utilizing multiple IP addresses for different purposes.<o:p echo "http://hackerone.com" | httpx -pa -probehttps://blogger.googleusercontent.com/img/a/AVvXsEhB0xiJhzUfUbMGxUXwPOP320YUW-Od1LPGOIHtQ403Fm2zG8WWiP5M4_HTIBmxQ0iwHaFzJB2h96Qorswq4X8WFDIUweAVLVNsbe3tw0WmPL4XNKubFNbe1mOcXYPbENJm7uhFZ19AgKSWeTqR0axUpqYjMicJ6fWJwhTdfH0Ur9RSAaxHggbwlZD7Ng=s16000 -p: scans the specified ports either as a list (in the format 80,443) or by providing absolute range (format 1-1023)<o:p echo "http://hackerone.com" | httpx -p 22,25,80,443,3306 -probe<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhOyFXdlocLJBO2tH74-UXFvf6K9y4yEm9gi74t9Tr2XYdBWKLzzWjfDvnW4mZuorvl9s4rROmZ62FhJZGqNp8aOxPOvVpJZ6TQx91kAD7bjaVyyv_4jB3PahMFZl3BZX3xKivYX0j1tLJkz8nIW5i5nxNsb--jDM2KC9V3Nh-f7hL8S8J_iGgtC8A9xg=s16000 POST Login<o:pHttpx can also be used to send POST requests. It can also be used to log into a page and read responses. For example, the page /userinfo.php is alogin portal and can be logged in with credentials test:test. The corresponding request in burp suite looks like<o:p https://blogger.googleusercontent.com/img/a/AVvXsEh5v5fov0RtLAof6b-hnFKVi--FdH3b6_LcJCK0F6WFAXNIB9T2nj_Tj0G0Zj8eA40-yy7uoQjXkH6_rejTweydG93MNwx_R60uQKDmOB8A2UAtzgxgVU_Pk5cuj3K7IA4nyY1hle14YjRlOAVZl6I_ZLCl1bkH4116pZ3Dbe55XJCqs1t-QhSkvkQtZg=s16000 To replicate the same request, httpx provides various modules<o:p
-x: specify the HTTP request options. GET, POST, PUT etc.<o:p
-H: provides custom headers to be sent<o:p
-body: specifies the additional data in the body to be sent along with the request<o:p
As you can see in the screenshot below, the tool has logged in (200 OK) and displaying the output of the profile page.<o:p echo "http://testphp.vulnweb.com" | httpx -debug-resp -x post -path "/userinfo.php" -H "Cookie: login=test%2Ftest" -body "uname=test&pass=test"<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEihPeBA5Hrk07516xhJi5ZHF-4V2CIWCNojeDo0MvTsMD9--4sGxWBEGRzQhk-UgnhxKv3EI-3z_aQqRSbO0OMqx-48w4sTOCb_UIdGNV82V2WbIJbGOuO9VSoT8lN-dENwcYqYxo8Z8kdxUOKnnomvAnT8kBAGFLe[...]
-csv: Stores the scan results in CSV format. Default scan includes almost all of the content probes.<o:p cat list | httpx -sc -csv -o /root/results.csv<o:pcat results.csv<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhRhIkcza7HMa4gOb5lQlmNplkIvp53BX2yHx5BBGgat8zXSf-bDKl5J7UWeptJXv5anfwgHZmwmFEH3BOIsWxeXddtjaLLUaw2ityaYmU2NPZQF3AfNEykLv9jHkV7zKGmW38P1J7FyCQbX7h0z0LbASN300FFoSaZo_HXHhMfpv4D8Yt2eIBGT5FoFQ=s16000 -json: Stores the scan results in json format. Default scan includes almost all the content probes<o:p cat list | httpx -sc -json -o /root/results.json<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhMoED5fGV0xKP9VQUi5K5eUWrQZ2JKGsZd3YZ1tqjr4RmGT4ogcepIZ3cx0YH-ZGOvKcjZ4BcuRp6pq4YtLJMzA00H0h0-egVcZpvwphsqfI2X5nlkvmB7vRUD2xliL38cMkuIpQwnj7974A3lnHl4u3VNtaZrCHLvKHyj9nDTqKLHHM9drcJcoAhirg=s16000 -srd: stores corresponding HTTP responses in custom directory with naming: “URL.txt”<o:p cat list | httpx -sc -o /root/results.txt -srd /root/responses<o:pcat /root/responses/rest.vulnweb.com.txt<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjC5DI04Er_J5Ie4ouhW0YGJRzvGVzMCqGSDE5xM3iR9-jNWcIUSoJlImg823gTiTWjT5ih8NJpSGPN9svTQXQA2_IqvVDwFs-FzVRl54r_ZBg326lpi3f14i6vpTb0m-ipDw3ia-SCDXCQ37TzhKb8DIz8VZviHSy1F-6JfcY6-5b0xQJXHAcYR3eUig=s16000 TCP/IP customizations<o:pSome filters are available to conduct an in-depth reconnaissance. These filters are extremely helpful in cases where an attacker needs to conduct basic network level reconnaissance too.<o:p
-pa: probes all IPs associated with the same host provided. Often same website is utilizing multiple IP addresses for different purposes.<o:p echo "http://hackerone.com" | httpx -pa -probehttps://blogger.googleusercontent.com/img/a/AVvXsEhB0xiJhzUfUbMGxUXwPOP320YUW-Od1LPGOIHtQ403Fm2zG8WWiP5M4_HTIBmxQ0iwHaFzJB2h96Qorswq4X8WFDIUweAVLVNsbe3tw0WmPL4XNKubFNbe1mOcXYPbENJm7uhFZ19AgKSWeTqR0axUpqYjMicJ6fWJwhTdfH0Ur9RSAaxHggbwlZD7Ng=s16000 -p: scans the specified ports either as a list (in the format 80,443) or by providing absolute range (format 1-1023)<o:p echo "http://hackerone.com" | httpx -p 22,25,80,443,3306 -probe<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhOyFXdlocLJBO2tH74-UXFvf6K9y4yEm9gi74t9Tr2XYdBWKLzzWjfDvnW4mZuorvl9s4rROmZ62FhJZGqNp8aOxPOvVpJZ6TQx91kAD7bjaVyyv_4jB3PahMFZl3BZX3xKivYX0j1tLJkz8nIW5i5nxNsb--jDM2KC9V3Nh-f7hL8S8J_iGgtC8A9xg=s16000 POST Login<o:pHttpx can also be used to send POST requests. It can also be used to log into a page and read responses. For example, the page /userinfo.php is alogin portal and can be logged in with credentials test:test. The corresponding request in burp suite looks like<o:p https://blogger.googleusercontent.com/img/a/AVvXsEh5v5fov0RtLAof6b-hnFKVi--FdH3b6_LcJCK0F6WFAXNIB9T2nj_Tj0G0Zj8eA40-yy7uoQjXkH6_rejTweydG93MNwx_R60uQKDmOB8A2UAtzgxgVU_Pk5cuj3K7IA4nyY1hle14YjRlOAVZl6I_ZLCl1bkH4116pZ3Dbe55XJCqs1t-QhSkvkQtZg=s16000 To replicate the same request, httpx provides various modules<o:p
-x: specify the HTTP request options. GET, POST, PUT etc.<o:p
-H: provides custom headers to be sent<o:p
-body: specifies the additional data in the body to be sent along with the request<o:p
As you can see in the screenshot below, the tool has logged in (200 OK) and displaying the output of the profile page.<o:p echo "http://testphp.vulnweb.com" | httpx -debug-resp -x post -path "/userinfo.php" -H "Cookie: login=test%2Ftest" -body "uname=test&pass=test"<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEihPeBA5Hrk07516xhJi5ZHF-4V2CIWCNojeDo0MvTsMD9--4sGxWBEGRzQhk-UgnhxKv3EI-3z_aQqRSbO0OMqx-48w4sTOCb_UIdGNV82V2WbIJbGOuO9VSoT8lN-dENwcYqYxo8Z8kdxUOKnnomvAnT8kBAGFLe[...]
Hacking Articles Tips Tricks Videos Tutorials
IHcyPCqnosZSFc-MmTRUUS7kmYvimsyjyETsUgOANDQ190b8jnHuBZ0QK3b1L7ddAxjsrqji_vinEnBrXXm2_Zu9w2kga_peO4CfDOymiu3DaEFQhSscSdsjqOgCbHXSb5Qy4iA=s16000 The same results can be saved in other formats too. Like,<o:p -csv: Stores the scan results in CSV format. Default…
oUHSvqT6XrnuCfGEKLCR8LjSiAg=s16000 HTTP Methods Probe<o:pThe “-x all” option probes all the HTTP OPTIONS (request methods) and displays which options are permitted on the webpage. It is a nifty tool for pentesting. As it is visible, all the options are permitted on the webserver.<o:p echo "http://testphp.vulnweb.com" | httpx -x all -probe<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiaNBWCRdHnhL4Indipc0G1EvbNpiOq6sOj-ZzMqYUrRAmV4vE156VpIc6jDEyHe8tQtLY8jjeAXESe698uUvEnqjwEpJC1lZzUS5BZIzXKvUSgwnNIO3MiliI7Ddn4C3V1AuBcZGqvr0kyigYkDedl1Cm7hRG43-3-APM3D_jPQSMBsKEBoJxdOx_Zmw=s16000 Routing though proxy<o:pHTTP requests can also be routed through custom proxies. For example, if we were to send requests through burp suite, we can use the “-http-proxy” module and specify the destination. Same can be done with socks proxy in the format, “socks5:127.0.0.1:9500”<o:p
And as you are able to see, request is now being captured in the proxy.<o:p echo "http://testphp.vulnweb.com" | httpx -x all -probe -http-proxy http://127.0.0.1:8080<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiOEWGbk4J4UnXg95YRewR53XsHrzsRTR2CnzYh30lExBKTt1a7xAftrnCeeocRrvddtdc4ug9t2e0uKS2g8b7Ep2vTWVZC-6sSmKVn5r2iOfwCk2kPaSz_PYIOVrW1wg7xZZelCwdmn0V8EO7kdfPv4q6kJuS9ZEJFd8FiLbCsz5onp5VfYaiVrnjuMw=s16000 Conclusion<o:pThe aim of the article was to serve as a ready reference for majority of the options available in httpx tool. We have covered almost all the working options as per the date of publishing of this article. Please feel free to check out the official repo for more and updated options here. Hope you liked the article. Thanks for reading.<o:p
And as you are able to see, request is now being captured in the proxy.<o:p echo "http://testphp.vulnweb.com" | httpx -x all -probe -http-proxy http://127.0.0.1:8080<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiOEWGbk4J4UnXg95YRewR53XsHrzsRTR2CnzYh30lExBKTt1a7xAftrnCeeocRrvddtdc4ug9t2e0uKS2g8b7Ep2vTWVZC-6sSmKVn5r2iOfwCk2kPaSz_PYIOVrW1wg7xZZelCwdmn0V8EO7kdfPv4q6kJuS9ZEJFd8FiLbCsz5onp5VfYaiVrnjuMw=s16000 Conclusion<o:pThe aim of the article was to serve as a ready reference for majority of the options available in httpx tool. We have covered almost all the working options as per the date of publishing of this article. Please feel free to check out the official repo for more and updated options here. Hope you liked the article. Thanks for reading.<o:p
Achieving Remote Code Execution via Unrestricted File Upload
$whoami:Continue reading on Medium »
Read more...
$whoami:Continue reading on Medium »
Read more...
Achieving Remote Code Execution via Unrestricted File Upload
$whoami:Continue reading on Medium »
Read more...
$whoami:Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Domain Codex Launches New Search Engine Tool for Researching Domain Intelligence
Domain Codex allows users to search more than 370 million Internet domain names and associated data.
➖ Sent by @TheFeedReaderBot ➖
Domain Codex Launches New Search Engine Tool for Researching Domain Intelligence
Domain Codex allows users to search more than 370 million Internet domain names and associated data.
➖ Sent by @TheFeedReaderBot ➖
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
CISA Hosts Eighth Cyber Storm Exercise With More than 200 Organizations
Participants across the globe worked together to respond to a simulated significant cyber incident impacting critical infrastructure.
➖ Sent by @TheFeedReaderBot ➖
CISA Hosts Eighth Cyber Storm Exercise With More than 200 Organizations
Participants across the globe worked together to respond to a simulated significant cyber incident impacting critical infrastructure.
➖ Sent by @TheFeedReaderBot ➖
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Secureworks Adds Hands-on-Keyboard-Detector to Taegis Platform
Detector helps prevent, detect, and respond to advanced threats with automation, machine learning, and threat intelligence.
➖ Sent by @TheFeedReaderBot ➖
Secureworks Adds Hands-on-Keyboard-Detector to Taegis Platform
Detector helps prevent, detect, and respond to advanced threats with automation, machine learning, and threat intelligence.
➖ Sent by @TheFeedReaderBot ➖
Achieving Remote Code Execution via Unrestricted File Upload
https://medium.com/@haroonhameed_76621/achieving-remote-code-execution-via-unrestricted-file-upload-6050f360c218?source=rss------bug_bounty-5
https://medium.com/@haroonhameed_76621/achieving-remote-code-execution-via-unrestricted-file-upload-6050f360c218?source=rss------bug_bounty-5
$whoami:Continue reading on Medium » (https://medium.com/@haroonhameed_76621/achieving-remote-code-execution-via-unrestricted-file-upload-6050f360c218?source=rss------bug_bounty-5)
Continue reading on Medium » (https://medium.com/@marsbase/marsbase-otc-bug-bounty-2767df24db75?source=rss------bug_bounty-5)