Hacking Articles Tips Tricks Videos Tutorials
dCIpwpFt_99unLTXkQETb65Is786ADWIb6mj0delHprSvdsj6ppzgyG9lz_VaLj1dIcqC2JwzwBtxR6EhYNn0GOFwUtBHckN5XcxRb0NwLlBL8Jz5aDaMy_IN1YPUic9lfgBy7MfXoKBjgoF7rRk5eZsd_IQ=s16000 -debug-req: Displays the outgoing HTTP request<o:p -debug-resp: Displays the corresponding…
IHcyPCqnosZSFc-MmTRUUS7kmYvimsyjyETsUgOANDQ190b8jnHuBZ0QK3b1L7ddAxjsrqji_vinEnBrXXm2_Zu9w2kga_peO4CfDOymiu3DaEFQhSscSdsjqOgCbHXSb5Qy4iA=s16000 The same results can be saved in other formats too. Like,<o:p
-csv: Stores the scan results in CSV format. Default scan includes almost all of the content probes.<o:p cat list | httpx -sc -csv -o /root/results.csv<o:pcat results.csv<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhRhIkcza7HMa4gOb5lQlmNplkIvp53BX2yHx5BBGgat8zXSf-bDKl5J7UWeptJXv5anfwgHZmwmFEH3BOIsWxeXddtjaLLUaw2ityaYmU2NPZQF3AfNEykLv9jHkV7zKGmW38P1J7FyCQbX7h0z0LbASN300FFoSaZo_HXHhMfpv4D8Yt2eIBGT5FoFQ=s16000 -json: Stores the scan results in json format. Default scan includes almost all the content probes<o:p cat list | httpx -sc -json -o /root/results.json<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhMoED5fGV0xKP9VQUi5K5eUWrQZ2JKGsZd3YZ1tqjr4RmGT4ogcepIZ3cx0YH-ZGOvKcjZ4BcuRp6pq4YtLJMzA00H0h0-egVcZpvwphsqfI2X5nlkvmB7vRUD2xliL38cMkuIpQwnj7974A3lnHl4u3VNtaZrCHLvKHyj9nDTqKLHHM9drcJcoAhirg=s16000 -srd: stores corresponding HTTP responses in custom directory with naming: “URL.txt”<o:p cat list | httpx -sc -o /root/results.txt -srd /root/responses<o:pcat /root/responses/rest.vulnweb.com.txt<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjC5DI04Er_J5Ie4ouhW0YGJRzvGVzMCqGSDE5xM3iR9-jNWcIUSoJlImg823gTiTWjT5ih8NJpSGPN9svTQXQA2_IqvVDwFs-FzVRl54r_ZBg326lpi3f14i6vpTb0m-ipDw3ia-SCDXCQ37TzhKb8DIz8VZviHSy1F-6JfcY6-5b0xQJXHAcYR3eUig=s16000 TCP/IP customizations<o:pSome filters are available to conduct an in-depth reconnaissance. These filters are extremely helpful in cases where an attacker needs to conduct basic network level reconnaissance too.<o:p
-pa: probes all IPs associated with the same host provided. Often same website is utilizing multiple IP addresses for different purposes.<o:p echo "http://hackerone.com" | httpx -pa -probehttps://blogger.googleusercontent.com/img/a/AVvXsEhB0xiJhzUfUbMGxUXwPOP320YUW-Od1LPGOIHtQ403Fm2zG8WWiP5M4_HTIBmxQ0iwHaFzJB2h96Qorswq4X8WFDIUweAVLVNsbe3tw0WmPL4XNKubFNbe1mOcXYPbENJm7uhFZ19AgKSWeTqR0axUpqYjMicJ6fWJwhTdfH0Ur9RSAaxHggbwlZD7Ng=s16000 -p: scans the specified ports either as a list (in the format 80,443) or by providing absolute range (format 1-1023)<o:p echo "http://hackerone.com" | httpx -p 22,25,80,443,3306 -probe<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhOyFXdlocLJBO2tH74-UXFvf6K9y4yEm9gi74t9Tr2XYdBWKLzzWjfDvnW4mZuorvl9s4rROmZ62FhJZGqNp8aOxPOvVpJZ6TQx91kAD7bjaVyyv_4jB3PahMFZl3BZX3xKivYX0j1tLJkz8nIW5i5nxNsb--jDM2KC9V3Nh-f7hL8S8J_iGgtC8A9xg=s16000 POST Login<o:pHttpx can also be used to send POST requests. It can also be used to log into a page and read responses. For example, the page /userinfo.php is alogin portal and can be logged in with credentials test:test. The corresponding request in burp suite looks like<o:p https://blogger.googleusercontent.com/img/a/AVvXsEh5v5fov0RtLAof6b-hnFKVi--FdH3b6_LcJCK0F6WFAXNIB9T2nj_Tj0G0Zj8eA40-yy7uoQjXkH6_rejTweydG93MNwx_R60uQKDmOB8A2UAtzgxgVU_Pk5cuj3K7IA4nyY1hle14YjRlOAVZl6I_ZLCl1bkH4116pZ3Dbe55XJCqs1t-QhSkvkQtZg=s16000 To replicate the same request, httpx provides various modules<o:p
-x: specify the HTTP request options. GET, POST, PUT etc.<o:p
-H: provides custom headers to be sent<o:p
-body: specifies the additional data in the body to be sent along with the request<o:p
As you can see in the screenshot below, the tool has logged in (200 OK) and displaying the output of the profile page.<o:p echo "http://testphp.vulnweb.com" | httpx -debug-resp -x post -path "/userinfo.php" -H "Cookie: login=test%2Ftest" -body "uname=test&pass=test"<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEihPeBA5Hrk07516xhJi5ZHF-4V2CIWCNojeDo0MvTsMD9--4sGxWBEGRzQhk-UgnhxKv3EI-3z_aQqRSbO0OMqx-48w4sTOCb_UIdGNV82V2WbIJbGOuO9VSoT8lN-dENwcYqYxo8Z8kdxUOKnnomvAnT8kBAGFLe[...]
-csv: Stores the scan results in CSV format. Default scan includes almost all of the content probes.<o:p cat list | httpx -sc -csv -o /root/results.csv<o:pcat results.csv<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhRhIkcza7HMa4gOb5lQlmNplkIvp53BX2yHx5BBGgat8zXSf-bDKl5J7UWeptJXv5anfwgHZmwmFEH3BOIsWxeXddtjaLLUaw2ityaYmU2NPZQF3AfNEykLv9jHkV7zKGmW38P1J7FyCQbX7h0z0LbASN300FFoSaZo_HXHhMfpv4D8Yt2eIBGT5FoFQ=s16000 -json: Stores the scan results in json format. Default scan includes almost all the content probes<o:p cat list | httpx -sc -json -o /root/results.json<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhMoED5fGV0xKP9VQUi5K5eUWrQZ2JKGsZd3YZ1tqjr4RmGT4ogcepIZ3cx0YH-ZGOvKcjZ4BcuRp6pq4YtLJMzA00H0h0-egVcZpvwphsqfI2X5nlkvmB7vRUD2xliL38cMkuIpQwnj7974A3lnHl4u3VNtaZrCHLvKHyj9nDTqKLHHM9drcJcoAhirg=s16000 -srd: stores corresponding HTTP responses in custom directory with naming: “URL.txt”<o:p cat list | httpx -sc -o /root/results.txt -srd /root/responses<o:pcat /root/responses/rest.vulnweb.com.txt<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjC5DI04Er_J5Ie4ouhW0YGJRzvGVzMCqGSDE5xM3iR9-jNWcIUSoJlImg823gTiTWjT5ih8NJpSGPN9svTQXQA2_IqvVDwFs-FzVRl54r_ZBg326lpi3f14i6vpTb0m-ipDw3ia-SCDXCQ37TzhKb8DIz8VZviHSy1F-6JfcY6-5b0xQJXHAcYR3eUig=s16000 TCP/IP customizations<o:pSome filters are available to conduct an in-depth reconnaissance. These filters are extremely helpful in cases where an attacker needs to conduct basic network level reconnaissance too.<o:p
-pa: probes all IPs associated with the same host provided. Often same website is utilizing multiple IP addresses for different purposes.<o:p echo "http://hackerone.com" | httpx -pa -probehttps://blogger.googleusercontent.com/img/a/AVvXsEhB0xiJhzUfUbMGxUXwPOP320YUW-Od1LPGOIHtQ403Fm2zG8WWiP5M4_HTIBmxQ0iwHaFzJB2h96Qorswq4X8WFDIUweAVLVNsbe3tw0WmPL4XNKubFNbe1mOcXYPbENJm7uhFZ19AgKSWeTqR0axUpqYjMicJ6fWJwhTdfH0Ur9RSAaxHggbwlZD7Ng=s16000 -p: scans the specified ports either as a list (in the format 80,443) or by providing absolute range (format 1-1023)<o:p echo "http://hackerone.com" | httpx -p 22,25,80,443,3306 -probe<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhOyFXdlocLJBO2tH74-UXFvf6K9y4yEm9gi74t9Tr2XYdBWKLzzWjfDvnW4mZuorvl9s4rROmZ62FhJZGqNp8aOxPOvVpJZ6TQx91kAD7bjaVyyv_4jB3PahMFZl3BZX3xKivYX0j1tLJkz8nIW5i5nxNsb--jDM2KC9V3Nh-f7hL8S8J_iGgtC8A9xg=s16000 POST Login<o:pHttpx can also be used to send POST requests. It can also be used to log into a page and read responses. For example, the page /userinfo.php is alogin portal and can be logged in with credentials test:test. The corresponding request in burp suite looks like<o:p https://blogger.googleusercontent.com/img/a/AVvXsEh5v5fov0RtLAof6b-hnFKVi--FdH3b6_LcJCK0F6WFAXNIB9T2nj_Tj0G0Zj8eA40-yy7uoQjXkH6_rejTweydG93MNwx_R60uQKDmOB8A2UAtzgxgVU_Pk5cuj3K7IA4nyY1hle14YjRlOAVZl6I_ZLCl1bkH4116pZ3Dbe55XJCqs1t-QhSkvkQtZg=s16000 To replicate the same request, httpx provides various modules<o:p
-x: specify the HTTP request options. GET, POST, PUT etc.<o:p
-H: provides custom headers to be sent<o:p
-body: specifies the additional data in the body to be sent along with the request<o:p
As you can see in the screenshot below, the tool has logged in (200 OK) and displaying the output of the profile page.<o:p echo "http://testphp.vulnweb.com" | httpx -debug-resp -x post -path "/userinfo.php" -H "Cookie: login=test%2Ftest" -body "uname=test&pass=test"<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEihPeBA5Hrk07516xhJi5ZHF-4V2CIWCNojeDo0MvTsMD9--4sGxWBEGRzQhk-UgnhxKv3EI-3z_aQqRSbO0OMqx-48w4sTOCb_UIdGNV82V2WbIJbGOuO9VSoT8lN-dENwcYqYxo8Z8kdxUOKnnomvAnT8kBAGFLe[...]
Hacking Articles Tips Tricks Videos Tutorials
IHcyPCqnosZSFc-MmTRUUS7kmYvimsyjyETsUgOANDQ190b8jnHuBZ0QK3b1L7ddAxjsrqji_vinEnBrXXm2_Zu9w2kga_peO4CfDOymiu3DaEFQhSscSdsjqOgCbHXSb5Qy4iA=s16000 The same results can be saved in other formats too. Like,<o:p -csv: Stores the scan results in CSV format. Default…
oUHSvqT6XrnuCfGEKLCR8LjSiAg=s16000 HTTP Methods Probe<o:pThe “-x all” option probes all the HTTP OPTIONS (request methods) and displays which options are permitted on the webpage. It is a nifty tool for pentesting. As it is visible, all the options are permitted on the webserver.<o:p echo "http://testphp.vulnweb.com" | httpx -x all -probe<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiaNBWCRdHnhL4Indipc0G1EvbNpiOq6sOj-ZzMqYUrRAmV4vE156VpIc6jDEyHe8tQtLY8jjeAXESe698uUvEnqjwEpJC1lZzUS5BZIzXKvUSgwnNIO3MiliI7Ddn4C3V1AuBcZGqvr0kyigYkDedl1Cm7hRG43-3-APM3D_jPQSMBsKEBoJxdOx_Zmw=s16000 Routing though proxy<o:pHTTP requests can also be routed through custom proxies. For example, if we were to send requests through burp suite, we can use the “-http-proxy” module and specify the destination. Same can be done with socks proxy in the format, “socks5:127.0.0.1:9500”<o:p
And as you are able to see, request is now being captured in the proxy.<o:p echo "http://testphp.vulnweb.com" | httpx -x all -probe -http-proxy http://127.0.0.1:8080<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiOEWGbk4J4UnXg95YRewR53XsHrzsRTR2CnzYh30lExBKTt1a7xAftrnCeeocRrvddtdc4ug9t2e0uKS2g8b7Ep2vTWVZC-6sSmKVn5r2iOfwCk2kPaSz_PYIOVrW1wg7xZZelCwdmn0V8EO7kdfPv4q6kJuS9ZEJFd8FiLbCsz5onp5VfYaiVrnjuMw=s16000 Conclusion<o:pThe aim of the article was to serve as a ready reference for majority of the options available in httpx tool. We have covered almost all the working options as per the date of publishing of this article. Please feel free to check out the official repo for more and updated options here. Hope you liked the article. Thanks for reading.<o:p
And as you are able to see, request is now being captured in the proxy.<o:p echo "http://testphp.vulnweb.com" | httpx -x all -probe -http-proxy http://127.0.0.1:8080<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiOEWGbk4J4UnXg95YRewR53XsHrzsRTR2CnzYh30lExBKTt1a7xAftrnCeeocRrvddtdc4ug9t2e0uKS2g8b7Ep2vTWVZC-6sSmKVn5r2iOfwCk2kPaSz_PYIOVrW1wg7xZZelCwdmn0V8EO7kdfPv4q6kJuS9ZEJFd8FiLbCsz5onp5VfYaiVrnjuMw=s16000 Conclusion<o:pThe aim of the article was to serve as a ready reference for majority of the options available in httpx tool. We have covered almost all the working options as per the date of publishing of this article. Please feel free to check out the official repo for more and updated options here. Hope you liked the article. Thanks for reading.<o:p
Achieving Remote Code Execution via Unrestricted File Upload
$whoami:Continue reading on Medium »
Read more...
$whoami:Continue reading on Medium »
Read more...
Achieving Remote Code Execution via Unrestricted File Upload
$whoami:Continue reading on Medium »
Read more...
$whoami:Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Domain Codex Launches New Search Engine Tool for Researching Domain Intelligence
Domain Codex allows users to search more than 370 million Internet domain names and associated data.
➖ Sent by @TheFeedReaderBot ➖
Domain Codex Launches New Search Engine Tool for Researching Domain Intelligence
Domain Codex allows users to search more than 370 million Internet domain names and associated data.
➖ Sent by @TheFeedReaderBot ➖
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
CISA Hosts Eighth Cyber Storm Exercise With More than 200 Organizations
Participants across the globe worked together to respond to a simulated significant cyber incident impacting critical infrastructure.
➖ Sent by @TheFeedReaderBot ➖
CISA Hosts Eighth Cyber Storm Exercise With More than 200 Organizations
Participants across the globe worked together to respond to a simulated significant cyber incident impacting critical infrastructure.
➖ Sent by @TheFeedReaderBot ➖
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Secureworks Adds Hands-on-Keyboard-Detector to Taegis Platform
Detector helps prevent, detect, and respond to advanced threats with automation, machine learning, and threat intelligence.
➖ Sent by @TheFeedReaderBot ➖
Secureworks Adds Hands-on-Keyboard-Detector to Taegis Platform
Detector helps prevent, detect, and respond to advanced threats with automation, machine learning, and threat intelligence.
➖ Sent by @TheFeedReaderBot ➖
Achieving Remote Code Execution via Unrestricted File Upload
https://medium.com/@haroonhameed_76621/achieving-remote-code-execution-via-unrestricted-file-upload-6050f360c218?source=rss------bug_bounty-5
https://medium.com/@haroonhameed_76621/achieving-remote-code-execution-via-unrestricted-file-upload-6050f360c218?source=rss------bug_bounty-5
$whoami:Continue reading on Medium » (https://medium.com/@haroonhameed_76621/achieving-remote-code-execution-via-unrestricted-file-upload-6050f360c218?source=rss------bug_bounty-5)
Continue reading on Medium » (https://medium.com/@marsbase/marsbase-otc-bug-bounty-2767df24db75?source=rss------bug_bounty-5)
Please avoid it because it is preventable.Continue reading on Medium » (https://adamwize.medium.com/burnout-and-me-63be6378dbad?source=rss------bug_bounty-5)