Black Hat Ethical Hacking
Recon Tool: ReconSpider

Recon Tool: ReconSpiderPost Views: 5 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes ReconSpiderReconSpider by bhavsec is one of the most advanced Open Source Intelligence (OSINT) Framework and Recon for scanning IP Addresses, Emails, Websites, and Organizations and finding out information from different sources. ReconSpider can be used by Infosec Researchers, Penetration Testers, Bug Hunters, and Cyber Crime Investigators to find deep information about their target. It also allows you to aggregate all the raw data, visualize it on a dashboard and facilitate alerting and monitoring of the data.

Recon Spider also combines the capabilities of Wave, Photon and Recon Dog to do a comprehensive enumeration of attack surface.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Why it’s called ReconSpider?ReconSpider = Recon + Spider

Recon = Reconnaissance

Reconnaissance is a mission to obtain information by various detection methods, about the activities and resources of an enemy or potential enemy, or geographic characteristics of a particular area.

Spider = Web crawler

A Web crawler, sometimes called a spider or spiderbot and often shortened to crawler, is an Internet bot that systematically browses the World Wide Web, typically for the purpose of Web indexing (web spidering). Version (beta)ReconSpider : 1.0.7Trending: OSINT Tool: Social Hunter
Trending: Offensive Security Tool: fuxploider Overview of the tool:* Performs OSINT scan on a IP Address, Emails, Websites, Organizations and find out information from different sources.
* Correlates and collaborate the results, show them in a consolidated manner.
* Use specific script / launch automated OSINT for consolidated data.
* Currently available in only Command Line Interface (CLI). Mind Map (v1)Check out their mind map to see visually organize information of this tool regarding api, services and techniques and more. https://bhavsec.com/img/reconspider_map.png ReconSpider Bannerhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/ReconSpider-Banner.png DocumentationInstalling and using ReconSpider is very easy. Installation process is very simple.

1. Downloading or cloning ReconSpider github repository.
2. Installing all dependencies.
3. Setting up the Database. Setting up the environmentStep 1 – Cloning ReconSpider on your linux system.

In order to download ReconSpider simply clone the GitHub repository. Below is the command which you can use in order to clone ReconSpider repository. git clone https://github.com/bhavsec/reconspider.gitStep 2 – Make sure python3 and python3-pip is installed on your system.

You can also perform a check by typing this command in your terminal. sudo apt install python3 python3-pipStep 3 – Installing all dependencies.

Once you clone and check python installation, you will find directory name as reconspider. Just go to that directory and install using these commands: cd reconspidersudo python3 setup.py installStep 4 – Setting up the Database.

IP2Proxy Database https://lite.ip2location.com/database/px8-ip-proxytype-country-region-city-isp-domain-usagetype-asn-lastseenDownload database, extract it and move to reconspider/plugins/ directory.
Trending: How to Exploit “improper error handling” in Web Applications Updating API KeysAPIs included in ReconSpider are FREE and having limited and restricted usage per month, Please update the current APIs with New APIs in setup.py file, and re-install once done to reflect the changes.

Warning: Not updating the APIs ca[...]

n result in not showing the expected output or it may show errors.

You need to create the account and get the API Keys from the following websites.

* Shodan.io – https://developer.shodan.io/api
* NumVerify – https://numverify.com/documentation
* IP Stack – https://ipstack.com/documentation
* Google Maps – https://developers.google.com/maps/documentation/places/web-service/get-api-key Usage (Click here to see the full usage)ReconSpider Full Wiki and How-to GuidePlease go through the ReconSpider Wiki Guide for a detailed explanation of each and every option and feature.
Clone the repo from here: GitHub Link
Trending: How do QR Codes work and how criminal hackers use them to generate phishing attacks – Demo https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Social-Hunter-300x150.png OSINT Tool: Social HunterSeptember 22, 2022
Reading Time: 2 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/dnsReaper-300x150.png Offensive Security Tool: dnsReaperSeptember 16, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/fuxploider-300x150.png Offensive Security Tool: fuxploiderSeptember 9, 2022
Reading Time: 2 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/ZenBuster-300x150.png Recon Tool: ZenBusterSeptember 2, 2022
Reading Time: 4 minutes https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Recon Tool: ReconSpider first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

List of Cybersecurity YouTubers for Beginners
https://cybersecurityspiral.medium.com/list-of-cybersecurity-youtubers-for-beginners-59071d6be9e6?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

This is a list of top 10 cybersecurity-related YouTube channels that I found extremely practical for beginners.Continue reading on Medium » (https://cybersecurityspiral.medium.com/list-of-cybersecurity-youtubers-for-beginners-59071d6be9e6?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
SCodeScanner - Stands For Source Code Scanner Where The User Can Scans The Source Code For Finding The Critical Vulnerabilities

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiB8XwFXLSZNCYm28Vi0TzfVTKdKOKVeDzD7IyCLkQNpElSpPzYL9MQj6JKtR4bIELZZuEfcz9UHAB3qsV7I1AD4_A7LaPWAIqX40BxcMTWJBWLa8D0du4mxfTAugKevmd_5to_4cxCvRTtu4xOPHlgs0yoszqzzyIez5ZAza4O0OEcLsOA2YiRnoOtKA/w640-h344/SCodeScanner.png
SCodeScanner stands for Source Code scanner where the user can scans the source code for finding the Critical Vulnerabilities. The main objective for this scanner is to find the vulnerabilities inside the source code before code gets published in Prod.
Features

1. Supported PHP Language

2. Supported YAML Language

3. Pass results to bug tracking services like Jira also Slack (Sending files to group to multiple people at once).

4. Gives results in JSON format, which can easily be used to any other program.
5. Works with Rules. We only need to create some rules which the target rule is not present in php/yaml directory.
6. Rules that can scan advance patterns

Achievements

SCodeScanner received 5 CVEs for finding vulnerabilities in multiple CMS plugins.

* CVE-2022-1465
* CVE-2022-1474
* CVE-2022-1527
* CVE-2022-1532
* CVE-2022-1604

How to run?

* Download the repository -

* Run pip3 install -r requirements.txt

* And run python3 scscanner.py --help
Feedback/Imporvements

I would love to hear your feedback on this tool. Open issues if you found any. And open PR request if you have something.

Contact

Utkarsh Agrawal
Website
Download Scodescanner

___________________________
@hacking_Attack
@Hacking_Video

My First Valid Bug “Bypass the Admin Panel”
https://medium.com/@digant_15/my-first-valid-bug-bypass-the-admin-panel-e859e72a1b7d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hey everyone, I am Digant Prajapati. Cyber Security Enthusiast and currently focusing on bug bounty💸.Continue reading on Medium » (https://medium.com/@digant_15/my-first-valid-bug-bypass-the-admin-panel-e859e72a1b7d?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
IS CYBERSECURITY MY BUSINESS?

https://cdn-images-1.medium.com/max/612/1*Dmq4PQ9lTjW9BgS4ySpxxw.jpeg
Cybersecurity is one of those topics that people shy away from. They often believe that it’s one of those complex topics that only tech…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Technology

https://cdn-images-1.medium.com/max/800/1*kwkg1e9YGfzGN1QHymbiiQ.jpeg
Up to 10 million Australians hit by telecoms Hack.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Solana-based wallet hack is seeing millions drained

https://cdn-images-1.medium.com/max/1600/1*KTR9XDncD2wxUp5Oo4V8KQ.png
A cyber assault affected about 8,000 user wallets, including Slope, Trust Wallet and Phantom. At least 7,767 wallets have been compromised.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
WAF bypasses via 0days

https://cdn-images-1.medium.com/max/2322/1*MUZyAlfoZqWLA0QZLGPGCQ.png
based on findings from a live hacking event

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
CATS : REST API Fuzzer And Negative Testing Tool For OpenAPI Endpoints

CATS , REST API fuzzer and negative testing tool. Run thousands of self-healing API tests within minutes with no coding effort!

* Comprehensive: tests are generated automatically based on a large number scenarios and cover every field and header
* Intelligent: tests are generated based on data types and constraints; each Fuzzer has specific expectations depending on the scenario under test
* Highly Configurable: high amount of customization: you can filter specific Fuzzers, HTTP response codes, HTTP methods, request paths, provide business context and a lot more
* Self-Healing: as tests are generated, any OpenAPI spec change is picked up automatically
* Simple to Learn: flat learning curve, with intuitive configuration and syntax
* Fast: automatic process for write, run and report tests which covers thousands of scenarios within minutes OverviewBy using a simple and minimal syntax, with a flat learning curve, CATS (Contract Auto-generated Tests for Swagger) enables you to generate thousands of API tests within minutes with no coding effort. All tests are generated, run and reported automatically based on a pre-defined set of 93 Fuzzers. The Fuzzers cover a wide range of boundary testing and negative scenarios from fully random large Unicode values to well crafted, context dependant values based on the request data types and constraints. Even more, you can leverage the fact that CATS generates request payloads dynamically and write simple end-to-end functional tests. InstallationHomebrewbrew tap endava/tap
brew install cats ManualCATS is bundled both as an executable JAR or a native binary. The native binaries do not need Java installed.

After downloading your OS native binary, you can add it in PATH so that you can execute it as any other command line tool:

sudo cp cats /usr/local/bin/cats

You can also get autocomplete by downloading the cats_autocomplete script and do:

source cats_autocomplete

To get persistent autocomplete, add the above line in ~/.zshrcor ./bashrc, but make sure you put the fully qualified path for the cats_autocompletescript.

You can also check the cats_autocompletesource for alternative setup.

There is no native binary for Windows, but you can use the uberjar version. This requires Java 17+ to be installed.

You can run it as java -jar cats.jar.

Head to the releases page to download the latest version: https://github.com/Endava/cats/releases. BuildYou can build CATS from sources on you local box. You need Java 17+. Maven is already bundled.

Before running the first build, please make sure you do a ./mvnw clean. CATS uses a fork ok OKHttpClientwhich will install locally under the 4.10.0-CATSversion, so don’t worry about overriding the official versions.

You can use the following Maven command to build the project: ./mvnw package -Dquarkus.package.type=uber-jarYou will end up with a cats-runner.jarin the targetfolder. You can run it wih java -jar cats-runner.jar ....

You can also build native images using a GraalVM Java version. ./mvnw package -PnativeNote: You will need to configure Maven with a Github PAT with read-packagesscope to get some dependencies for the build. Notes on Unit TestsYou may see some ERRORlog messages while running the Unit Tests. Those are expected behaviour for testing the negative scenarios of the Fuzzers. Running CATSBlackbox modeBlackbox mode means that CATS doesn’t need any specific context. You just need to provide the service URL, the OpenAPI spec and most probably authentication headers.

cats –contract=openapi.yaml –server=http://localhost:8080 –headers=headers.yml –bla[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
CATS : REST API Fuzzer And Negative Testing Tool For OpenAPI Endpoints

___________________________
@hacking_Attack
@Hacking_Video

WAF bypasses via 0days
https://terjanq.medium.com/waf-bypasses-via-0days-d4ef1f212ec?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video