OWASP Favicon Database:

Other places to find information only using basic tools:

robots.txt, sitemap.xml, HTTP Headers, Framework Stack - developer tools

Google Hacking / Dorking

Google hacking / Dorking utilizes Google’s advanced search engine features, which allow you to pick out custom content. You can, for instance, pick out results from a certain domain name using the site: filter, for example (site:tryhackme.com) you can then match this up with certain search terms, say, for example, the word admin (site:tryhackme.com admin) this then would only return results from the tryhackme.com website which contain the word admin in its content. You can combine multiple filters as well. Here is an example of more filters you can use:

Filter

Example

Description

site

site:tryhackme.com

returns results only from the specified website address

inurl

inurl:admin

returns results that have the specified word in the URL

filetype

filetype:pdf

returns results which are a particular file extension

intitle

intitle:admin

returns results that contain the specified word in the title

Wappalyzer - idnetify technologies a website uses

Wayback Machine - Identify changes to versions and previous vulnerabilities

GitHub - version tracker

S3 Buckets - storage service where people store files to access over cloud

Automated Discover Through Wordlists

Sub Domain Enumeration#

Methods: Brute Force, OSINT, Virtual Host

SSL/TLS Certificates: sites like https://crt.sh and https://ui.ctsearch.entrust.com/ui/ctsearchui offer a searchable database of certificates that shows current and historical results.

Use Google, EG. site:*.tryhackme.com -site:www.tryhackme.com to find submdomains

Bruteforce DNS Tool such as dnsrecon, sublist3r, FFUF

Authentication Bypass#

ffuf to enumerate valid usernames by checking which ones trigger the response username already exists (or similar)

brute force login with valid usernames and password wordlist

Use logic flaws to bypass logins

Intercept password reset requests using valid username via curl requests, create account on site to forward password reset email to via curl request, use resources like support tickets etc to bypass login screen for valid user.

Cookie Tampering

Alter login cookies changing booleans to true

Hash replays - database of hashes

Encode and Decode https://www.base64encode.org/

IDOR#

Insecure Direct Object Reference

Altering requests to retrieve different files or info

Altering your invoice number in a url from an email to receive another customers invoice data

decode requests, alter info, encode again and resend

create two accounts and swap the ID numbers

parameter mining