Resources

CHECK the following links that summarise quite a lot of RECON videos by different hackers.

• https://gist.github.com/ruevaughn/8a8e26533ffe495284e7531daad5d9d0
• https://gist.github.com/ruevaughn/71d5e27da86190b1aae39f67724e991f
• 20 Top Videos to Master Recon https://github.com/NafisiAslH/KnowledgeSharing/blob/main/CyberSecurity/Web/100BugBountySecrets/secrets/secret05.md
• https://gowthams.gitbook.io/bughunter-handbook/list-of-vulnerabilities-bugs/recon-and-osint/subdomain-enumeration

Recon shopify by TomNomNomDotCom

• Videos:
  • https://www.youtube.com/watch?v=SYExiynPEKM
  • Bug bounties with Bash: https://www.youtube.com/watch?v=s9w0KutMorE
    • Slides: https://tomnomnom.com/talks/bug-bounties-with-bash-virsec.pdf
• Scope: https://hackerone.com/shopify?type=team
• Create a file containing wildcard subdomains from the scope

shopifykloud.com
shopify.com

• Use https://github.com/tomnomnom/assetfinder to find domains/subdomains and use https://github.com/tomnomnom/anew to append lines from stdin to a file, but only if they don't already appear in the file. Outputs new lines to stdout too.

cat wildcards | assetfinder --subs-only | anew domains

• Use https://github.com/tomnomnom/httprobe to take a list of domains/subdomains and probe for working http and https servers.
  • Can check HTTP status on https://httpstatus.io/

cat domains | httprobe -t 80 --prefer-https | anew hosts 

• Use https://github.com/Findomain/Findomain : The complete solution for domain recognition. Supports screenshooting, port scan, HTTP check, data import from other tools, subdomain monitoring, alerts via Discord, Slack and Telegram, multiple API Keys for sources and much more.

findomain -f wildcards | tee -a findomain.out

• Need to copy only domains/subdomains from findomain.out to file from-findomain, and use anew to add those new domains/subdomains to the existing file hosts