The newest Recon resources are on the Recon page. For a reading order instead of a date order, see the Recon learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2023-12-12 2023 | Finding that one weird endpoint with Bambdas intermediate 4 min read | Library of Burp Suite Bambdas designed to discover unusual HTTP endpoints and potential vulnerabilities. These mini-extensions, coded directly within the proxy, facilitate rapid experimentation for security researchers. Examples include detecting oversized redirect responses, identifying HTML content-type responses with multiple closing tags, flagging discrepancies between declared and real `Content-Length` headers, and finding servers using unexpected ports. The library also includes Bambdas for locating JSON responses with incorrect `text/html` content types, discovering non-standard GraphQL endpoints, and identifying JSONP endpoints exploitable via CSP bypass. → portswigger.net |
| 2023-11-21 2023 | Find My Ports | Modern Web Dev Booster beginner | Find My Ports | Modern Web Dev Booster https://ift.tt/RsXCgFY |
| 2023-11-09 2023 | assetnote beginner | assetnote https://ift.tt/I84SATb |
| 2023-11-05 2023 | TrafficWatch - TrafficWatch A Packet Sniffer Tool Allows You To Monitor And Analyze Network Traffic From PCAP Files beginner | TrafficWatch - TrafficWatch, A Packet Sniffer Tool, Allows You To Monitor And Analyze Network Traffic From PCAP Files https://ift.tt/c1tg2uv → kitploit.com |
| 2023-10-17 2023 | enumerating 24 million users intermediate 14 min read AuthN | Library for enumerating Microsoft 365 users by leveraging the OneDrive enumeration technique. This method utilizes simple HTTP requests to identify valid users without requiring authentication or making logon attempts, as demonstrated by tools like AAD-Internals and TREVORspray. The library facilitates infrastructure setup with a central TRON server for data management and CLU bots for scraping, enabling the discovery of millions of user accounts. |
| 2023-10-05 2023 | Useful Websites for Pentesters & Hackers beginner Bug Bounty | Useful Websites for Pentesters & Hackers https://ift.tt/wL3ZVXG |
| 2023-10-05 2023 | Bug Bounty Hunting Guide: Essential Tools and Strategies beginner Bug Bounty | Bug Bounty Hunting Guide: Essential Tools and Strategies https://ift.tt/oqOZFys |
| 2023-10-05 2023 | How to build custom scanners for web security research automation intermediate 5 min read Burp Fuzzing | Extension for Burp Suite that automates the detection of web race conditions and infoleaks, inspired by research into vulnerabilities like Cloudbleed. It leverages techniques such as single-packet attacks and "gadgets" to probe for anomalies and identify potential race-condition indicators, reporting differing status codes to minimize false negatives, and is available as part of the Backslash Powered Scanner. → portswigger.net |
| 2023-10-04 2023 | Directory Listing beginner | Directory Listing https://ift.tt/hdv6BCV |
| 2023-09-26 2023 | trickest/wordlists beginner 1 min read | Library of wordlists derived from CMS source code, including WordPress, Joomla, Drupal, Magento, Ghost, and Tomcat. Each entry offers base wordlists with full file paths and all-levels wordlists that account for directory structure variations. Additional lists are generated from robots.txt files of top websites, subdomains discovered via bug bounty programs, and subdomains extracted from SSL certificates. These wordlists are created using Trickest workflows that clone repositories, fetch robots.txt, enumerate subdomains, and process data for security testing. |
| 2023-09-05 2023 | How to Set up a Reverse Proxy (Step-By-Steps for Nginx and Apache) beginner 23 min read | Library for configuring Nginx and Apache as reverse proxies, enhancing web server security, performance, and reliability. It enables unified domain management, load balancing with techniques like Global Server Load Balancing, and powerful caching for static and dynamic content, while also offering enhanced security by cloaking origin server details and defending against DDoS attacks. |
| 2023-08-20 2023 | Pentest-Cheat-Sheets beginner 7 min read Bug Bounty | Cheatsheet for penetration testing commands and techniques, aiding in efficient reconnaissance, brute-forcing, network scanning with nmap and dnsenum, SMB and RDP exploitation using tools like xfreerdp and crowbar, SQL injection with sqlmap, and cross-site scripting payloads. It also includes snippets for SNMP enumeration, MySQL connections, and basic HTTP requests. |
| 2023-08-07 2023 | Malwarize/webpalm beginner | Library for structured web-tree generation and regex-based data extraction. Webpalm features high-speed multi-threading, multiple export formats including JSON and XML, and colorized output with robust error handling. It supports including or excluding specific domains and status codes, and allows saving results to files. Users can configure traversal depth, worker threads, and utilize regexes for data extraction, with examples like `webpalm -u https://example.com -l2 --regexes comments="\<\!--.*?-->" -o results.json`. |
| 2023-08-07 2023 | devanshbatham/DNSleuth beginner | Library for sniffing DNS packets and displaying queries with color-coding. Installation involves cloning the repository, granting execute permissions to `setup.sh`, and running the script. Once installed, DNSleuth can be launched from the command line to monitor all network interfaces for DNS traffic. It requires Python 3.x, Scapy, and Colorama as dependencies. |
| 2023-08-06 2023 | hakoriginfinder beginner 1 min read | Tool for discovering origin hosts behind reverse proxies, aiding in WAF bypass. It sends HTTP requests to provided IP addresses with a manipulated `Host` header, comparing responses to an initial request using the Levenshtein algorithm. Key options include setting the target hostname (`-h`), specifying ports (`-p`), adjusting the Levenshtein threshold (`-l`), and configuring thread count (`-t`). Output details matches, tested URLs, and Levenshtein scores. |
| 2023-07-26 2023 | Web Application Black-Box testing intermediate API Sec Bug Bounty | Web Application Black-Box testing https://ift.tt/d1Mrqn4 |
| 2023-07-02 2023 | DNS Analyzer - Finding DNS vulnerabilities with Burp Suite intermediate 7 min read Burp | Library for finding DNS vulnerabilities in web applications using Burp Suite. This extension leverages Burp Collaborator to analyze DNS name resolution, similar to the earlier DNS Analysis Server but with simplified setup. It helps identify resolvers susceptible to Kaminsky-style attacks by examining UDP source port and DNS ID randomness through a Kaminsky status, scatter plots, and statistics. The library aids in detecting vulnerabilities like account takeover via email redirection by analyzing DNS interactions triggered through features like password resets. |
| 2023-06-08 2023 | Snoop Project beginner 9 min read | Tool for OSINT investigations, Snoop searches over 5400 websites and a local database for user nicknames. It can extract geocoordinates from unstructured data, visualize them on an OSM map, and generate reports in various formats including CSV, TXT, and HTML. Snoop supports searching multiple users, excluding specific regions, and allows for customizable search parameters like timeout and pool size. It runs natively on Windows and Linux without requiring Python dependencies. |
| 2023-06-08 2023 | Google dork cheatsheet beginner 1 min read OSINT | Cheatsheet of Google Dorking techniques, demonstrating how to leverage operators like `intext:`, `intitle:`, `-inurl:`, `filetype:`, and `~` for targeted information retrieval. Examples include finding indexed files, specific document types containing sensitive terms like "confidential salary," and bypassing common extensions. |
| 2023-06-08 2023 | kargisimos/offensive-bookmarks beginner 1 min read Bug Bounty OSINT | Collection of browser bookmarks for penetration testers, bug bounty hunters, and reverse engineers. This curated list, named "offensive-bookmarks," categorizes resources across OSINT, cheat sheets, malware development and analysis, shells, obfuscation techniques for various languages (including PowerShell and Python), privilege escalation methods for Windows and Linux, password cracking tools, and cybersecurity labs. |
| 2023-06-02 2023 | The Ultimate Guide to Port Scanning using Nmap | Nmap Notes beginner 14 min read | Library for port scanning with Nmap, detailing target specification, host discovery methods like ARP, ICMP, and TCP SYN pings, and port specification techniques. It covers service and version detection, along with leveraging the Nmap Scripting Engine (NSE) for advanced exploitation. |
| 2023-05-04 2023 | Hacking Techniques and Intrusion Detection beginner 6 min read Bug Bounty | Tutorial on using GDB and Immunity Debugger for software exploitation. It details debugging fundamentals for pentesters, including step-by-step execution, breakpoints, variable tracking, and memory examination. The tutorial demonstrates finding a NULL pointer dereference bug in a C program using GDB, highlighting its power for analyzing and understanding program behavior. |
| 2023-04-20 2023 | Wazuh and NMAP integrarion for Network Vulnerability Scans intermediate | Wazuh and NMAP integrarion for Network Vulnerability Scans https://ift.tt/YLbjMJ9 |
| 2023-04-02 2023 | Writing a Network Scanner using Python intermediate Python | Writing a Network Scanner using Python https://ift.tt/DAWbHwz |
| 2022-05-05 2022 | Favorite tweet by @_zwink intermediate Python | Favorite tweet: Just created a Python script which given a list of /24 IP address ranges, will crawl them, extract domains and subdomains from SSL certs, check the domains, and write out a CSV file o... |
| 2022-04-25 2022 | Favorite tweet by @JasonFord intermediate OSINT Python | Favorite tweet: I'm continuing to work on my python skills to gather data using threat intel APIs. I've shared this script on GitHub that you can use (with your own API key) to query @EmergingThreats... |
| 2022-04-06 2022 | Favorite tweet by @harshbothra_ beginner Bug Bounty | Favorite tweet: 14 Payload Repositories to find all the required Payloads & Attack Vectors. 🧵 — Harsh Bothra (@harshbothra_) Apr 1, 2022 |
| 2022-04-02 2022 | Favorite tweet by @clintgibler beginner | Favorite tweet: ☁️ What to look for when reviewing a company's infrastructure @lancinimarco's structured approach for reviewing security architecture of a multi-cloud SaaS company & finding critical ... |
| 2022-03-19 2022 | Favorite tweet by @NandanLohitaksh beginner Bug Bounty | Favorite tweet: Pentest-Book: A collection of some awesome tools or techniques, tricks that might be useful in pentests/bugbounties (by @Six2dez1) #cybersecurity #bughunting #hacking #malware https:/... |
| 2022-03-18 2022 | Favorite tweet by @NandanLohitaksh intermediate XSS | Favorite tweet: Mass Blind XSS 🔥👇 By @HackerGautam ✅ One-Liner : hakrawler -plain -usewayback -wayback -url https://t.co/UWTXcbtzMq | grep "=" | egrep -iv ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|wo... |
| 2022-03-18 2022 | Favorite tweet by @HackerGautam intermediate XSS | Favorite tweet: Mass Blind XSS 🔥👇 ✅ One-Liner : hakrawler -plain -usewayback -wayback -url https://t.co/Tmo5ijSdeM | grep "=" | egrep -iv ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|t... |
| 2022-03-17 2022 | Favorite tweet by @0xAsm0d3us beginner Bug Bounty | Favorite tweet: Pentest-Book: A collection of some awesome tools or techniques, tricks that might be useful in pentests/bugbounties (by @Six2dez1) #cybersecurity #bughunting #hacking #malware https:/... |
| 2022-03-14 2022 | Favorite tweet by @harshbothra_ beginner OSINT | Favorite tweet: 17 Search Engines every Security Professional Must Know 🧵 — Harsh Bothra (@harshbothra_) Mar 14, 2022 |
| 2022-03-06 2022 | Favorite tweet by @AnubhavSingh_ beginner Bug Bounty | Favorite tweet: Tips and Resources to learn about pentesting 28 Attack Surface by @0xAwali A thread 🧵 ↓ #AppSec #infosec #bugbountytips #Pentesting — Anubhav Singh🇮🇳 (@AnubhavSingh_) Mar 6, 2022 |
| 2022-03-06 2022 | Favorite tweet by @fardeenahmed411 beginner Bug Bounty Burp | Favorite tweet: Top 10 essential tools for Bug-Bounty Hunting : 1. Burp Suite / ZAP-Proxy 2. Google Dorking Script 3. DNS-Discovery 4. Reverse IP Lookup 5. Wapiti 6. INalyzer 7. IronWASP 8. Wfuzz 9. ... |
| 2022-03-05 2022 | Favorite tweet by @harshbothra_ beginner | Favorite tweet: 4 Subdomain Enumeration Tools you must have in your Arsenal 💻 🧵 — Harsh Bothra (@harshbothra_) Mar 5, 2022 |
| 2022-03-02 2022 | Favorite tweet by @ptracesecurity intermediate Burp | Favorite tweet: Nuclei-Burp Extension: run nuclei scanner directly from burp https://t.co/5eXxgjapf7 #Pentesting #BurpSuite #WebSecurity #Infosec https://t.co/xwhsoQfhRo — Ptrace Security GmbH (@ptr... |
| 2022-01-16 2022 | How I Found multiple SQL Injection with FFUF and Sqlmap in a few minutes intermediate Fuzzing SQLi | How I Found multiple SQL Injection with FFUF and Sqlmap in a few minutes |
| 2022-01-15 2022 | Must-Have Tools For Hacking beginner Bug Bounty | Must-Have Tools For Hacking |
| 2022-01-10 2022 | ffuf - Fuzz Faster U Fool beginner 9 min read Fuzzing | Library for fast web fuzzing written in Go. `ffuf` supports fuzzing URLs, headers, and POST data using the `FUZZ` keyword, and can filter responses by size (`-fs`) or status code (`-fc`). It offers features like recursive scanning, maximum runtime limits (`-maxtime`, `-maxtime-job`), and integrates with mutators via `--input-cmd`, enabling complex fuzzing scenarios such as JSON payload generation with Radamsa. Prebuilt binaries are available, and installation can be done via Homebrew or `go install`. |
| 2022-01-10 2022 | Install Nuclei beginner 13 min read Fuzzing | Library for fast, template-based vulnerability scanning using simple YAML templates. It supports multiple protocols like HTTP, DNS, and TCP, and can be integrated into CI/CD pipelines. Nuclei allows for custom vulnerability detection scenarios to reduce false positives and includes integrations with tools like Jira, Splunk, and GitHub. The tool requires Go version 1.24.2 or later for installation. |
| 2022-01-10 2022 | Nuclei Templates beginner 1 min read Fuzzing | Library of community-curated templates for the nuclei scanner, designed to detect various application security vulnerabilities. This repository houses templates developed by the project team and contributions from the security community, covering diverse attack vectors. Detailed documentation for creating custom templates is available, alongside statistics on template attributes like tags, author, severity, and type. Community engagement is encouraged through GitHub discussions and a Discord server for direct interaction with maintainers. |
| 2022-01-10 2022 | A @TomNomNom Recon Tools Primer beginner 5 min read | Library of reconnaissance tools by @tomnomnom, including `gf` for security-pattern matching, `httprobe` for webserver detection, `unfurl` for URL parsing, `meg` for parallel requests, `anew` for de-duplicating lists, and `waybackurls` for archived URLs, all designed with the Unix philosophy for granular, composable workflows. → danielmiessler.com |
| 2022-01-03 2022 | webapp-wordlists beginner | Library of over 100,000 web application and CMS wordlists, meticulously curated for specific versions of popular platforms like WordPress, Drupal, Typo3, and Craft CMS. Each wordlist enumerates files and directories for a given version, aiding in security assessments and vulnerability discovery. Contributions and requests for additional wordlists are welcomed via pull requests and issues. |
| 2021-12-31 2021 | How To: Use GoScan to Quickly Enumerate Networks & Services intermediate 11 min read | Tool that automates network and service enumeration by leveraging Nmap and integrating with other scanners like Nikto and sqlmap. GoScan features interactive tab auto-completion and an SQLite backend for data persistence, and functions as a framework to abstract and streamline reconnaissance tasks. It allows for target loading, host discovery, port scanning, and service enumeration with various options, including dry runs and aggressive scans. While it offers a streamlined approach, users must be aware of limitations such as the inability to issue OS commands directly within the framework and a less direct method for canceling long scans. → null-byte.wonderhowto.com |
| 2021-12-06 2021 | How to run BeEF behind an nginx reverse proxy with SSL correctly intermediate 4 min read | Library for configuring BeEF behind an nginx reverse proxy with SSL, addressing "Blocked Mixed Active Content" errors. It details BeEF's `config.yaml` settings for `allow_reverse_proxy`, `public`, and `public_port`, along with Nginx `proxy_pass` directives to correctly handle HTTPS requests and ensure BeEF hooks function on secure pages. → stackoverflow.com |
| 2021-11-24 2021 | Install Nuclei beginner 13 min read Bug Bounty | Library for high-performance vulnerability scanning. Nuclei utilizes simple YAML-based templates to detect vulnerabilities, allowing users to create custom scenarios that minimize false positives by simulating real-world conditions. It supports multiple protocols (TCP, DNS, HTTP, SSL, and more) and integrates with CI/CD pipelines and various platforms like Jira, Splunk, and GitHub. Installation requires Go version 1.24.2 or later. |
| 2021-11-21 2021 | HTB: BountyHunter intermediate 10 min read Bug Bounty | Writeup detailing a penetration test on the HTB: BountyHunter machine, which begins with an XXE vulnerability allowing file reads from `/etc/passwd`. This initial access leads to discovering credentials for SSH, enabling further privilege escalation via a Python `eval` injection in a root-level ticket validation script. |
| 2021-11-17 2021 | Spear Phishing And Subdomains Takeover intermediate | Spear Phishing And Subdomains Takeover |
| 2021-11-11 2021 | New Release: FullHunt Public API! news 1 min read | Library providing free public access to FullHunt's attack surface enumeration capabilities, including subdomains, domains, assets, and exposed services. Integrates with the OSINT tool TheHarvester, acting as a data source for it. Offers unlimited API access for enterprises, with custom APIs and advanced data analysis available through the FullHunt Enterprise Platform. |