Internal Network Pentest and IR Reference: bug hunting methodology

# Bug Hunting Methodology

## Passive Recon

* Using [shodan.io](https://www.shodan.io/), [fofa.info](https://en.fofa.info/), [zoomeye.ai](https://www.zoomeye.ai/) or [odin.io](https://search.odin.io/hosts) to detect similar app

  ```ps1
  # https://github.com/glennzw/shodan-hq-nse
  nmap --script shodan-hq.nse --script-args 'apikey=<yourShodanAPIKey>,target=<hackme>'
  ```

* Search for similar websites using the same favicon: [pielco11/fav-up](https://github.com/pielco11/fav-up) or slightly different icon: [profundis.io/favicon-matcher](https://profundis.io/tools/favicon-matcher)

  ```ps1
  python3 favUp.py --favicon-file favicon.ico -sc
  python3 favUp.py --favicon-url https://domain.behind.cloudflare/assets/favicon.ico -sc
  python3 favUp.py --web domain.behind.cloudflare -s
  ```

* Search inside Shortener URLs: [shorteners.grayhatwarfare.com](https://shorteners.grayhatwarfare.com/), [utkusen/urlhunter](https://github.com/utkusen/urlhunter)

  ```ps1
  urlhunter --keywords keywords.txt --date 2020-11-20
  ```

* Search inside Buckets: [buckets.grayhatwarfare.com](https://buckets.grayhatwarfare.com/)

* Using [The Wayback Machine](https://archive.org/web/) to detect forgotten endpoints

  ```powershell
  # Look for JS files, old links
  curl -sX GET "http://web.archive.org/cdx/search/cdx?url=<targetDomain.com>&output=text&fl=original&collapse=urlkey&matchType=prefix"
  ```

* Using [laramies/theHarvester](https://github.com/laramies/theHarvester)

  ```python
  python theHarvester.py -b all -d domain.com
  ```

* Look for private information in [GitHub](https://github.com) repositories with [michenriksen/GitRob](https://github.com/michenriksen/gitrob.git)

  ```bash
  gitrob analyze johndoe --site=https://github.acme.com --endpoint=https://github.acme.com/api/v3 --access-tokens=token1,token2
  ```

* Perform Google Dorks search: [ikuamike/GoogleDorking.md](https://gist.github.com/ikuamike/c2611b171d64b823c1c1956129cbc055)

  ```ps1
  site: *.example.com -www
  intext:"dhcpd.conf" "index of"
  intitle:"SSL Network Extender Login" -checkpoint.com
  ```

* Enumerate subdomains using HackerTarget

  ```ps1
  curl --silent 'https://api.hackertarget.com/hostsearch/?q=targetdomain.com' | grep -o '\w.*targetdomain.com'
  ```

* Enumerate endpoints using CommonCrawl

  ```ps1
  echo "targetdomain.com" | xargs -I domain curl -s "http://index.commoncrawl.org/CC-MAIN-2018-22-index?url=*.targetdomain.com&output=json" | jq -r .url | sort -u
  ```

## Active Recon

### Network Discovery

* Subdomains enumeration
    * Enumerate already found subdomains: [projectdiscovery/subfinder](https://github.com/projectdiscovery/subfinder), [OWASP/Amass](https://github.com/OWASP/Amass)

    ```ps1
    subfinder -d hackerone.com
    amass enum -passive -dir /tmp/amass_output/ -d example.com -o dir/example.com
    ```

    * Permutate subdomains: [infosec-au/altdns](https://github.com/infosec-au/altdns)
    * Bruteforce subdomains: [Josue87/gotator](https://github.com/Josue87/gotator)
    * Resolve subdomains to IP with [blechschmidt/massdns](https://github.com/blechschmidt/massdns), remember to use a good list of resolvers like [trickest/resolvers](https://github.com/trickest/resolvers)

    ```ps1
    massdns -r resolvers.txt -o S -w massdns.out subdomains.txt
    ```

    * Subdomain takeovers: [EdOverflow/can-i-take-over-xyz](https://github.com/EdOverflow/can-i-take-over-xyz)

* Network discovery
    * Scan IP ranges with `nmap`, [robertdavidgraham/masscan](https://github.com/robertdavidgraham/masscan) and [projectdiscovery/naabu](https://github.com/projectdiscovery/naabu)
    * Discover services, version and banners

* Review latest acquisitions

* ASN enumeration
    * [projectdiscovery/asnmap](https://github.com/projectdiscovery/asnmap): `asnmap -a AS45596 -silent`
    * [asnlookup.com](http://www.asnlookup.com)

* DNS Zone Transfer

  ```ps1
  host -t ns domain.local
  domain.local name server master.domain.local.

  host master.domain.local        
  master.domain.local has address 192.168.1.1
 
  dig axfr domain.local @192.168.1.1
  ```

### Web Discovery

#### Common Files

* `security.txt`: A file that provides contact info for reporting security issues with your site (like an email or PGP key).

  ```ps1
  Contact: mailto:security@example.com
  ```

* `sitemap.xml`: Lists all the important URLs of your site so search engines can index them efficiently.

  ```ps1
  <urlset>
    <url><loc>https://example.com/</loc></url>
    <url><loc>https://example.com/about</loc></url>
  </urlset>
  ```

* `robots.txt`: Tells search engine crawlers which pages or files they can or cannot access on your site.

  ```ps1
  User-agent: *
  Disallow: /admin/
  ```

#### Enumerate Files and Folders

Enumerate all accessible files and subdirectories. Once the underlying technology has been identified, prioritize the use of targeted wordlists rather than generic ones. Technology specific wordlists such as those provided by Assetnote ([https://wordlists.assetnote.io](https://wordlists.assetnote.io)), significantly improve coverage and efficiency. Examples include `httparchive_parameters_top_1m_2026_01_27.txt`, `httparchive_directories_1m_2026_01_27.txt`, and `httparchive_php_2026_01_27.txt`.

* [OJ/gobuster](https://github.com/OJ/gobuster)
* [ffuf/ffuf](https://github.com/ffuf/ffuf)
* [bitquark/shortscan](https://github.com/bitquark/shortscan)

  ```ps1
  ffuf -H 'User-Agent: Mozilla' -v -t 30 -w mydirfilelist.txt -b 'NAME1=VALUE1; NAME2=VALUE2' -u 'https://example.com/FUZZ'
  gobuster dir -a 'Mozilla' -e -k -l -t 30 -w mydirfilelist.txt -c 'NAME1=VALUE1; NAME2=VALUE2' -u 'https://example.com/'
  ```

Identify and enumerate backup and temporary files that may have been unintentionally exposed. These files often contain source code, credentials, or sensitive configuration data and are commonly created by editors, deployment processes, or manual backups.

* [mazen160/bfac](https://github.com/mazen160/bfac)

```bash
bfac --url http://example.com/test.php --level 4
bfac --list testing_list.txt
```

Crawl the website's pages and resources to identify additional attack surface and expand the assessment perimeter.

* [hakluke/hakrawler](https://github.com/hakluke/hakrawler)
* [projectdiscovery/katana](https://github.com/projectdiscovery/katana)

```ps1
katana -u https://tesla.com
echo https://google.com | hakrawler
```

#### Next.js Endpoints

In Next.js, `window.__BUILD_MANIFEST` is a runtime global variable that the framework automatically injects into the client-side JavaScript bundle.

Go to `DevTools->Console` and execute this JavaScript code:

```js
console.log(window.__BUILD_MANIFEST)
console.log(__BUILD_MANIFEST.sortedPages)
```

If you inspect your app in the browser console (for a production build), you might see something like this:

```js
{__rewrites: {…}, /: Array(10), /404: Array(8), /500: Array(4), /_error: Array(1), …}
/: (10) ['static/chunks/2852872c-b605aca0298c2109.js', 'static/chunks/3748-