From 9193312a812844763bda2d4975c893fa2214c6ab Mon Sep 17 00:00:00 2001 From: Zishan Ahamed Thandar Date: Sun, 27 Oct 2024 18:32:27 +0530 Subject: [PATCH] Update CTFBOX.md --- notes/CTFBOX.md | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/notes/CTFBOX.md b/notes/CTFBOX.md index e2906f4..ac2b7b5 100644 --- a/notes/CTFBOX.md +++ b/notes/CTFBOX.md @@ -16,13 +16,11 @@ - Wordlist generator `cewl http://domain.tld/ | grep -v CeWL > custom-wordlist.txt` - Subdomain Enumeration - ```bash - gobuster vhost -u http://monitorsthree.htb --append-domain -w /opt/wordlist/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -r - ffuf -w /opt/wordlist/SecLists/Discovery/DNS/subdomains-top1million-110000.txt:FUZZ -u http://domain.tld -H 'Host: FUZZ.permx.htb' -fw 18 - ``` + 1. Gobuster ```gobuster vhost -u http://monitorsthree.htb --append-domain -w /opt/wordlist/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -r``` + 2. ffuf ```ffuf -w /opt/wordlist/SecLists/Discovery/DNS/subdomains-top1million-110000.txt:FUZZ -fw 18 -u http://domain.tld -H 'Host: FUZZ.permx.htb'``` - Directory Busting - 1. Directory`ffuf -w /opt/wordlist/SecLists/Discovery/Web-Content/raft-large-directories.txt -u https://target.com/FUZZ/` - 2. Files `ffuf -w /opt/wordlist/SecLists/Discovery/Web-Content/raft-large-directories.txt,/opt/wordlist/SecLists/Discovery/Web-Content/raft-large-files.txt -u https://target.com/FUZZ/` + 1. Directory`ffuf -w /opt/wordlist/SecLists/Discovery/Web-Content/raft-large-directories.txt -u https://target.com/FUZZ/` + 2. Files `ffuf -w /opt/wordlist/SecLists/Discovery/Web-Content/raft-large-directories.txt,/opt/wordlist/SecLists/Discovery/Web-Content/raft-large-files.txt -u https://target.com/FUZZ/` - Recursive directory busting `ffuf -w /opt/wordlist/SecLists/Discovery/Web-Content/raft-large-directories.txt,/opt/wordlist/SecLists/Discovery/Web-Content/raft-large-files.txt -recursion -recursion-depth 3 -u https://target.com/FUZZ/` - BruteForce - Check outdated or vulnerable version for any service or software using exploitdb and google