pentest_web_graybox_example

(★ 15)

No description available.

Owner Repos

Simula-o_Ataque_PTES_Windows ★ 34

No description provided.
BSC_DLP_Community ★ 9

BSC DLP - Open-source Data Loss Prevention platform for discovering, classifying, monitoring and protecting sensitive data across endpoints and enterprise environments.

Go

File Explorer

ZIP Download
  • README.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Link
Example

Command Glossary

Commands referenced in this DOCs, explained below.

🔍

dalfox

View Details ▼

A powerful open-source XSS scanner focused on automation.

dalfox url {{https://example.com}}

Scan a single URL for XSS vulnerabilities:

dalfox url {{https://example.com}} {{[-H|--header]}} '{{X-My-Header: 123}}'

Scan a URL using a header for authentication:

dalfox file {{path/to/file}}

Scan a list of URLs from a file:

🔍

dig

View Details ▼

DNS lookup utility.
See also: `resolvectl`, `nslookup`, `host`.

dig +short {{example.com}}

Lookup the IP(s) associated with a hostname (A records):

dig +noall +answer {{example.com}}

Get a detailed answer for a given domain (A records):

dig +short {{example.com}} {{A|MX|TXT|CNAME|NS}}

Query a specific DNS record type associated with a given domain name:

🔍

nikto

View Details ▼

Web server scanner which performs tests against web servers for multiple items.

perl nikto.pl {{[-h|-host]}} {{192.168.0.1}}

Perform a basic Nikto scan against a target host:

perl nikto.pl {{[-h|-host]}} {{192.168.0.1}} {{[-p|-port]}} {{443}}

Specify the port number when performing a basic scan:

perl nikto.pl {{[-h|-host]}} {{https://192.168.0.1:443/}}

Scan ports and protocols with full URL syntax:

🔍

nmap

View Details ▼

Network exploration tool and security/port scanner.
Some features (e.g. SYN scan) activate only when `nmap` is run with root privileges.
See also: `hping3`, `masscan`, `naabu`, `rustscan`, `zmap`.

nmap -v{{1|2|3}} {{ip_or_hostname}}

Scan the top 1000 ports of a remote host with various [v]erbosity levels:

nmap -T5 -sn {{192.168.0.0/24|ip_or_hostname1,ip_or_hostname2,...}}

Run a ping sweep over an entire [s]ub[n]et or individual hosts very aggressively:

sudo nmap -A -iL {{path/to/file.txt}}

Enable OS detection, version detection, script scanning, and traceroute of hosts from a file:

🔍

sqlmap

View Details ▼

Detect and exploit SQL injection flaws.

python sqlmap.py {{[-u|--url]}} "{{http://www.example.com/vuln.php?id=1}}"

Run sqlmap against a single target URL:

python sqlmap.py {{[-u|--url]}} "{{http://www.example.com/vuln.php}}" --data="{{id=1}}"

Send data in a POST request (`--data` implies POST request):

python sqlmap.py {{[-u|--url]}} "{{http://www.example.com/vuln.php}}" --data="{{query=foobar;id=1}}" --param-del="{{;}}"

Change the parameter delimiter (& is the default):

🔍

whatweb

View Details ▼

Next-generation web scanner.

whatweb {{website1 website2 ...}}

Scan websites/targets for web technologies:

whatweb {{[-i|--input-file]}} {{targets_file}}

Read targets/websites from a file:

whatweb {{[-v|--verbose]}} {{example.com}}

Scan a website/target in verbose mode:

🔍

whois

View Details ▼

Client for the WHOIS (RFC 3912) protocol.

whois {{example.com}}

Get information about a domain name:

whois {{8.8.8.8}}

Get information about an IP address:

whois -b {{8.8.8.8}}

Get abuse contact for an IP address:

// repository documentation