Hello, Everyone! 👋

Today, we’ll explore Content Discovery, an essential aspect of bug hunting that often uncovers hidden files, directories, or endpoints critical for identifying vulnerabilities. Let’s get started! 🚀

Why Content Discovery Matters

Content Discovery goes beyond standard reconnaissance, enabling you to locate sensitive resources and hidden assets. While many rely on default tools and wordlists, staying ahead of the curve requires customized strategies and innovative techniques. Here’s how to refine your approach.

🔧 Advanced Steps for Content Discovery

1. Brute-Forcing Directories

The next step is building on subdomain enumeration from Part 1, directory brute-forcing. Always check the rules of the bug bounty program before using automated scanners.

Recommended Tools:

a. Dirb

• Scans web servers for directories and files using a wordlist.
• Command: dirb http://target.com /usr/share/wordlists/dirb/common.txt
• Pro Tip: Use custom wordlists tailored to the target for better results.

b. Dirbuster

• A GUI-based tool for discovering hidden directories and files.
• Steps:
  1. Open Dirbuster.
  2. Enter the target URL (e.g., http://target.com).
  3. Load a wordlist (e.g., /usr/share/wordlists/dirb/common.txt).
  4. Start the scan.

c. FFUF (Fuzz Faster U Fool)

• Flexible fuzzing tool for discovering directories and parameters.
• Command (Directory Bruteforcing): ffuf -u http://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt
• Command (Parameter Bruteforcing): ffuf -u http://target.com/search?FUZZ=test -w /usr/share/wordlists/parameters.txt

d. Gobuster

• Command-line tool for brute-forcing directories and files.
• Command: gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt -x php,html,js

2. Customizing Wordlists

Generic wordlists often miss critical paths. Enhance your wordlists based on the technologies detected on the target site.

Tools for Technology Detection:

• Wappalyzer: A browser extension or CLI tool.
• Once you identify the tech stack (e.g., PHP, Node.js), use specialized wordlists such as:
  • SecLists
  • Karanxa’s Wordlists

3. Finding Parameters

Parameters are gateways to vulnerabilities like XSS, Open Redirect, or IDOR.

Tools:

• Arjun: Discovers hidden HTTP parameters.
  • Install: pip3 install arjun
  • Command: arjun -u https://target.com -oJ params.json
• Pair Arjun with KXSS for XSS detection: cat params.txt | kxss

4. Analyzing JavaScript Files

JavaScript files often reveal sensitive information such as API keys, credentials, or hidden endpoints.

Steps:

1. Find JS Files: katana -u https://target.com -jc -d 2 | grep ".js$" | uniq | sort > js.txt
2. Extract Secrets:
   • Use SecretFinder: cat js.txt | while read url; do python3 SecretFinder.py -i $url -o cli >> secrets.txt; done
   • Use LinkFinder to locate endpoints: python3 linkfinder.py -i js.txt -o endpoints.txt

5. API Endpoint Enumeration

APIs are treasure troves for vulnerabilities. Use FFUF for endpoint discovery:

Command:

ffuf -u http://api.target.com/FUZZ -w /usr/share/wordlists/api_endpoints.txt -t 50

Manual Testing:

• Test parameters like id, token, or session for weaknesses.
• Look for verbose responses that reveal sensitive information.
• Combine findings with tools like JWT_Tool to analyze JSON Web Tokens.

6. Checking for Backup and Old Files

Backup files often reveal sensitive information.

Command:

gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt -x .bak,.old,.zip,.tar.gz

7. Functionality Mapping

Understanding website functionality helps identify potential vulnerabilities.

Steps:

1. Interact with forms, buttons, and features.
2. Use Burp Suite to capture requests and create a sitemap.
3. Document observed behaviours and potential attack vectors.

Pro Tips to Stand Out

1. Leverage Custom Scripts: Automate repetitive tasks with Python or Bash.
2. Monitor DNS Traffic: Use tools like DNSDumpster for additional insights.
3. Search GitHub: Use tools like GitRob or truffleHog to find sensitive information in public repositories.

What’s Next?

That’s all for Part 2! Stay tuned for Part 3, where we’ll move from reconnaissance to analyzing and exploiting vulnerabilities.

If you found this guide helpful, don’t forget to share it and follow me for more! 😊