trickstersec / reconftw.cfg

Created April 10, 2023 21:48 — forked from jhaddix/reconftw.cfg

reconFTW config file: NO google/osint, wordlist creation, nuclei js analysis

	#################################################################
	# reconFTW config file #
	#################################################################

	# General values
	tools=~/Tools # Path installed tools
	SCRIPTPATH="$( cd "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )" # Get current script's path
	profile_shell=".$(basename $(echo $SHELL))rc" # Get current shell profile
	reconftw_version=$(git rev-parse --abbrev-ref HEAD)-$(git describe --tags) # Fetch current reconftw version
	generate_resolvers=false # Generate custom resolvers with dnsvalidator

trickstersec / Github bash generated search links (from hunter.sh)

Created March 21, 2022 23:08 — forked from jhaddix/Github bash generated search links (from hunter.sh)

Github bash generated search links (from hunter.sh)



	echo ""
	echo "********** Github Dork Links (must be logged in) *****************"
	echo ""
	echo " password"
	echo "https://github.com/search?q=%22$1%22+password&type=Code"
	echo "https://github.com/search?q=%22$without_suffix%22+password&type=Code"
	echo ""
	echo " npmrc _auth"

trickstersec / bountyscan_setup.sh

Created March 21, 2022 22:59 — forked from jhaddix/bountyscan_setup.sh

	#!/bin/bash
	export DEBIAN_FRONTEND=noninteractive;
	echo "[] Starting Install... []"
	echo "[] Upgrade installed packages to latest []"
	echo -e "\nRunning a package upgrade...\n"
	apt-get -qq update && apt-get -qq dist-upgrade -y
	apt full-upgrade -y
	apt-get autoclean

	echo "[] Install stuff I use all the time []"

trickstersec / bucket-disclose.sh

Created March 21, 2022 22:57 — forked from jhaddix/bucket-disclose.sh

Using error messages to decloak an S3 bucket. Uses soap, unicode, post, multipart, streaming and index listing as ways of figure it out. You do need a valid aws-key (never the secret) to properly get the error messages

	#!/bin/bash

	# Written by Frans Rosén (twitter.com/fransrosen)
	_debug="$2" #turn on debug
	_timeout="20"
	#you need a valid key, since the errors happens after it validates that the key exist. we do not need the secret key, only access key
	_aws_key="AKIA..."
	H_ACCEPT="accept-language: en-US,en;q=0.9,sv;q=0.8,zh-TW;q=0.7,zh;q=0.6,fi;q=0.5,it;q=0.4,de;q=0.3"
	H_AGENT="user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36"

trickstersec / content_discovery_all.txt

Created March 21, 2022 22:56 — forked from jhaddix/content_discovery_all.txt

a masterlist of content discovery URLs and files (used most commonly with gobuster)

This file has been truncated, but you can view the full file.

	`
	~/
	~
	×™×


	___
	__
	_

trickstersec / all.txt

Created March 21, 2022 22:54 — forked from jhaddix/all.txt

all wordlists from every dns enumeration tool... ever. Please excuse the lewd entries =/

This file has been truncated, but you can view the full file.


	.
	..
	........
	@
	*
	.
	..*
	ðŸŽ

trickstersec / cloud_metadata.txt

Created March 21, 2022 22:54 — forked from jhaddix/cloud_metadata.txt

Cloud Metadata Dictionary useful for SSRF Testing

	## AWS
	# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories

	http://169.254.169.254/latest/user-data
	http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/ami-id
	http://169.254.169.254/latest/meta-data/reservation-id
	http://169.254.169.254/latest/meta-data/hostname
	http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key

trickstersec / WAHH_Task_Checklist.md

Created March 21, 2022 22:53 — forked from jhaddix/Testing_Checklist.md

The Web Application Hacker's Handbook - Task Checklist - Github-Flavored Markdown

The Web Application Hacker's Handbook

Web Application Hacker's Handbook Task checklist as a Github-Flavored Markdown file

Purpose

Cheatsheet for HackTheBox with common things to do while solving these CTF challenges.

Because a smart man once said:

Never google twice.

Jonatan trickstersec

The Web Application Hacker's Handbook

Contents

Purpose

Linux General