This note is written to Solve Web Application CTFs, Bug Bounty or Web App Penetration Testing.
Check my Bug Bounty Hunting Methodology to learn some bonus.
You can use my script Hackify to install tools and wordlist on your linux system.
git clone https://github.com/ZishanAdThandar/hackify.git
cd hackify
chmod +x hackify.sh; bash hackify.sh # tools
chmod +x wordlist.sh; bash wordlist.sh # wordlist
dig axfr @<ip_address> target.tldwhois target.tldgobuster vhost -u http://monitorsthree.htb --append-domain -w /opt/wordlists/SecLists/Discovery/DNS/namelist.txt -rffuf -w /opt/wordlists/SecLists/Discovery/DNS/dns-Jhaddix.txt:FUZZ -fw 18 -mc all -ac -u http://domain.tld -H 'Host: FUZZ.domain.tld' [For vpn file and ctf]ffuf -w /opt/wordlists/SecLists/Discovery/DNS/dns-Jhaddix.txt:FUZZ -fw 18 -mc all -ac -u http://FUZZ.domain.tld [For Real World]subauto domain.tld [Very useful for real world subdomain enumeration.]dig: To find DNS misconfigeration ip leak.ffuf -w /opt/wordlists/SecLists/Discovery/Web-Content/directory-list-lowercase-2.3-big.txt -ic -recursion -recursion-depth 3 -u https://target.com/FUZZffuf -w /opt/wordlists/SecLists/Discovery/Web-Content/raft-large-directories.txt -u https://target.com/FUZZ/dirsearch -e php,html,txt -t 50 -u http://domain.tld/ffuf -w /opt/wordlists/SecLists/Discovery/Web-Content/raft-large-files.txt -u https://target.com/FUZZ/feroxbuster -w /opt/wordlists/SecLists/Discovery/Web-Content/raft-large-directories.txt -u http://target.tld/ReconSpider.py domain.tldarjun -u target.tlf=dparmafinder++https://web.archive.org/cdx/search/cdx?url=*.domanin.tld&fl=original&collapse=urlkeyrobots.txt, secrets.txt, .well-known/security.txt, /.well-known/change-password, .well-known/openid-configuration, .well-known/assetlinks.json, .well-known/mta-sts.txt etc file could reveal sensetive informationsdirb to find common files. dirb http://target.tldwafw00f domain.tldnikto -h domain.tld -Tuning bcurl -I domain.tldwpscan --url https://domain.tld/wordpress-blog/ -e u,ap --api-token=<API_TOKEN> Check https://wpscan.com/profile for api token.curl https://raw.githubusercontent.com/IvanGlinkin/Fast-Google-Dorks-Scan/master/FGDS.sh -s |bash -s domain.comwhich git-houndnano /root/go/bin/config.yml Example: https://github.com/tillson/git-hound/blob/main/config.example.ymlgit-hound --otp-code 1234568git-hound --config-file /root/go/bin/config.yml --subdomain-file subdomains.txtnuclei -utnuclei -l httpsubdomain.txt -resume nuclei.txt -nmhe [rate-limit 10/second to avoid error of rapid request, -nmhe to skip error]for i in $(cat domain.comhttpssubdomain.txt); do echo \"$i\", \" \"; done > domain.comacunetix.csvafrog -T domain.comhttpsubs.txt