-
asura and
caon are now friends 8 months, 1 week ago
-
caon started the topic Configure your .ffufrc for ffuf in the forum BugBountyTips 8 months, 4 weeks ago
That’s a small configuration thatchanges a lot!
Some targets have WAFs/protections that will ignore or slow your fuzzing requests using ffuf just because you are fuzzing it with default User-Agent.
The default user-agent for ffuf is a custom one to identify requests from the program. It is a must to change that default User Agent, specially if…[Read more]
-
caon joined the group
HackerOne Bug Bounty Hunters 8 months, 4 weeks ago
-
caon replied to the topic How to find if sub is wildcard? in the forum Bug Bounty Q&A 8 months, 4 weeks ago
If you are going to use puredns get a nice list of resolvers, you can find them here:
https://github.com/felipecaon/resolvers
It is a list of already known and resolvered IPs but with a re-checking steps, I’ve found out that rechecking makes them less noisy because a lot of DNSes are configured to cloak results.
-
caon replied to the topic How to find if sub is wildcard? in the forum Bug Bounty Q&A 8 months, 4 weeks ago
I have found some subs using this very same method you pointed. If you are going to use puredns do not forget to get a nice list of resolvers daily. Puredns does the first verification against your list of resolvers (so they can be less reliable) and the second check against verified ones (amazon, google).
If have daily updating resolvers in my…[Read more]
-
caon replied to the topic Whats the deal of having multiple wordlists? in the forum Bug Bounty Q&A 8 months, 4 weeks ago
Agree that they can be noisy. But from a “I need to get paths that no one found” perspective, it does not makes any sense to use smaller lists – yeah, you should have a quick list to fire into every target to see what’s the deal – but apart than that, if you have concerns about WAFs, it is way better to use a distributed scanner…[Read more]
-
caon replied to the topic Whats the deal of having multiple wordlists? in the forum Bug Bounty Q&A 8 months, 4 weeks ago
I is a good ideia if the target does not have WAF or any kind of control. I would use a distributed solution
-
caon started the topic Whats the deal of having multiple wordlists? in the forum Bug Bounty Q&A 8 months, 4 weeks ago
Recently I found myself thinking in how performatic my wordlists are. I have custom lists with all sorts of information, but here I’m talking about fuzzing with general lists – not technology focused stuff, which makes obvious the need of having multiple lists.
What’s the difference between your subdomain, parameter or path list? I’ve been…[Read more]
-
caon changed their profile picture 8 months, 4 weeks ago
-
caon became a registered member 8 months, 4 weeks ago