Tip 1：
老外总结的挖洞思路：
思路1：- [ ] Identify web server, technologies and database- [ ] Subsidiary and Acquisition Enumeration- [ ] Reverse Lookup- [ ] Reverse Whois- [ ] ASN & IP Space Enumeration思路2：- [ ] ReconFTW- [ ] Github Recon- [ ] Waf Detection- [ ] CRAWLING- [ ] gospider- [ ] gau- [ ] gauplus- [ ] hakrawlerService Enumeration- [ ] Google DorkGathering Parameters- [ ] Wordlist creation- [ ] Metadata思路3：- [ ] Screenshot → gowitness- [ ] Searchsploits- [ ] Directory Enumeration-- [ ] ffuf- [ ] wfuzz- [ ] dirbuster- [ ] gobuster- [ ] dirsearchJS File Analysishttp://JSFinder.shsubjs | getjsJS hardcoded APIs and secrets (secretfinder)LinkFinder思路4：api endpointsBroken link hijacking (blc)Locate admin and login panelNuclei template based reconSubdomains from subdomains (altdns, flydns, goaltdns)- [ ] Parameter Fuzzing- [ ] Content Discovery- [ ] Endpoints- [ ] .git/HEAD → git exposed- [ ] Login forms思路5：- [ ] Login endpoints- [ ] PORTSCANNING- [ ] nmap- [ ] masscan- [ ] naabu- [ ] dnsrecon → zonetransfer? → dnsrecon <target> -t axfrfavicon → shodanMisconfigured Cloud StorageWAYBACKURLS dataUse censys fofa, shodanCVE SCAN
Tip 2：
你没见过的XSS（已测，可弹）
<script type="importmap">{"imports": {"xss": "data:text/javascript,export default alert(1)"}}</script><script type=module>import "xss"</script>
Tip 3：
Interesting paths
最后，三上镇楼，加油加油加油！
三上：总有一些粉丝，打着学习的旗号来看我~
原文始发于微信公众号（奔跑在Hackerone的路上）：Bug Bounty Tips（2022-04-18）
