OffensiveSecurity - A structured, folderized offensive security framew

项目说明

BBH-Recon Framework

> A comprehensi reconnaissance framework for bug bounty hunting and red team operations.

The framework has been reorganized into a folderized structure to impro and scalability. Each module contains detailed tool workflows, configuration notes, and operational checklists.

---

🗺️ Reorganized Table of Contents

1. 01. Operational Security & Infrastructure

* & secure pro.
* Setting up stealth redirectors (Nginx, CDNs) to protect team assets.
* Proxychains configuration and IP rotation techniques (Tor, AWS API Gateway / FireProx).
* Operational en isolation and legal safe harbor compliance.

2. 02. Scope, Target Profiling & Corporate OSINT

* Programmatic scope parsing from Bug Bounty platforms using bbscope.
* Business hierarchy mapping (acquisitions, subsidiaries) company registries (SEC, Crunchbase).
* Passi and identity har.
* Search engine dorking (Google Hacking Database) for sensitive data leakage.
* Threat intelligence search queries (Shodan, Censys, FOFA).
* Historical DNS and WHOIS tracking.

3. 03. Passi

* Passi gathering using aggregators (subfinder, bbot, amass, assetfinder).
* Certificate Transparency (CT) log mining (direct SQL queries to crt.sh and real-time CertStream monitoring).
* Historical archive URL scraping (Wayback Machine, GAU).
* Ad-network tag correlation to link unknown assets.

4. 04. Acti & Network Discovery

* DNS bruteforcing and permutation workflows (puredns, gotator, dnsgen).
* Subdomain takeo mechanisms.
* ASN and IP space mapping (metabigor, BGP tables).
* Mass port scanning and fingerprinting (masscan, nmap, rustscan).
* host fuzzing (ffuf).

5. 05. Web Content Discovery

* Recursi and file fuzzing (feroxbuster, ffuf).
* Active web crawling (katana).
* API and GraphQL schema discovery (kiterunner, arjun, clair).
* Ja analysis, endpoint extraction (linkfinder), and secret scanning (secretfinder).

6. 06. Cloud Reconnaissance

* AWS storage bucket discovery, permission checks, and IMDSv1/v2 metadata retrieval.
* Google Cloud Storage bucket and metadata checks.
* Azure blob containers analysis and instance metadata.
* Multi-cloud storage scanning (cloudbrute).

7. 07. Assessment & Analysis

* Technology stack detection and matching.
* Parameter fuzzing, deduplication (uro), and injection mapping.
* Authentication analysis (JWT testing, OAuth 2.0 , session tracking).
* Automated scanning pipelines using nuclei.

8. 08. Red Team Tradecraft & Detection Engineering

* New Module: In-depth analysis of stealth C2 infrastructure redirectors.
* Passive SSL/TLS Handshake Fingerprints: O of JA3/JA4 and JARM signature behaviors.
* Acti Discovery: Querying Microsoft 365 and Federated Identity Pro.
* Defense E: Network scan rate optimization (low-and-slow) and protocol blending.
* Blue Team Detection: Writing Suricata rules, Sigma templates, and tracking beaconing signatures.

9. 09. Monitoring & Continuous Reconnaissance

* Real-time CT monitoring and notification pipelines.
* Custom bash scripting for daily differential scanning.
* Distributed scanning architectures utilizing cloud fleets (axiom).
* Setting up notifier outputs (notify) for Discord and Slack.

10. 10. Reporting, Resources & Cheat Sheets

* Writing high-impact reports.
* Reference links for must-ha.
* Unified one-liner cheat sheets (full domain resolution, exposed .git discovery, S3 enumeration).

---

> Maintained by RemmyNine | Contributions welcome via PR.

---

Magnus — Offensi Automation

The Scripts/ directory contains magnus.ps1 — a modular PowerShell recon automation script for bug bounty hunting.

| Flag | Mode | Description |
|------|------|-------------|
| --recon | Full Recon | Passive subs → DNS resolution → live HTTP → port scan (CDN-common ports) |
| -gp | Endpoint Collection | Wayback Machine + GAU URL aggregation, merge, clean, dedup |
| --content | Content Discovery | FFuF directory/path fuzzing on li |
| --tech | Tech Fingerprinting | Wappalyzer-style stack detection |
| --takeover | Takeo | Nuclei + Subzy subdomain takeo |
| --vuln | Scan | Nuclei C/misconfig templates |
| --passive | Passi | Passi enumeration (subfinder, assetfinder, crt.sh) |
| --crawl | Web Crawling | Katana recursi + JS file extraction |
| --ports | Port Scan | Comprehensive Nmap top 1000 port scan |

项目信息

开发语言：PowerShell

Star 数：44

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A structured, folderized offensive security framework covering passive/active reconnaissance, web content discovery, cloud recon, vulnerability assessment, and advanced Active Directory Pentesting & Red Teaming tradecraft with defensive telemetry analysis.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。