BigBountyRecon - BigBountyRecon tool utilises 58 different techniqu

项目说明

BigBountyRecon

BigBountyRecon tool utilises 58 different techniques using Google dorks and open source tools to expedite the process of initial reconnaissance on the target organisation. Reconnaissance is the most important step in any penetration testing or a bug hunting process. It provides an attacker with some preliminary knowledge on the target organisation. Furthermore, it will be useful to gain insights into what controls are in place as well as some rough estimations on the security maturity level of the target organisation.

This tool can be used in addition to your usual approach for bug hunting. The idea is to quickly check and gather information about your target organisation without in time and remembering these syntaxes. In addition, it can help you define an approach towards finding some quick wins on the target.

Any suggestions or ideas for this tool are welcome - just tweet me on

!image

ANYRUN:

Techniques

1. Directory Listing: Finding open directories using Google Dork on your target organisation helps one to understand the directory structure on the webserver. It may reveal sensiti or it may lead to information disclosure.

2. Configuration Files: Often times configuration files contains sensiti such as hardcoded passwords, sensiti locations or API tokens which can help you gain pri access to the internal resources.

3. Database Files: Database Files are data files that are used to store the contents of the database in a structured format into a file in separate tables and fields. Depending on the nature of the web application these files could provide access to sensiti.

4. WordPress: WordPress is an open-source CMS written in PHP. WordPress has thousands of plugins to build, customise and enhance the websites. There are numerous in these plugins. Finding WordPress related

5. Log Files: Log files sometimes provide detailed information of the users' acti in a particular application. These files are good to look at session cookies or other types of tokens.

6. Backup and Old Files: Backup files are original copies of the critical systems. These provide access to PII or access to sensiti.

7. Login Pages: It is extremely important to identify login pages of your target organisation to perform bruteforce attempts or trying default credentials to gain further access to organisation resources.

8. SQL Errors: SQL errors leaks sensiti about the backend systems. This can help one to perform enumeration on the database types and see if the application is to input related attacks such as SQL Injection.

9. Apache Config Files: Apache HTTP Server is configured by placing directives in plain text configuration files. The main configuration file is usually called httpd.conf. In addition, other configuration files may be added using the Include directive, and wildcards can be used to include many configuration files. Any directive may be placed in any of these configuration files. Depending on the entries in these config files it may reveal database connection strings, username and passwords, the internal workings, used and referenced libraries and business logic of application.

10. Robots.txt File: Robots.txt file instructs web robots how to crawl pages on their website. Depending on the content of the file, an attacker might disco directories and files.

11. DomainEye: DomainEye is a domain/host in tool that has the largest domain databases. They provide services such as reverse Whois, reverse IP lookup, as well as reverse NS and MX.

12. Publicly Exposed Documents: Such documents can be used to extract metadata information.

13. phpinfo(): Exposing phpinfo() on its own isn't necessarily a risk, but in combination with other could lead to your site becoming compromised. Additionally, module could make attackers life easier when targeting application using newly discovered exploits.

14. Finding Backdoors: This can help one to identify website defacements or ser related issues. By exploiting the open redirect on the trusted web application, the attacker can redirect to a phishing page.

15. Install/Setup Files: Such files allows an attacker to perform enumeration on the target organisation. Information gathered using these files can help disco details which can then be used to perform the targeted exploit.

16. Open Redirects: With these, we look at known parameters to open redirect related issues.

17. Apache Struts RCE: Successfully exploiting an RCE could allow the attacker to run arbitrary programs. Here, we are looking for files with extensions of ".action" or ".do".

18. 3rd Party Exposure: Here we are looking for exposure of information on third party sites such as Codebeautify, Codeshare and Codepen.

19. Check Security Headers: Identify quickly if the target site is using security related headers in the ser.

20. GitLab: Quickly look for sensiti on the GitLab.

21. Find Pastebin Entries: Shows you the results related to the target organisation on the Pastebin site. This could be passwords or any other sensiti related to the target organisation.

22. Employees on LINKEDIN: Identifying employee names on LinkedIn can help you build a username list when it comes to password spraying attack.

23. .HTACCESS / Sensiti: Look for sensitive file exposure. This may indicate a ser.

24. Find Subdomains: Subdomain helps you expand the attack surface on the target organisation. There are numerous tools a to automate the process of subdomain enumeration.

25. Find Sub-Subdomains: Identify sub-sub domains on the target organisation using Google Dork,

26. Find WordPress related exposure: WordPress related exposure helps you gain access to sensiti and folders.

27. BitBucket & Atlassian: Source code leakage, hardcoded credentials and access to cloud infrastructure.

28. Passi: Passi is a great tool to perform threat in. Using BigBountyRecon we will use Passi to identify subdomains on the target information.

29. Stacko: Source code exposure or any technology-specific questions mentioned on the Stacko.

30. Find WordPress related exposure using Wayback Machine: Look for archie files using WaybackMachine.

31. GitHub: Quickly look for sensiti on the GitHub.

32. OpenBugBounty: Look for publicly exposed security issues on the OpenBugBounty website.

33. Reddit: Information about the particular organisation on the Reddit platform.

34. Crossdomain.xml: Look for misconfigured crossdomain.xml files on the target organisation.

35. ThreatCrowd: Search engine for threats, however, we are going to use this to identify additional sub-domains.

36. .git Folder: Source code exposure. it's possible to download the entire repository content if accessible.

37. YouTube: Look for any recent news on Youtube.

38. Digitalocean Spaces: Spaces is an S3-compatible object storage service that lets you store and ser amounts of data. We will look for any data exposures.

39. .SWF File (Google): Flash is dead. We are going to use Google Dorks to look for older of flash .swf's which contain .

40. .SWF File (Yandex): Flash is dead. We are going to use Yandex to look for older of flash .swf's which contain .

41. .SWF File (Wayback Machine): Flash is dead. We are going to use WaybackMachine to look for older of flash .swf's which contain .

42. Wayback Machine: Look for archi to access old files.

43. Reverse IP Lookup: Reverse IP Lookup lets you discover all the domain names hosted on any given IP address. This will help you to explore the attack surface for a target organisation.

44. Traefik: Look for an open-source Edge Router for an unauthenticated interface which exposes internal services.

45. Cloud Storage and Buckets: Google CSE for cloud storages - aws, digitalocean, backblaze, wasabi, rackspace, dropbox, ibm, azure, dreamhost, linode, gcp, box, mailru

46. s3 Buckets: Open s3 buckets.

47. PublicWWW: Source code search engine indexes the content of over 200 million web sites and provides a query interface that lets the caller find any alphanumeric snippet, signature or keyword in the web pages ‘HTML’, ‘Ja’ and ‘CSS’ style sheet code.

48. Censys (IPv4, Domains & Certs): Search engine for finding internet devices. We will use this to look for additional sub-domains using endpoints on Censys.

49. Shodan: Search engine for Internet-connected devices

50. SharePoint RCE: Look for C SharePoint RCE related endpoint.

51. API Endpoints: Find WSDL files.

52. Gist Searches: Quickly look for sensiti on the Gist pastes.

53. CT Logs: Certificate Transparency (CT) is an Internet security standard and open-source framework for monitoring and auditing digital certificates. We will use to look for additional sub-domains for a targeted organisation.

54. Password Leak: Look for plaintext passwords of internal employees exposed in leaks.

55. What CMS: Identify the and type of CMS used by a target organisation for targeted enumeration and exploit research.

Screenshots

Search for plaintext passwords for a target organisation:

!image

Looking for subdomains and other interesting information on the target organisation:

!image

Finding Apache Struts related assets:

!image

if the URL contains extenstion of ".do":

!image

How to use this tool?

Step1: Download the file from Release section:

Step2: Run the EXE file

Step3: Enter the target domain

Step4: Click on different buttons in the tool to find information

Step5: In case of Google Captcha simply click on the puzzle and mo

Questions?

Twitter: <br>
LinkedIn:

Dorking operators across Google, DuckDuckGo, Yahoo and Bing

Table obtained from:

Here is a table with possible dorks for search engines.

| Dork | Description | Google | DuckDuckGo | Yahoo | Bing |
|------------------------------------------------------------- |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |-------- |------------ |------- |------ |
| cache:[url] | Shows the of the web page from the search engine’s cache. | ✓ | | | |
| related:[url] | Finds web pages that are similar to the specified web page. | ✓ | | | |
| info:[url] | Presents some information that Google has about a web page, including similar pages, the cached of the page, and sites linking to the page. | ✓ | | | |
| site:[url] | Finds pages only within a particular domain and all its subdomains. | ✓ | ✓ | ✓ | ✓ |
| intitle:[text] or allintitle:[text] | Finds pages that include a specific keyword as part of the indexed title tag. You must include a space between the colon and the query for the operator to work in Bing. | ✓ | ✓ | ✓ | ✓ |
| allinurl:[text] | Finds pages that include a specific keyword as part of their indexed URLs. | | ✓ | | |
| meta:[text] | Finds pages that contain the specific keyword in the meta tags. | | | | |
| filetype:[file extension] | Searches for specific file types. | ✓ | ✓ | | ✓ |
| intext:[text], allintext:[text], inbody:[text] | Searches text of page. For Bing and Yahoo the query is inbody:[text]. For DuckDuckGo the query is intext:[text]. For Google either intext:[text] or allintext:[text] can be used. | ✓ | ✓ | | ✓ |
| inanchor:[text] | Search link anchor text | ✓ | | | |
| location:[iso code] or loc:[iso code], region:[region code] | Search for specific region. For Bing use location:[iso code] or loc:[iso code] and for DuckDuckGo use region:[iso code].An iso location code is a short code for a country for example, Egypt is eg and USA is us. | | ✓ | | ✓ |
| contains:[text] | Identifies sites that contain links to filetypes specified (i.e. contains:pdf) | | | | ✓ |
| altloc:[iso code] | Searches for location in addition to one specified by language of site (i.e. pt-us or en-us) | | | | ✓ |
| feed:[feed type, i.e. rss] | Find RSS feed related to search term | | ✓ | ✓ | ✓ |
| hasfeed:[url] | Finds webpages that contain both the term or terms for which you are querying and one or more RSS or Atom feeds. | ✓ | ✓ | | ✓ |
| ip:[ip address] | Find sites hosted by a specific ip address | | | ✓ | ✓ |
| language:[language code] | Returns websites that match the search term in a specified language | | ✓ | ✓ | |
| book:[title] | Searches for book titles related to keywords | ✓ | | | |
| maps:[location] | Searches for maps related to keywords | ✓ | | | |
| linkfromdomain:[url] | Shows websites whose links are mentioned in the specified url (with errors) | | | | ✓ |

Contribution & License

<a rel="license" href=" alt="Creati License" style="border-width:0" src=" /></a><br />This work is licensed under a <a rel="license" href=" Attribution 4.0 International License</a>.</br>
Want to contribute? Please fork it and hit up with a pull request.

Any suggestions or ideas for this tool are welcome - just tweet me on

项目信息

开发语言：C#

Star 数：1571

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕BigBountyRecon tool utilises 58 different techniques using various Google dorks and open source tools to expedite the process of initial reconnaissance on the target organisation. 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。