Proxy Bar on Telegram: “Рубрика На заметку $USERNAME@hacker.wtf

Рубрика На заметку $USERNAME@hacker.wtf - part 6
*
CDX API Internet Archive оч полезная штука, особенно если уметь миксовать со сторонним софтом.

web.archive.org/cdx/search/cdx?url=*.example.com/*&collapse=urlkey&output=text&fl=original&filter=original
:.*\.(xls|xml|xlsx|json|pdf|sql|doc|docx|pptx|txt|git|tar\.gz|tgz|bak|7z|rar|log|cache|secret|db|backup|yml|gz|config|csv|yaml|md|md5|exe|dll|bin|ini|bat|sh|tar|deb|rpm|iso|img|env|apk|msi|dmg|tmp|crt|pem|key|pub|asc)$

*
Можно завернуть в быстрый onliner + добить по портам 80\443\etc

domain="example.com"
ext='(xls|xml|xlsx|json|pdf|sql|doc|docx|pptx|txt|git|tar\.gz|tgz|bak|7z|rar|log|cache|secret|db|backup|yml|gz|config|csv|yaml|md|md5|exe|dll|bin|ini|bat|sh|tar|deb|rpm|iso|img|env|apk|msi|dmg|tmp|crt|pem|key|pub|asc)'

curl -s "https://web.archive.org/cdx/search/cdx?url=*.$domain/*&collapse=urlkey&output=text&fl=original&filter=original:.*\.${ext}$" \
  | sed 's/:80\//\//; s/:443\//\//' \
  | sort -u \
  | tee "wayback_files_${domain}.txt"

*
Ну или в нормальный bash + subfinder + amass + httpx

#!/usr/bin/env bash
set -euo pipefail

domain="${1:-}"
[[ -z "$domain" ]] && { echo "Usage: $0 example.com"; exit 1; }

outdir="recon_${domain}"
mkdir -p "$outdir"

ext='(xls|xml|xlsx|json|pdf|sql|doc|docx|pptx|txt|git|tar\.gz|tgz|bak|7z|rar|log|cache|secret|db|backup|yml|gz|config|csv|yaml|md|md5|exe|dll|bin|ini|bat|sh|tar|deb|rpm|iso|img|env|apk|msi|dmg|tmp|crt|pem|key|pub|asc)'

subs_file="$outdir/subdomains.txt"
urls_file="$outdir/wayback_urls.txt"
files_file="$outdir/wayback_files.txt"
alive_file="$outdir/alive_urls.txt"

echo "[*] Enumerating subdomains for $domain ..."

subfinder -silent -d "$domain" 2>/dev/null | sort -u > "$subs_file.tmp" || true

amass enum -passive -d "$domain" 2>/dev/null | sort -u >> "$subs_file.tmp" || true

sort -u "$subs_file.tmp" > "$subs_file"
rm -f "$subs_file.tmp"

echo "[*] Subdomains: $(wc -l < "$subs_file")"

echo "[*] Querying Wayback CDX per subdomain (rate-limited) ..."

: > "$urls_file"
while IFS= read -r sub; do
  #collapse=urlkey и fl=original — чтобы получить уникальные урлы, filter чтобы не тащить мусор
  curl -s "https://web.archive.org/cdx/search/cdx?url=${sub}/*&collapse=urlkey&output=text&fl=original&filter=original:.*\.${ext}$" \
    >> "$urls_file" || true

  sleep 0.2
done < "$subs_file"

curl -s "https://web.archive.org/cdx/search/cdx?url=*.$domain/*&collapse=urlkey&output=text&fl=original&filter=original:.*\.${ext}$" \
  >> "$urls_file" || true

cat "$urls_file" \
  | sed 's/:80\//\//; s/:443\//\//' \
  | sort -u > "$files_file"

echo "[*] Wayback “interesting files” URLs: $(wc -l < "$files_file")"
echo "[*] Saved: $files_file"

echo "[*] Checking which URLs are alive (HEAD/GET minimal) via httpx ..."
# -mc 200,204,301,302,307,308 — живые
# -follow-redirects куда ведёт
httpx -silent -l "$files_file" -follow-redirects -mc 200,204,301,302,307,308 -timeout 10 -retries 1 \
  | tee "$alive_file" > /dev/null

echo "[*] Alive URLs: $(wc -l < "$alive_file")"
echo "[*] Done. Output dir: $outdir"

Ну а цепочек понастроить можно до бесконечности:
subfinder + httpx + waybackurls/gau/katana + uro + gf patterns = (xss, sqli, redirect и чьтотамеще)
или
subfinder + httpx + katana + grep '\.js$' + nuclei -t exposures = (API keys, JWT secrets, AWS keys, эндпоинты и тд)

натурально миллионы их

#РубрикаНаЗаметкуХакеру