Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-22 04:33:28 +00:00
Code Issues Projects Releases Packages Wiki Activity

GitBook: [master] 3 pages modified

Browse source
This commit is contained in:
CPol 2020-12-08 12:25:09 +00:00 committed by gitbook-bot
parent 3dbed86121
commit e63b5800b7
No known key found for this signature in database
GPG key ID: 07D2180C7B12D0FF
3 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
SUMMARY.md
View file

@ -172,6 +172,7 @@
* [69/UDP TFTP/Bittorrent-tracker](pentesting/69-udp-tftp.md)
* [79 - Pentesting Finger](pentesting/pentesting-finger.md)
* [80,443 - Pentesting Web Methodology](pentesting/pentesting-web/README.md)
* [Uncovering CloudFlare](pentesting/pentesting-web/uncovering-cloudflare.md)
* [Laravel](pentesting/pentesting-web/laravel.md)
* [Code Review Tools](pentesting/pentesting-web/code-review-tools.md)
* [Symphony](pentesting/pentesting-web/symphony.md)

3
pentesting-web/open-redirect.md
View file

@ -8,6 +8,9 @@ Using a whitelisted domain or keyword
```text
www.whitelisted.com.evil.com redirect to evil.com
https://www.target01.com//example.com/ redirect to //example.com/
https://www.target01.com%09.example.com redirect to example.com
https://www.target01.com%252e.example.com redirect to example.com
```
Using "//" to bypass "http" blacklisted keyword

8
pentesting/pentesting-web/uncovering-cloudflare.md Normal file
View file

@ -0,0 +1,8 @@
# Uncovering CloudFlare
Techniques to try to uncover web servers behind cloudflare:
* Search for the domain inside [http://www.crimeflare.org:82/cfs.html](http://www.crimeflare.org:82/cfs.html)
* \*\*\*\*[**CloudFlair**](https://github.com/christophetd/CloudFlair) is a tool that will search using Censys certificates that contains the domain name, then it will search for IPv4s inside those certificates and finally it will try to access the web page in those IPs.
* You can also use some service that gives you the historical DNS records of the domain. Maybe the web page is running on an IP address used before.