Web Pentesting Tools

# Subdomain enumeration workflow
# Step 1: Passive enumeration
subfinder -d target.com -o subs.txt
amass enum -passive -d target.com >> subs.txt

# Step 2: Remove duplicates
sort -u subs.txt > subs-unique.txt

# Step 3: Probe for live hosts
httpx -l subs-unique.txt -o live-hosts.txt

# Step 4: Screenshot live hosts
gowitness file -f live-hosts.txt -P screenshots/

# Step 5: Technology fingerprinting
httpx -l live-hosts.txt -tech-detect -o tech-stack.txt

# Nmap comprehensive web scan
nmap -sC -sV -p 80,443,8080,8443 target.com -oA nmap-web

# Nikto scan
nikto -h https://target.com -output nikto-results.txt

# Nuclei vulnerability scan
nuclei -u https://target.com -t cves/ -t vulnerabilities/ -o nuclei-results.txt

# Nuclei with severity filter
nuclei -u https://target.com -severity critical,high -o critical-vulns.txt

# Full reconnaissance workflow
echo "target.com" | subfinder | httpx | nuclei -t technologies/

# ffuf - Directory fuzzing
ffuf -w /path/to/wordlist.txt -u https://target.com/FUZZ -mc 200,301,302,403

# ffuf - Filter by response size (hide 404 pages that return same size)
ffuf -w wordlist.txt -u https://target.com/FUZZ -fs 1234

# ffuf - Parameter fuzzing
ffuf -w params.txt -u "https://target.com/api?FUZZ=test" -mc all -fc 400

# ffuf - POST data fuzzing
ffuf -w usernames.txt -u https://target.com/login -X POST -d "user=FUZZ&pass=test"

# ffuf - Subdomain fuzzing
ffuf -w subdomains.txt -u http://FUZZ.target.com -mc 200

# Gobuster directory scan
gobuster dir -u https://target.com -w wordlist.txt -x php,txt,html -t 50

# Feroxbuster recursive scan
feroxbuster -u https://target.com -w wordlist.txt --depth 3

# Parameter discovery with Arjun
arjun -u https://target.com/api/endpoint

# SQLMap - Basic injection test
sqlmap -u "https://target.com/page?id=1" --batch --dbs

# SQLMap - POST request
sqlmap -u "https://target.com/login" --data="user=admin&pass=test" --batch

# SQLMap - With cookies and specific DBMS
sqlmap -u "https://target.com/api?id=1" --cookie="session=abc123" --dbms=mysql

# XSStrike - XSS testing
xsstrike -u "https://target.com/search?q=test"

# Commix - Command injection
commix -u "https://target.com/ping?ip=127.0.0.1"

# tplmap - SSTI testing
python tplmap.py -u "https://target.com/page?name=test"

# Hydra - HTTP POST form brute force
hydra -L users.txt -P passwords.txt target.com http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"

# Hydra - HTTP Basic Auth
hydra -L users.txt -P passwords.txt target.com http-get /admin

# John - Crack password hashes
john --wordlist=/path/to/rockyou.txt hashes.txt

# Hashcat - MD5 hashes (mode 0)
hashcat -m 0 -a 0 hashes.txt wordlist.txt

# Hashcat - bcrypt (mode 3200)
hashcat -m 3200 -a 0 hashes.txt wordlist.txt

# CeWL - Generate custom wordlist from target site
cewl https://target.com -d 2 -m 5 -w custom-wordlist.txt

# jwt_tool - Analyze JWT
jwt_tool <token> -T

# jwt_tool - Test for vulnerabilities
jwt_tool <token> -M at

# Install SecLists
git clone https://github.com/danielmiessler/SecLists.git /opt/SecLists

# Alternative: Install via package manager
brew install seclists

# Common wordlist paths (after installation)
/opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt
/opt/SecLists/Discovery/Web-Content/common.txt
/opt/SecLists/Passwords/Leaked-Databases/rockyou.txt
/opt/SecLists/Discovery/DNS/subdomains-top1million-5000.txt