Hoşgeldin Misafir

Discovery Listing - Cheatsheet

WeeZe

WeeZe

WeeZe

8 Haz 2025
817 Mesaj

Aktiflik

Seviye

Deneyim

TIM / GÖREV:
mh3epd3.png
# Nedir:
Directory / content fuzzing, web sunucularında gizli dizinler, admin panelleri, yedek dosyalar, API endpoint’leri ve unutulmuş kaynakları tespit etmek için kullanılan brute‑force tabanlı keşif tekniğidir.

# Daha detaylı incelemek isterseniz Turkhacks Resmi Github reposundan bakabilirsiniz.

Markdown (GitHub flavored): 
### Turkhacks.com | Bug Researchers Team
GitHub: https://github.com/turkhacks-com


# FEROXBUSTER

## Temel dizin taraması
feroxbuster -u https://target.com -w /usr/share/wordlists/dirb/common.txt

## Thread sayısını artır
feroxbuster -u https://target.com -w wordlist.txt -t 50

## Dosya uzantıları ile tarama
feroxbuster -u https://target.com -w wordlist.txt -x php,txt,bak,zip,old

## Recursive (alt dizinlere inerek)
feroxbuster -u https://target.com -w wordlist.txt -r

## Durum kodu filtreleme
feroxbuster -u https://target.com -w wordlist.txt -s 200,204,301,302

## Proxy (Burp / Tor)
feroxbuster -u https://target.com -w wordlist.txt --proxy http://127.0.0.1:8080

---

# WFUZZ

## Temel fuzz
wfuzz -c -z file,/usr/share/wordlists/dirb/common.txt --hc 404 https://target.com/FUZZ

## Dosya uzantıları ile
wfuzz -c -z file,wordlist.txt --hc 404 https://target.com/FUZZ.php

## HTTP method fuzz
wfuzz -c -z list,GET-POST-PUT-DELETE https://target.com/FUZZ

## Cookie / Header ile fuzz
wfuzz -c -z file,wordlist.txt -H "User-Agent: FUZZ" https://target.com/

---

# FFUF

## Temel fuzz
ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt

## Dosya uzantıları ile
ffuf -u https://target.com/FUZZ -w wordlist.txt -e .php,.bak,.old,.zip,.txt

## Status code filtreleme
ffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200,204,301,302

## Boyut bazlı filtre
ffuf -u https://target.com/FUZZ -w wordlist.txt -fs 4242

## Recursive fuzz
ffuf -u https://target.com/FUZZ -w wordlist.txt -recursion

## Header / Cookie ile fuzz
ffuf -u https://target.com/FUZZ -w wordlist.txt -H "Authorization: Bearer FUZZ"

---

# WORDLIST ÖNERİLERİ

-------------------------------------

Amaç  |	Wordlist
Genel  |	dirb/common.txt
Büyük  |	raft-large-directories.txt
API  |	api-endpoints.txt
Backup  |	backup-files.txt
Admin  |	admin-panels.txt

-------------------------------------

#İpuçları

Önce küçük wordlist → sonra büyük liste
Status 301/302 mutlaka incele
Backup (.bak, .old, .zip) uzantıları çok kritik bulgudur
API dizinleri ayrı wordlist ile fuzz edilmelidir
 

THS-AI

THS-AI

THS-AI

THS YAPAY ZEKA
Turkhacks Kurumsal
20 Haz 2025
11,255 Mesaj

Aktiflik

Seviye

Deneyim

TIM / GÖREV:
**Discovery Listing – Cheatsheet (XenForo)**
1. **Create a Central Hub** – Use a single Google Sheet, Notion page, or a dedicated forum thread where every discovery item is logged.
2. **Uniform Columns** – Keep the same columns for every entry:
* Title (short, descriptive)
* URL / ID (exact link or internal reference)
* Status (New / Reviewed / Completed)
* Tags (e.g., “Bug”, “Feature”, “UI”)
* Notes (quick summary, issue, or next action)
3. **Assign Ownership** – Each row should have an “Owner” column so it’s clear who is responsible for follow‑up.
4. **Set a Review Cadence** – Schedule a weekly quick‑check (e.g., every Friday) to confirm that new entries are added and status updates applied.
5. **Use Color‑Coding** – Apply a simple color scheme:
* Green = Completed
* Yellow = In Progress
* Red = Blocked / High Priority
6. **Keep it Minimal** – No extra fluff. If a link or description isn’t absolutely necessary, leave it out. A concise list is easier to scan.
7. **Version Control** – If you use a shared spreadsheet, enable version history so you can roll back accidental changes.
8. **Export for Reporting** – Periodically export the sheet as CSV to attach to status reports or emails; this automates the data capture step.

**Quick Tags Cheat Sheet**
- **BUG** – Functional issue
- **REQ** – Feature request
- **UI** – User‑interface change
- **SEC** – Security concern
- **DOC** – Documentation update

**Hands‑on Tip**
Start by filling the sheet with the last month’s discoveries before you roll out the system – that gives the team a realistic template while they learn the flow.
 
Cevap yazmak için giriş yap yada kayıt ol.
Geri
Üst