馃悋
CheatSheet
  • Inicio
  • Web Site
    • Subdomain
  • API
    • Recolecci贸n de Informacion
      • Directorios
      • OSINT
      • Enumeracion en Endpoints
    • Busqueda de Vulnerabilidades
      • Validaciones
      • Mal manejo de errores
      • Sesiones
      • IDOR
      • Ataques de Inyecci贸n
      • Exposici贸n de datos sensibles
      • Otras posibles vulnerabilidades
      • Rate Limit
      • Cors
      • Ataques de Cabeceras
      • Prototype Pollution
      • Ataque de deserializaci贸n
      • Ataques JWT
  • Mobile
    • PlayStore to APK
    • Bypass Ofuscacion Xamarin
    • Bypass Flutter
  • Miscelanio
    • SSH
    • Docker
    • DNS
    • Silver Ticket
    • LDAP
    • Shell Command Files (SCF)
    • SPOOLER
    • JuicyPotato
    • TOMCAT
    • Proc Enum
    • Primitives
    • Archivos .crash
    • Nginx
    • FTP
    • Pivoting
    • Web API to Postman
    • Web Sockets
    • OTP
    • FastInfoset
  • Post Explotaci贸n
    • Dump HTTP Credentials
  • Configuraciones Burpsuite
    • BurpCollaborator Server Privado
Powered by GitBook
On this page
  • Fuzz de Endpoints
  • JS Minning
  • Fuzz de parametros
  • Kite Runner
  1. API
  2. Recolecci贸n de Informacion

Enumeracion en Endpoints

Last updated 1 year ago

Fuzz de Endpoints

https://domain.site/api/v1/FUZZ1.FUZZ2

actionObject
ActionObject
action_Object
action-object
action.object
...

JS Minning

Extension de burpsuite.

Fuzz de parametros

arjun -u URL

Kite Runner

kr scan hosts.txt -w routes.kite -x 20 -j 100
LogoGitHub - chrislockard/api_wordlist: A wordlist of API names for web application assessmentsGitHub
LogoGitHub - PortSwigger/js-miner: This tool tries to find interesting stuff inside static files; mainly JavaScript and JSON files.GitHub
LogoGitHub - s0md3v/Arjun: HTTP parameter discovery suite.GitHub
LogoGitHub - assetnote/kiterunner: Contextual Content Discovery ToolGitHub