Bug Bounty with Bash

Hello guys,

Adding Bash to my bug bounty was the best thing I ever did during my learning process!

Tables of Content:

1. Introduction
2. Subdomain Enumeration
3. Subdomain Takeovers
4. CORS Misconfiguration
5. Resources

Let’s Start with Some Basics Introduction. Ummm…

What’s Bash? (The first question comes.)

Bash — Bourne Again Shell

Bash is a standard shell, it’s intuitive and flexible. In Linux and macOS, Bash is a standard shell for common users. The primary purpose of bash is to allow you to interact with the computers’ OS so that you can accomplish whatever you need to do. Bash is just a language that allows you to execute some commands in a programmable way.

To learn more about bash, Here is a Bash Cookbook which can help you to learn each and everything about Bash

Bash Cookbook for Everyone — Part 1

Now Why Bash and Bug Bounties together?

I would say why not? You’ll only find tools made for security-purpose that do nearly what you do but in a much faster way and written in bash and If you can’t find one. Then Write One.

So, Lets Start

I know GUIs are nice and interactive but are not fast.

Majorly Used Commands in bash during Bug Bounty

cat — concatenate files
tee — copy stdin to a file and to the screen
sort — sort the lines from stdin

🔎Julia Evans🔍 on Twitter

sort & uniq

uniq — Remove duplicate lines from stdin
xargs — run a command using each line from stdin as an argument
awk — general purpose text-processing language

🔎Julia Evans🔍 on Twitter

awk

grep — search for patterns in files or stdin

🔎Julia Evans🔍 on Twitter

grep

find — list files recursively and apply filters

🔎Julia Evans🔍 on Twitter

find

sed — edit the input stream

🔎Julia Evans🔍 on Twitter

sed

Now let’s do Some Recon with the Help of BASH

Subdomain Enumeration

1. One-liner to find the subdomains:

while read sub; do if host “$sub.example.com” &> /dev/null; then echo “$sub.example.com”; fi; done < subdomains_wordlist.txt
~tomnomnom

2. Automating Stuff with the help of tools:
Note: these tools should be already installed in your system
Check out my previous blog post to install and use all the tools

Recon like you owns it!

##!/bin/bash

#starting assetfinder

assetfinder --subs-only $1 | tee -a domains.txt

#starting amass

amass enum --passive -d $1 -o domains

#removing duplicate entries
sort -u domains -o domains

#filtering the domains
cat domains | filter-resolved | tee -a domains.txt
rm domains

#checking for alive domains
echo "\n\n[+] Checking for alive domains..\n"
cat domains.txt | ~/go/bin/httprobe | tee -a alive.txt

Save the above script with subenum.sh and give it executable permission
chmod +x subenum.sh

In the above script, we have used amass and assetfinder for subdomain enumeration, then sort to remove the duplicate entries after it I have used filter-resolved (another get tool by tomnomnom) to resolve the domains and to check how many domains are actually alive, for that we have used a tool called httprobe by tomnomnom and saved the alive domains in a different file called alive.txt.

Next comes it Subdomain Takeover

It starts with checking the CNAME of subdomains

host -t CNAME subdomain.example.com

Having a lot of targets to scan.

Now doing it manually for every subdomain is hard work to-do.
So to shorten the time period and increasing its value is because you are reading this blog. Right?

One Liner to do it is:

cat domains.txt | xargs -n 1 -I{} host -t CNAME {}

For speeding things up pipes give you some parallelization for free and xargs can run things in parallel

Next will be making a Script to find CORS Misconfiguration

So this is the easiest way to find the CORS misconfiguration

You can download this script from here: https://raw.githubusercontent.com/tomnomnom/dotfiles/master/scripts/acao

Give it executable permission by chmod and run it:

./acao <subdomain_filename>

More Resources

• Fasten your Recon process using Shell Scripting
• tomnomnom/dotfiles
• Ten Things I Wish I'd Known About bash
• explainshell.com - match command-line arguments to their help text
• nahamsec/recon_profile

Best of luck everyone. Keep-Hacking!

Feedbacks and edits are welcome

Twitter, Linkedin

If you enjoyed this blog, please click the 👏 button and share it to help others find it.