ProjectDiscovery

A Guide to DNS Takeovers: The Misunderstood Cousin of Subdomain Takeovers

Introduction Let's start with this: A DNS takeover is not the same as a subdomain takeover. Subdomain takeovers are old news. Hackers who caught onto them early made busloads of bounties by automating their detection and exploitation. They're still out there, but competition is fierce. Crafty hackers built bots that detect and report subdomain takeovers within minutes of them becoming vulnerable. DNS takeovers are the new Orange. They've become popular among seasoned bug bounty hunters, but a

Learning & Automation

Building Your Own Historical DNS Solution with DNSx

If you’ve been following these blogs, you’ll see that in the last article, we hacked together a basic attack surface monitoring platform using projectdiscovery tools. Using some of those basic building blocks, we’re going to build a basic historical DNS bot that will continuously enumerate domains and then alert us for the existence of new domains. We will also be able to request the results from a flask API. I will be forking the old project as a starting point, so if you haven’t already read

Attack Surface Management Learning & Automation

Hacking Together an ASM Platform Using ProjectDiscovery Tools

Introduction In this article, we’re going to walk through hacking together a simple attack surface monitoring platform by using ProjectDiscovery tools, bash, and flask. We will also be using MongoDB & Redis for scan data and scan queues. This tool was written for the pure purpose of this article, if you would like to contribute to it or fork the repository, I encourage you to! The whole concept of the ProjectDiscovery tool suite is that it is modular, allowing you to tweak it to your heart's c

Attack Surface Management

ProjectDiscovery's Best Kept Secrets

A tour of ProjectDiscovery's less-known public tools, and how to use them by @pry0cc Introduction For those unaware, ProjectDiscovery is a group of talented hackers and creators that have massively disrupted the offensive tooling industry by creating tooling that genuinely makes the lives of hackers easier. If you’re active in the offensive security industry or bug bounty, you’ve likely heard of some of their brilliant flagship tools such as nuclei, httpx, dnsx, naabu and subfinder. These ar

Learning & Automation

Abusing Reverse Proxies, Part 2: Internal Access

Introduction As seen in Part 1: Abusing Reverse Proxies: Metadata, open proxies can allow an attacker to access cloud metadata API services. However, even without metadata services available, open proxies can be a boon for an attacker. A primer on open proxy types: * Forward: typical use case is allowing private network users to access the internet via a common egress point. This allows an organization to make rules for which types of internet services are accessible to users. * Reverse:

Vulnerability Research Nuclei & Templates

Abusing Reverse Proxies, Part 1: Metadata

Introduction Many cloud service providers offer a "metadata" service on their virtual machines. These services offer sensitive details about the instance and cloud operating environment. Metadata services offer REST APIs to programmatically retrieve this data. Amazon’s AWS service defined the IMDSv1 “standard” on their EC2 instances, and since then many others have adopted this IMDSv1 scheme as well, including AWS, Google, and Azure. The services have generally settled on the IP address 169.254

Vulnerability Research Nuclei & Templates

Token Spray - Introduction to self-contained template

We search for secret leaks in a variety of places including GitHub, JS files, HTTP replies, source code, and other places. Once we've identified these keys, the next question is: what service does this key belong to, and is it valid? Answers to those questions determines the severity of the revealed token. Found a hardcoded client ID and client secret in some frontend. Now what? — jub0bs (@jub0bs) October 3, 2021 Keyhacks is a great project that provides valid examples of API requests fo

Nuclei & Templates

Nuclei v2.5.2 - First Security Release

We'd like to thank @c3l3si4n for disclosing the first security vulnerability that affects nuclei. This blog describes a brief overview of the security issue/impact and the measures we took to address it. Issue Summary The nuclei engine has a code execution vulnerability using components with known vulnerabilities that can be exploited by utilizing a specially crafted headless based template. Root Cause Nuclei relies on the go-rod library for a high level browser driver to run templates tha

Nuclei & Templates

Nuclei v2.4.0 - Uniform, Stable & More Powerful

The new nuclei v2.4.0 release includes a slew of bug fixes and feature enhancements that improve the overall uniformity, stability, and functionality of the tool. Uniform This version includes improvements to the template execution process, with the nuclei-templates repository now serving as the default entry point. This means that when no templates are specified, the Nuclei engine executes all public templates (those that are not excluded) on the targets that have been specified. nuclei -u

Nuclei & Templates

Secrets Scanning with Nuclei

Within the v2.3.0 release, we've introduced File based scanning capabilities into the Nuclei engine. If you are already a Nuclei user, you will find it familiar because it follows the same principles as the HTTP based templates. We wanted to provide a similar approach to make writing your own file based templates simple and convenient. File protocol The File protocol template extension makes pattern-based file matching possible by enabling Nuclei to scan the desired parts of the file system.

Nuclei & Templates

Writing security templates for Apache Airflow

Apache Airflow is an Open Source tool that allows users "programmatically author, schedule and monitor workflows". We decided to create a suite of checks for testing security of Airflow installations and document the entire process to show how easy it is to write custom nuclei templates for any piece of technology. Environment Setup Before we start with template creation, we need to set up an airflow instance for testing. We found this repo on GitHub with the docker-compose file to set up a l

Learning & Automation

Exploiting Race conditions with Nuclei

What Is a Race Condition Vulnerability? A race condition attack happens when a computing system that’s designed to handle tasks in a specific sequence is forced to perform two or more operations simultaneously. This technique takes advantage of a time gap between the moment a service is initiated and the moment a security control takes effect. This attack, which depends on multithreaded applications, can be delivered in one of two ways: interference caused by untrusted processes (essentially a

Nuclei & Templates Vulnerability Management

ProjectDiscovery

A Guide to DNS Takeovers: The Misunderstood Cousin of Subdomain Takeovers

Building Your Own Historical DNS Solution with DNSx

Hacking Together an ASM Platform Using ProjectDiscovery Tools

ProjectDiscovery's Best Kept Secrets

Abusing Reverse Proxies, Part 2: Internal Access

Abusing Reverse Proxies, Part 1: Metadata

Token Spray - Introduction to self-contained template

Nuclei v2.5.2 - First Security Release

Nuclei v2.4.0 - Uniform, Stable & More Powerful

Secrets Scanning with Nuclei

Writing security templates for Apache Airflow

Exploiting Race conditions with Nuclei

Monitor your infrastructure

Talk to sales

Platform

Open Source

Resources

Company