ProjectDiscovery Stories

A Deep Dive on Katana "Field" Extraction

Reconnaissance is an important step in identifying and building your organization's attack surface or targeted assets. Web crawling is a prominent reconnaissance technique that allows you to gather information by automatically traversing and extracting data from web pages. However, this process often results in unstructured data that contains countless URLs and parameters, making it difficult to identify unique endpoints, parameters, and fields for use in automation or reconnaissance pipelines.

Learning & Automation

How to use Uncover: Quickly discover exposed hosts using multiple search engines

As the world becomes increasingly connected, more and more devices are being exposed to the internet. This includes everything from industrial control systems to home routers and even refrigerators. Unfortunately, many of these devices are not properly secured, leaving them open to attack. This is where internet-based search engines like Shodan, Censys, and others come in. These tools allow security researchers to find hosts and vulnerabilities on the internet by searching for specific patterns

Learning & Automation

Introducing Alterx: Efficient Active Subdomain Enumeration with Patterns

What is Alterx ? Alterx is a Fast and Customizable subdomain wordlist generator using patterns. alterx fits in the active subdomain enumeration pipeline, which involves creating a wordlist using permutations of passive subdomain enumeration results. Instead of hardcoding patterns in the tool itself, alterx uses a set of patterns that users can customize. This makes alterx more efficient and effective than other existing tools. To understand alterx better, we need to know what active subdomain e

Vulnerability Management

Reconnaissance 105: Additional Types of Active Reconnaissance

Welcome to a 5 part series on Recon with ProjectDiscovery! * Part 1 * Part 2 * Part 3 * Part 4 * Part 5 * This is the final post in our blog series on reconnaissance for penetration testing and bug bounty hunting. In this post, we look at some more creative ways to do active and passive reconnaissance to ensure completely coverage of your target's assets. Subsidiary and Acquisition Enumeration Subsidiary and acquisition enumeration, also known as corporate structure enumeration, is the proce

Learning & Automation

Implementing Nuclei into your Bitbucket CI/CD Pipeline for Scanning Live Web Applications

Security is a crucial factor for both small and large enterprises. This has led to the evolution of DevOps into DevSecOps, which integrates security at an internal level. As we have discussed in previous blogs, it is important to implement security within your DevOps cycle to ensure that it becomes DevSecOps. This approach introduces security at an early phase and helps mitigate multiple misconfigurations early on. In this blog, we will explore how to use Nuclei, a powerful open-source tool for

Nuclei & Templates Vulnerability Management

Reconnaissance 104: Expanded Scanning

Welcome to a 5 part series on Recon with ProjectDiscovery! * Part 1 * Part 2 * Part 3 * Part 4 * Part 5 * Template-based Scanning Template-based scanning is a technique that can be used as part of reconnaissance to identify vulnerabilities and misconfigurations in a target system or network. It involves using a set of predefined templates or rules to define the types of vulnerabilities and misconfigurations that should be looked for, and then scanning the target system or network using these

Learning & Automation

Implementing Nuclei into your GitLab CI/CD Pipeline for Scanning Live Web Applications

Security is a fundamental requirement for businesses of all sizes. In recent years, DevOps has evolved into DevSecOps, which emphasizes the integration of security at every stage of the development process. As previously discussed, it is critical to incorporate security into the DevOps cycle to detect and mitigate potential security risks early on. This approach enables organizations to identify and address security vulnerabilities and misconfigurations before they escalate into significant issu

Nuclei & Templates Vulnerability Management

Reconnaissance 103: Host and Port Discovery

Welcome to a 5 part series on Recon with ProjectDiscovery! * Part 1 * Part 2 * Part 3 * Part 4 * Part 5 * Live Host Discovery After gathering all available subdomains, the following process filters all valid ones based on their HTTP method and response content. The httpx tool can collect information about a web server, such as the types of HTTP methods it supports and the contents of its HTTP headers. Httpx During reconnaissance, httpx can gather information about a web server. This inform

Learning & Automation

Reconnaissance 102: Subdomain Enumeration

Welcome to a 5 part series on Recon with ProjectDiscovery! * Part 1 * Part 2 * Part 3 * Part 4 * Part 5 * Subdomain enumeration is an essential reconnaissance technique in the fields of penetration testing and bug bounty hunting. In this part of our series on reconnaissance, we will explore the importance of this technique, how it works, and which tools can be used to conduct subdomain enumeration. We will also discuss best practices and common pitfalls to avoid when performing this type of rec

Learning & Automation

Reconnaissance 101: Active & Passive Reconnaissance

Welcome to a 5 part series on Recon with ProjectDiscovery! * Part 1 * Part 2 * Part 3 * Part 4 * Part 5 * Reconnaissance is a pivotal part of penetration testing and bug bounty hunting, and having an understanding of an organization's assets is crucial for assessing its attack surface. Procuring complete and accurate information during this phase is often crucial for the success of the pentest. This initial step is crucial because it helps to identify the target system or network and collect in

Learning & Automation

An in-depth guide to subfinder: beginner to advanced

In the era of application security, bug bounties have evolved and become mainstream for hackers around the globe. Hackers are constantly looking for new tactics to automate the process of reconnaissance and find different types of vulnerabilities. One of the first steps to hacking a larger scoped program is subdomain enumeration. You can find subdomains by using tools like amass, assetfinder, sudomy, and others. However, in this post, we'll discuss one of the most popular, subfinder, from Proje

Learning & Automation

Using PD tools to find my first subdomain takeover

Since joining PD in December, I've been learning a lot about our community and what it takes to be a modern security engineer. One of the biggest lessons I think I've learned is: 🤔To be a great defender, you have to think like an attacker Gone are the days when there were very separate teams—red and blue have even become “purple” in many organizations—doing security. And like the terminology or not, security continues to “shift left” and move into “DevSecOps.” While anyone trying to sell you

Learning & Automation

ProjectDiscovery Stories

A Deep Dive on Katana "Field" Extraction

How to use Uncover: Quickly discover exposed hosts using multiple search engines

Introducing Alterx: Efficient Active Subdomain Enumeration with Patterns

Reconnaissance 105: Additional Types of Active Reconnaissance

Implementing Nuclei into your Bitbucket CI/CD Pipeline for Scanning Live Web Applications

Reconnaissance 104: Expanded Scanning

Implementing Nuclei into your GitLab CI/CD Pipeline for Scanning Live Web Applications

Reconnaissance 103: Host and Port Discovery

Reconnaissance 102: Subdomain Enumeration

Reconnaissance 101: Active & Passive Reconnaissance

An in-depth guide to subfinder: beginner to advanced

Using PD tools to find my first subdomain takeover

Monitor your infrastructure

Talk to sales

Platform

Open Source

Resources

Company