🇵🇰XSS & Open Redirect
🔥 Perfect regex to Endpoints Analysis
(
figlet -f small -c "UUIDs" | lolcat; grep -Eo '[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}' wayback.txt | sort -u | tee >(wc -l | awk '{print "Total UUIDs: "$1}');
figlet -f small -c "JWT" | lolcat; grep -a "eyJ" wayback.txt | grep -Eo 'eyJ[A-Za-z0-9_\-\.]+' | sort -u | tee >(wc -l | awk '{print "Total JWTs: "$1}');
figlet -f small -c "Suspicious Strings" | lolcat; grep -Eo '([a-zA-Z0-9_-]{20,})' wayback.txt | sort -u | tee >(wc -l | awk '{print "Total Suspicious: "$1}');
figlet -f small -c "Credit Cards" | lolcat; grep -Eo '\b[0-9]{13,16}\b' wayback.txt | sort -u | tee >(wc -l | awk '{print "Total CCs: "$1}');
figlet -f small -c "SessionIDs" | lolcat; grep -Eo '[a-zA-Z0-9]{32,}' wayback.txt | sort -u | tee >(wc -l | awk '{print "Total SessionIDs: "$1}');
figlet -f small -c "Tokens & Secrets" | lolcat; grep -aiE 'token=|token |code=|code |secret=|secret ' wayback.txt | sort -u | tee >(wc -l | awk '{print "Total Tokens/Secrets: "$1}');
figlet -f small -c "Credentials" | lolcat; grep -aiE 'admin|pass(word|wd|wd=)|pwd|passwd|password|mail|phone|mobile|number' wayback.txt | sort -u | tee >(wc -l | awk '{print "Total Cred-like: "$1}');
figlet -f small -c "Private IPs" | lolcat; grep -Eo '((10|172\.(1[6-9]|2[0-9]|3[0-1])|192\.168)\.[0-9]{1,3}\.[0-9]{1,3})' wayback.txt | sort -u | tee >(wc -l | awk '{print "Total Private IPs: "$1}');
figlet -f small -c "All IPs" | lolcat; grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' wayback_domain.com.txt | sort -u | tee >(wc -l | awk '{print "Total IPs: "$1}');
figlet -f small -c "Payments" | lolcat; grep -aiE 'payment|order(id)?|pay(id)?|invoice|receipt' wayback.txt | sort -u | tee >(wc -l | awk '{print "Total Payments: "$1}');
figlet -f small -c "Roles" | lolcat; grep -aiE 'role=|privilege=|=admin' wayback.txt | sort -u | tee >(wc -l | awk '{print "Total Roles: "$1}');
figlet -f small -c "API Endpoints" | lolcat; grep -aiE '/api/|api\.|/graphql|graphql' wayback.txt | sort -u | tee >(wc -l | awk '{print "Total API Endpoints: "$1}');
figlet -f small -c "Auth Stuff" | lolcat; grep -aiE 'sso|/sso|saml|/saml|oauth|/oauth|auth|/auth|callback|/callback' wayback.txt | sort -u | tee >(wc -l | awk '{print "Total Auth: "$1}');
f
)Subdomains Gathering
Check Server and client side redirect then Exploit Further
Find XSS Steps
---------------------------------------------------------------------
1
Open Redirect GET-Based in Register-Login-logout-signup and Reset-Password Page URL
3
If Access token available In Redirect URL then Check Account take Over
OR Check with Burp Collaborater And Webhook URL
7
Blind XSS Check to Account take Over
8
13
15
Create and Customize XSS Payload According WAF and Regex
16
RXSS to Account Take Over
17
if GET Parameter Check for SQL injection
Last updated