Howlsec
HOWLSEC
offensive security
// notes/ Exploitation & Tooling
🔎

Finding CVEs & Misconfigurations

Mapping detected versions to public exploits and spotting common misconfigurations.

#cve#searchsploit#exploitation

Finding CVEs & Misconfigurations

Checking for CVE's and misconfigrations

Use nuclei too: https://github.com/projectdiscovery/nuclei

unnamed_6e429920f1cb4b349e8ce30aea1909ea

heartbleed oneliner

🐺 howlsec@kali
01cat subdomains.txt | while read line ; do echo "QUIT" | openssl s_client -connect $line:443 2>&1 | grep 'server extension "heartbeat" (id=15)' || echo $line: safe; done

jaeles

https://github.com/jaeles-project/jaeles

GO111MODULE=on go get github.com/jaeles-project/jaeles GO111MODULE=on go install github.com/jaeles-project/jaeles@latest

Nuclei

https://github.com/projectdiscovery/nuclei

🐺 howlsec@kali
01go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest
02 
03nuclei -u https://www.example.com -o nuclei.txt -H 'Cookie: __utma=3888939.1525145704.1681934326.1682325240.1682336033.7; __utmz=3888939.1682336033.7.3.utmcsr=burpsuite|utmccn=(referral)|utmcmd=referral|utmcct=/; optimizelyEndUserId=oeu1681934326465r0.21988294222220184; optimizelySegments=%7B%7D; optimizelyBuckets=%7B%7D; __utmc=3888939; __gads=ID=ee3e4f3ff600bee0-221dfa15abdd00d6:T=1682241482:RT=1682241482:S=ALNI_MZmEwEJmLePmDeB73-j6k6bkHYs2w; __gpi=UID=00000bee4645a8fe:T=1682241482:RT=1682325604:S=ALNI_MYw9Y650SP71kBJ43eC0sqwW865Mg; ASP.controls_findbusiness_ascx=1; __utmb=3888939.11.10.1682336033; __utmt=1'  -t exposures/ -t cves/ -t vulnerabilities/ -t fuzzing/ -t misconfiguration/ -t technologies/
This option attempts to fingerprint the technology stack and components used on the target, then select templates that have been tagged with those tech stack keywords. Example:
🐺 howlsec@kali
01`nuclei` `-u` `https://jira.targetdomain.site` `-s` `critical,high,medium,low,info`  `-as`

Osmedeus

https://github.com/j3ssie/osmedeus

Directly run on vuln scan and directory scan on list of domains: osmedeus scan -f vuln-and-dirb -t list-of-domains.txt

Scan list of targets: osmedeus scan -T list_of_targets.txt

General scan: osmedeus scan -f general -t tesla.com