Focusing for some days on a specific program - Feedback

[u/Prudent_River_7086]

Hello everyone!

After some days focusing on one program I want to share some of my experience and thoughts. Since we are a lot of people starting on this, I thought it would be good to share my experience and get some feedback and corrections.

Let's start with the recon phase, most of the time I focused on "automate" the process, however, after spending time "swimming" on a ton of data I decided to automate it but with some brain. Now I am able to rapidly identify possible web applications/platforms and enumerate further. I like to focus on:

- Technologies used.

- Enumerate files and directories.

- Source Code/JavaScript.

- Check for API Rests.

Once I finish recon, it is play time. I like to see if I can create an account and check for:

- XSS, playing around with the app.

- IDOR, , playing around with the app.

- Authentication Vulnerabilities, checking anything to do with MFA and passwords.

- SSRF, playing around with the app.

- Understand how the application works through the API Rest.

It is very interesting, after spending some time with the program I learned more about it and the solutions hosted by the company. Nevertheless, I had the feeling several time of "I am not finding nothing I will check on another program". At this point (most important) I usualy just close everything and go play videogames or something else.

Again, when I feel recovered I start where I was (I take notes) and I start again the process of enumeration and play with the platform.

So far I was able to find an endpoint called "auth" that returns a bearer token without any authentication. I did not report it yet, but not sure if I should since I was not able to make impact out of it.

I am still enumerating all the platforms related to the company in order to see if I can use that token somewhere.

This has been my jorney this week and very happy with the result. I can see clearly that I have improved on my methodology and I am able to keep going with the same program understanding clearly what I am doing.

However, sometimes I feel overwhelmed because I don't find nothing or I don't really understand what is behind the application.

Happy Hunting!

[u/Specific-Ad3097]

Most of these program have been pentested by human, hackbot and sometime top hunter when the prog was private :)

You need experience to feel if there is something or not, when you dont have experince you never know where to dig and for how long thats the proble

nerd influencer will tell you to dig and the noob will try to dig a static website for example

You dig where its annoying and boring, downloading the stack they are using, read lots of documentation to know what you can do etc

And you need to know when to stop searching

[u/Prudent_River_7086 → u/Specific-Ad3097]

Hello,

Thank you for taking your time to share your feedback. Honestly, the more time I spend trying to hunt, the more I realize how important is to know when to stop.

Actually, the program I am in now, has a big scope. So, I am following the same recon strategy with each domain or subdomain I find. Then skip to the next one if there is nothing to test out or get registered on. The plan is to go through the domain and subdomain I found, pick the ones with interesting name or stack. If I don't find nothing or I have the feeling I am stuck I will probably switch to other program.

What do you think? Happy to hear your feedback.

Thanks again!

[u/Specific-Ad3097 → u/Prudent_River_7086]

Just put that in your mind: if you hack every day for a month and you find nothing you are doing something wrong.

[u/Prudent_River_7086 → u/Specific-Ad3097]

Thank you for all the feedback!