İçerik Keşfi & Recon

recon difficulty: kolay

İyi bir web testi, saldırı yüzeyini genişletmekle başlar. Amaç; gizli alt alan adlarını, uçları, parametreleri ve eski/terk edilmiş içeriği bulup test edilecek her noktayı ortaya çıkarmaktır.

Komut üreteci

ffuf · directory brute

embedded tool

URL FUZZWordlist

Generated command

ffuf -u https://hedef.com/FUZZ -w raft-medium-directories.txt -mc 200,301,302,403 -t 40

ffuf · directory brute

Subdomain & varlık keşfi

subfinder -d hedef.com -all -o subs.txt

amass enum -passive -d hedef.com

assetfinder --subs-only hedef.com

httpx -l subs.txt -title -tech-detect -status-code -o live.txt

puredns bruteforce wordlist.txt hedef.com -r resolvers.txt

Certificate Transparency (crt.sh), SecurityTrails, ZoneTransfer (açıksa) ve reverse WHOIS pasif kaynakları tamamlar.

curl -s "https://crt.sh/?q=%25.hedef.com&output=json" | jq -r '.[].name_value' | sort -u

dig axfr @ns1.hedef.com hedef.com

Dizin & dosya brute force

ffuf -u https://hedef.com/FUZZ -w raft-medium-directories.txt \
  -mc 200,204,301,302,307,401,403 -o ffuf.json

feroxbuster -u https://hedef.com -w wordlist.txt -x php,bak,zip,txt,old

gobuster dir -u https://hedef.com -w wordlist.txt -t 50

ffuf -u https://hedef.com/FUZZ -w files.txt -e .php,.bak,.sql,.zip,.git,.env

İlginç hedefler: /.git/, /.env, /backup/, /api/, /swagger, /graphql, /actuator, /server-status, phpinfo.php, /.svn/, /WEB-INF/web.xml, /debug, /metrics.

Virtual host keşfi

ffuf -u https://IP/ -H "Host: FUZZ.hedef.com" -w vhosts.txt -fs <default_len>

ffuf -u https://hedef.com/ -H "Host: FUZZ" -w vhosts.txt -fc 404

Parametre & JS madenciliği

Gizli parametreler — arjun -u https://hedef.com/api veya Burp Param Miner .

JS çıkar — uçlar, API anahtarları, iç yollar:

katana -u https://hedef.com -jc -d 3 -o crawl.txt

getJS -url https://hedef.com | tee js.txt

python linkfinder.py -i https://hedef.com/app.js -o cli

Arşivler :

gau hedef.com | tee gau.txt

waybackurls hedef.com | sort -u

cat gau.txt | grep -EI '\.(js|json|config|bak|sql|env)'

Sözlük birleştir — crawl + wayback + wordlist → ikinci tur brute.

API & şema keşfi

ffuf -u https://hedef.com/FUZZ -w api-routes.txt -mc 200,401

nuclei -u https://hedef.com -t http/exposures/

GraphQL introspection → GraphQL.

Teknoloji parmak izi

whatweb https://hedef.com

wafw00f https://hedef.com

nuclei -u https://hedef.com -t technologies/ -silent

curl -sI https://hedef.com | grep -iE 'server|x-powered|via'

WAF/CDN varlığı payload stratejisini (encoding, timing) belirler.

Hassas dosya checklist

□ /.git/HEAD /.git/config → git-dumper
□ /.env /config.php.bak /web.config
□ /backup.zip /db.sql /dump.tar.gz
□ /actuator/env /jolokia (Spring)
□ /server-status /server-info (Apache)
□ /_profiler /phpinfo.php
□ S3 / Azure blob public listing (JS veya DNS)

git-dumper https://hedef.com/.git/ ./git-dump

grep -RniE 'api[_-]?key|secret|password' git-dump | head

Sonraki adım

subs + live → takeover taraması
dirs + js endpoints → SQLi/XSS/SSRF/IDOR
api docs → BOLA/BFLA
wayback params → reflected XSS / open redirect

→ SQLi · XSS · SSRF · IDOR · API · Takeover