RCE by finding secret hidden files via Encryption and hashing

1 week ago 18

BOOK THIS SPACE FOR AD

ARTICLE AD

You can create modified wordlists like this.

Base64 Encoding:-

cat list.txt | while read row; do
echo -n "row" | base64 | tee -a
base64list.txt;

2.Using ‘ffuf’ for Fuzzing

With the generated wordlists, you can use ffuf to check multiple file types and hash values.

Example:-

ffuf -w base64list.txt:/W1 -w
extentions.txt:/W2 -u "https://example.com/W1.W2" -mc 200

This allows you to test combinations of hash values or encoded values with different file extensions (like `.php`, `.bak`, zip….).

This is very helpful in bug bounty as it widens your scope and it is easy to do but can get you more bugs by just by adding another step in your recon process.

Read Entire Article