Welcome back, cyberwarriors! 

You’ve probably seen people committing their env files to GitHub without noticing it. When you’re looking for a job as a coder, that mistake alone is significant enough to get you rejected if it happens during the technical portion. And if it ever happened to you, it’s happened to plenty of others too.

Today we’ll look at TruffleHog. It’s a tool that scans Git repositories and their full history for secrets that got committed by accident. It uses high entropy checks with custom regular expressions to catch strings that look like API keys, tokens, passwords and other sensitive data. You can point it at one repository or use a GitHub or GitLab API to hit a lot of projects in one go.

A developer can delete a key from the latest commit, but it will still live in Git’s past. With those credentials, you access services without making much noise.

Installation

First install git-dumper and TruffleHog. The Python package and the GitHub release are not the same, so pay attention to which one you’re on.

kali > pip3 install git-dumper  
kali > pip3 install trufflehog

We’ll use git-dumper when we find an exposed .git directory and then run TruffleHog against that dump. Leaked .git folders are still common.

Dump a Repository

Some servers leave the entire .git directory open. Below you can see a website where it was fully accessible.

Dump it by giving git-dumper the URL and a local folder for the files.

kali > git-dumper http://example.com/.git dump

Other websites block the directory listing but still serve some of the files.

Git-dumper can pull every object, commit and reference it can reach.

kali > git-dumper http://example.com/.git/  dump

Everything will be stored in the dump folder.

Analyzing the Repositories

Once the dump is on disk, run TruffleHog against it. By default it runs entropy-based matching. That can help, but it shouldn’t be the only mode you know. In our case, regex with entropy off gave us more results. 

kali > trufflehog --regex --entropy NO dump

In one of the files we found database credentials.

You can also install TruffleHog from the GitHub release and scan the filesystem directly:

kali > curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin 

kali > trufflehog filesystem /home/kali/Documents/dump  

This build is fine for tuning your scans, but it often makes more noise and false positives, so just be aware of it.

Other Ways to Analyze Repositories

Depending on which build you’re using, try these flags to change what you get in the output.

Scan a repo for verified secrets:

kali > trufflehog git https://github.com/trufflesecurity/test_keys --results=verified,unknown

Verified means TruffleHog checked these finding live against the service API (AWS, GitHub and so on). Unknown is both high entropy and regex hits that it couldn’t confirm.

Same scan with JSON output:

kali > trufflehog git https://github.com/trufflesecurity/test_keys --results=verified,unknown --json

Scan a GitHub repo including issues and pull requests:

kali > trufflehog github --repo=https://github.com/trufflesecurity/test_keys --issue-comments --pr-comments  

That digs into issues, comments, PR bodies and comments. You can find leaks in discussions too.

Scan a local Git repo:

kali > trufflehog git file://test_keys --results=verified,unknown  

Useful when you’ve compromised a dev Linux machine with multiple projects on it. There’s a better chance of finding something locally than pushed to GitHub, although both can happen, as you now know.

Summary

We had an external pentest where several services were accessible but no credentials could be found. Surprisingly, some developers had kept projects they were doing for the company publicly accessible on GitHub. Eventually we found a working pair and got into a database.

TruffleHog can be really helpful here. Sensitive files sometimes get exposed without the publisher even knowing it. We’re humans and we make mistakes. Offensive or defensive, the point is the same.

The post Open Source Intelligence (OSINT): Finding Leaked Secrets with TruffleHog first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Sometimes you might run the same model twice and get different results. That often happens when you’ve upgraded it with skills. Skills are detailed text documents that lay out the tools the model should use, the approach it should take and how it should analyze the results. Good skills are practical, pulled from actual reports on HackerOne and other bug bounty platforms. A model can still lean on its own knowledge, but that’s just less efficient.

There are plenty of skills out there you might come across, but not everything can be trusted. Some skills can simply be dangerous and infect your system. To make sure they are safe, you can check them with SkillSpector by NVIDIA, so you don’t end up with anything malicious on your system.

Bug Bounty Skills

Both of these repositories do bug bounty hunting end to end, but they go about it in almost opposite ways.

The first is called Bountyforge. It’s actually just one single skill file, but it’s smart enough to split itself into eight different mini agents that all work at the same time. One looks at websites and apps, another at crypto and blockchain, others go after different angles hackers can exploit. It also checks each finding with four different tests to make sure it’s not a false alarm. Then you get a report in whatever format the bug bounty program wants.

You don’t even need Claude Code or any other coding tool for this, you can just run it right inside the regular Claude website in your browser.

The second bug bounty repository is Claude-BugHunter. It takes the opposite approach. The repo has 83 skills and almost half of those were built by studying 681 real bug reports that people actually got paid for on HackerOne. These skills aren’t locked to Claude Code either, you can use OpenCode, Codex or Hermes Agents with them.

Here are a few examples of the results we got with these skills.

API endpoints are often vulnerable and this is worth trying your luck on to see how it goes.

Another approach can be APK reverse engineering. Here we found a hardcoded RSA-2048 signing private key baked into the published APK. With that key, hackers can push a new app to the app store and infect every employee phone, getting access not just to the WiFi network at the workplace but to their personal life too. Quite dangerous.

We found an API endpoint vulnerable to an SQL injection and managed to pull the entire database.

Having skills built on real attacks keeps the model from wandering off into its own weird approaches and missing a lot of good findings. 

Active Directory Skills

Claude-AD was made by ADScanPro for testing a company’s internal network. It gives your model a playbook with skills and agents built for an Active Directory assessment. The developers are upfront that it’s not an auto pwn tool. It’s meant to guide you through the assessment. Every finding can get mapped to a compliance control (DORA, NIS2 and ENS).

Claude-AD is very careful about getting caught too. It explains what a security team would actually see on their end if that technique got used. And any time it’s about to do something that would actually change things on the company’s network, it stops and asks for confirmation first.

General Cybersecurity Skills

Antropic-Cybersecurity-Skills is basically a giant reference book. It has 817 skills covering 29 areas of security work, cloud security, malware analysis, all the way down to hardware and firmware. Each skill is its own small file, so your agent will quickly pull out the two or three it actually needs for its task.

Every skill ties back to real security frameworks that companies and auditors already use (NIST CSF, MITRE ATT&CK and so on). So if your model finds a problem using one of these skills, it can also tell you exactly which official standard it violates. You can use it to justify findings to a compliance team.

SCADA Skills

On an industrial network, a clumsy scan can shut down a production line or damage physical equipment, since a lot of this gear is old and wasn’t built to handle unexpected traffic. That’s why the ICS skill by Masriyan is built to never actively touch a live industrial network. Instead, it works off network captures someone already took. It reads the file, recognizes industrial protocols by the ports they normally run on (Modbus, DNP3, Siemens S7, EtherNet/IP, OPC-UA, and more) and counts which devices are talking to each other. It then shows you write commands, these are the ones that change a value on an industrial device. That’s the traffic you want to see first.

The second mode skips network captures and instead searches for exposed industrial equipment using Shodan and Censys. The skill can also help your model reason about how an industrial network is laid out and check findings against MITRE’s ICS specific attack framework and the IEC 62443 security standard.

Science Skills

Although science isn’t really what we want to focus on here, in one of our SCADA articles we mentioned that to carry out a successful attack requires hackers to understand the technical process of the plant. That means understanding how the chemicals are produced and which units are used along the way. We also showed how vinyl acetate is produced and talked about paracetamol production.

1 kg of paracetamol at 100% purity was reported to cost €8,205, while 1 kg at 99% purity cost just €5. So even a single day of sabotage could cause serious financial damage to an enterprise.

Finding a scientist among hackers is quite a challenge, which is why Stuxnet needed a group of people from different backgrounds working toward one objective. But now hackers can just import different skills to make their attacks more devastating. K-Dense published 140 skills with access to different scientific databases and Python tools.

The real concern here isn’t ICS exploits inside the repository, there aren’t any. It’s the access to sensitive scientific data paired with an AI agent that can actually understand that data and change it.

Summary

AI skills can be a gamechanger, especially when they’re based on actual reports hackers got paid for. These skills show your model how to approach things and what tools to use during the test, so it doesn’t wander off hallucinating and inventing its own ways of testing things. That can wreck your bug bounty flow, since you’ll end up overlooking plenty of potential targets.

Simply relying on the AI to find things isn’t enough, hunters that do it keep getting a lot of dupes. You need to test things manually too. For this reason we created our Bug Bounty training to show you how to find bugs and work with the AI more efficiently.

The post Artificial Intelligence (AI) in Cybersecurity, Part 25: Upgrading Your Model with Specific Skillset first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors and bug bounty hunters!

When we work with web applications, we often need to effectively crawl and spider them to understand what we’re dealing with. But the main problem we might encounter is that a target web app is an SPA, or single-page application. This means that the website loads a single HTML file initially and dynamically updates the content within that page as the user interacts with it. Therefore, traditional crawling tools become ineffective with modern web applications.

To work with modern JavaScript frameworks, single-page applications, and sophisticated authentication mechanisms, we can use the Katana framework from ProjectDiscovery. Katana is a web crawler that allows you to discover hidden paths, parameters, and endpoints in web applications. It’s fast, modular, and supports multiple crawling techniques.

One of the most impressive aspects of Katana is its ability to handle JavaScript execution and dynamic content rendering. Traditional crawlers often miss critical functionality because they cannot execute JavaScript or understand how modern web applications dynamically generate content. Katana addresses this limitation by incorporating headless browser capabilities that allow it to fully render pages, execute JavaScript, and discover content that would otherwise remain hidden.

Let’s explore how to download, install, and utilize this powerful reconnaissance tool to enhance your web application security testing capabilities.

Installing Katana

There are few methouds of installing the tool. In this article, I’ll focus on installing using Go programming language.

First, verify if Go is already installed:

kali> go version

Install Katana using the Go package manager:

kali> go install github.com/projectdiscovery/katana/cmd/katana@latest

Verify the installation:

kali> katana -version

Crawling Modes

Katana supports two main crawling modes, each tailored to different types of web applications and use cases.

The Standard Mode is designed for speed and simplicity, making it ideal for traditional websites. It uses Go’s built-in HTTP library to handle requests and responses, parsing raw HTTP response bodies without executing JavaScript or rendering the DOM. This lightweight approach ensures fast performance but may miss endpoints in more complex applications that rely on browser-based events.

In contrast, the Headless Mode offers a more thorough crawl by simulating a real browser environment. This mode is especially useful for modern, JavaScript-heavy applications, as it captures both raw and rendered content. By mimicking a legitimate browser fingerprint (including TLS and user-agent headers), it improves coverage and detection of dynamic elements.

You can enable Headless Mode with the -headless flag and customize it further with several options:

• -sc / -system-chrome: Use the locally installed Chrome
• -sb / -show-browser: Show the browser window during execution
• -ho / -headless-options: Pass custom Chrome options
• -nos / -no-sandbox: Disable the Chrome sandbox (useful for root users)
• -cdd / -chrome-data-dir: Specify a custom Chrome data directory
• -scp / -system-chrome-path: Set a specific path to the Chrome executable
• -noi / -no-incognito: Disable incognito mode

Basic Website Reconnaissance

Let’s start with a fundamental reconnaissance scenario where we need to map a target website’s structure and discover all accessible endpoints. For this example let’s try to understand application’s structure of Vesti.ru – Russian news website.

kali> katana -u https://example-target.com -d 5 -c 10 -o target-crawl-results.txt

-u: Specifies the target URL

-d 5: Sets maximum crawling depth to 5 levels

-c 10: Uses 10 concurrent threads for faster crawling

-o: Saves all discovered URLs to a file

JavaScript-Heavy Application Crawling

Modern web applications often rely heavily on JavaScript for content generation. Here’s how to handle an AngularJS-based single-page application.

kali> katana -u https://angular-app.com -js-crawl -headless -timeout 30 -delay 2 -o angular-results.json

-js-crawl: Enables JavaScript execution during crawling to handle AngularJS controllers and directives

-headless: Uses headless Chrome for rendering AngularJS templates and executing digest cycles

-timeout 30: Sets 30-second timeout for page loads to accommodate AngularJS bootstrapping

-delay 2: Adds 2-second delay between requests to allow AngularJS routing transitions

Known Files Discovery

Crawl for common files like robots.txt and sitemap.xml that often reveal valuable information about website structure and hidden content. These files can provide insights into:

• robots.txt: Disallowed directories and files that may contain sensitive information
• sitemap.xml: Complete site structure including pages not linked from main navigation
• Other discovery files: Common configuration files, backup files, and administrative interfaces

kali> katana -u https://example.com -known-files all -d 3

Note that a minimum depth of 3 is required to ensure comprehensive discovery of all known files across the target application.

Filtering Capabilities

Katana offers robust filtering features that help users process, refine, and manage crawl output with precision. These capabilities make it easy to isolate valuable data, reduce noise, and tailor results to match specific goals.

Users can filter output by specific fields, include or exclude URLs based on extensions or regular expressions, and even define custom fields using a YAML configuration file. This flexibility is crucial for handling the often large volume of data produced during a crawl, ensuring that users can focus on the most relevant information.

Some key filtering options include:

• -field or -f: Display specific fields (e.g., url, path, fqdn, rdn)
• -store-field or -sf: Save selected fields to disk
• -extension-match or -em: Show only URLs with specific file extensions
• -extension-filter or -ef: Exclude URLs with specific file extensions
• -match-regex or -mr: Include URLs that match a regex pattern
• -filter-regex or -fr: Exclude URLs that match a regex pattern

Example:
To extract only .js URLs (including those with query parameters) and save their full URLs to a file, you could run:

kali> katana -u https://example.com -match-regex “\.js” -f url -sf url -o js-files.txt

Summary

Whether you’re conducting penetration tests, bug bounty research, or comprehensive cyberwar operations, Katana’s advanced capabilities and modern architecture make it an essential addition to your hacking toolkit.

If you’re serious about sharpening your offensive security skills, consider our Subscriber Pro package. It’s designed to take your expertise to the next level.

The post Web App Hacking: Katana, A Next-Generation Crawling and Spidering Framework first appeared on Hackers Arise.

Welcome back, cyberwarriors!

Some of you are already spending your time hunting for bugs in web apps on bug bounty programs. You may stare at a target for hours looking for a small mistake buried in that huge pile of code. Finding a bug is always a hard thing when you get started. 

But we’ve got some tools that will improve your web recon. Some of them are well known, but others never got the attention they deserved. Together they can expand the attack surface and find secrets. Test them yourself and then feed them into your AI.

Gospider

Let’s start with Gospider. Gospider is a fast web crawler that can build a detailed map of a website. It goes through sitemap.xml and robots.txt, finds links buried in JavaScript files and can pull URLs from the Wayback Machine, Common Crawl, VirusTotal and AlienVault OTX.

Let’s install it:

# Using Go Lang
kali > GO111MODULE=on go install github.com/jaeles-project/gospider@latest

# Or using apt
kali > sudo apt install gospider

Now we test it against our target:

kali > gospider -s https://example.com -d 3 -c 20 --js --subs -o output

You can use it with –cookie and –header to add custom HTTP headers. For instance, CVE-2025-29927 needed a header with x-middleware-subrequest to test whether Node.js was vulnerable. To dig through JS files for hidden links, use –js. Subdomains can be found with –subs. –other-source will pull URLs from Archive.org, Common Crawl, VirusTotal and AlienVault OTX. 

Finally, –o saves your results to a file and –p routes your traffic through a proxy (http://localhost:8080).

SecretsFinder

The purpose of this tool is to find sensitive information hidden inside JavaScript files or source code. SecretsFinder searches for API keys, access tokens, JWTs, passwords, and other types of credentials using a collection of regular expressions. If the built in patterns aren’t enough for you, use -r <regex> with your own.

kali > git clone https://github.com/m4llok/SecretFinder.git
kali > cd SecretFinder
kali > python3 -m venv venv; source venv/bin/activate; pip3 install -r requirements.txt

You can scan websites, local source code or files exported from Burp Suite.

kali > python3 SecretFinder.py  -i “test/*.js” -o cli

JSLuice

JSLuice is also a great tool for bug hunting. It doesn’t rely on regular expressions, but it does syntax analysis with Tree-sitter instead. That way it can find more URLs, API endpoints, secrets and interesting strings.

It picks up URLs even when they’re built dynamically in code, not just hardcoded text. It also finds secrets by understanding context and meaning, instead of just matching fixed patterns. That way it can find things that you’d miss otherwise. 

JSLuice was developed by Tom Hudson, the same person behind gron, meg and unfurl.

kali > go install github.com/BishopFox/jsluice/cmd/jsluice@latest
kali > echo 'export PATH="$HOME/go/bin:$PATH"' >> ~/.bashrc
kali > source ~/.bashrc

Now we can use it:

kali > jsluice <mode> <parameters> <files>

There are two modes you’ll need. The urls mode extracts URLs and paths, while the secrets mode finds secrets and other interesting strings in the code.

kali > jsluice secrets secs.js | jq ‘select (.type != “stringLiteral”)’

Beyond those, JSLuice also has three operating modes built for static code analysis. Tree mode shows the JavaScript syntax tree to see  how the code is structured underneath all that formatting.

kali > jsluice tree tree.js 

Query mode runs custom Tree-sitter queries, so you can find language constructs quickly. It takes some practice. Format mode beautifies compressed JavaScript, so you can read it. 

Here is an example:

function x(a,b){return fetch("/api/"+a,{method:"POST",body:JSON.stringify(b)})}var c=123;

And here is the output after JSLuice cleans it up:

function x(a, b) {
    return fetch("/api/" + a, {
        method: "POST",
        body: JSON.stringify(b)
    });
}
var c = 123;

That alone can save you time. 

xnLinkFinder

xnLinkFinder is an upgraded version of LinkFinder. It doesn’t just extract JavaScript URLs, but it can also find parameters, generate custom wordlists tailored to the target app, search for secrets and process data from multiple sources. Definitely great for recon.

kali > pip install xnLinkFinder

We first need to collect URLs with Gospider:

kali > gospider -s https://example.com --js --subs  -o gospider_output

Next, we remove Gospider’s service information and image links with other unnecessary resources:

kali > cat target_ru | grep -E 'http[s]?://' | sed 's/.* - //' | grep -vE '\.(jpg|jpeg|png|gif|svg|ico|css|woff|ttf|eot|mp3|mp4|webm|avi)$' | sort -u > filtered_urls.txt

Once it’s ready, we can use it as input for xnLinkFinder:

kali > xnLinkFinder -i target_ru -sf example.com -sp example.com -op parameters.txt -owl wordlist.txt -sp secrets.txt

The list with URLs is specified with -i, while -sf limits processing to URLs that belong to the target domain. Without that flag, xnLinkFinder will also crawl external links. The base domain is specified with -sp. Then -op saves all discovered parameters to a file and -owl generates a custom wordlist that can later be used for parameter mining or fuzzing with FFUF. Finally, -os saves any secrets the tool finds along the way.

Dalfox

Dalfox is a scanner that finds reflected, stored and blind XSS. It does extensive parameter analysis in HTML, JavaScript, attributes, event handlers or other contexts. It can also evaluate WAF behavior and reflection points. It will automatically discover potential injection points with parameter mining and BAV (Basic Another Vulnerability) analysis.

kali > go install github.com/hahwul/dalfox/v2@latest

# or download the .deb package from the latest release

Here’s how you use it:

# Scan a single target
kali > dalfox scan “http://example.com”

# Scan a list of URLs
kali > dalfox scan targets.txt

-b here specifies a callback server. It will inject callback URLs into payloads and it looks like this:

<script src="https://callback-server"></script>

If the payload actually executes somewhere on the target, you will get an incoming request. Burp Collaborator and webhook.site both work well here.

Caido

Caido is a strong alternative to Burp Suite for intercepting and modifying HTTP traffic. The developers say it was built by hackers for hackers. Caido was written in Rust, which is great for performance, and it consumes significantly less than Burp.

Caido now ships with Kali Linux. If you are running an older release, you can install it yourself:

kali > sudo apt update
kali > sudo apt install caido

We have a series on Caido. If you’re new to it, you can start with our articles.

The tool may feel a little unfamiliar compared to what you are used to, but you can quickly become comfortable with it. The free edition does have a few limitations, though. 

Summary

You always begin your hunt with recon and the tools we covered here play a role in that process. Gospider will build a detailed map of a target, pulling in current and historical URLs. SecretsFinder and JSLuice dig into JavaScript and source code to find credentials, endpoints and things you’d otherwise miss. xnLinkFinder builds on that by extracting parameters and generating custom wordlists for better testing. Dalfox uses discovered parameters to test them for XSS and Caido completes it being a lightweight alternative to Burp Suite.

Web app hacking is a skill you need if you want to land a job as a pentester. You’ll often deal with clients who want to make their external infrastructure stronger. For that reason, we’ve created our Web App Hacking training. In our experience, API endpoints are often misconfigured and that’s where you can find many bugs, Hacking APIs will teach you how to do it.

The post Web App Hacking: Six Tools for Bug Hunters first appeared on Hackers Arise.

A step-by-step method for finding and proving CORS misconfiguration vulnerabilities: the header checks, the edge cases developers miss, and how to fix them.

How to Test for CORS Misconfigurations Like a Bug Bounty Hunter on Latest Hacking News | Cyber Security News, Hacking Tools and Penetration Testing Courses.

Welcome back, cyberwarrior! 

Today we are going to cover the use of SQLMap in bug bounty and web pentest. This tool has been around for years and proved to be the top choice. When you test websites for SQLi, you often start manually with known payloads and then move to your tools. Although there are a few tools available out there, this one is the most capable. So it’s a good idea to start with it.

This article will teach you how to work with flags and options. Since all the heavy lifting is done by the tool, it’s enough for you to start finding bugs and report them. SQLi is considered to be a critical vulnerability, as it may lead to RCE or a full website compromise. That really depends on the database management system (DBMS). We had a case during a pentest where an admin’s IP was whitelisted in the MySQL database. That same IP also had SSH open, and credential reuse got us into that server too. You never know what you’re going to run into once you’re inside a database. Sometimes one finding can lead to the next. That’s why this vulnerability is critical.

OWASP Top 10

Although the injections moved down the list, they’re still out there and very much exploitable. There are many gov websites that are vulnerable to it. Sometimes you’ll come across a time-based injection that’s pretty slow to work with. Other times, you might get a union-based injection that will let you dump entire databases fast and clean. Error-based injections are common and easy to spot. And finally, there are boolean-based injections.

It’s not always obvious that a website is vulnerable to an injection. It might look totally outdated but give you nothing. And on the other hand, solid looking websites can leak everything with just one payload.

Simple payload

Let’s start with the basics. Often, you don’t need to go overboard as SQLMap can handle most of it for you. You can stick with simple payloads and only then get into complex ones. The complexity of the payload doesn’t always increase the chance of a successful SQLi. Even changing parameters like –risk or –level too early can make your payload fail.

Let’s take a Russian ISP website as an example. The one-liner here is simple. Below you can see an intercepted POST request that we saved from Burp. It had random login credentials for the test. 

kali > sudo sqlmap -r website.ru.txt --risk=3 --level=4 --batch --random-agent

You can play with levels and risks, but be careful as some websites may have WAF, so try to keep it low in the beginning.

Now let’s try dumping their data with –dump. We are interested in the billing database (-D billing) and users11 table (-T users11). At the end of the line we will add –columns to enumerate the columns.

kali > sudo sqlmap -r website.ru.txt --risk=3 --level=4 --batch --random-agent --dump -D billing -T users11

You can also use –users and –passwords to dump credentials of database admins.

–users extracts database management users. Here you will see all the whitelisted IPs, but sometimes you will come across localhost, which won’t let you connect to the DB externally. –passwords will dump password hashes if available. If you succeed, it opens up a new attack vector, as mentioned before.

Let’s now test a second example where higher risk and level work just fine and actually give better results. 

Here is a furniture shop in Moscow. Even though the website seems pretty modern, the id= parameter is injectable.

We will go with –level=4 and –risk=3 again this time. The asterisk (*) points at the parameter that needs to be tested. You can also use -p for that.

kali > sudo sqlmap -u “https://website.ru/product.php?id=*” --risk=3 --level=4 --random-agent --batch --dbs

It worked. Now we dump the users table with usernames and hashes. But keep in mind, not all hashes can be cracked by SQLMap. If it fails, don’t be surprised. Just export them and use Hashcat or John the Ripper.

Once cracked, we can log into the website. If someone cracks an admin’s hash, they can cause real damage to the website.

That was easy. Let’s look at a different challenge.

Tampers

This is a gov.ru website. It’s different compared to the previous ones, because regular SQLMap payloads fail here. It’s protected by a WAF that filters suspicious requests. For this reason we will use tampers. There are many of them and random is a popular choice. It randomizes the casing of your payload, which can help bypass WAFs.

kali > sudo sqlmap -u “http://website.gov.ru/search?category?new&q=news” --batch --level=3 --risk=2 --dbms=mysql -p q --dbs --tamper=randomcase --no-cast

Another flag you might notice is –no-cast. This tells SQLMap not to cast data types. It can be useful after you find a working injection. Before that, it might get in your way.

There are tons of tamper scripts designed for different firewalls. If you find out what firewall is running, you’ll have a better chance of picking the right one.

Columns

Here is another government-associated website for the city of Khabarovsk. Khabarovsk is a major city in the Russian Far East, close to China. It’s known for its military importance and some sketchy biological programs during the Soviet era. This website looks like a city archive. Let’s dig into it.

Look at the search functions. It shows results in a table format. That’s your clue. We need to know how many columns are returned. If your union payload uses the wrong number of columns, it won’t work.

As you can see above, there are four of them. So we will go with –union-col=4

kali > sudo sqlmap -u “https://website.ru/afond/index.php?x=0&y=0&short_search=...&act=search” --level=5 --risk=3 --tamper=randomcase,between,space2comment --random-agent --batch --dbs --dbs=mysql -p short_search --union-col=4 --union-char=”a” --no-cast

Using a union character (a random string or ID) can sometimes help stabilize your payload and avoid false positives. Don’t forget to add tamper scripts. You can even stack them, just make sure they don’t conflict with each other. 

Conclusion

That’s it for Part 1. We’ve laid the foundation in this chapter showing you the real use of SQLMap and its functions. As it was mentioned previously, SQLi are critical vulnerabilities and it’s always a good idea to test them during your Web App Hacking or Bug Bounty. We have training on each, where we give you the needed skills to start finding your first bugs or land a job as a pentesters, as many companies require these skills. 

The post Web App Hacking: Using SQLMap in Bug Bounty first appeared on Hackers Arise.

The post Open-Source Intelligence(OSINT): Sherlock – The Ultimate Username Enumeration Tool first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Lately we have been covering the use of AI in cybersecurity and this space has been growing so fast that it’s hard to keep up sometimes. It’s only going to keep growing from here, so it’s smart to learn how to use it to your advantage instead of getting left behind.

Today we’re going to show you a pentest tool that works with different models. The tool comes ready to use right out of the box and you don’t have to provide your API key to get started. During our own testing, we did eventually hit a usage limit, but by that point we had already gotten a ton of work done. The limits will reset every day, sometimes you just need to wait 5-14 hours. But the daily limit should be enough for you to complete many of your tasks.

What is PentestCode

PentestCode is an autonomous agent that lives in your terminal. You point it at a target and from there it takes over. It can run tools, read the output, build a picture of the network as it decides what step makes sense next. Under the hood, it’s a hard fork of OpenCode, but stripped of all the code editing features and rebuilt from the ground up with offensive security in mind.

In our experience the tool did well in both web and network pentesting. Of course, everyone’s mileage may vary, so give it a shot yourself and see how it fits into your workflow. With that said, let’s get it set up.

Setting Up

All you need to do is unzip the release version and start it up. Before you do that though, make sure you are downloading the original project made by s0ld13rr and not some fork. There have been reports of forks being bundled with infected files, so stick to the source.

kali > wget https://github.com/s0ld13rr/pentestcode/releases/download/v0.2.5/pentestcode-linux-x64.tar.gz
kali > 7z x pentestcode-linux-x64.tar.gz
kali > 7z x pentestcode-linux-x64.tar

And that’s it, we are ready to launch.

Working with PentestCode

Once you launch the tool, the console will appear.

kali > ./pentestcode

At this point you can either leave everything at the default settings or tweak the model and the provider yourself. By default, the tool is set up with OpenCode Zen as the provider and Big Pickle as the model, though you can switch that over to DeepSeek v4 Flash. 

If you want to connect to a different provider, just type /connect.

And whenever you want to swap the model, just type /models and pick from the list.

Active Directory

Let’s start by testing this against our own lab. We gave it an Active Directory account with low privileges and asked to pull some interesting information from LDAP.

It came back with domain admins, misconfigs, machine accounts and more.

At the very end of the report, it suggested the next steps based on everything it found. 

Then we brought in BloodHound to see the relationships across the domain. If you have been following our earlier articles, you already know that our lowpriv account is set up as a kind of backdoor, since it holds GenericAll rights over AdminSDHolder. The tool found the backdoor and exploited it.

The agent performed a DCSync attack and pulled every user hash in the environment. Then we asked it to generate a golden ticket.

It pulled it off using the Impacket. Keep in mind, using Impacket won’t always work against a protected endpoint, so it’s important to spell out clearly how you want the pentest to be done. If you are running this against a live target, put real guardrails in place and give the tool much more detailed prompts so it does not wander somewhere it shouldn’t.

Finally, we get to the tedious part of a pentest. It’s writing up the report. You can do it in different formats using /report.

kali > sudo apt install glow
kali > glow report.md

Web Pentesting and Bug Bounty Hunting

Web pentesting is such a massive topic on its own that plenty of people end up specializing in just one or two attacks testing them across different targets. PentestCode can be used here too, once you give it a good starting point through solid reconnaissance. You can toggle between modes using Tab, switching back and forth between Recon and Pentest.

We intentionally kept our prompt vague, just to see how creative the tool would get on its own and pointed it at a website. Within 15 minutes, it mapped out every subdomain tied to that company and tested the infrastructure behind each one.

The goal was to get an RCE. We didn’t expect much to come of it, but it managed to do it.

PentestCode uploaded a webshell and used curl to do recon on the internal network from there. On top of that, it compromised both a mail account and a MySQL database. The admin panel was also exploited with a CSRF vulnerability. Pretty impressive stuff, honestly.

The tool comes in handy during post exploitation as well. In our test, it exploited a vulnerability in PostgreSQL and escalated its way up to superuser access, then went through the databases and pulled out some interesting data. You can see some of it below.

Summary

If you decide to test PentestCode yourself, make sure you steer clear of vague prompts and set clear boundaries so that it doesn’t go further than it should. Use /pause to choose a mode where it stops and waits for your approval before moving forward. We believe that it’s important to keep a human in the loop in cybersecurity work like this. 

We also invite you to join our AI for Cybersecurity training. During the training, we’ll show you different ways of using AI in cybersecurity, set up local models and solve labs. The field is evolving rapidly and the sooner you learn things, the greater the advantage you’ll have. There’s no reason to resist AI. It’s a tool to master.

The post Artificial Intelligence (AI) in Cybersecurity, Part 23: Using PentestCode for Pentesting and Bug Bounty Hunting first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Think back to the first time you installed Kali Linux. It was probably one of those moments where you realized just how many cybersecurity tools existed. Your applications menu was packed with hundreds of tools covering everything from recon and vulnerability scanning to exploitation, password attacks, wireless security and much more.

At first, it was exciting. But most beginners spend hours clicking through the menus wondering what every tool does and when they should actually use it. Unfortunately, the sheer number of applications quickly becomes overwhelming. Even if you dedicate time to learning them, chances are you’ll forget many of their names simply because there are so many available. On top of that, documentation isn’t always beginner-friendly. Some projects have excellent documentation, while others assume you already know exactly what the tool is supposed to do before you even start reading.

The good news is that you don’t have to memorize hundreds of commands or remember every tool available. Instead, you can build your own arsenal of references that helps you quickly find the right tool.

In this article, we’re going to build exactly that. We’ll explore two resources called Arsenal-NG and Arsenal, both of which are designed to make finding offensive security tools, payloads, commands much faster.

Arsenal-NG

The first tool we’ll look at is Arsenal-NG. The name pretty much explains what it does. Arsenal-NG is essentially a searchable collection of offensive security tools, commands, and predefined workflows. Whether you’re doing reconnaissance, exploiting a service, generating payloads, Arsenal-NG can help you find the right tool for the job.

Let’s install it.

kali > git clone https://github.com/halilkirazkaya/arsenal-ng.git
kali > cd arsenal-ng
kali > make build

Once compilation finishes, you can launch the program directly. For convenience, you may also want to move the binary into one of the directories listed in your PATH environment variable. Doing so allows you to start Arsenal-NG from any directory. 

kali > arsenal-ng

When it starts, you’ll immediately notice a large collection of tools organized inside the interface. Each tool includes predefined presets for different kinds of operations. 

To display the complete list of available tools, simply run tools

If you already know what kind of task you’re trying to accomplish but don’t remember what tool can do it, you can use the built-in search feature. Searching by keywords makes it easy to discover them.

Once you’ve found the tool you need, selecting one of its presets walks you through the required parameters. There you simply provide the requested information and let it generate the command for you.

If you need additional information about the application itself, run help.

Arsenal

Unlike Arsenal-NG, Arsenal focuses primarily on web exploitation and can be used directly from your browser. There is no installation process, making it convenient when you simply need a quick reference.

You can access it here.

One thing worth mentioning is that the website supports multiple languages. If the interface isn’t already in English, simply switch the language using the selector in the upper-right corner. Once inside, you’ll notice that the content is organized into several different sections, each designed to help with a different phase of a web penetration test.

One of them is Payloads.

This area contains a huge collection of payloads covering many different types of web vulnerabilities and exploitation techniques. Whether you’re working with command injection, SQL injection, XSS, SSTI, XXE, deserialization, or other common web vulnerabilities, chances are you’ll find useful examples here.

Another valuable section is Attack Chains.

Rather than simply providing payloads, Attack Chains guide you through the overall exploitation process. They outline the sequence of steps typically required to compromise a target.

The Commands section is another good reference.

You can build the command you need by selecting the appropriate options.

Then we have Wordlists.

There are numerous wordlists organized into logical categories, making it much easier to find exactly what you’re looking for. Each category often contains several different wordlists optimized for different situations. 

You’ll also find a large collection of Scripts.

These scripts cover a wide variety of purposes, including reconnaissance, AI-related security checks, subdomain takeovers, automation and more.

Of course, we’ve only scratched the surface. Arsenal contains more additional sections that are worth exploring on your own. Spend some time clicking through the different categories and seeing what they have.

Summary

Building your own cybersecurity arsenal isn’t about memorizing every command ever written. In fact, no experienced pentester or hacker remembers every tool, every option or every payload. There are simply too many of them, and new ones are being developed all the time. Arsenal-NG and Arsenal can help you organize knowledge. They are valuable when you’re getting started and they remain just as useful years later when you’re experienced.

Since many of these tools fall into different categories, such as network pentesting, web pentesting, bug bounty hunting, and more, the best way to develop your skills is through our Member Gold subscription. It gives you access to a wide variety of training courses covering different areas.

The post Linux for Hackers: Building Your Tool Arsenal first appeared on Hackers Arise.