Ap6pack/outrider-recon

"owner": {     "name": "Adam Rhys Heaton (Ap6pack)",     "url": "https://github.com/Ap6pack"

"name": "Adam Rhys Heaton (Ap6pack)",     "url": "https://github.com/Ap6pack"   },

"url": "https://github.com/Ap6pack"

"author": {         "name": "Adam Rhys Heaton (Ap6pack)",         "url": "https://github.com/Ap6pack"

"name": "Adam Rhys Heaton (Ap6pack)",         "url": "https://github.com/Ap6pack"       },

"url": "https://github.com/Ap6pack"

},       "homepage": "https://github.com/Ap6pack/outrider-recon",       "repository": "https://github.com/Ap6pack/outrider-recon",

"homepage": "https://github.com/Ap6pack/outrider-recon",

"repository": "https://github.com/Ap6pack/outrider-recon",

"author": {     "name": "Adam Rhys Heaton (Ap6pack)",     "url": "https://github.com/Ap6pack"

"name": "Adam Rhys Heaton (Ap6pack)",     "url": "https://github.com/Ap6pack"   },

"url": "https://github.com/Ap6pack"

},   "homepage": "https://github.com/Ap6pack/outrider-recon",   "repository": "https://github.com/Ap6pack/outrider-recon",

"homepage": "https://github.com/Ap6pack/outrider-recon",

"repository": "https://github.com/Ap6pack/outrider-recon",

[Credential-related source omitted]

| Schema leak in error                     | _"Schema leak in error response — framework signature `{framework}` exposed; map to known {framework} vulns and craft targeted payloads."_                                                  | | Sen

| Sensitive keyword                        | _"Path contains '{keyword}' — review for direct object reference, mass-assignment, or hidden admin functionality."_                                                                         | | Ope

| Open RTDB Firebase                       | _"Open Firebase RTDB at <https://{project}.firebaseio.com/.json> — read everything, then test write at `/<random-key>.json` with PUT to gauge ACL scope."_                                  |

[Credential-related source omitted]

| Open kubelet                             | _"Open kubelet on {host}:10250 — `GET /pods` to list; `POST /run/<ns>/<pod>/<container>` for in-container exec without K8s API auth."_                                                      | | Ope

| Open etcd                                | _"Open etcd on {host}:2379 — `etcdctl get / --prefix --keys-only` for full cluster state; secrets stored under `/registry/secrets/`."_                                                      | | K8s

| K8s API anonymous                        | _"Kubernetes API on {host}:6443 with anonymous-auth — `kubectl --server=<https://{host}:6443> --insecure-skip-tls-verify get pods --all-namespaces`."_                                      |

[Credential-related source omitted]

{       "method": "GET",       "url": "https://api.example.com/v1/users",

"method": "GET",       "url": "https://api.example.com/v1/users",       "source": "apk:com.example.android"

"url": "https://api.example.com/v1/users",

- **archive.org:** `curl -s -d "url=<https://target.com/page"> <https://web.archive.org/save`> — returns archived URL.

- **archive.today:** Submit via their form endpoint as a backup when archive.org is slow or blocked. - **Local mirror:** `wget --mirror --convert-links --adjust-extension --page-requisites --no-parent -P ./evidence/ <https://target.com/path

- **Local mirror:** `wget --mirror --convert-links --adjust-extension --page-requisites --no-parent -P ./evidence/ <https://target.com/path`> for a full offline copy.

- **Other archivers:** [URLScan.io](https://urlscan.io/) (scan + resource map), [ArchiveBox](https://archivebox.io/) (self-hosted HTML/PDF/screenshots), [SingleFileZ](https://github.com/gildas-lormeau/SingleFileZ) (offline single-file HTML)

- `gowitness scan single --url <https://target.com/admin> --screenshot-path ./evidence/screenshots/`

- `playwright screenshot --url <https://target.com/admin> --output ./evidence/screenshots/admin.png`

- **System packages:** `sudo apt install nmap masscan jq` or `brew install nmap masscan jq`

| Target                                         | Port                 | Probe                                                                                           | Severity                           | | -----------------------------

| Target                                         | Port                 | Probe                                                                                           | Severity                           | | -----------------------------

| ---------------------------------------------- | -------------------- | ----------------------------------------------------------------------------------------------- | ---------------------------------- | | **Docker API (unencrypted)** 

| ---------------------------------------------- | -------------------- | ----------------------------------------------------------------------------------------------- | ---------------------------------- | | **Docker API (unencrypted)** 

| **Docker API (unencrypted)**                   | 2375                 | `curl -sk -m 5 <http://${IP}:2375/v1.40/info`>                                                  | CRITICAL                           |

| **Docker API (unencrypted)**                   | 2375                 | `curl -sk -m 5 <http://${IP}:2375/v1.40/info`>                                                  | CRITICAL                           |

| **Docker API (TLS)**                           | 2376                 | `curl -sk -m 5 <https://${IP}:2376/v1.40/info`>                                                 | HIGH                               |

| **Docker API (TLS)**                           | 2376                 | `curl -sk -m 5 <https://${IP}:2376/v1.40/info`>                                                 | HIGH                               |

| **Kubernetes API server**                      | 6443 / 8443          | `curl -sk -m 5 <https://${IP}:6443/api`>                                                        | HIGH if anonymous non-403          |

| **Kubernetes API server**                      | 6443 / 8443          | `curl -sk -m 5 <https://${IP}:6443/api`>                                                        | HIGH if anonymous non-403          |

| **kubelet**                                    | 10250 (HTTPS)        | `curl -sk -m 5 <https://${IP}:10250/pods`>                                                      | CRITICAL (no auth = pod exec)      |

| **kubelet**                                    | 10250 (HTTPS)        | `curl -sk -m 5 <https://${IP}:10250/pods`>                                                      | CRITICAL (no auth = pod exec)      |

| **etcd**                                       | 2379 (client)        | `curl -sk -m 5 <https://${IP}:2379/v2/keys/`>                                                   | CRITICAL (cluster state + secrets) |

| **etcd**                                       | 2379 (client)        | `curl -sk -m 5 <https://${IP}:2379/v2/keys/`>                                                   | CRITICAL (cluster state + secrets) |

| **Kubernetes Dashboard**                       | 8001 / 9090 / 30000+ | `curl -sk -m 5 <http://${IP}:8001/api/v1/namespaces/kube-system/services/kubernetes-dashboard`> | HIGH                               |

| **Kubernetes Dashboard**                       | 8001 / 9090 / 30000+ | `curl -sk -m 5 <http://${IP}:8001/api/v1/namespaces/kube-system/services/kubernetes-dashboard`> | HIGH                               |

| **kube-controller-manager**                    | 10257                | `curl <https://${IP}:10257/metrics`>                                                            | MEDIUM                             |

| **kube-controller-manager**                    | 10257                | `curl <https://${IP}:10257/metrics`>                                                            | MEDIUM                             |

| **kube-scheduler**                             | 10259                | `curl <https://${IP}:10259/metrics`>                                                            | MEDIUM                             |

| **kube-scheduler**                             | 10259                | `curl <https://${IP}:10259/metrics`>                                                            | MEDIUM                             |

| Registry                        | Search pattern                                                                                  | | ------------------------------- | ----------------------------------------------------------------------

| Registry                        | Search pattern                                                                                  | | ------------------------------- | ----------------------------------------------------------------------

| ------------------------------- | ----------------------------------------------------------------------------------------------- | | Docker Hub                      | `<https://hub.docker.com/search?q=<target-keyword>>&type=image`       

| ------------------------------- | ----------------------------------------------------------------------------------------------- | | Docker Hub                      | `<https://hub.docker.com/search?q=<target-keyword>>&type=image`       

| Docker Hub                      | `<https://hub.docker.com/search?q=<target-keyword>>&type=image`                                 |

| Docker Hub                      | `<https://hub.docker.com/search?q=<target-keyword>>&type=image`                                 |

| Quay (Red Hat)                  | `<https://quay.io/search?q=<target-keyword>>`                                                   |

| Quay (Red Hat)                  | `<https://quay.io/search?q=<target-keyword>>`                                                   |

| GitHub Container Registry       | `<https://api.github.com/orgs/<org>>/packages?package_type=container`                           |

| GitHub Container Registry       | `<https://api.github.com/orgs/<org>>/packages?package_type=container`                           |

| Amazon ECR Public               | `<https://gallery.ecr.aws/?searchTerm=<keyword>>`                                               |

| Amazon ECR Public               | `<https://gallery.ecr.aws/?searchTerm=<keyword>>`                                               |

| Google Container Registry (GCR) | `<https://gcr.io/v2/<project-id>>/tags/list` (also try `us.gcr.io`, `eu.gcr.io`, `asia.gcr.io`) |

| Google Container Registry (GCR) | `<https://gcr.io/v2/<project-id>>/tags/list` (also try `us.gcr.io`, `eu.gcr.io`, `asia.gcr.io`) |

| Platform               | Common exposure                                               | Probe                                                         | | ---------------------- | ----------------------------------------------------------

| Platform               | Common exposure                                               | Probe                                                         | | ---------------------- | ----------------------------------------------------------

| ---------------------- | ------------------------------------------------------------- | ------------------------------------------------------------- | | **Jenkins**            | `/script` (Groovy console = RCE if no auth), `/asynchPeopl

| ---------------------- | ------------------------------------------------------------- | ------------------------------------------------------------- | | **Jenkins**            | `/script` (Groovy console = RCE if no auth), `/asynchPeopl

| **Jenkins**            | `/script` (Groovy console = RCE if no auth), `/asynchPeople/` | `curl -sk -m 10 "${T}/script"`                                |

| **Jenkins**            | `/script` (Groovy console = RCE if no auth), `/asynchPeople/` | `curl -sk -m 10 "${T}/script"`                                |

| **GitLab self-hosted** | Version in HTML; `/api/v4/version`                            | `curl -sk -m 10 "${T}/api/v4/version"`                        |

| **GitLab self-hosted** | Version in HTML; `/api/v4/version`                            | `curl -sk -m 10 "${T}/api/v4/version"`                        |

| **TeamCity**           | `/login.html`; CVE-2024-27198 (KEV)                           | `curl -sk -m 10 "${T}/login.html" \| grep -i TeamCity`        |

| **TeamCity**           | `/login.html`; CVE-2024-27198 (KEV)                           | `curl -sk -m 10 "${T}/login.html" \| grep -i TeamCity`        |

| **Argo CD**            | `/api/version`; anonymous-auth posture                        | `curl -sk -m 10 "${T}/api/version"`                           |

| **Argo CD**            | `/api/version`; anonymous-auth posture                        | `curl -sk -m 10 "${T}/api/version"`                           |

| **Bamboo**             | `/rest/api/latest/info`                                       | `curl -sk -m 10 "${T}/rest/api/latest/info"`                  |

| **Bamboo**             | `/rest/api/latest/info`                                       | `curl -sk -m 10 "${T}/rest/api/latest/info"`                  |

| **Drone CI**           | `/api/info`                                                   | `curl -sk -m 10 "${T}/api/info"`                              |

| **Drone CI**           | `/api/info`                                                   | `curl -sk -m 10 "${T}/api/info"`                              |

| **Spinnaker**          | `/gate/info`, `/applications`                                 | `curl -sk -m 10 "${T}/gate/info"`                             |

| **Spinnaker**          | `/gate/info`, `/applications`                                 | `curl -sk -m 10 "${T}/gate/info"`                             |

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

# testssl.sh (thorough + readable) docker run --rm -ti drwetter/testssl.sh https://target.example

# testssl.sh (thorough + readable) docker run --rm -ti drwetter/testssl.sh https://target.example

docker run --rm -ti drwetter/testssl.sh https://target.example

docker run --rm -ti drwetter/testssl.sh https://target.example

- [ja3er.com](https://ja3er.com) — JA3 → client-software mapping.

- [ja3er.com](https://ja3er.com) — JA3 → client-software mapping.

python3 -c " import urllib.request, codecs, mmh3 data = urllib.request.urlopen('https://target.example/favicon.ico').read()

python3 -c " import urllib.request, codecs, mmh3 data = urllib.request.urlopen('https://target.example/favicon.ico').read()

import urllib.request, codecs, mmh3 data = urllib.request.urlopen('https://target.example/favicon.ico').read() print(mmh3.hash(codecs.encode(data, 'base64')))"

import urllib.request, codecs, mmh3 data = urllib.request.urlopen('https://target.example/favicon.ico').read() print(mmh3.hash(codecs.encode(data, 'base64')))"

data = urllib.request.urlopen('https://target.example/favicon.ico').read()

data = urllib.request.urlopen('https://target.example/favicon.ico').read()

GET https://login.microsoftonline.com/{tenant-or-domain}/.well-known/openid-configuration

GET https://login.microsoftonline.com/{tenant-or-domain}/.well-known/openid-configuration

GET https://login.microsoftonline.com/getuserrealm.srf?login=<probe-user>@<domain>

GET https://login.microsoftonline.com/getuserrealm.srf?login=<probe-user>@<domain>

POST https://autodiscover-s.outlook.com/autodiscover/metadata/json/1

POST https://autodiscover-s.outlook.com/autodiscover/metadata/json/1

Microsoft Exchange Online IPs (truncated common ranges): `40.96.0.0/13`, `52.96.0.0/14`, `13.107.6.152/31`, `13.107.18.10/31`, `40.99.0.0/16`, `40.104.0.0/15`, `52.98.0.0/15`. Full list: [Office 365 URLs and IP address ranges](https://learn

Microsoft Exchange Online IPs (truncated common ranges): `40.96.0.0/13`, `52.96.0.0/14`, `13.107.6.152/31`, `13.107.18.10/31`, `40.99.0.0/16`, `40.104.0.0/15`, `52.98.0.0/15`. Full list: [Office 365 URLs and IP address ranges](https://learn

POST https://login.microsoftonline.com/common/GetCredentialType

POST https://login.microsoftonline.com/common/GetCredentialType

GET https://{domain}/adfs/idpinitiatedsignon.aspx

GET https://{domain}/adfs/idpinitiatedsignon.aspx

GET https://{domain}/adfs/Services/Trust/mex

GET https://{domain}/adfs/Services/Trust/mex

GET https://{domain}/.well-known/openid-configuration

GET https://{domain}/.well-known/openid-configuration

Google-Workspace-hosted-domain customers expose discovery endpoints with characteristic `issuer` URI (`<https://accounts.google.com`>) and JWKS URI. MX records pointing to `aspmx.l.google.com` are a corroborating signal.

Google-Workspace-hosted-domain customers expose discovery endpoints with characteristic `issuer` URI (`<https://accounts.google.com`>) and JWKS URI. MX records pointing to `aspmx.l.google.com` are a corroborating signal.

| Product  | URL pattern in `issuer`                                   | | -------- | --------------------------------------------------------- | | Auth0    | `<https://*.auth0.com`>                                   |

| Product  | URL pattern in `issuer`                                   | | -------- | --------------------------------------------------------- | | Auth0    | `<https://*.auth0.com`>                                   |

| -------- | --------------------------------------------------------- | | Auth0    | `<https://*.auth0.com`>                                   | | OneLogin | `<https://*.onelogin.com`>                                |

| -------- | --------------------------------------------------------- | | Auth0    | `<https://*.auth0.com`>                                   | | OneLogin | `<https://*.onelogin.com`>                                |

| Auth0    | `<https://*.auth0.com`>                                   |

| Auth0    | `<https://*.auth0.com`>                                   |

| OneLogin | `<https://*.onelogin.com`>                                |

| OneLogin | `<https://*.onelogin.com`>                                |

| Ping     | `<https://*.pingone.com`>, `<https://*.pingidentity.com`> |

| Ping     | `<https://*.pingone.com`>, `<https://*.pingidentity.com`> |

| Duo      | `<https://*.duosecurity.com`>                             |

| Duo      | `<https://*.duosecurity.com`>                             |

# Resolve tenant first curl -sk -m 10 "https://login.microsoftonline.com/${TARGET_DOMAIN}/.well-known/openid-configuration" | jq -r '.issuer'

# Resolve tenant first curl -sk -m 10 "https://login.microsoftonline.com/${TARGET_DOMAIN}/.well-known/openid-configuration" | jq -r '.issuer'

curl -sk -m 10 "https://login.microsoftonline.com/${TARGET_DOMAIN}/.well-known/openid-configuration" | jq -r '.issuer'

curl -sk -m 10 "https://login.microsoftonline.com/${TARGET_DOMAIN}/.well-known/openid-configuration" | jq -r '.issuer'

curl -sk -m 10 "https://teams.microsoft.com/api/mt/emea/beta/users/<email>/externalsearchv3"

curl -sk -m 10 "https://teams.microsoft.com/api/mt/emea/beta/users/<email>/externalsearchv3"

for sub in "" "-my" "-admin"; do   echo "=== ${STEM}${sub}.sharepoint.com ==="   curl -sk -m 10 -I "https://${STEM}${sub}.sharepoint.com/" -w '%{http_code}\n'

for sub in "" "-my" "-admin"; do   echo "=== ${STEM}${sub}.sharepoint.com ==="   curl -sk -m 10 -I "https://${STEM}${sub}.sharepoint.com/" -w '%{http_code}\n'

echo "=== ${STEM}${sub}.sharepoint.com ==="   curl -sk -m 10 -I "https://${STEM}${sub}.sharepoint.com/" -w '%{http_code}\n' done

echo "=== ${STEM}${sub}.sharepoint.com ==="   curl -sk -m 10 -I "https://${STEM}${sub}.sharepoint.com/" -w '%{http_code}\n' done

curl -sk -m 10 -I "https://${STEM}${sub}.sharepoint.com/" -w '%{http_code}\n'

curl -sk -m 10 -I "https://${STEM}${sub}.sharepoint.com/" -w '%{http_code}\n'

foreach ($s in @("","-my","-admin")) {   try {     $r = Invoke-WebRequest -Uri "https://${STEM}${s}.sharepoint.com/" -Method Head -UseBasicParsing -TimeoutSec 10

foreach ($s in @("","-my","-admin")) {   try {     $r = Invoke-WebRequest -Uri "https://${STEM}${s}.sharepoint.com/" -Method Head -UseBasicParsing -TimeoutSec 10

try {     $r = Invoke-WebRequest -Uri "https://${STEM}${s}.sharepoint.com/" -Method Head -UseBasicParsing -TimeoutSec 10     "${STEM}${s}.sharepoint.com -> HTTP $($r.StatusCode) (tenant exists)"

try {     $r = Invoke-WebRequest -Uri "https://${STEM}${s}.sharepoint.com/" -Method Head -UseBasicParsing -TimeoutSec 10     "${STEM}${s}.sharepoint.com -> HTTP $($r.StatusCode) (tenant exists)"

$r = Invoke-WebRequest -Uri "https://${STEM}${s}.sharepoint.com/" -Method Head -UseBasicParsing -TimeoutSec 10

$r = Invoke-WebRequest -Uri "https://${STEM}${s}.sharepoint.com/" -Method Head -UseBasicParsing -TimeoutSec 10

[Credential-related source omitted]

[Credential-related source omitted]

STEM="acme" curl -sk -m 10 -I "https://${STEM}-my.sharepoint.com/personal/${USER_TOKEN}/Documents/" -w '%{http_code}\n' # 401 = exists; 404 = not provisioned

STEM="acme" curl -sk -m 10 -I "https://${STEM}-my.sharepoint.com/personal/${USER_TOKEN}/Documents/" -w '%{http_code}\n' # 401 = exists; 404 = not provisioned

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

curl -sk -m 10 "https://app.target.example/main.js" | \

curl -sk -m 10 "https://app.target.example/main.js" | \

curl -sk -m 10 "https://login.microsoftonline.com/${TARGET_DOMAIN}/v2.0/.well-known/openid-configuration" | \

curl -sk -m 10 "https://login.microsoftonline.com/${TARGET_DOMAIN}/v2.0/.well-known/openid-configuration" | \

curl -sk -m 10 -X POST "$T/graphql" \

curl -sk -m 10 -X POST "$T/graphql" \

curl -sk -m 10 -X POST "$T/graphql" \

curl -sk -m 10 -X POST "$T/graphql" \

- **Clairvoyance** — automated field-suggestion enumerator. `clairvoyance -w wordlist.txt -o schema.json <https://target.example/graphql`>. (Install: see `docs/reference/tooling-install.md`)

- **Clairvoyance** — automated field-suggestion enumerator. `clairvoyance -w wordlist.txt -o schema.json <https://target.example/graphql`>. (Install: see `docs/reference/tooling-install.md`)

- People-search by company: `<https://www.linkedin.com/search/results/people/?currentCompany=["<company-id>>"]`. Get company-id from the company's LinkedIn URL or profile JSON.

- People-search by company: `<https://www.linkedin.com/search/results/people/?currentCompany=["<company-id>>"]`. Get company-id from the company's LinkedIn URL or profile JSON.

company:     "Acme Corp"   location:    "Boston, MA"   linkedin_url: https://www.linkedin.com/in/alicedoe

company:     "Acme Corp"   location:    "Boston, MA"   linkedin_url: https://www.linkedin.com/in/alicedoe

location:    "Boston, MA"   linkedin_url: https://www.linkedin.com/in/alicedoe   derived_emails:

location:    "Boston, MA"   linkedin_url: https://www.linkedin.com/in/alicedoe   derived_emails:

linkedin_url: https://www.linkedin.com/in/alicedoe

linkedin_url: https://www.linkedin.com/in/alicedoe

| ------------------------ | ----------------------------------------------------------------------------------------- | | `recon-asset-discovery`  | Subdomains, ASN/BGP, DNS, CT, WHOIS/RDAP, wordlists                                       

| ------------------------ | ----------------------------------------------------------------------------------------- | | `recon-asset-discovery`  | Subdomains, ASN/BGP, DNS, CT, WHOIS/RDAP, wordlists                                       

| `recon-asset-discovery`  | Subdomains, ASN/BGP, DNS, CT, WHOIS/RDAP, wordlists                                       | | `web-surface`            | Swagger/GraphQL paths, curl probes, Wayback, Postman, endpoint scoring                    

| `recon-asset-discovery`  | Subdomains, ASN/BGP, DNS, CT, WHOIS/RDAP, wordlists                                       | | `web-surface`            | Swagger/GraphQL paths, curl probes, Wayback, Postman, endpoint scoring                    

| `web-surface`            | Swagger/GraphQL paths, curl probes, Wayback, Postman, endpoint scoring                    |

| `web-surface`            | Swagger/GraphQL paths, curl probes, Wayback, Postman, endpoint scoring                    |

| ----------------------------------------------------------------------------------------- | ------------------------ | | Subdomains, ASN/BGP, DNS, CT, WHOIS/RDAP, wordlists                                       | `recon-asset-discovery`  

| ----------------------------------------------------------------------------------------- | ------------------------ | | Subdomains, ASN/BGP, DNS, CT, WHOIS/RDAP, wordlists                                       | `recon-asset-discovery`  

| Subdomains, ASN/BGP, DNS, CT, WHOIS/RDAP, wordlists                                       | `recon-asset-discovery`  | | Web surface: Swagger/GraphQL paths, curl probes, Wayback, Postman, endpoint scoring       | `web-surface`            

| Subdomains, ASN/BGP, DNS, CT, WHOIS/RDAP, wordlists                                       | `recon-asset-discovery`  | | Web surface: Swagger/GraphQL paths, curl probes, Wayback, Postman, endpoint scoring       | `web-surface`            

| Web surface: Swagger/GraphQL paths, curl probes, Wayback, Postman, endpoint scoring       | `web-surface`            |

| Web surface: Swagger/GraphQL paths, curl probes, Wayback, Postman, endpoint scoring       | `web-surface`            |

#!/usr/bin/env python3

#!/usr/bin/env python3

GRAPHQL_URL = "https://hackerone.com/graphql"

GRAPHQL_URL = "https://hackerone.com/graphql"

"Content-Type": "application/json",     "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36",     "Origin": "https://hackerone.com",

"Content-Type": "application/json",     "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36",     "Origin": "https://hackerone.com",

"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36",     "Origin": "https://hackerone.com",     "Referer": "https://hackerone.com/hacktivity",

"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36",     "Origin": "https://hackerone.com",     "Referer": "https://hackerone.com/hacktivity",

"Origin": "https://hackerone.com",

"Origin": "https://hackerone.com",

"Referer": "https://hackerone.com/hacktivity",

"Referer": "https://hackerone.com/hacktivity",

def gql_raw(query: str) -> dict:     payload = json.dumps({"query": query}).encode()     req = urllib.request.Request(GRAPHQL_URL, data=payload, headers=HEADERS, method="POST")

def gql_raw(query: str) -> dict:     payload = json.dumps({"query": query}).encode()     req = urllib.request.Request(GRAPHQL_URL, data=payload, headers=HEADERS, method="POST")

payload = json.dumps({"query": query}).encode()     req = urllib.request.Request(GRAPHQL_URL, data=payload, headers=HEADERS, method="POST")     try:

payload = json.dumps({"query": query}).encode()     req = urllib.request.Request(GRAPHQL_URL, data=payload, headers=HEADERS, method="POST")     try:

req = urllib.request.Request(GRAPHQL_URL, data=payload, headers=HEADERS, method="POST")

req = urllib.request.Request(GRAPHQL_URL, data=payload, headers=HEADERS, method="POST")

try:         with urllib.request.urlopen(req, timeout=20) as resp:             return json.loads(resp.read())

try:         with urllib.request.urlopen(req, timeout=20) as resp:             return json.loads(resp.read())

with urllib.request.urlopen(req, timeout=20) as resp:

with urllib.request.urlopen(req, timeout=20) as resp:

def gql_vars(query: str, variables: dict) -> dict:     payload = json.dumps({"query": query, "variables": variables}).encode()     req = urllib.request.Request(GRAPHQL_URL, data=payload, headers=HEADERS, method="POST")

def gql_vars(query: str, variables: dict) -> dict:     payload = json.dumps({"query": query, "variables": variables}).encode()     req = urllib.request.Request(GRAPHQL_URL, data=payload, headers=HEADERS, method="POST")

payload = json.dumps({"query": query, "variables": variables}).encode()     req = urllib.request.Request(GRAPHQL_URL, data=payload, headers=HEADERS, method="POST")     try:

payload = json.dumps({"query": query, "variables": variables}).encode()     req = urllib.request.Request(GRAPHQL_URL, data=payload, headers=HEADERS, method="POST")     try:

req = urllib.request.Request(GRAPHQL_URL, data=payload, headers=HEADERS, method="POST")

req = urllib.request.Request(GRAPHQL_URL, data=payload, headers=HEADERS, method="POST")

try:         with urllib.request.urlopen(req, timeout=20) as resp:             return json.loads(resp.read())

try:         with urllib.request.urlopen(req, timeout=20) as resp:             return json.loads(resp.read())

with urllib.request.urlopen(req, timeout=20) as resp:

with urllib.request.urlopen(req, timeout=20) as resp:

type=int,         default=1,         help="Number of pages to fetch (50 results/page, default: 1). Use 5-20 for keyword searches.",

type=int,         default=1,         help="Number of pages to fetch (50 results/page, default: 1). Use 5-20 for keyword searches.",

default=1,         help="Number of pages to fetch (50 results/page, default: 1). Use 5-20 for keyword searches.",     )

default=1,         help="Number of pages to fetch (50 results/page, default: 1). Use 5-20 for keyword searches.",     )

help="Number of pages to fetch (50 results/page, default: 1). Use 5-20 for keyword searches.",

help="Number of pages to fetch (50 results/page, default: 1). Use 5-20 for keyword searches.",

#!/usr/bin/env python3

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

("SLACK_TOKEN",          SEV_HIGH,     "slack",       r"\bxox[abpors]-[0-9A-Za-z\-]{10,48}\b"),     ("SLACK_WEBHOOK",        SEV_MEDIUM,   "slack",       r"https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+"),

("SLACK_TOKEN",          SEV_HIGH,     "slack",       r"\bxox[abpors]-[0-9A-Za-z\-]{10,48}\b"),     ("SLACK_WEBHOOK",        SEV_MEDIUM,   "slack",       r"https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+"),

("SLACK_WEBHOOK",        SEV_MEDIUM,   "slack",       r"https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+"),

("SLACK_WEBHOOK",        SEV_MEDIUM,   "slack",       r"https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+"),

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

**Email priority:** exec (CEO/CFO/CISO) → IT/helpdesk/security → dev/engineer/DBA → sales/HR/finance → generic role accounts.

**Email priority:** exec (CEO/CFO/CISO) → IT/helpdesk/security → dev/engineer/DBA → sales/HR/finance → generic role accounts.

The following modules have full implementation detail — probe paths, wordlists, curl one-liners, regexes, and scoring rubrics — in the specialized sub-skills. This skill defines _what to do_; those skills define _how to do it_.

The following modules have full implementation detail — probe paths, wordlists, curl one-liners, regexes, and scoring rubrics — in the specialized sub-skills. This skill defines _what to do_; those skills define _how to do it_.

- [Have I Been Pwned](https://haveibeenpwned.com/) — breach lookup; Pwned Passwords API (k-anonymity).

- [Have I Been Pwned](https://haveibeenpwned.com/) — breach lookup; Pwned Passwords API (k-anonymity).

- [Dehashed](https://dehashed.com/) — credential search (paid).

- [Dehashed](https://dehashed.com/) — credential search (paid).

- [IntelX](https://intelx.io/) — data intelligence.

- [IntelX](https://intelx.io/) — data intelligence.

- [LeakCheck](https://leakcheck.io/), [Snusbase](https://snusbase.com/), [BreachDirectory](https://breachdirectory.org/).

- [LeakCheck](https://leakcheck.io/), [Snusbase](https://snusbase.com/), [BreachDirectory](https://breachdirectory.org/).

- **[Cavalier (Hudson Rock)](https://cavalier.hudsonrock.com/) — infostealer log lookups; FREE; highest single-source ROI for compromised employee credentials.**

- **[Cavalier (Hudson Rock)](https://cavalier.hudsonrock.com/) — infostealer log lookups; FREE; highest single-source ROI for compromised employee credentials.**

# By domain (canonical first call) curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-domain?domain=target.com" | jq .

# By domain (canonical first call) curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-domain?domain=target.com" | jq .

curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-domain?domain=target.com" | jq .

curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-domain?domain=target.com" | jq .

# By email (single-account check) curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-email?email=alice@target.com" | jq .

# By email (single-account check) curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-email?email=alice@target.com" | jq .

curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-email?email=alice@target.com" | jq .

curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-email?email=alice@target.com" | jq .

# By URL (when target's app is the breach victim) curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-url?url=https://app.target.com" | jq .

# By URL (when target's app is the breach victim) curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-url?url=https://app.target.com" | jq .

curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-url?url=https://app.target.com" | jq .

curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-url?url=https://app.target.com" | jq .

# EPSS score for a CVE curl -sk "https://api.first.org/data/v1/epss?cve=CVE-2024-3400" | jq '.data[0]'

# EPSS score for a CVE curl -sk "https://api.first.org/data/v1/epss?cve=CVE-2024-3400" | jq '.data[0]'

curl -sk "https://api.first.org/data/v1/epss?cve=CVE-2024-3400" | jq '.data[0]'

curl -sk "https://api.first.org/data/v1/epss?cve=CVE-2024-3400" | jq '.data[0]'

# Check if in CISA KEV curl -sk https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | \

# Check if in CISA KEV curl -sk https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | \

curl -sk https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | \

curl -sk https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | \

# InTheWild confirmed-exploitation check curl -sk "https://inthewild.io/api/vulnerability?cve=CVE-2024-3400"

# InTheWild confirmed-exploitation check curl -sk "https://inthewild.io/api/vulnerability?cve=CVE-2024-3400"

curl -sk "https://inthewild.io/api/vulnerability?cve=CVE-2024-3400"

curl -sk "https://inthewild.io/api/vulnerability?cve=CVE-2024-3400"

# Trickest CVE-to-PoC lookup (GitHub repo) # https://github.com/trickest/cve — browse: /YYYY/CVE-YYYY-NNNNN.md

# Trickest CVE-to-PoC lookup (GitHub repo) # https://github.com/trickest/cve — browse: /YYYY/CVE-YYYY-NNNNN.md

# https://github.com/trickest/cve — browse: /YYYY/CVE-YYYY-NNNNN.md

# https://github.com/trickest/cve — browse: /YYYY/CVE-YYYY-NNNNN.md

| Platform             | URL Pattern                                | | -------------------- | ------------------------------------------ | | Lever (ATS)          | `<https://jobs.lever.co/<company>>`        |

| Platform             | URL Pattern                                | | -------------------- | ------------------------------------------ | | Lever (ATS)          | `<https://jobs.lever.co/<company>>`        |

| -------------------- | ------------------------------------------ | | Lever (ATS)          | `<https://jobs.lever.co/<company>>`        | | Greenhouse (ATS)     | `<https://boards.greenhouse.io/<company>>` |

| -------------------- | ------------------------------------------ | | Lever (ATS)          | `<https://jobs.lever.co/<company>>`        | | Greenhouse (ATS)     | `<https://boards.greenhouse.io/<company>>` |

| Lever (ATS)          | `<https://jobs.lever.co/<company>>`        |

| Lever (ATS)          | `<https://jobs.lever.co/<company>>`        |

| Greenhouse (ATS)     | `<https://boards.greenhouse.io/<company>>` |

| Greenhouse (ATS)     | `<https://boards.greenhouse.io/<company>>` |

| AshbyHQ (ATS)        | `<https://jobs.ashbyhq.com/<company>>`     |

| AshbyHQ (ATS)        | `<https://jobs.ashbyhq.com/<company>>`     |

| Company careers page | `<https://careers.<target>>.com`           |

| Company careers page | `<https://careers.<target>>.com`           |

curl -sk "https://discord.com/api/v9/invites/<token>?with_counts=true"

curl -sk "https://discord.com/api/v9/invites/<token>?with_counts=true"

# Per-package history curl -sk "https://pypi.org/pypi/<package>/json" | jq '.releases | keys'

# Per-package history curl -sk "https://pypi.org/pypi/<package>/json" | jq '.releases | keys'

curl -sk "https://pypi.org/pypi/<package>/json" | jq '.releases | keys'

curl -sk "https://pypi.org/pypi/<package>/json" | jq '.releases | keys'

# Per-gem metadata curl -sk "https://rubygems.org/api/v1/gems/<gem-name>.json" | jq .

# Per-gem metadata curl -sk "https://rubygems.org/api/v1/gems/<gem-name>.json" | jq .

curl -sk "https://rubygems.org/api/v1/gems/<gem-name>.json" | jq .

curl -sk "https://rubygems.org/api/v1/gems/<gem-name>.json" | jq .

- Search: `<https://crates.io/search?q=<target>>`

- Search: `<https://crates.io/search?q=<target>>`

- Per-crate metadata: `<https://crates.io/api/v1/crates/<crate-name>>`

- Per-crate metadata: `<https://crates.io/api/v1/crates/<crate-name>>`

- Search: `<https://packagist.org/search/?q=<target>>`

- Search: `<https://packagist.org/search/?q=<target>>`

- Per-package metadata: `<https://packagist.org/packages/<vendor>>/<package>.json`

- Per-package metadata: `<https://packagist.org/packages/<vendor>>/<package>.json`

- Search: `<https://www.nuget.org/packages?q=<target>>`

- Search: `<https://www.nuget.org/packages?q=<target>>`

- Search: `<https://search.maven.org/?q=<target>>`

- Search: `<https://search.maven.org/?q=<target>>`

[Credential-related source omitted]

[Credential-related source omitted]

# Scopes already captured from X-OAuth-Scopes header curl -sk -m 10 -I -H "$H" https://api.github.com/user | grep -i 'X-OAuth-Scopes'

# Scopes already captured from X-OAuth-Scopes header curl -sk -m 10 -I -H "$H" https://api.github.com/user | grep -i 'X-OAuth-Scopes'

curl -sk -m 10 -I -H "$H" https://api.github.com/user | grep -i 'X-OAuth-Scopes'

curl -sk -m 10 -I -H "$H" https://api.github.com/user | grep -i 'X-OAuth-Scopes'

# All repos accessible (own + collaborator + org member) curl -sk -m 10 -H "$H" "https://api.github.com/user/repos?affiliation=owner,collaborator,organization_member&per_page=100"

# All repos accessible (own + collaborator + org member) curl -sk -m 10 -H "$H" "https://api.github.com/user/repos?affiliation=owner,collaborator,organization_member&per_page=100"

curl -sk -m 10 -H "$H" "https://api.github.com/user/repos?affiliation=owner,collaborator,organization_member&per_page=100"

curl -sk -m 10 -H "$H" "https://api.github.com/user/repos?affiliation=owner,collaborator,organization_member&per_page=100"

# Org memberships curl -sk -m 10 -H "$H" "https://api.github.com/user/orgs"

# Org memberships curl -sk -m 10 -H "$H" "https://api.github.com/user/orgs"

curl -sk -m 10 -H "$H" "https://api.github.com/user/orgs"

curl -sk -m 10 -H "$H" "https://api.github.com/user/orgs"

# Per-org: members, repos, secrets (metadata-only — names not values) ORG="<orgname>" curl -sk -m 10 -H "$H" "https://api.github.com/orgs/$ORG/members"

# Per-org: members, repos, secrets (metadata-only — names not values) ORG="<orgname>" curl -sk -m 10 -H "$H" "https://api.github.com/orgs/$ORG/members"

ORG="<orgname>" curl -sk -m 10 -H "$H" "https://api.github.com/orgs/$ORG/members" curl -sk -m 10 -H "$H" "https://api.github.com/orgs/$ORG/repos?per_page=100"

ORG="<orgname>" curl -sk -m 10 -H "$H" "https://api.github.com/orgs/$ORG/members" curl -sk -m 10 -H "$H" "https://api.github.com/orgs/$ORG/repos?per_page=100"

curl -sk -m 10 -H "$H" "https://api.github.com/orgs/$ORG/members"

curl -sk -m 10 -H "$H" "https://api.github.com/orgs/$ORG/members"

curl -sk -m 10 -H "$H" "https://api.github.com/orgs/$ORG/repos?per_page=100"

curl -sk -m 10 -H "$H" "https://api.github.com/orgs/$ORG/repos?per_page=100"

curl -sk -m 10 -H "$H" "https://api.github.com/orgs/$ORG/actions/secrets"   # requires admin:org

curl -sk -m 10 -H "$H" "https://api.github.com/orgs/$ORG/actions/secrets"   # requires admin:org

# Per-repo workflow secrets (metadata only) REPO="<orgname/reponame>" curl -sk -m 10 -H "$H" "https://api.github.com/repos/$REPO/actions/secrets"

# Per-repo workflow secrets (metadata only) REPO="<orgname/reponame>" curl -sk -m 10 -H "$H" "https://api.github.com/repos/$REPO/actions/secrets"

curl -sk -m 10 -H "$H" "https://api.github.com/repos/$REPO/actions/secrets"

curl -sk -m 10 -H "$H" "https://api.github.com/repos/$REPO/actions/secrets"

# Identity details curl -sk -m 10 -H "$H" -X POST "https://slack.com/api/users.identity" | jq .

# Identity details curl -sk -m 10 -H "$H" -X POST "https://slack.com/api/users.identity" | jq .

curl -sk -m 10 -H "$H" -X POST "https://slack.com/api/users.identity" | jq .

curl -sk -m 10 -H "$H" -X POST "https://slack.com/api/users.identity" | jq .

# What conversations can I see? curl -sk -m 10 -H "$H" -X POST \

# What conversations can I see? curl -sk -m 10 -H "$H" -X POST \

curl -sk -m 10 -H "$H" -X POST \

curl -sk -m 10 -H "$H" -X POST \

"https://slack.com/api/conversations.list?types=public_channel,private_channel,mpim,im&limit=200" | \

"https://slack.com/api/conversations.list?types=public_channel,private_channel,mpim,im&limit=200" | \

# Workspace info curl -sk -m 10 -H "$H" -X POST "https://slack.com/api/team.info" | jq .

# Workspace info curl -sk -m 10 -H "$H" -X POST "https://slack.com/api/team.info" | jq .

curl -sk -m 10 -H "$H" -X POST "https://slack.com/api/team.info" | jq .

curl -sk -m 10 -H "$H" -X POST "https://slack.com/api/team.info" | jq .

# User list (only if scope includes users:read) curl -sk -m 10 -H "$H" -X POST \

# User list (only if scope includes users:read) curl -sk -m 10 -H "$H" -X POST \

curl -sk -m 10 -H "$H" -X POST \

curl -sk -m 10 -H "$H" -X POST \

"https://slack.com/api/users.list?limit=100" | \

"https://slack.com/api/users.list?limit=100" | \

# /me already done (validation) curl -sk -m 10 -H "$H" https://api.getpostman.com/me | jq '.user'

# /me already done (validation) curl -sk -m 10 -H "$H" https://api.getpostman.com/me | jq '.user'

curl -sk -m 10 -H "$H" https://api.getpostman.com/me | jq '.user'

curl -sk -m 10 -H "$H" https://api.getpostman.com/me | jq '.user'

# Workspaces curl -sk -m 10 -H "$H" https://api.getpostman.com/workspaces | jq '.workspaces[] | {id, name, type}'

# Workspaces curl -sk -m 10 -H "$H" https://api.getpostman.com/workspaces | jq '.workspaces[] | {id, name, type}'

curl -sk -m 10 -H "$H" https://api.getpostman.com/workspaces | jq '.workspaces[] | {id, name, type}'

curl -sk -m 10 -H "$H" https://api.getpostman.com/workspaces | jq '.workspaces[] | {id, name, type}'

# Per-workspace collections + environments WS="<workspace-id>" curl -sk -m 10 -H "$H" "https://api.getpostman.com/workspaces/$WS" | jq '.workspace.collections[]'

# Per-workspace collections + environments WS="<workspace-id>" curl -sk -m 10 -H "$H" "https://api.getpostman.com/workspaces/$WS" | jq '.workspace.collections[]'

WS="<workspace-id>" curl -sk -m 10 -H "$H" "https://api.getpostman.com/workspaces/$WS" | jq '.workspace.collections[]' curl -sk -m 10 -H "$H" "https://api.getpostman.com/workspaces/$WS" | jq '.workspace.environments[]'

WS="<workspace-id>" curl -sk -m 10 -H "$H" "https://api.getpostman.com/workspaces/$WS" | jq '.workspace.collections[]' curl -sk -m 10 -H "$H" "https://api.getpostman.com/workspaces/$WS" | jq '.workspace.environments[]'

curl -sk -m 10 -H "$H" "https://api.getpostman.com/workspaces/$WS" | jq '.workspace.collections[]'

curl -sk -m 10 -H "$H" "https://api.getpostman.com/workspaces/$WS" | jq '.workspace.collections[]'

curl -sk -m 10 -H "$H" "https://api.getpostman.com/workspaces/$WS" | jq '.workspace.environments[]'

curl -sk -m 10 -H "$H" "https://api.getpostman.com/workspaces/$WS" | jq '.workspace.environments[]'

# Per-collection requests (where secrets often live) COL="<collection-id>" curl -sk -m 10 -H "$H" "https://api.getpostman.com/collections/$COL" | jq '.collection.item[]'

# Per-collection requests (where secrets often live) COL="<collection-id>" curl -sk -m 10 -H "$H" "https://api.getpostman.com/collections/$COL" | jq '.collection.item[]'

COL="<collection-id>" curl -sk -m 10 -H "$H" "https://api.getpostman.com/collections/$COL" | jq '.collection.item[]' # Run secret catalog over the JSON

COL="<collection-id>" curl -sk -m 10 -H "$H" "https://api.getpostman.com/collections/$COL" | jq '.collection.item[]' # Run secret catalog over the JSON

curl -sk -m 10 -H "$H" "https://api.getpostman.com/collections/$COL" | jq '.collection.item[]'

curl -sk -m 10 -H "$H" "https://api.getpostman.com/collections/$COL" | jq '.collection.item[]'

# Environments (often contain creds) ENV="<environment-id>" curl -sk -m 10 -H "$H" "https://api.getpostman.com/environments/$ENV" | \

# Environments (often contain creds) ENV="<environment-id>" curl -sk -m 10 -H "$H" "https://api.getpostman.com/environments/$ENV" | \

ENV="<environment-id>" curl -sk -m 10 -H "$H" "https://api.getpostman.com/environments/$ENV" | \   jq '.environment.values[] | {key, value}'

ENV="<environment-id>" curl -sk -m 10 -H "$H" "https://api.getpostman.com/environments/$ENV" | \   jq '.environment.values[] | {key, value}'

curl -sk -m 10 -H "$H" "https://api.getpostman.com/environments/$ENV" | \

curl -sk -m 10 -H "$H" "https://api.getpostman.com/environments/$ENV" | \

# Models accessible (already done as validation) curl -sk -m 10 -H "$H" -H "$A" https://api.anthropic.com/v1/models | jq '.data[] | .id'

# Models accessible (already done as validation) curl -sk -m 10 -H "$H" -H "$A" https://api.anthropic.com/v1/models | jq '.data[] | .id'

curl -sk -m 10 -H "$H" -H "$A" https://api.anthropic.com/v1/models | jq '.data[] | .id'

curl -sk -m 10 -H "$H" -H "$A" https://api.anthropic.com/v1/models | jq '.data[] | .id'

# Usage / quota (admin-scoped tokens only) curl -sk -m 10 -H "$H" -H "$A" https://api.anthropic.com/v1/organizations/usage_report | jq .

# Usage / quota (admin-scoped tokens only) curl -sk -m 10 -H "$H" -H "$A" https://api.anthropic.com/v1/organizations/usage_report | jq .

curl -sk -m 10 -H "$H" -H "$A" https://api.anthropic.com/v1/organizations/usage_report | jq .

curl -sk -m 10 -H "$H" -H "$A" https://api.anthropic.com/v1/organizations/usage_report | jq .

# Models (already done as validation) curl -sk -m 10 -H "$H" https://api.openai.com/v1/models | jq '.data | length'

# Models (already done as validation) curl -sk -m 10 -H "$H" https://api.openai.com/v1/models | jq '.data | length'

curl -sk -m 10 -H "$H" https://api.openai.com/v1/models | jq '.data | length'

curl -sk -m 10 -H "$H" https://api.openai.com/v1/models | jq '.data | length'

# Org info (if key has org scope) curl -sk -m 10 -H "$H" https://api.openai.com/v1/organizations | jq .

# Org info (if key has org scope) curl -sk -m 10 -H "$H" https://api.openai.com/v1/organizations | jq .

curl -sk -m 10 -H "$H" https://api.openai.com/v1/organizations | jq .

curl -sk -m 10 -H "$H" https://api.openai.com/v1/organizations | jq .

# Files / fine-tunes (sometimes contain training data with PII) curl -sk -m 10 -H "$H" https://api.openai.com/v1/files | jq .

# Files / fine-tunes (sometimes contain training data with PII) curl -sk -m 10 -H "$H" https://api.openai.com/v1/files | jq .

curl -sk -m 10 -H "$H" https://api.openai.com/v1/files | jq .

curl -sk -m 10 -H "$H" https://api.openai.com/v1/files | jq .

curl -sk -m 10 -H "$H" https://api.openai.com/v1/fine_tuning/jobs | jq .

curl -sk -m 10 -H "$H" https://api.openai.com/v1/fine_tuning/jobs | jq .

**Brute-force tier:** puredns against [assetnote.io](https://wordlists.assetnote.io/) wordlists.

**Brute-force tier:** puredns against [assetnote.io](https://wordlists.assetnote.io/) wordlists.

# 2. Cert Spotter API (sslmate) — free w/ rate limits curl -sk "https://api.certspotter.com/v1/issuances?domain=${D}&include_subdomains=true&expand=dns_names" | \

# 2. Cert Spotter API (sslmate) — free w/ rate limits curl -sk "https://api.certspotter.com/v1/issuances?domain=${D}&include_subdomains=true&expand=dns_names" | \

curl -sk "https://api.certspotter.com/v1/issuances?domain=${D}&include_subdomains=true&expand=dns_names" | \

curl -sk "https://api.certspotter.com/v1/issuances?domain=${D}&include_subdomains=true&expand=dns_names" | \

# 3. CertStream archive (Calidog) curl -sk "https://crt.calidog.io/?q=${D}" | jq -r '.[].name_value' | sort -u

# 3. CertStream archive (Calidog) curl -sk "https://crt.calidog.io/?q=${D}" | jq -r '.[].name_value' | sort -u

curl -sk "https://crt.calidog.io/?q=${D}" | jq -r '.[].name_value' | sort -u

curl -sk "https://crt.calidog.io/?q=${D}" | jq -r '.[].name_value' | sort -u

# 5. AlienVault OTX — free, no key curl -sk "https://otx.alienvault.com/api/v1/indicators/domain/${D}/passive_dns" | \

# 5. AlienVault OTX — free, no key curl -sk "https://otx.alienvault.com/api/v1/indicators/domain/${D}/passive_dns" | \

curl -sk "https://otx.alienvault.com/api/v1/indicators/domain/${D}/passive_dns" | \

curl -sk "https://otx.alienvault.com/api/v1/indicators/domain/${D}/passive_dns" | \

# 6. ThreatMiner curl -sk "https://api.threatminer.org/v2/domain.php?q=${D}&rt=5" | jq -r '.results[]'

# 6. ThreatMiner curl -sk "https://api.threatminer.org/v2/domain.php?q=${D}&rt=5" | jq -r '.results[]'

curl -sk "https://api.threatminer.org/v2/domain.php?q=${D}&rt=5" | jq -r '.results[]'

curl -sk "https://api.threatminer.org/v2/domain.php?q=${D}&rt=5" | jq -r '.results[]'

# 7. URLScan curl -sk "https://urlscan.io/api/v1/search/?q=domain:${D}" | \

# 7. URLScan curl -sk "https://urlscan.io/api/v1/search/?q=domain:${D}" | \

curl -sk "https://urlscan.io/api/v1/search/?q=domain:${D}" | \

curl -sk "https://urlscan.io/api/v1/search/?q=domain:${D}" | \

# 8. Anubis-DB (last resort) curl -sk -A "Mozilla/5.0" "https://anubisdb.com/anubis/subdomains/${D}" | jq -r '.[]'

# 8. Anubis-DB (last resort) curl -sk -A "Mozilla/5.0" "https://anubisdb.com/anubis/subdomains/${D}" | jq -r '.[]'

curl -sk -A "Mozilla/5.0" "https://anubisdb.com/anubis/subdomains/${D}" | jq -r '.[]'

curl -sk -A "Mozilla/5.0" "https://anubisdb.com/anubis/subdomains/${D}" | jq -r '.[]'

| Source                   | URL                                                                  | Notes                                                         | | ------------------------ | -----------------------------------------------

| Source                   | URL                                                                  | Notes                                                         | | ------------------------ | -----------------------------------------------

| ------------------------ | -------------------------------------------------------------------- | ------------------------------------------------------------- | | **Assetnote Wordlists**  | `<https://wordlists.assetnote.io/`>            

| ------------------------ | -------------------------------------------------------------------- | ------------------------------------------------------------- | | **Assetnote Wordlists**  | `<https://wordlists.assetnote.io/`>            

| **Assetnote Wordlists**  | `<https://wordlists.assetnote.io/`>                                  | Best-curated; updated regularly                               |

| **Assetnote Wordlists**  | `<https://wordlists.assetnote.io/`>                                  | Best-curated; updated regularly                               |

| **SecLists**             | `<https://github.com/danielmiessler/SecLists`>                       | Subdomains: `Discovery/DNS/subdomains-top1million-110000.txt` |

| **SecLists**             | `<https://github.com/danielmiessler/SecLists`>                       | Subdomains: `Discovery/DNS/subdomains-top1million-110000.txt` |

| **jhaddix all.txt**      | `<https://gist.github.com/jhaddix/86a06c5dc309d08580a018c66354a056`> | Long-running curated                                          |

| **jhaddix all.txt**      | `<https://gist.github.com/jhaddix/86a06c5dc309d08580a018c66354a056`> | Long-running curated                                          |

| **OneListForAll**        | `<https://github.com/six2dez/OneListForAll`>                         | Aggregated; very large                                        |

| **OneListForAll**        | `<https://github.com/six2dez/OneListForAll`>                         | Aggregated; very large                                        |

| **raft-large-words.txt** | inside SecLists                                                      | Time-tested content wordlist                                  | | **commonspeak2**         | `<https://github.com/assetnote/commonspeak2-wor

| **raft-large-words.txt** | inside SecLists                                                      | Time-tested content wordlist                                  | | **commonspeak2**         | `<https://github.com/assetnote/commonspeak2-wor

| **commonspeak2**         | `<https://github.com/assetnote/commonspeak2-wordlists`>              | Generated from BigQuery                                       |

| **commonspeak2**         | `<https://github.com/assetnote/commonspeak2-wordlists`>              | Generated from BigQuery                                       |

| **fuzzdb**               | `<https://github.com/fuzzdb-project/fuzzdb`>                         | Fuzzing payloads + wordlists                                  |

| **fuzzdb**               | `<https://github.com/fuzzdb-project/fuzzdb`>                         | Fuzzing payloads + wordlists                                  |

whois target.example curl -sk "https://rdap.org/domain/${D}" | jq .

whois target.example curl -sk "https://rdap.org/domain/${D}" | jq .

curl -sk "https://rdap.org/domain/${D}" | jq .

curl -sk "https://rdap.org/domain/${D}" | jq .

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

| 11  | Stripe Test Key           | `\bsk_test_[0-9A-Za-z]{24,}\b`                                                                                       | LOW          | stripe           | | 12  | Slack Token               | `\bxox[abpors]-

| 11  | Stripe Test Key           | `\bsk_test_[0-9A-Za-z]{24,}\b`                                                                                       | LOW          | stripe           | | 12  | Slack Token               | `\bxox[abpors]-

| 12  | Slack Token               | `\bxox[abpors]-[0-9A-Za-z\-]{10,48}\b`                                                                               | HIGH         | slack            | | 13  | Slack Webhook             | `<https://hooks

| 12  | Slack Token               | `\bxox[abpors]-[0-9A-Za-z\-]{10,48}\b`                                                                               | HIGH         | slack            | | 13  | Slack Webhook             | `<https://hooks

| 13  | Slack Webhook             | `<https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+`>                                            | MEDIUM       | slack            |

| 13  | Slack Webhook             | `<https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+`>                                            | MEDIUM       | slack            |

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

dig +short TXT "_mta-sts.${D}" curl -sS "https://mta-sts.${D}/.well-known/mta-sts.txt"

dig +short TXT "_mta-sts.${D}" curl -sS "https://mta-sts.${D}/.well-known/mta-sts.txt"

curl -sS "https://mta-sts.${D}/.well-known/mta-sts.txt"

curl -sS "https://mta-sts.${D}/.well-known/mta-sts.txt"

https://{candidate}.s3.amazonaws.com/

https://{candidate}.s3.amazonaws.com/

https://{candidate}.s3-{region}.amazonaws.com/

https://{candidate}.s3-{region}.amazonaws.com/

https://s3.{region}.amazonaws.com/{candidate}/

https://s3.{region}.amazonaws.com/{candidate}/

https://{candidate}.storage.googleapis.com/

https://{candidate}.storage.googleapis.com/

https://storage.googleapis.com/{candidate}/

https://storage.googleapis.com/{candidate}/

https://{candidate}.blob.core.windows.net/

https://{candidate}.blob.core.windows.net/

| Notion           | `*.notion.site/<slug>`                | | Confluence Cloud | `<target>.atlassian.net/wiki/spaces/` | | Trello           | `<https://trello.com/b/<id>>/<slug>`  |

| Notion           | `*.notion.site/<slug>`                | | Confluence Cloud | `<target>.atlassian.net/wiki/spaces/` | | Trello           | `<https://trello.com/b/<id>>/<slug>`  |

| Confluence Cloud | `<target>.atlassian.net/wiki/spaces/` | | Trello           | `<https://trello.com/b/<id>>/<slug>`  | | Miro             | `<https://miro.com/app/board/<id>>/`  |

| Confluence Cloud | `<target>.atlassian.net/wiki/spaces/` | | Trello           | `<https://trello.com/b/<id>>/<slug>`  | | Miro             | `<https://miro.com/app/board/<id>>/`  |

| Trello           | `<https://trello.com/b/<id>>/<slug>`  |

| Trello           | `<https://trello.com/b/<id>>/<slug>`  |

| Miro             | `<https://miro.com/app/board/<id>>/`  |

| Miro             | `<https://miro.com/app/board/<id>>/`  |

| Service     | Endpoint                                                                                    | Method | | ----------- | ------------------------------------------------------------------------------------------- | ------ | | 

| Service     | Endpoint                                                                                    | Method | | ----------- | ------------------------------------------------------------------------------------------- | ------ | | 

| Wayback CDX | `<https://web.archive.org/cdx/search/cdx?url={domain}/*&output=json&fl=timestamp,original`> | GET    |

| Wayback CDX | `<https://web.archive.org/cdx/search/cdx?url={domain}/*&output=json&fl=timestamp,original`> | GET    |

for ext in asp php jsp cfm aspx cgi pl; do   curl -s "https://web.archive.org/cdx/search/cdx?url=${D}/*.${ext}&output=json&fl=timestamp,original&limit=50" | jq -r '.[][1]' 2>/dev/null

for ext in asp php jsp cfm aspx cgi pl; do   curl -s "https://web.archive.org/cdx/search/cdx?url=${D}/*.${ext}&output=json&fl=timestamp,original&limit=50" | jq -r '.[][1]' 2>/dev/null

curl -s "https://web.archive.org/cdx/search/cdx?url=${D}/*.${ext}&output=json&fl=timestamp,original&limit=50" | jq -r '.[][1]' 2>/dev/null

curl -s "https://web.archive.org/cdx/search/cdx?url=${D}/*.${ext}&output=json&fl=timestamp,original&limit=50" | jq -r '.[][1]' 2>/dev/null

Legacy endpoints often reveal admin panels, forgotten upload forms, and deprecated APIs that still resolve. Cross-reference discovered paths with `§5` always-on HTTP checks. | Postman search | `<https://www.postman.com/_api/ws/proxy`> | POS

Legacy endpoints often reveal admin panels, forgotten upload forms, and deprecated APIs that still resolve. Cross-reference discovered paths with `§5` always-on HTTP checks. | Postman search | `<https://www.postman.com/_api/ws/proxy`> | POS

| Postman search | `<https://www.postman.com/_api/ws/proxy`> | POST (body: `{"service":"search","method":"POST","path":"/search-all","body":{"queryIndices":["collaboration.workspace"],"queryText":"{domain}","size":100}}`) |

| Postman search | `<https://www.postman.com/_api/ws/proxy`> | POST (body: `{"service":"search","method":"POST","path":"/search-all","body":{"queryIndices":["collaboration.workspace"],"queryText":"{domain}","size":100}}`) |

| StackExchange | `<https://api.stackexchange.com/2.3/search/advanced?site=stackoverflow.com&q={domain}&filter=withbody`> | GET |

| StackExchange | `<https://api.stackexchange.com/2.3/search/advanced?site=stackoverflow.com&q={domain}&filter=withbody`> | GET |