tools/recommended

Fingerprinting BuiltWith What BuiltWith is, how its historical tech-stack tracking differs from Wappalyzer, and how I use it to see a target's evolution. recommended root access Recon Whois What Whois reveals about a domain (owner, dates, registrar), and why it's my first check on any suspicious domain. recommended root access OSINT OSINT Framework What the OSINT Framework directory is, how to navigate it by category, and how it helps when you don't know which tool to reach for. recommended root access OSINT Reverse Image Search Google, Yandex and TinEye reverse image search compared, and how I use them to verify profile photos and find image sources. recommended root access OSINT Holehe What Holehe is, how it checks live email registration across dozens of services, and how it differs from Have I Been Pwned. recommended root access Recon OWASP Amass What Amass is, passive vs active subdomain enumeration, and why it's my final recon pass after crt.sh and Sublist3r. recommended root access OSINT Maltego What Maltego is, how transforms build an entity-relationship graph, and how I use it to map an organisation's surface. recommended root access OSINT Sherlock What Sherlock is, how to search a username across 300+ platforms, and how it complements Have I Been Pwned. recommended root access Util CrackStation What CrackStation is, its lookup-vs-bruteforce limitations, and why it's always my first try before spending local GPU time. recommended user access Util LOLBAS What LOLBAS is, how to abuse native Windows binaries for execution/download/bypass, and why it pairs with GTFOBins. recommended root access Util Regex101 What Regex101 is, how to debug regex patterns live across flavours, and how I use it for Burp rules and log parsing. recommended root access Util CyberChef What CyberChef is, how to chain encode/decode operations client-side, and how I use it to deobfuscate payloads in CTFs. recommended root access Malware Any.run What Any.run is, how to run interactive malware analysis in the browser, and when I reach for it over VirusTotal. recommended root access Malware urlscan.io What urlscan.io is, how to sandbox a suspicious URL safely, and how I use it for phishing triage in bug bounty. recommended root access Fingerprinting SSL Labs What Qualys' SSL Labs test is, how to analyse a server's TLS configuration in depth, and how I use it for recon. recommended root access Fingerprinting SecurityHeaders.com What SecurityHeaders.com is, how it grades a site's HTTP security headers, and how I use it for quick bug bounty triage. recommended root access Fingerprinting Wappalyzer What Wappalyzer is, how to fingerprint a site's tech stack, and why it's my first step on any web target. recommended root access OSINT Have I Been Pwned What Have I Been Pwned is, how to check emails/passwords against known breaches (with k-anonymity), and how I use it in engagements. recommended user access Recon Wayback Machine What the Wayback Machine's CDX API is, how to list every archived URL for a domain, and how I use it to find forgotten endpoints. recommended root access Recon DNSDumpster What DNSDumpster is, how to use it for DNS/subdomain recon, and how it complements crt.sh in my bug bounty workflow. recommended root access Recon crt.sh What crt.sh is, how to query Certificate Transparency logs for subdomains, and how I use it as the first step of bug bounty recon. recommended root access Recon Shodan What Shodan is, how to search it (filters, host lookup), and how I use it for passive recon in bug bounty. recommended root access Malware VirusTotal What VirusTotal is, how to use it (web + API, file/hash/URL scanning), and how I actually use it during CTFs and bug bounty triage. recommended user access Util GTFOBins What GTFOBins is, how to look up abusable Linux binaries for privesc, and why it's my go-to after every sudo -l. recommended root access