tools/recommended

Fingerprinting BuiltWith What BuiltWith is, how its historical tech-stack tracking differs from Wappalyzer, and how I use it to see a target's evolution. recommended Recon Whois What Whois reveals about a domain (owner, dates, registrar), and why it's my first check on any suspicious domain. recommended OSINT OSINT Framework What the OSINT Framework directory is, how to navigate it by category, and how it helps when you don't know which tool to reach for. recommended OSINT Reverse Image Search Google, Yandex and TinEye reverse image search compared, and how I use them to verify profile photos and find image sources. recommended OSINT Holehe What Holehe is, how it checks live email registration across dozens of services, and how it differs from Have I Been Pwned. recommended Recon OWASP Amass What Amass is, passive vs active subdomain enumeration, and why it's my final recon pass after crt.sh and Sublist3r. recommended OSINT Maltego What Maltego is, how transforms build an entity-relationship graph, and how I use it to map an organisation's surface. recommended OSINT Sherlock What Sherlock is, how to search a username across 300+ platforms, and how it complements Have I Been Pwned. recommended Util CrackStation What CrackStation is, its lookup-vs-bruteforce limitations, and why it's always my first try before spending local GPU time. recommended Util LOLBAS What LOLBAS is, how to abuse native Windows binaries for execution/download/bypass, and why it pairs with GTFOBins. recommended Util Regex101 What Regex101 is, how to debug regex patterns live across flavours, and how I use it for Burp rules and log parsing. recommended Util CyberChef What CyberChef is, how to chain encode/decode operations client-side, and how I use it to deobfuscate payloads in CTFs. recommended Malware Any.run What Any.run is, how to run interactive malware analysis in the browser, and when I reach for it over VirusTotal. recommended Malware urlscan.io What urlscan.io is, how to sandbox a suspicious URL safely, and how I use it for phishing triage in bug bounty. recommended Fingerprinting SSL Labs What Qualys' SSL Labs test is, how to analyse a server's TLS configuration in depth, and how I use it for recon. recommended Fingerprinting SecurityHeaders.com What SecurityHeaders.com is, how it grades a site's HTTP security headers, and how I use it for quick bug bounty triage. recommended Fingerprinting Wappalyzer What Wappalyzer is, how to fingerprint a site's tech stack, and why it's my first step on any web target. recommended OSINT Have I Been Pwned What Have I Been Pwned is, how to check emails/passwords against known breaches (with k-anonymity), and how I use it in engagements. recommended Recon Wayback Machine What the Wayback Machine's CDX API is, how to list every archived URL for a domain, and how I use it to find forgotten endpoints. recommended Recon DNSDumpster What DNSDumpster is, how to use it for DNS/subdomain recon, and how it complements crt.sh in my bug bounty workflow. recommended Recon crt.sh What crt.sh is, how to query Certificate Transparency logs for subdomains, and how I use it as the first step of bug bounty recon. recommended Recon Shodan What Shodan is, how to search it (filters, host lookup), and how I use it for passive recon in bug bounty. recommended Malware VirusTotal What VirusTotal is, how to use it (web + API, file/hash/URL scanning), and how I actually use it during CTFs and bug bounty triage. recommended Util GTFOBins What GTFOBins is, how to look up abusable Linux binaries for privesc, and why it's my go-to after every sudo -l. recommended