2. Web application Pentester - HTB Bizness, nikto, ffuf, dirsearch, add-ons, wordlists, flameshot
This time we will be using HTB Bizness to study.
I didn't finish and didn't put any flag information since the box is still live.
These are some points that I have discussed during the video.
1. Use Ping command to check if the target is live.
2. Use a port scanner to check open ports.
3. Use Nikto to search for vulnerability
4. 'View Page Source' Or click CTRL+U
5. Go through javascript.
6. Robots.txt
7. Directory Fuzzing
1. `dirsearch -u https://bizness.htb
2. `ffuf -u https://bizness.htb/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-small-directories.txt -fw 1 -v`
8. Add-ons
1. Foxy-Proxy
2. Cookie Quick Manager
3. wappalyzer
9. Wordlists
1. https://github.com/danielmiessler/Sec...
10. Flameshot
11. download using wget
12. `pip3 install alive_progress`