## Gobuster
* A directory and file brute-forcing tool used to find hidden files, directories, and subdomains on websites
* It operates by sending HTTP requests based on a wordlist and identifying resources that are not publicly linked but still accessible
### Commands
* Installation
{% code overflow="wrap" lineNumbers="true" %}
```bash
sudo apt install gobuster
```
{% endcode %}
***
* Scan
{% code overflow="wrap" lineNumbers="true" %}
```bash
gobuster -u $URL #Scan url
gobuster -u $url -w $wordlist #Specify wordlist path
gobuster dir -u $url -w $wordlist #Directory and file mode
gobuster dns -u $url -w $wordlist #For DNS enumeration
gobuster vhost -u $url -w $wordlist #Subdomain mode
gobuster vhost -u $url -w $wordlist --append-domain #To set de subdomain first
```
{% endcode %}
{% hint style="warning" %}
Remember that when using the `vhost` option, you have to have the domain IP on the list of known hosts
{% endhint %}
## ffuf
* Flexible and fast web fuzzing tool used for brute-forcing directories, files, subdomains, and more
### Commands
* Installation
{% code overflow="wrap" lineNumbers="true" %}
```bash
sudo apt install ffuf
```
{% endcode %}
***
* Scan
{% code overflow="wrap" lineNumbers="true" %}
```bash
ffuf -u $URL/FUZZ -w $wordlist #FUZZ to fill the part to be fuzz
ffuf -u $URL/FUZZ -w $wordlist -o $filename #get output in a file
```
{% endcode %}
{% hint style="info" %}
**Note:** Optional keywords can be added after `$wordlist` separating them with `,`
{% endhint %}
## dirb
* Web content scanner that automates the task of discovering hidden directories and files on a web server by brute-forcing URL paths using a wordlist
### Commands
* Installation
{% code overflow="wrap" lineNumbers="true" %}
```bash
sudo apt install dirb
```
{% endcode %}
***
* Scan
dirb $URL #Scan URL
dirb $URL $wordlist #Use wordlist
dirb $URL $wordlist -w #Ignore warning messages
dirb $URL $wordlist -u $username:$password #Use
dirb $URL $wordlist -E $certificate #Use certificate
## Nikto
* A tool for scanning vulnerabilities of websites
### Commands
* Installation
{% code overflow="wrap" lineNumbers="true" %}
```bash
sudo apt install nikto
```
{% endcode %}
***
* Usage
{% code overflow="wrap" lineNumbers="true" %}
```bash
nikto -h $host #Scan a website
nikto -h $host -ssl #Scan a website using HTTPS
nikto -h $IPtxtFile #Scan all directions from a text file
nikto -h $host -o $outFile #Output results to a file
nikto -h $host -o $outFile -Format $format #Indicate format of the output
nikto -h $host -Tuning b #Just run fingerprinting modules
```
{% endcode %}
## Payload Box
* GitHub repository with payloads for different web application attacks
*
## Feroxbuster
* A directory and file brute-forcing tool (fuzzer) written in *Rust*
### Commands
* Installation
{% code overflow="wrap" lineNumbers="true" %}
```bash
sudo apt install feroxbuster
```
{% endcode %}
***
* Scan
{% code overflow="wrap" lineNumbers="true" %}
```bash
feroxbuster -u $URL #Scan URL
feroxbuster -u $url -w $wordlist #Specify wordlist path
feroxbuster -u $url -t $threads #Specify number of concurrent threads
feroxbuster -u $url -L $threads #Limit number of concurrent scans
feroxbuster -u $url -t $threads #Specify file for output
feroxbuster -u $url -x $extension #Specify extension of files
feroxbuster -u $url -n #Don't scan recursively folders or endpoints
```
{% endcode %}
## Git-Dumper
* A tool to fetch the files and reconstruct a Git repository locally
*
### Commands
* Installation
{% code overflow="wrap" lineNumbers="true" %}
```bash
git clone https://github.com/arthaud/git-dumper
cd /git-dumper
pip install -r requirements.txt
python git_dumper.py http://$target/.git/ ./repo
```
{% endcode %}
## GitSniff
* A tool to fuzz *GitHub* repositories in search of hidden, deleted, or private forks
*
### Commands
* Installation
{% code overflow="wrap" lineNumbers="true" %}
```bash
git clone https://github.com/NotReallyJustin/GitSniff
cd /GitSniff
pip install requests
pip install tqdm
```
{% endcode %}
***
* Usage
{% code overflow="wrap" lineNumbers="true" %}
```bash
python ./gitsniff.py -u $repositoryURL
```
{% endcode %}
## Security Headers
* A web service that analyzes the HTTP response headers of any website and gives it a grade based on its security posture
*