So in the last lecture, we got into the surprising at all, and now I want to show you how you can
take a list of domains and probe them to confirm that they have no listening services for EDP initiative,
because now in the past, I would use TomTom's HDTV, which is absolutely amazing.
This guy is you know, he's extremely talented.
He's he's really nice, great personality and well-spoken, very articulate.
But you know, nothing against him.
No, no.
I like to use the ax because I guess it has a broader support base and there's more there's more minds
working on it.
It's not just one person.
And so that's not to say that Tom Nominals project hasn't been forked.
But, you know, this one, there's just a lot of development and it is just more robust and it's easier
for me to use.
So what we're going to do, you could just download the latest release, obviously, if you wanted to
just grab the binary right, you would go down here, you download the Linux and 64 and you would just
basically have the binary.
But what we're going to do is we're going to build it from source and you can see what you can do.
Right.
You can basically say HTP and then tackle the name of the file.
So we're going to use our combined file and then we can print out the title, the content length and
the status code.
And I'll show you, you know, all this data for all the domains that you have.
And the reason we're doing this is because data we get back from subfolder and amass.
You know, isn't necessarily current, I mean, you know, those feeds, don't you know, those feeds
at one time were accurate, but they may not be now.
And that's what you need to make sure you channel both the output through a tool like HTP X.
And you can see there's lots of different options here.
We don't need to get into all these because he's pretty straightforward.
You could just one cat for the file and then pipe it to ETP and you get some nice responses.
Right.
And here's a one liner to you, run some finder with HTP in one sweep.
So it's really nice.
So let's just get this going.
All right.
So what are we going to do is we're going to run HGP X and we're just going to Pathet to into the terminal
and get this going.
And again, this is working, this works because we installed go and we did that a few years back,
so make sure you've got go set up, you've got your go path and to go route configured and everything
set up in your DSH are safe out.
So now that we have the set up, we can type HBP and we can see you can see everything we can do with
it.
All right, so what we're going to do is we're just going to pipe people combined into a seatbacks,
what we want are the following content.
Link up with the title first.
And I think we definitely want that status code and see if there's anything else in here, we don't
need the IP.
You can see there's a lot of options, right, which is good.
It's good that we have flexibility.
Everything else looks pretty good.
You can even set the ports that you wanted to come back and you can even change the user agent screen,
you want to use randomly generated user agent string's.
That is code we did that thread's 50, that's fine.
Strike the title.
All right, everything looks good, so we're going to run it.
Control easy.
Look at this, beautiful.
I mean, it's so cool, I mean, I love this you're actually seeing.
The euro status code, the number of bytes returned in the title right now, this makes it really,
really, really, really, really easy.
Look at the check this out.
Access denied for all three.
That means that there is authentication minus end point.
Right.
But now we know for for not found.
This is not valid.
We don't even need to bother looking at this in a browser.
It's that we didn't have to go there because ATP X told us that it's not good.
Right.
So we're getting a bunch of Hobbins and this is really, really good.
It's gonna save us a lot of time when we go through Usenko witness later when we take screenshots of
everything.
So we'll let this run and then we will return once it finishes.
All right.
So a few minutes later, we are back, everything's finished and you can see a lot of beautiful, colorful
output.
Now, one thing that you might want to do when you think about your bug bounty automation flow is outputting
this and matching and only certain things.
Right.
So what you could do is you could filter for certain projects in the response.
You could filter by a specific status code to maybe you only want, you know, four or three status
codes for all three, or maybe you only want status codes where the content length is not zero.
Right.
You can get really specific here.
You can export the results as a Jason file if you do tactics and then you can feed that into other tools
further down your automation workflow so you can match on content length like I'm showing you here email,
you can say email and you maybe have a specific content link that you want to match and you can do that
here as well.
So there's a lot of flexibility here, and, you know, I encourage you to really explore all of your
options here, you know, that's what we're going to do here.
And we are actually going to wrap up the EDP Express.
And what we're going to do in the next lecture is we're going to get go witness training so we can start
to look at some screenshots of these pages.
Right.
Because you could technically just say, OK, I'm going to put all these in my browser and go to each
one down the line.
But that's not very smart and it can take a long time.
So you can instead feed everything into something like a witness, which is a rewrite of eyewitness.
And it will then show you screenshots of all of these pages.
And you can just look at the screen shots that look interesting and then focus your back on the efforts.
They're kind of cool, right?
All right, guys, I'll see you in the next picture.
Come back a little bit by.