All right, Tom, the last lecture we talked about is DNA scan, which is basically a wrapper from that
scan, let you scan domains and translate them into IP addresses so that you can see which parts are
available.
And now I want to show you guys go, Spider.
So this is a really fast Web spider.
What you can do with this is you can use it to spider web applications.
So, of course, you know, you can use to do this.
But the nice thing about Spider that, you know, it'll actually verify links from JavaScript files.
It'll find the links, it'll pass it out, and it will run it against, you know, various intelligence
sources, such as the Wayback Machine virus total in Alien Vault.
So you can see some of the goodness here.
Right.
So I want to show you guys how you can install this and how we can get going with.
Spider, it's really easy to use and you'll see how awesome it is in a second.
So here we go.
We're just going to grab this control.
See in.
Go right to that, finished rather quickly and you can see we have got Spider, so let's again split
the pain so we can type out the command and learn what commands or what flags we want to use.
All right.
So we've got go spider and we've got some flags, right?
What flags will we use?
So I think the best approach for us will be to use a sites list to crawl.
Right, so we can do tech capital as PayPal combined and then we can output everything into another
file.
We'll call it PayPal.
Go, Spider.
All right, and that was way too fast.
Let's take a look at PayPal combined.
All right.
So the problem here, of course, is we're missing the protocols.
All right.
So let's pipe in.
Into you go, Spider, since we have the protocols in front.
I think that's what it was.
It was a waiting for.
So you can see now we're going to get everything we need here.
It's going to go out and spider this stuff and it just gives us, you know, more files to look at.
Right.
More more resources to attack.
And you can actually see where it's coming from.
You can see link finder in here.
You can see JavaScript, all these different sources.
And it's going to compile it into one huge file that we can then use to assess and then we can get through
it.
Right.
So we can grab and say, hey, I want to look for, you know, password strings or, you know, I want
to look for anything that looks suspicious.
Another tool, it's really good to have caroler.
This is also a really good one for numeration, you know, goes by Nightcrawler are pretty much the
leading applications for this.
This is also written and go and you can discover, you know, forms in point, subdomains, JavaScript
files, which often contain juicy items.
And it's just it's just a really good tool to use, so if you wanted to install Hakala, you would just
run this command right here.
Right.
And it's pretty much the same kind of situation.
Then you can just go through the you know, the usage for track crawler and use it according to your
needs.
So we're done here, see if we can take a look at the file that was resulting.
So we've got a bunch of stuff here.
See if we can look at one of these.
Now, some of these files are zero bytes, but others aren't like, for example, let's take I don't
know, something.
It looks interesting.
About this guy right here, sandbox, right?
So here you can see there's some stuff that might be interesting.
Scroll up a little bit.
That some JavaScript files.
So it's a sandbox, right, so it's a test and you can see it looks like some test commands were inside
of this robot's file, right?
So a lot of times the robots, it's basically telling me files that the developers don't want scraped
by search engines.
So, you know, you might want to explore some of these these endpoints, you know, manually go there
and see if there's anything interesting there, like clean money.
What's that?
Right.
This is on the API.
And, yeah, this is very manual does take some time and some work.
But hey, I mean, bug bounty takes work, right?
There's some things you can automate this other things that require closer attention.
And this is one of those things that requires you to really take your time and to to really think through
how a Web application works and what these JavaScript files are doing.
Right.
And what this means.
So in the next lecture, we're going to get into nuclei and that'll wrap up the reconstruction robot
Betty.
All right.
So you guys are a little bit.