julle/oscp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

first commit

Browse Source
This commit is contained in:
julle
2025-11-21 17:17:42 +01:00
commit 4cad18c2a5
285 changed files with 122106 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Necronomicon/OSINT/Tips and Tricks.md
+25
View File
@@ -0,0 +1,25 @@
- Origin Domains
- Content Delivery Networks (CDNs) are used to deliver website content/traffic more efficiently and reduce server load.
- CDNs are *not* proxies for the real webserver--the real webserver is the origin.
- Oftentimes, CDNs will block security testing payloads. Find the origin server and bypass the filtering/CDN.
- Examples (for Akamai):
- `origin-sub.domain.com`
- `origin.sub.domain.com`
- Try sending `Pragma: akamai-x-get-true-cache-key` - key often has origin in it
- Things to look for:
- Logins
- Defaultcontent
- Bypass domains (dev, qa, ww1,ww2,)
- 302’s
- Basic Auth
- Old looking frameworks
- Outdated Priv Pol / Trademark
- Favicon analysis
- Useful when you have a *ton* of webservers to analyze - fingerprint by the favicon
- [FavFreak](https://github.com/devanshbatham/FavFreak)
- Reporting guidelines:
- Detailed enough to reproduce
- Record your proof in case the issue gets fixed before your submission is triaged
- Some orgs are more mature than others, it may take time – ask your triager
- Autogenerated / autosubmitted reports are obvious especially if they lack any good information
- Prove impact. Take it further if you can. Example: An XSS with a simple “alert(1)” could get you $50-100, but can you prove it’s more impactful? We love to see it!