From Recon to RCE: How AI and a cup of Boost Helped Me Turn SQLi into a Command Injection Jackpot…
1 min read
Summary
The author recounts how a casual five-minute bug hunt turned into a successful recon session resulting in a critical RCE (Remote Code Execution) report.
-AI combined with aBtnough deprived of inspiration, I decided to distract myself with a quick bug hunt, thinking I’d probably just bounce off anyway. To my surprise, my terminal seemed to find the meaning of life—or at least a vulnerable endpoint that would soon turn my life around.” The author finds a bug bounty program that offers financial rewards for finding and reporting vulnerabilities.
The author describes the tools and techniques used in the recon phase, including domain discovery tools assetfinder, crtsh, findomain, and subfinder to identify assets and subdomains associated with a target domain.
The results are combined and cleaned up using anew, and httprobe to identify live hosts.
Further reconnaissance is conducted using katana, waybackurls, and gauplus to discover more assets.
The author checks for subdomain takeover possibilities using subzy and identifies potential broken links and hijacking opportunities.
Parameter fuzzing is performed using tools like paramspider and Arjun, and finally, the author mentions checking for possible XSS vulnerabilities.