Web Stuff

Stuff related to web apps

HTTP methods to test for access control issues

GET
HEAD
POST
OPTIONS
TRACE
PUT
DELETE
CONNECT
PATCH

HTTP headers to change location

# Rewrite IP source
X-Originating-IP: 
X-Forwarded-For: 
X-Forwarded: 
Forwarded-For: 
X-Forwarded-Host: 
X-Remote-IP: 
X-Remote-Addr: 
X-ProxyUser-Ip: 
X-Original-URL: 
Client-IP: 
X-Client-IP: 
X-Host: 
True-Client-IP: 
Cluster-Client-IP: 
X-ProxyUser-Ip: 

# Rewrite location
X-Original-URL: /admin
X-Rewrite-URL: /admin

Git

# Dump Git repo
# Link: https://github.com/arthaud/git-dumper
git-dumper <URL>/.git <DESTINATION DIR>

# Extract more info from repo
# Link: https://github.com/internetwache/GitTools/blob/master/Extractor/extractor.sh
./extractor.sh <PATH TO GIT REPO> <DESTINATION DIR>

Nuclei

# Run authenticated scan
nuclei -u <URL> -H "<COOKIE>"