003random

Write-up H1-212

Index

Title	Description
Tools	The tools etc. which I used during this CTF
My journey	My experience during this CTF
The steps	The steps to reproduce
Things learned	Summary of things we used/learned in this CTF

003random

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
   <system.webServer>
      <handlers accessPolicy="Read, Script, Write">
         <add name="web_config" path="*.config" verb="*" modules="IsapiModule" scriptProcessor="%windir%\system32\inetsrv\asp.dll" resourceType="Unspecified" requireAccess="Write" preCondition="bitness64" />
      </handlers>
      <security>
         <requestFiltering>
            <fileExtensions>
               <remove fileExtension=".config" />

003random

while read -r line
do
    echo "$line.$2" >> $3
done < $1

003random

#!/usr/bin/env bash

while getopts ":d:" opt; do
  case $opt in
    d)
      domain=$OPTARG
      ;;
  esac
done

003random

~/scripts/append_subdomains.sh ~/wordlists/commonspeak2-subdomains.txt $domain "wordlist.txt"

003random

 awk -F ". " '{print $1}' "wordlist-online.txt" > "wordlist-filtered.txt" && mv "wordlist-filtered.txt" "wordlist-online.txt"

003random

subfinder -d $domain -nW -o "subfinder-online.txt" -rL ~/wordlists/resolvers.txt > /dev/null 2>&1

003random

amass -rf ~/wordlists/resolvers.txt -d "$domain" -o "amass.txt" > /dev/null 2>&1

003random

massdns -r ~/wordlists/resolvers.txt -q -t A -o S -w "amass-online.txt" "amass.txt"

003random

python ~/tools/altdns/altdns.py -i "subdomains.txt"  -o "altdns-wordlist.txt" -w ~/tools/altdns/words.txt