# Hacking Notebook

# Web Hacking

## Content Discovery

### Definition :

### Ressources :

### Tools / Things to check
- robots.txt
- favicon
- sitemap.xml
- HTTP Headers
- Google Dorking
- Wappalyzer
- Wayback Machine
- GitHub
- S3 Buckets : http(s)://{name}.s3.amazonaws.com where {name} is decided by the owner

## Subdomain Enumeration

### Definition :

### Ressources :

### Tools / Things to check
- crt.sh
- Google Dorking
- dns bruteforce
- Sublist3r
- vhost

## Authentication Bypass

### Definition :

### Ressources :

### Tools / Things to check

- Username enumeration with ffuf
- Bruteforce
- Logic Flaw
- Cookie Tampering

## IDOR

### Definition :

### Ressources :

https://www.youtube.com/watch?v=rloqMGcPMkI
https://www.youtube.com/watch?v=gINAtzdccts

### Tools / Things to check

- Burpsuite
- Try to get other user information "/profile?user_id=1000"
- For Hash id : Cyberchef or Crackstation
- Web requests

## Incident Response and Forensics