PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Recon series #3: HTTP fingerprinting – sleuthing for a web application’s hidden vulnerabilities

yeswehack.com | blog | #bug-bounty | #waf | #cve | #recon | #http-fingerprinting | #banner-grabbing
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Recon series #3 on HTTP fingerprinting: analysing response headers, banner grabbing, malformed requests, default file structures and cookie parameters to map technologies and hidden weaknesses.
Published
Collected

Related coverage

blog · yeswehack.com
‘People think I’m all about automation, but I only automate recon’: how rabhi became our all-time #1 Bug Bounty hunter
YesWeHack interviews Issam Rabhi, its all-time #1 bug bounty hunter, on his path from reverse engineering to top rankings, his recon-first automation methodology, favourite vulnerability types, notable finds, and advice for aspiring hackers.
blog · yeswehack.com
Recon series recap: The ultimate guide to Bug Bounty reconnaissance and footprinting
Recap of a six-part recon series covering hidden endpoints, subdomain enumeration, HTTP fingerprinting, hidden parameters and Google dorking, with tools like Nmap, Shodan and the Wayback Machine.
blog · yeswehack.com
Recon Series #6: Excavating hidden artifacts with Wayback Machine and other web-archive tools
Recon series #6 explains archive-based reconnaissance with Wayback Machine, CommonCrawl, Archive.today and URLScan to recover deprecated endpoints, embedded secrets and forgotten admin panels.
blog · yeswehack.com
Recon series #5: A hacker’s guide to Google dorking
Beginner-friendly guide to Google dorking: core operators such as site:, inurl: and filetype:, plus hands-on queries for subdomain discovery, hidden files, login portals and exposed credentials.
blog · yeswehack.com
Recon series #4: Port scanning – uncovering attack vectors by revealing open ports and hidden services
Recon series #4 on port scanning: passive scans via Shodan and Censys, active TCP/UDP techniques, banner grabbing, firewall evasion, and tools including Nmap, Masscan, Naabu and httpx.
blog · yeswehack.com
Recon Series #2: Subdomain enumeration – expand attack surfaces with active, passive techniques
Recon series #2 on subdomain enumeration: passive techniques via Censys, Shodan and SecurityTrails, Google dorking, DNS brute-forcing and vhost fuzzing, demonstrated on the ATG bug bounty program.
Back