Differences

This shows you the differences between two versions of the page.

--- cybersecurity:tools:burpsuite [2026/09/20 14:22] – created warnaud
+++ cybersecurity:tools:burpsuite [2026/09/20 14:27] (current) – warnaud
@@ Line 2: / Line 2: @@
 ===== Pre =====
 {{ :cybersecurity:tools:burp.jpg?nolink |}}
+Most bug hunters open Burp Suite the moment they get a target.
+I wait.
+Here are the 5 things I do before touching Burp Suite:
+  - Google Dorking the target \\ site:target.com ext:php OR ext:json OR ext:env \\You'd be surprised what's indexed that shouldn't be.
+  - Subdomain enumeration \\subfinder + httpx pipeline.\\I'm looking for forgotten dev/staging subdomains.\\They're almost always less hardened than the main app.
+  - JavaScript file hunting\\I run waybackurls + gf on every JS file.\\Devs leave API keys, internal routes, and hardcoded tokens here more than anywhere else.
+  - Reading the job listings\\The company's open roles tell me their exact tech stack.\\"We use AWS Lambda, React, and PostgreSQL" = I know exactly what to test.
+  - Checking old vulnerability disclosures\\Search HackerOne's disclosed reports for the same target or similar tech.\\Patterns repeat. Developers make the same mistakes twice.
+Burp Suite is a powerful tool.
+But it's useless without knowing where to point it.
+Recon is where 80% of my findings actually start.
+Save this. You'll use it.
+Which step surprised you the most? Drop it below 👇
+— @sheoraninfosec
+Bug Bounty Hunter · HackerOne & Intigriti
+Original post: https://www.linkedin.com/feed/update/urn:li:activity:7459437305418727424