PD: Quick Run

Let’s see how data flows from broad discovery to specific security findings.

Use the PD’s dedicated testing domain: chaos.projectdiscovery.io.

Phase 1: Discovery

#

1. Finding the surface with: Subfinder

% subfinder -d projectdiscovery.io -o subdomains.txt

2. Finding the doors with: Naabu

% naabu -list subdomains.txt -p 80,443,8080,8443 -o open_ports.txt

3. Checking the services with: HTTPX

% httpx -list open_ports.txt -title -tech-detect -status-code

4. Scanning for vulnerabilities with: Nuclei

% nuclei -ut
% nuclei -u https://testphp.vulnweb.com -severity low,medium,high,critical

Phase 2: Chaining

#

Let’s see the power of chaining.

The true strength of the PD suite is the UNIX Philosophy: Standard Input (stdin) and Standard Output (stdout). We can chain the results of one tool directly into the next.

Here is a classic automation chain that goes from a domain name to a vulnerability report in one line:

% subfinder -d projectdiscovery.io | httpx -silent | nuclei -t vulnerabilities/ -severity low,medium,high,critical

Phase 3: Advanced Piping

#

Security assessment to local home lab network.

% naabu -host 192.168.10.0/24 -top-ports 100 -silent | httpx -sc -title | nuclei -tags exposure,misconfig

Common Tools

#