Second-Order is a Scans web applications for second-order subdomain takeover by crawling the app, and collecting URLs (and other data) that match certain rules, or respond in a certain way.
Download a prebuilt binary from the releases page and unzip it.
Go version 1.17 is recommended
go install -v github.com/mhmdiaa/second-order@latest
Docker
docker pull mhmdiaa/second-order
Command line options
-target string
Target URL
-config string
Configuration file (default “config.json”)
-depth int
Depth to crawl (default 1)
-header value
Header name and value separated by a colon ‘Name: Value’ (can be used more than once)
-insecure
Accept untrusted SSL/TLS certificates
-output string
Directory to save results in (default “output”)
-threads int
Number of threads (default 10)
Configuration File
Example configuration files are in config
LogQueries
: A map of tag-attribute queries that will be searched for in crawled pages. For example, "a": "href"
means log every href
attribute of every a
tag.LogNon200Queries
: A map of tag-attribute queries that will be searched for in crawled pages, and logged only if they contain a valid URL that doesn’t return a 200
status code.LogInline
: A list of tags whose inline content (between the opening and closing tags) will be logged, like title
and script
All results are saved in JSON files that specify what and where data was found
LogQueries
are saved in attributes.json
{
“https://example.com/”: {
“input[name]”: [
“user”,
“id”,
“debug”
]
}
}
The results of LogNon200Queries
are saved in non-200-url-attributes.json
{
“https://example.com/”: {
“script[src]”: [
“https://cdn.old_abandoned_domain.com/app.js”,
]
}
}
The results of LogInline
are saved in inline.json
{
“https://example.com/”: {
“title”: [
“Example – Home”
]
},
“https://example.com/login”: {
“title”: [
“Example – login”
]
}
}
Usage Ideas
This is a list of tips and ideas (not necessarily related to second-order subdomain takeover) on what to use Second Order for.
<input>
names to build a tailored parameter bruteforcing wordlist: parameters.json.A tool crafted with simplicity in mind but harboring its own set of flaws. Despite…
CyberSentry is a robust automated scanning tool designed for web applications. It helps security professionals, ethical…
Delve into the world of DARKARMY, a potent arsenal of cybersecurity tools designed to empower…
Evade (Evasion) - this feature helps you to evade spells of enemies directed at you…
Step into the world of bug hunting with Cazador, a powerful toolkit designed to equip…
Prepare to take your Among Us gaming experience to the next level with the latest…