Live Recon: Hacking With STOK

Live Recon: Hacking With STOK is a practical reconnaissance stream featuring NahamSec and security researcher STOK (Fredrick Stoksund) analyzing large-scale bug bounty program data from HackerOne and Bugcrowd using the Trickest platform. The primary focus is lead generation and methodology for identifying promising targets and vulnerabilities within bug bounty programs.

## Overview NahamSec partners with Trickest to scan nearly every major bug bounty program, resulting in massive datasets covering organizations like Yahoo, Quora, Binance, Stanford, Snapchat, and others. The stream demonstrates practical techniques for filtering and analyzing this data to identify interesting attack vectors. The data is available free at checkers.io.

## Key Methodologies STOK emphasizes a deep-dive, manual approach rather than automation at scale. His primary strategy involves: (1) selecting targets with depth rather than pursuing numerous subdomains; (2) creating multiple user accounts to test for IDORs and authentication issues; (3) monitoring targets for changes over time; (4) looking for what breaks systems rather than what works. He describes this as "falling in love with a target" and comparing it to re-watching a TV series—you notice small changes others miss.

## Technical Analysis Approach The core recon methodology involves filtering HTTP responses by status codes to identify anomalies. Rather than treating 404s, 403s, and 500s as dead ends, STOK advocates sorting by content length to find rare responses. Standard error pages typically have consistent sizes; outliers indicate something unusual occurred—often application logic or JavaScript files revealing additional functionality. Error pages returning 403 with substantial data frequently contain useful information like embedded scripts pointing to other endpoints.

## Practical Techniques Demonstrated - **Content Length Filtering**: Sorting by response size to isolate anomalies; treating rare sizes as high-value targets - **403 Analysis**: Examining forbidden pages for embedded JavaScript or error messages that reveal application structure - **Redirect Chain Mapping**: Following 302/307 redirects to identify internal portals, staging environments, or different infrastructure - **Swagger/API Documentation Hunting**: Looking for swagger.io, openapi, or api/docs endpoints that provide API specifications - **JavaScript File Inspection**: Using browser DevTools or view source to extract API endpoints, roles, and functionality - **Wayback Machine Integration**: Cross-referencing Internet Archive data to find historical endpoints and functionality - **Match/Replace Techniques**: Modifying API responses (e.g., changing `false` to `true`, switching user roles) to access restricted features - **Fuzzing Organization IDs**: Iterating through org parameters to discover other organizations or accounts - **Basic Auth Testing**: Attempting default credentials or password spraying against 401-protected endpoints

## Real-World Examples The stream walks through several targets including Daimler, Marriott, MongoDB internal portals, and others. Notable findings include redirect chains revealing internal infrastructure, org ID parameters susceptible to fuzzing, login pages permitting registration or password resets, and APIs behind authentication proxies (Okta, etc.) that may expose functionality through JavaScript inspection.

## Key Insights - Most successful hacking combines hunches, experience, and data analysis - Automation handles volume but manual investigation yields quality findings - Different skill sets and approaches lead to different discoveries—there's no single "correct" way - Deep knowledge of a single target often outperforms shallow scanning of many targets - Error responses and edge cases often reveal more than successful requests - Swagger documentation is particularly valuable for API security testing - Internal asset discovery (corp, intra, dev subdomains) frequently surfaces testing/staging environments with fewer security controls

## Tools and Platforms Trickest (primary data analysis tool), Burp Suite (Intruder, match/replace), Splunk (large dataset analysis), browser DevTools, Wayback Machine, grep for pattern matching.

## Future Work STOK mentions preparing a presentation at Black Hat with Jonah (FFUF creator) on a novel tool related to bit-flip squatting. He plans to participate in Def Con and the H1702 competition after taking time to recover from previous burnout. He emphasizes the importance of avoiding burnout by hacking for curiosity and fun rather than purely financial motivation.