Finding a working bug host requires not just time but effort. You'll need to use tools like Termux, for example, that will let you get all the information you need to know before you know exactly where to target with your work.
Disclaimer!
This guide is for educational purposes only, as we do share this for most ISPs to take note of the loops in their systems so as to know how to address them. You are responsible for the misuse of the overall context of this guide, and we won't be held responsible for any unethical practice.
The Ultimate Guide to Find Bug Host (SNI/TCP) for Free Internet in Any Country
I've been using Termux for most of my work and research, and I think it is the best pentesting app for any Android device. I decided to share the mobile tutorial because I believe most of you are willing to work on your phone.
Nevertheless, if you are on PC, you can still use Windows PowerShell for the task. Best if you are on Linux; you'll have some of these repos I'll show you already preinstalled (nmap, for example).
Finding Bug Host on Android Using Nmap in Termux
Since Nmap can be a course on its own with its numerous command, we made a section on how to find bug host using Nmap in Termux. That section also includes all the possible methods to get information about your ISP using your Android device.
Finding Bug Host on Android Using Sublist3r in Termux
This is a host scanner tool and it can scan any website and report if it has open ports; from its results, you will know if you can use the host to get free internet. One thing you should keep in mind here is that this is information gathering, and from the information the tool will give you, you will be best oriented on how to use it to bug a host for free internet.
To install Sublist3r in Termux:
- As always before using Termux, we need to update the package repo in order to work with the latest features of each tool. So run the command "apt update && apt upgrade". This will perform a fresh update on all the repos.
- Now we need to install git so we can clone the tool's repository. We do this by entering the command "pkg install git"
- Since this tool runs with Python, we need to install both python and python. So we run the command "pkg install python"
- Now install python 2 with the command "pkg install python2"
- Now we need to clone the sublist3r repo. To do that we run the command "git clone https://github.com/aboul3la/Sublist3r.git"
- Once cloned, we need to switch to the tool's directory. To do that, run the command "cd Sublist3r".
- Now, once in the directory, we need to list all the items in that directory in order to see if it was cloned. To do that simply type in "ls".
- You should now be able to see all the contents of the directory. Spot out a file named requirements.txt. If you see the file then you need to run the requirements. To do that, simply type in "pip2 install -r requirements.txt". If you get an error that pip2 isn't installed, just run the command "pkg install pip2" then repeat this step.
- With the requirements in place, we need to run the tool using python. To do that, simply type in "python setup.py install". The tool interface will appear. Don't get scared by its interface, you are in the flow.
- Now to perform a scan on a website or host, just simply run the command "python2 sublist3r.py -d example.com or website.com(examples)" This will return you very useful results for your free internet projects and from its results, you will know if a bug host can give you free internet or not.
Important!
Replace example.com with the domain or host you want to scan.
Where you see website.com(example), you can use that to scan both a website or web server and the different subdomains hosted under it. You can get the subdomains of a particular website or web server by performing a reverse IP domain lookup.
We often do a reverse IP domain lookup to check all the websites and subdomains hosted under a particular webserver as we find many subdomains that give free internet, and meanwhile their main web server doesn't, so it is always important to perform a reverse IP domain lookup for all hosts you get.
We are done with the Android platform, and that is how you can find both SNI or HTTP bug host name for free internet. If you are interested in a bug host list, then you can checkout our SNI/HTTP/V2Ray hostname list to use for free internet access in your country.
How to Find SNI/HTTP Bug Hostnames Using Your PC Device
On PC, the steps are even easier since a PC is a workspace for most projects that can't be rendered on a phone.
However, as is the case with Android, you need some PC tools to run the scans for bug host. The reports on a PC are even more meaningful since we can easily play around with some aspects.
Requirements to Find Bug Host for Free Internet Using PC
- Your PC (Windows/Mac/Debian Distributions)
- Bug Host tools (Nmap for all PC types and The Bug Host tools specifically for Windows)
- VPN or Proxy (For unauthorized scans).
- Determination.
Procedure to Find Bug Host for Free Internet Using PC
We will proceed in two ways: The first which involves the use of Nmap (Zenmap) to perform different scan types on the host to get all the open/closed/filtered ports.
Nmap is a free, open source and multi-platform network security scanner used for network discovery and security auditing. Amongst other things, it allows you to create a network inventory, managing service upgrade schedules, monitor host or service uptime and scan for open ports and services on a host.
And the second method will be by using some 3rd party tools which we will provide by the end of this guide.
Using Nmap to Perform Scans Bug Hosts for Open Ports
- For a Start, you will need and download and install Nmap on your PC from the Nmap official website. I believe you know how to install software programs on PC.
- Once Nmap installed, do not launch it. We will be using Nmap in Command Prompt for a start
- On your PC, search for Command Prompt or CMD, then click on it.
- To check if Nmap is available in your CMD, just enter nmap and click enter on your keyboard.
If you are shown something similar to that on the image above, then Nmap was successfully installed in your PC.
- Let's start with a default scan. A default scan uses 1000 common TCP ports and has host delivery enables.
- To perform a host scan, just simply enter "nmap hostname" or "nmap ip_address" without quotes. Replace the hostname with the hostname you want to scan for open ports and replace ip_address with the IP if in case you are scanning an ip_address.
- Host Discovery performs a check to see if the host is online. In a large IP range, this is useful for identifying only active or interesting hosts, rather than scanning every single port on every single IP in the range (a lot of which may not even be there).
- You are to run scans on hostname or IP address on which you have authorization to perform scans on. It can be illegal to scan unauthorized hosts and IP addresses. As seen in the image below, I ran a default scan on the nmap test site - scanme.nmap.org. The default scan yielded the results you see in the image below.
- Since you are running scans for free internet, I advise you to use a VPN app or proxy to hide your real IP address in case things don't go in a favorable direction.
- The information returned from Nmap is in columns of PORT, STATE, and SERVICE as seen in the image above.
Check the table below for a complete understanding of these results on the different port states.
| STATE | Description |
|---|---|
| Open | The target port actively responds to TCP/UDP/SCTP requests. |
| Closed | The target port is active but not listening. |
| Filtered | A firewall or packet filtering device is preventing the port state from being returned. |
| Unfiltered | The target port is reachable but Nmap cannot determine if it is open or closed. |
| Open/Filtered | Nmap cannot determine if the target port is open or filtered. |
| Closed/Filtered | Nmap cannot determine if the target port is closed or filtered. |
Now that we know the basics, let's see how we can use Nmap for scanning open ports.
Nmap Port Scanning Commands
These commands will work well whether you are using nmap on Termux (Android) or PowerShell (PC) or even any other platform that has the nmap repo cloned.
The “–open” parameter
In any of the commands below, you can specify the “–open” parameter in your Nmap command to have Nmap only show you ports with an “Open” state.
Command to use: nmap –open [ip_address or hostname]
Scanning a Single Port
This command will initiate a default scan against the target hostname or IP on port 80.
Command to use: nmap -p 80 [ip_address or hostname]
The above image shows that port 80 has been filtered for the IP I scanned. This is a common case faced when you get status code 200 OK, and you think all is good; you have to run it here to see if the port you are using for it is filtered or if it is still open before concluding.
Scanning a specific range of ports
This command will initiate a default scan against the target host and look for ports between the range of 1-200.
Command to use: nmap -p 1-200 [ip_address or hostname]
From the above image, you can see that there are 2 open ports in the range of ports 1-200. This is a great step forward if we want to use this for free internet since we are aware of the open ports. Another interesting thing here is the SERVICE. You can see that for each open port, the SERVICE it works is next to it.
So from the image above, if we want to create a free internet config file using the bug host above, we know that we can use either SSH (SNI) tunneling mode or HTTP tunneling mode (payload generation including SSH) on both port 22 and port 80. That's already great progress.
Scanning the entire port range
This command will initiate a scan against the target host looking for all ports (1-65535).
Command to use: nmap -p- [ip_address or hostname]
This will take some time since it scans over 65535 ports.
Fast Scan on the top 100 ports
This command will initiate a fast scan against the target host, looking only for the top 100 common TCP ports.
Command to use: nmap -F [ip_address or hostname]
Scanning multiple TCP/UDP ports
This command will initiate a scan against the target host looking only for specified UDP and TCP ports.
Command to use: nmap -p U:53,67-68,T:21-25,80,135 [ip_address or hostname]
Scanning for specific service names
This command will initiate a scan against the target host looking for ports associated with specified service names.
Command to use: nmap -p http,ssh,msrpc,microsoft-ds [ip_address or hostname]
TCP SYN scan (default)
This command will initiate a TCP SYN scan against the target host. A TCP SYN scan sends a SYN packet to the target host and waits for a response. If it receives an ACK packet back, this indicates the port is open. If an RST packet is received, this indicates the port is closed. If no response is received after multiple transmissions, the port is considered filtered (a device or application between the source and the target is filtering the packets).
nmap -sS [ip_address or hostname]
TCP connect scan
This command will initiate a TCP connect scan against the target host. A TCP connect scan is the default scan performed if a TCP SYN scan is not possible. This type of scan requests that the underlying operating system try to connect with the target host/port using the ‘connect’ system call.
Command to use: nmap -sT [ip_address or hostname]
UDP port scan
This command will initiate a UDP port scan against the target host. A UDP scan sends a UDP packet to the target port(s). If a response is received, the port is classified as Open. If no response is received after multiple transmissions, the port is classified as open/filtered.
Command to use: nmap -sU [ip_address or hostname]
SCTP INIT scan
This command will initiate an SCTP INIT scan against the target host. An SCTP INIT scan is similar to the TCP SYN scan but specific to the SCTP protocol. An INIT chunk is sent to the target port(s). If an INIT-ACK chunk is received back, the port is classified as open. If an ABORT chunk is received, the port is classified as closed. If no response is received after multiple transmissions, the port is classified as filtered.
Command to use: nmap -sY [ip_address or hostname]
Using Zenmap for Port Scanning
The Nmap installation package comes with a front-end GUI for Nmap called Zenmap, used to control Nmap from a user interface rather than a command line.
One of the key benefits of using the GUI front-end version is the ability to save scanning profiles. You can configure a profile to include customized scanning options, scan targets, ping options, scripts, and performance options.
You may wish to create a new profile before initiating a scan. To create one, go to Profile >> New Profile or Command.
A default list of scan profiles is included, and the description and options for each can be reviewed from Profile >> Edit Selected Profile.
Many prefer using this rather than Nmap because of its custom scan features and easy-to-use interface.
To perform a scan, enter the target to be scanned and choose a scan profile before clicking ‘Scan’.
Once the scan on the hostname or IP is completed, the results will be displayed in the "Nmap Output" tab, with a further breakdown available in the Ports/Hosts, Topology, Host Details, and Scans tabs.
To get full information about the ports, go to the Ports/Hosts section. There you will find all the ports available on the host and their different states.
Zenmap saves a history of your scans and allows you to compare two scans side-by-side. To do this, go to Tools >> Compare Results. This is useful for checking whether two hosts have the same list of open ports.
Using 3rd Party Tools to Perform Scans Bug Hosts for Open Ports
These 3rd party tools are some tools that you can use to perform scans on a bug host for open ports, just as we did with Nmap above.
I believe that, with the knowledge of port scanning you obtained using the Nmap guide above, it will just be a game for you to use these tools.
However, unlike Nmap, the tools are available only for the Windows platform.
Important!
The password for the file is AiMTutorials.
What's the Next Step to Take When You Get a Working SNI/HTTP Bug Hostname?
The next thing you will want to do after you have gotten your SNI or HTTP bug hostname is to create a working config file for free internet access through this host.
For this, you need VPN apps such as HTTP Injector, HA Tunnel Plus, and HTTP Custom, since they cover a variety of features and protocols to deal with whatever hostname type. That's why we put more effort into releasing tutorials that cover all the main parts of these applications.
The Bottom Line
We recently released a bug host guide on this blog. Though it covered more information than you will find elsewhere, it wasn't enough, as we kept on receiving feedback from most of you complaining about situations we did not mention in that guide.
In this guide, we mentioned some key aspects from the previous guide on bug hosts and released an ultimate guide to find a bug host on whatever device you might be using, be it Android or PC. We have covered everything in this guide, and you will not find a better guide anywhere.
