🎓 مرجع تخصصی آموزش تست نفوذ و رد تیم TryHackBox 

📌 در اینجا، آموزش‌ های خودمون رو همراه با سناریوها و تمرین‌ های واقعی در اختیارتون قرار میدهیم.

📌 شما میتونید در کنار آموزش‌ های تئوری و عملی‌ محور ما، مستقیماً در محیط‌ های کاری ازشون استفاده کنید.

📌 علاوه بر این، نکته‌ های باگ بانتی و مطالب مرتبط دیگه هم همیشه در اختیارتون قرار میگیرد.

✍ از اولین پست های کانال ما شروع کنید به خوندن .

⚠️ پس این فرصت رو از دست ندید! 

➖➖➖➖➖➖➖➖➖
🆔 @TryHackBox

🔥 AutoAR = Full Bug Bounty Automation

Recon → Scan → Exploit → Report (automated)

• Subdomains (15+ sources)
• Nuclei + CVE scan
• JS secrets + GitHub leaks
• DNS takeover + misconfigs
• AI agent (FREE)
• Results → Cloudflare R2

Stop manual recon.

https://github.com/h0tak88r/AutoAR

📰 @BackupLSO
📚 @LibrarySecOfficial

Web-Check - 🕵️‍♂️ All-in-one OSINT tool for analysing any website

📰 @BackupLSO
📚 @LibrarySecOfficial

Bug Bounty Tips:

- Always check hidden/internal endpoints like "/getSchema", "/actuator", "/env"
- Look for H2 / embedded DB usage → often misconfigured
- Try injecting JDBC params (INIT, TRACE, etc.)
- Don’t ignore default tokens or exposed headers
- Think beyond SQLi → DB features themselves can be weaponized


So guys if you really enjoy to read such methods show your love ❤️

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

🔥 Ultimate Bug Bounty Goldmine — 1000+ Real Writeups

XSS, CSRF, SSRF, IDOR, SQLi, RCE… everything in one place.
Real reports from Google, Facebook, PayPal, Microsoft & more.

Perfect for learning real-world exploitation, not just theory.

GitHub: https://github.com/devanshbatham/Awesome-Bugbounty-Writeups



❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

⚠️ S3 Bucket Recon ⚠️

Source : https://github.com/securitycipher/awsome-websecurity-checklist/blob/main/Mindmaps/S3-Bucket%20Recon.png


❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

☄️Apache HTTP Server Vulnerability Testing Tool | PoC for CVE-2024-38472 , CVE-2024-39573 , CVE-2024-38477 , CVE-2024-38476 , CVE-2024-38475 , CVE-2024-38474 , CVE-2024-38473 , CVE-2023-38709

🔥https://github.com/mrmtwoj/apache-vulnerability-testing


❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

🦊 CloudFox helps you gain situational awareness in unfamiliar cloud environments. It’s an open source command line tool created to help penetration testers and other offensive security professionals find exploitable attack paths in cloud infrastructure.

https://github.com/BishopFox/cloudfox

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

Bug Bounty Reconnaissance-Phase 1

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

🔥CVE-2026-41940 cPanel/WHM Authentication Bypass - Detection Artifact Generator

🚨https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

⚠️403 bypass tools for bug bounty hunters:

bypass-403 → https://github.com/iamj0ker/bypass-403
nomore403 → https://github.com/devploit/nomore403
4-ZERO-3 → https://github.com/Dheerajmadhukar/4-ZERO-3
byp4xx → https://github.com/lobuhi/byp4xx
dontgo403 → https://github.com/mbrg/dontgo403

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

2FA Bypass
https://github.com/0xmaximus/Galaxy-Bugbounty-Checklist/tree/main/2FA%20bypass

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

😈Turn your Burp Suite findings into clean, professional cards, ready for reports, bug bounty submissions, and social sharing.

🚨https://github.com/JFOZ1010/repshot

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

Claude-BugHunter — Turn Claude Code into a Senior Bug Hunter & Red Team Operator 🤖💀

A powerful skill bundle built for bug bounty hunters and external red teams.

• 51 specialized security skills
• 15 slash commands for automated workflows
• 681 real disclosed report patterns
• Coverage across Web, API, Cloud, OAuth, SAML, GraphQL, SSRF, IDOR, XSS, RCE & more
• Enterprise attack paths for M365, Okta, VPNs, SharePoint & VMware
• Built-in triage, validation, reporting & evidence hygiene workflows
• Burp MCP integration and engagement tracking

From recon and vulnerability discovery to validation and report writing, Claude automatically loads the right skills based on what you're testing.

🔗 https://github.com/elementalsouls/Claude-BugHunter

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

Hi everyone,
I’m currently developing an AI-powered chatbot on Telegram focused on the field of Cyber Security.
If you’re interested in investing in this project or would like to learn more, feel free to reach out to me.
Looking forward to connecting.

@RedTeamKitBot

CloudRip Fast Cloudflare bypass scanner. A tool that helps you find the real IP addresses hiding behind Cloudflare by checking subdomains.

https://github.com/moscovium-mc/CloudRip


❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

📌Bug Bounty Tip: Finding Confidential Documents Fast

✅Admins often leave these unredacted files online by mistake, making them a high-medium severity finding for bug bounty programs.

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

Roadmap for Cyber Security & Ai Security

https://t.me/+390M0bSj10BiMDJk


Membership is only for 100 people.

⭕ For 47

⚠️HackLabs is a collection of hands-on vulnerable labs designed to practice web exploitation, privilege escalation, Active Directory attacks, and general pentesting techniques in a safe environment.

⚠️ For educational and authorized testing only.

🔗 https://github.com/afsh4ck/HackLabs

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

WAF Bypass Techniques + Tools

Here are some powerful tools and methods to help you bypass Web Application Firewalls during bug hunting:

🔥 Tools:
- wafw00f — WAF fingerprinting tool
→ https://github.com/EnableSecurity/wafw00f
- bypass-firewalls-by-DNS-history — Discover origin IPs via old DNS records
→ https://github.com/vincentcox/bypass-firewalls-by-DNS-history
- CloudFail — Excellent for bypassing Cloudflare
→ https://github.com/m0rtem/CloudFail

🔥 Effective Bypass Techniques:

1. Origin IP Discovery — Use historical DNS records (Censys, etc.) to find the real server IP and connect directly.
2. Dev/Staging Subdomains — These often don’t have WAF protection.
3. Case Variations — Try SeLeCt instead of SELECT
4. Comment Injection — SE//LECT
5. Multiple Encodings — URL → Double URL → Unicode, etc.
6. Parameter Pollution — ?id=1&id=2
7. HTTP Method Swap — Change from GET → POST → PUT
8. Content-Type Swap — Switch between form-data, JSON, XML
9. HTTP/2 Cleartext — Some WAFs only inspect HTTP/1.1

Quick WAF Detection Command:

curl -I https://target.com | grep -iE "server|cdn|cf-|x-"

Save this for your next bug bounty hunt! 🔥

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial