XSS from javascript hidden params
assetfinder *.com | gau | egrep -v '(.css|.svg)' | while read url; do vars=$(curl -s $url | grep -Eo "var [a-zA-Z0-9]+" | sed -e 's,'var','"$url"?',g' -e 's/ //g' | grep -v '.js' | sed 's/.*/&=xss/g'); echo -e "\e[1;33m$url\n\e[1;32m$vars"
2🔥19👍3❤2
- Register An account with email service@intl.paypal.com on the target
- navigate to support section and see if there are any emails converted into support tickets
credit - NinadMishra
#bugbountytips
- navigate to support section and see if there are any emails converted into support tickets
credit - NinadMishra
#bugbountytips
🐳9👍3
Offsec has been acquired by an private equity.
https://www.prnewswire.com/news-releases/leeds-equity-partners-acquires-offsec-302275836.html
https://www.prnewswire.com/news-releases/leeds-equity-partners-acquires-offsec-302275836.html
PR Newswire
Leeds Equity Partners Acquires OffSec
/PRNewswire/ -- Leeds Equity Partners ("Leeds Equity") announced today that it has acquired OffSec (the "Company"), the leading provider of continuous...
🧑💻CloakQuest3r - Uncover the true IP address of websites safeguarded by Cloudflare & Others
https://github.com/spyboy-productions/CloakQuest3r
https://github.com/spyboy-productions/CloakQuest3r
2🔥12👍3
Argus is an all-in-one information gathering tool crafted for ethical hackers and cybersecurity experts. It seamlessly integrates network analysis, web exploration, and threat detection, all in a sleek and intuitive interface. Argus turns complex reconnaissance into an art of simplicity.
---
Please open Telegram to view this post
VIEW IN TELEGRAM
GitHub
GitHub - jasonxtn/Argus: The Ultimate Information Gathering Toolkit
The Ultimate Information Gathering Toolkit. Contribute to jasonxtn/Argus development by creating an account on GitHub.
👍7
CVE-2024-9634: RCE in GiveWP WordPress Plugin, 9.8 rating 🔥
Another one critical vulnerability in GiveWP. This time, attackers can inject PHP code using one parameter.
Search at Netlas.io:
👉 Link: https://nt.ls/9tUYx
👉 Dork: http.body:"plugins/give/assets/dist"
Read more: https://github.com/advisories/GHSA-6fx6-wrpf-cpgv
Another one critical vulnerability in GiveWP. This time, attackers can inject PHP code using one parameter.
Search at Netlas.io:
👉 Link: https://nt.ls/9tUYx
👉 Dork: http.body:"plugins/give/assets/dist"
Read more: https://github.com/advisories/GHSA-6fx6-wrpf-cpgv
👍5❤3
POC for CVE-2024-4577 PHP CGI Argument Injection 🔥 🔥 🔥
Nuclei Template: https://github.com/11whoami99/CVE-2024-4577/blob/main/CVE-2024-4577.yaml
Nuclei Template: https://github.com/11whoami99/CVE-2024-4577/blob/main/CVE-2024-4577.yaml
1❤9👍2
Here are few Good GraphQl report to learn more about it.
1. hackerone.com/reports/2048725
2. hackerone.com/reports/2524939
3. hackerone.com/reports/2357012
4. hackerone.com/reports/2122671
5. hackerone.com/reports/2207248
6. hackerone.com/reports/1864188
7. hackerone.com/reports/1085332
8. hackerone.com/reports/1084904
9. hackerone.com/reports/1293377
10. hackerone.com/reports/1192460
1. hackerone.com/reports/2048725
2. hackerone.com/reports/2524939
3. hackerone.com/reports/2357012
4. hackerone.com/reports/2122671
5. hackerone.com/reports/2207248
6. hackerone.com/reports/1864188
7. hackerone.com/reports/1085332
8. hackerone.com/reports/1084904
9. hackerone.com/reports/1293377
10. hackerone.com/reports/1192460
HackerOne
Sorare disclosed on HackerOne: Circular based introspetion Query...
## Summary:
Hi Team, Hope you are doing great Sorare graphql Api has introspection enabled by default as per the policy it's meant to be public so they can facilitate their users with Graphql...
Hi Team, Hope you are doing great Sorare graphql Api has introspection enabled by default as per the policy it's meant to be public so they can facilitate their users with Graphql...
👍6❤3
Subdomain Takeover POC :
subfinder -d domain | httpx -silent > subdomains.txt ; nuclei -t /root/nuclei-templates/http/takeovers -l subdomains.txt
👍8❤1
80% bug bounties is about understanding the application/framework/protocol and (knowing about what exactly are you doing or if it's actually worth doing)
👍29🔥4🗿3❤1
CVE-2024-20329: Improper Neutralization of Command Delimiters in Cisco ASA, 9.9 rating 🔥🔥🔥
The vulnerability allows an attacker with low privileges to remotely execute commands via SSH and thus gain full control of the system.
More then 140k instances at Netlas.io:
👉 Link: https://nt.ls/Rfjme
👉 Dork: http.body:"/+CSCOE+/logon.html"
Vendor's advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssh-rce-gRAuPEUF
The vulnerability allows an attacker with low privileges to remotely execute commands via SSH and thus gain full control of the system.
More then 140k instances at Netlas.io:
👉 Link: https://nt.ls/Rfjme
👉 Dork: http.body:"/+CSCOE+/logon.html"
Vendor's advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssh-rce-gRAuPEUF
❤3🗿2👍1
Please open Telegram to view this post
VIEW IN TELEGRAM
Gist
I’ve analyzed numerous tools, blogs, tweets, and other resources on bypassing 403 Forbidden errors using HTTP Headers Fuzzing techniques.…
I’ve analyzed numerous tools, blogs, tweets, and other resources on bypassing 403 Forbidden errors using HTTP Headers Fuzzing techniques. After extensive research, I’ve compiled a list of headers y...
1❤12👍3🗿1