🔥 Bug Bounty Recon Tip: Find forgotten / hidden APIs & endpoints devs left behind! 🔥

Chain these 2 awesome free tools by @xnl-h4ck3r:

1️⃣ waymore → pulls massive archived URLs + responses from Wayback, Common Crawl, VirusTotal, URLScan, OTX & more

Basic command:
waymore -i target.com -oU waymore-urls.txt

2️⃣ xnLinkFinder → parses those responses / JS / pages and extracts juicy endpoints, parameters, secrets & even generates a target-specific wordlist

Chain it like this:
xnLinkFinder -i waymore-urls.txt -sf target.com -o results/

💡 Pro combo (most people run):
waymore -i example.com -oU urls.txt && xnLinkFinder -i urls.txt -sf example.com -o cli -sp

You’ll often discover undocumented /admin-api/v2, debug endpoints, old GraphQL paths, forgotten params with IDORs, leaked keys etc. → pure passive recon gold!

Install both via pip:
pip install waymore
pip install git+https://github.com/xnl-h4ck3r/xnLinkFinder.git

Repos:
→ https://github.com/xnl-h4ck3r/waymore
→ https://github.com/xnl-h4ck3r/xnLinkFinder

Happy hunting & don’t forget to chain → gau + katana + waymore + xnLinkFinder = monster recon list 😈

#BugBounty #Recon #WebHacking #APIHunting #CyberSecurity

Hey Hunter's,
DarkShadow is hare back again!

Well this is Not releted any POC or Method, This is a burp suite Ai extension which is really really awesome. So don't forget to try it 💀

https://github.com/six2dez/burp-ai-agent

#bugbountytip #tool

Hey Hunter’s,
DarkShadow is here back again, dropping a SSFR bypass method.

if you ever test SSRF, and there any parameter passing url with a fixed endpoint then try like:

burpcollab.com/anything/endpoint/../../

#ssrf #bugbountytips

#AD

⭕️ WordPress Testing Tool + Auto Upload (2026)

• Extracts usernames using multiple methods
• Tests ~395 passwords per user with smart patterns
• Intelligent WP detection with multi-login support
• WAF-aware headers
• 100 concurrent threads for fast scanning
• Multi-language support

⚡️ Covers one site completely before moving to the next for maximum results.

🐶 DM: @Mm_fit
⚠️ Limited access for 3 users only

Channel: https://t.me/cve0day

#AD