Web Cache Poisoning🌱🌵🔥
#bugbounty #infosec

The objective of web cache poisoning is to send a request that causes a harmful response that gets saved in the cache and served to other users.

Where to find 🧵(1/n) :👇 Complete Thread

https://twitter.com/Aacle_/status/1588199064780537856?s=20&t=G9tW-LmTpkn9SteflrprpQ

File upload cheatsheet🌵

Download :
https://2003700811-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M5x1LJiRQvXWpt04_ee%2F-Mc98SRU_YMf-VQ6QyjW%2F-Mc98XubnHvMuxmO__Gd%2Fimage.png?alt=media&token=53e73826-afd2-4d89-aeeb-d7848266d9f1


#bugbounty #infosec #hacking

6 Bugbounty Tips 😀🤩 from @EdOverflow

#infosec #bugbountytip ☝🏻

secondary context fuzzing: 🌵#bugbounty #infosec
/..%2f
/..;/
/../
/..%00/
/..%0d/
/..%5c
/..\
/..%ff/
/%2e%2e%2f
/.%2e/
/%3f (?)
/%26 (&)
/%23 (#)

via https://samcurry.net/hacking-starbucks/

100 million😲 sbux accounts disclosure
see also: https://docs.google.com/presentation/d/1N9Ygrpg0Z-1GFDhLMiG3jJV6B_yGqBk8tuRWO1ZicV8

Guidance for beginners in bug bounty🌱🌵
by @LucianNitescu

Link:
https://drive.google.com/file/d/1CmhAL3XxHYfFMaRGaL7ooJ5gkQ_lg5XO/view

#bugbounty #infosec #hacking

Introducing 20 web-application hacking tools🔥🤩🌵

1. Burp Suite - Framework.

2. ZAP Proxy - Framework.

3. Dirsearch - HTTP bruteforcing.

4. Nmap - Port scanning.

5. Sublist3r - Subdomain discovery.

6. Amass - Subdomain discovery.

7. SQLmap - SQLi exploitation.

8. Metasploit - Framework.

9. WPscan - WordPress exploitation.

10. Nikto - Webserver scanning.

11. HTTPX - HTTP probing.

12. Nuclei - YAML based template scanning.

13. FFUF - HTTP probing.

14. Subfinder - Subdomain discovery.

15. Masscan - Mass IP and port scanner.

16. Lazy Recon - Subdomain discovery.

17. XSS Hunter - Blind XSS discovery.

18. Aquatone - HTTP based recon.

19. LinkFinder - Endpoint discovery through JS files.

20. JS-Scan - Endpoint discovery through JS files.


#bugbounty #bugbountytips #cybersecurity

8-hour-long BurpSuite Focused Course for FREE. 👇

Don't miss it.

Will expire soon

#bugbountytips
#bugbounty
#infosec
#Pentesting

https://www.udemy.com/course/bug-bounty-hunting-with-burp-suite/?couponCode=HACKITGUYS

Web Application Penetration Testing Checklist
by
@e11i0t_4lders0n


https://alike-lantern-72d.notion.site/Web-Application-Penetration-Testing-Checklist-4792d95add7d4ffd85dd50a5f50659c6


#bugbounty #infosec #hacking

How JWT WOrks & it's attack scenario😀☝🏻
by
@sec_r0
#bugbounty #infosec #hacking

Download :
https://securityzines.com/flyers/jwt.html

All about most common Http Response Headers 😀☝🏻
by
@sec_r0
#bugbounty #infosec #hacking

Download :
https://securityzines.com/flyers/httpres.html

Bug Bounty Tips 🌵

#bugbounty #bugbountytips #infosec

- If Render Page crash:
sudo sysctl -w kernel.unprivileged_userns_clone=1

- If embedded browser crash due sandbox:
find .BurpSuite -name chrome-sandbox -exec chown root:root {} \; -exec chmod 4755 {} \;

- Scope with all subdomains:
.*\.test\.com$

- Use Intruder to target specific parameters for scanning
- Right click: actively scan defined insertion points

# Configuration
- Project Options -> HTTP -> Redirections -> Enable JavaScript-driven
- User Options -> Misc -> Proxy Interception -> Always disabled
- Target -> Site Map -> Show all && Show only in-scope items

# XSS Validator extension
1) Start xss.js phantomjs $HOME/.BurpSuite/bapps/xss.js
2) Send Request to Intruder
3) Mark Position
4) Import xss-payload-list from $Tools into xssValidator
5) Change Payload Type to Extension Generated
6) Change Payload Process to Invoke-Burp Extension - XSS Validator
7) Add Grep-Match rule as per XSS Validator
8) Start.

# Filter the noise
https://gist.github.com/vsec7/d5518a432b70714bedad79e4963ff320

# Filter the noise TLDR
# TLS Pass Through
.*\.google\.com
.*\.gstatic\.com
.*\.googleapis\.com
.*\.pki\.goog
.*\.mozilla\.com

# Send swagger to burp
https://github.com/RhinoSecurityLabs/Swagger-EZ
# Hosted:
https://rhinosecuritylabs.github.io/Swagger-EZ/

# If some request/response breaks or slow down Burp
- Project options -> HTTP -> Streaming responses -> Add url and uncheck "Store streaming responses...."

# Burp Extension rotate IP yo avoid IP restrictions
https://github.com/RhinoSecurityLabs/IPRotate_Burp_Extension

# Collab/SSRF/pingback alternative
interactsh.com
ceye.io
requestcatcher.com
canarytokens.org
webhook.site
ngrok.com
pingb.in
swin.es
requestbin.net
ssrftest.com
rbnd.gl0.eu
dnslog.cn
beeceptor.com

# Run private collaborator instance in AWS
https://github.com/Leoid/AWSBurpCollaborator

# Run your own collab server
https://github.com/yeswehack/pwn-machine

# Wordlist from burp project file
cat project.burp | strings | tok | sort -u > custom_wordlist.txt

# Autorize:
1. Copy cookies from low priv user and paste in Autorize
2. Set filters (scope, regex)
3. Set Autorize ON
4. Navigate as high priv user

# Turbo Intruder
basic.py -> Set %s in the injection point and specify wordlist in script
multipleParameters.py -> Set %s in all the injection points and specify the wordlists in script

# Match and Replace
https://github.com/daffainfo/match-replace-burp

# Customize Audit Scans
Configure your audit profile -> Issues reported -> Individual issues -> right-click on "Extension generated issues" -> "Edit detection methods"
Works on most of issues like SQLi

# Send to local Burp from VPS
# In local computer
ssh -R 8080:127.0.0.1:8080 root@VPS_IP -f -N
# In VPS
curl URL -x http://127.0.0.1:8080

# Ip rotation
https://github.com/ustayready/fireprox

In short Basic Computer Networking - Notes
#bugbounty #infosec

Beginner should know in Infosec community

See : ☝🏻

Download From Here : https://pbs.twimg.com/media/FgKbobdWQAA4UiB?format=jpg&name=large

Most Common TCP/UDP Port in Networking
#bugbounty #networking #infosec

Download : https://miro.medium.com/max/720/1*jIxgQnfS9X2dVDNKTrzVJg.png

See : ☝🏻