API Penetration Testing Series - Part 6

Common API Vulnerabilities

Covered - Info Disclosure, BOLA, Broken Authentication, Excessive Data Exposure, BFLA, Mass Assignment, Security Misconfig, Injection and etc

My Notion Notes 🔗 : https://aacle.notion.site/Common-API-Vulnerabilities-cc18fc96ec99458aacbead44f4b4b384?pvs=4

Ultimate 401 and 403 bypass methods

🌴🌱🍃🍂

https://www.vidocsecurity.com/blog/401-and-403-bypass-how-to-do-it-right/

Amazing List of All DAMN Vulnerable Labs Wher you can improve your Pentesting Skills

Categorized for different different cybersec fields

Check This out : https://twseptian.github.io/penetration%20testing/pentest/Vulnerable-Resource/

Sticky notes for pen-testing, bug bounty, and CTFs.

https://exploit-notes.hdks.org

If you want to learn about Machine Learning and Artificial Intelligence you can check this account on thread.

To find information disclosure vulnerabilities change the headers

- Change the Accept header to:

- Also trying sending null byte like

GET /%00

If error handling is not done properly, reveals server version information, stack and route information

#bugbounty #bugbountytip

Tips for finding hardcoded credentials

Whenever you are searching for hardcoded credentails, don't forget to read "jquery.js" files as well. Sometime you might find 3rd party hardcoded credentials

#bugbountytips #hacking #infosec

My new video is now available on Rabkimusc:

https://youtu.be/ASSzCKvA4p0 Go watch, like, comment, subscribe, and share as much as you can.

Show your support, guy's.

साधु जी सीता राम

I requested to All hindus to please Listen & share this Song with your contacts

Bug Bounty Tip ☘️

https://web.archive.org/cdx/search/cdx?url=target.com&matchType=domain&fl=original&collapse=urlkey

Change url Para. Value : url=target.com -> Help you to extract lots of interesting Endpoints, Imformation Disclosure, API Keys and many more about that Target from wayback archive

CSP-bypass techniques ☘️

https://bhavesh-thakur.medium.com/content-security-policy-csp-bypass-techniques-e3fa475bfe5d

#bugbounty #bugbountytips

A strategy to land your first pentest job 🌴

https://blog.pentesterlab.com/a-strategy-to-land-your-first-pentest-job-25209a351689

Hurricane Electric operates its own global IPv4 and IPv6 network and is considered the largest IPv6 backbone in the world as measured by number of networks connected, its give a fresh domain records, more real data! 😃

Expose domains over Akamai or Cloudflare with HEDnsExtractor and httpx(
@pdiscoveryio
):

Github:https://github.com/teixeira0xfffff/HEDnsExtractor/

[+] python hednsextractor[.py "https://bgp[.he.net/net/23.192.0.0/11#_dns" | httpx -title -tech-detect -status-code | grep -i "rockstar"

Reference : https://twitter.com/ptyspawnbinbash/status/1683378527888896002?s=20

Amazing Roadmap To Become Best Security Researcher 🔥

https://securityflow.io/roadmap/

200+books on info sec and cybersecurity. Feel free to download any and read. LINK: https://drive.google.com/drive/u/0/folders/12Mvq6kE2HJDwN2CZhEGWizyWt87YunkU