Escalating SSRF to RCE in AWS Elastic Beanstalk

Bounty Thursdays is an independent show covering whats going on in the Bug Bounty space, covering news, life & community.

-------------- -- --
This episode is sponsored by:

INTIGRITI - Ethical hacking and managed bug bounty platform
https://go.intigriti.com/stok…

GF Paterns For (ssrf,RCE,Lfi,sqli,ssti,idor,url redirection,debug_logic, interesting Subs) parameters grep - 1ndianl33t/Gf-Patterns

Hacker can steal leaked API keys, passwords, and customer data from GitHub to login to servers, steal personal information, and rack up absurd AWS charges. This article explains shows common types of secrets that users post and how to find them.

~ Broken Link Checker subfinder -d target > subs.txt ; cat subs.txt | httprobe | tee http.txt ; cat http.txt | waybackurls | egrep -iv ".(jpg|gif|css|png|woff|pdf|svg|js)" | tee wdata.txt ; cat wdata.txt | burl | tee brokenlink.txt https://t.co/D2p3OtylOZ…

Hey Whatsup! This is Satyendra an Infosec noob, I hope you are doing well. I’m presenting here my little research on Unrestricted file…

Bypass rate limit to account takeover 1. Server limited brute force OTP by ip. 2. Install & config ip rotate(burp suite extender). 3. Send password reset code. 4. Brute force OTP with intruder. 5. Change password. #bugbountytip #bugbountytips

Updated list of 104 hacking tools and resources for security researchers, covering web proxies, recon, API testing, mobile, cloud, and more.

How did I found SSRF in Facebook — the story of my first bug bounty

When you are fuzzing API Endpoints worth you add XMLHttpRequest headers, some frameworks filter requests that don't was called by Frontend Applications. - "X-requested-with: XMLHttpRequest" * Found in some PHP frameworks. #BugBounty #BugBountyTips #Pentesting

Of late, I see a lot of newbie bug hunters and security enthusiasts joining Infosec twitter and it pains to see their failure stories in…

You need many accounts during the bug bounty or whatever, this tool is for you. Get shared credentials with https://t.co/ejRFKore1T https://t.co/vTIAO4nCcx @HusseiN98D @stokfredrik @Mik317_ #bugbounty #bugbountytips #bugbountytip

Hello everyone its been a long time I haven’t published any blog because I was busy in making a blog on my recon technique. I hope you…

Cross-Site Request Forgery (CSRF) is hardly seen with new frameworks but is yet exploitable like old beautiful days. CSRF, a long story…