Web Security | Bug hunting
@cybersecurityresources
7.41K
subscribers
46
photos
2
files
473
links
A web penetration testing / General cybersecurity / Network related topics channel that provides direct links for interesting resources and notes.
Download Telegram
Join
Web Security | Bug hunting
7.41K subscribers
Web Security | Bug hunting
http://www.kamilonurozkaleli.com/posts/starbucks-singapore-account-takeover/
Kamil Onur Özkaleli as ko2sec
6k$ Worth Account Takeover via IDOR in Starbucks Singapore
Recon While browsing Starbucks Singapore, I noticed a page loaded with content from a 3rd party site. Let’s call this site example.com in order not to disclose it. When I did some research on this site, I saw the same login page on card.starbucks.com.sg in…
Web Security | Bug hunting
https://medium.com/@ironfisto/easy-wins-verbose-error-worth-facebook-hof-7d8a99dd920b
Medium
Easy wins : verbose error worth Facebook HOF
Hi Info sec community
Web Security | Bug hunting
https://medium.com/@ricardoiramar/the-powerful-http-request-smuggling-af208fafa142
Medium
The Powerful HTTP Request Smuggling
💪
TL;DR: This is how I was able to exploit a HTTP Request Smuggling in a Mobile Device Management (MDM) servers and send any MDM command to…
Web Security | Bug hunting
https://samcurry.net/hacking-apple/
samcurry.net
We Hacked Apple for 3 Months: Here’s What We Found
Between the period of July 6th to October 6th myself, Brett Buerhaus, Ben Sadeghipour, Samuel Erb, and Tanner Barnes worked together and hacked on the Apple bug bounty program.
Web Security | Bug hunting
https://saadahmedx.medium.com/weaponizing-xss-for-fun-profit-a1414f3fcee9
Medium
Weaponizing XSS For Fun & Profit
Hi Folks! hope you all doing good so I am back with another amazing way of bypassing the WAF which is blocking me from weaponizing the XSS…
Web Security | Bug hunting
https://www.infosecmatter.com/bug-bounty-tips-8-oct-14/
InfosecMatter
Bug Bounty Tips #8 - InfosecMatter
Intercepting traffic on iOS13 in Burp Suite, Find SQL injections (command combo), Get scope of Bugcrowd programs in CLI, GraphQL notes for beginners, Chaining file uploads with other vulns, GitHub dorks for AWS, Jira, Okta .. secrets, Simple reflected XSS…
Web Security | Bug hunting
https://www.securifera.com/blog/2020/10/13/403-to-rce-in-xampp
Securifera
403 to RCE in XAMPP
403 to RCE in XAMPP
Some of the best advice I was ever given at how to become more successful at vulnerability discovery is to always try and dig a little deeper. Whether you are a penetration tester, red teamer, or bug bounty hunter, this advice has always…
Web Security | Bug hunting
https://www.youtube.com/watch?v=t37Xlp4qSaY
YouTube
NEW content discovery tools for FASTER bounty recon (Pentesting webapps)
Bounty Thursdays is an independent show covering whats going on in the Bug Bounty, web app penetration testing, appsec space, covering news, life & community.
Get all the links mentioned in this video by signing up to the newsletter over at https://stokfredrik.com…
Web Security | Bug hunting
https://medium.com/@sechunter/js-is-love-%EF%B8%8F-ca393a4849e9
Medium
JS is l0ve
❤️
.
$5K for Rest API Key.
Web Security | Bug hunting
https://praseudo.com/sensitive-info-leak-in-curve-app-bug-bounty/
Web Security | Bug hunting
https://twitter.com/m4ll0k2/status/1319783718249238535?s=19
Twitter
m4ll0k
How to access to company without being part of it with google oauth, with your gmail account.. [it only works if the company has a misconfiguration!] #bugbountytips #bugbounty
Web Security | Bug hunting
https://www.youtube.com/watch?v=dBTuWzX8hd0
YouTube
Stored XSS via CSRF in *.sony.co.in | Video POC | Bug Bounty
Status[+]:Duplicate
Web Security | Bug hunting
https://blog.redforce.io/sql-injection-in-insert-update-query-without-comma/
Redforce
Comma is forbidden! No worries!! Inject in insert/update queries without it
A writeup regarding exploiting SQL injection issue in an insert query while it wasn't possible to use a comma at my payload at all.
Web Security | Bug hunting
https://a-constant.medium.com/beyond-the-wall-command-injection-still-alive-577a898df0b5
Web Security | Bug hunting
https://medium.com/@roshancp/command-execution-preg-replace-php-function-exploit-62d6f746bda4?fbclid=IwAR2kmrdgfHXPnaI0-oLnS3VNIpHaH9oCC-Re8aXr7KV-nGsXo3qsR4Dbdf4
Medium
Command Execution - preg_replace() PHP Function Exploit | RCE
How preg_replace e works, How to exploit it and how to Prevent
Web Security | Bug hunting
https://www.youtube.com/watch?v=rm2ox3xmHFc&feature=youtu.be&fbclid=IwAR2WURTzv2H-GbcIRPqCH2DM52pa_N5k_snyJlJN3ZbIOhnuiF3hUEHCxBM
Web Security | Bug hunting
https://protector47.medium.com/bounty-1000-critical-business-logic-flaws-leads-to-account-takeover-product-amount-9b5715a84613
Web Security | Bug hunting
https://medium.com/techfenix/ssrf-server-side-request-forgery-worth-4913-my-highest-bounty-ever-7d733bb368cb
Medium
SSRF (Server Side Request Forgery) worth $4,913 | My Highest Bounty Ever !
Bug Bounty Write-Up
Web Security | Bug hunting
https://nechudav.blogspot.com/2020/11/31k-ssrf-in-google-cloud-monitoring.html?m=1
Blogspot
31k$ SSRF in Google Cloud Monitoring led to metadata exposure
Update 25.01.2021: Added Google engineers exploit method for getting access token. Google Cloud Monitoring (formerly called Stackdriver)...
Web Security | Bug hunting
https://www.bugbountyhunter.com/disclosed/
Bugbountyhunter
Publicly Disclosed HackerOne Bug Bounty Findings | BugBountyHunter.com
Browse public HackerOne bug bounty program statisitcs via vulnerability type. BugBountyHunter is a custom platform created by zseano designed to help you get involved in bug bounties and begin participating from the comfort of your own home.
Web Security | Bug hunting
https://twitter.com/infosec_au/status/1329939139832152064?s=19
Twitter
shubs
I've just added an API routes wordlist containing 953011 possible API paths from the HTTPArchive dataset. Download it at https://t.co/Y04dyFY5q1 - all paths which start with "/api/", "/v1/", "/v2", or "/rest/". Good luck hacking! Thanks for requesting this…
