Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Looking for some web advice
Hi!
I'm looking for a little advice regarding a site I'm trying to develop, I need to find a creative workaround for something regarding HTTP requests, iframes, and captcha.
Would love to sit and brainstorm on discord, hmu if it sounds fun :)
submitted by /u/GarlicBreadIsNice
[link] [comments]
Looking for some web advice
Hi!
I'm looking for a little advice regarding a site I'm trying to develop, I need to find a creative workaround for something regarding HTTP requests, iframes, and captcha.
Would love to sit and brainstorm on discord, hmu if it sounds fun :)
submitted by /u/GarlicBreadIsNice
[link] [comments]
reddit
Looking for some web advice
Hi! I'm looking for a little advice regarding a site I'm trying to develop, I need to find a creative workaround for something regarding HTTP...
Story about more than 3.5 million PII leakage in Yahoo!!!
https://dhakalbibek.medium.com/story-about-more-than-3-5-million-pii-leakage-in-yahoo-78f98bf69b49?source=rss------bug_bounty-5
https://dhakalbibek.medium.com/story-about-more-than-3-5-million-pii-leakage-in-yahoo-78f98bf69b49?source=rss------bug_bounty-5
Hello GUYS,Continue reading on Medium » (https://dhakalbibek.medium.com/story-about-more-than-3-5-million-pii-leakage-in-yahoo-78f98bf69b49?source=rss------bug_bounty-5)
Hacking on Medium
Nuevo error de Linux en el módulo de firewall de Netfilter permite a los atacantes obtener acceso…
https://cdn-images-1.medium.com/max/849/0*ggnAjCvamzrDcZuZ
PUBLICADO EN 14 MARZO, 2022POR EHACKING
Continue reading on Medium »
Nuevo error de Linux en el módulo de firewall de Netfilter permite a los atacantes obtener acceso…
https://cdn-images-1.medium.com/max/849/0*ggnAjCvamzrDcZuZ
PUBLICADO EN 14 MARZO, 2022POR EHACKING
Continue reading on Medium »
Medium
Nuevo error de Linux en el módulo de firewall de Netfilter permite a los atacantes obtener acceso a la raíz
PUBLICADO EN 14 MARZO, 2022POR EHACKING
Hacking on Medium
Cryptocurrency Exchange Hacks: how to secure customers from stealing their funds
https://cdn-images-1.medium.com/max/1200/1*V5IhJl0ogDmF8Rv_WYHQTw.png
With growing popularity and mass adoption of crypto assets, the amount of funds flowing to centralized exchanges have been increasing as…
Continue reading on Medium »
Cryptocurrency Exchange Hacks: how to secure customers from stealing their funds
https://cdn-images-1.medium.com/max/1200/1*V5IhJl0ogDmF8Rv_WYHQTw.png
With growing popularity and mass adoption of crypto assets, the amount of funds flowing to centralized exchanges have been increasing as…
Continue reading on Medium »
Medium
Cryptocurrency Exchange Hacks: how to secure customers from stealing their funds
With growing popularity and mass adoption of crypto assets, the amount of funds flowing to centralized exchanges have been increasing as…
Open Redirect via Sendgrid Email Misconfiguration
Hello developer , bug hunter and cyber security enthusiast. In this opportunity i wanna show you my first Bug Bounty writeup from one of a…Continue reading on System Weakness »
Read more...
Hello developer , bug hunter and cyber security enthusiast. In this opportunity i wanna show you my first Bug Bounty writeup from one of a…Continue reading on System Weakness »
Read more...
The story of 3 bugs that lead to Unauthorized RCE — Pascom Systems
A detailed post on how I chained 3 vulnerabilities (A path traversal, An SSRF in an external piece of software, and a post-authentication…Continue reading on Medium »
Read more...
A detailed post on how I chained 3 vulnerabilities (A path traversal, An SSRF in an external piece of software, and a post-authentication…Continue reading on Medium »
Read more...
Solution to my $20 egg hunt (Part 1)
Last week, I posted an article titled “There’s $20 hidden in this post”. Here’s how to solve the first part of it…Continue reading on Medium »
Read more...
Last week, I posted an article titled “There’s $20 hidden in this post”. Here’s how to solve the first part of it…Continue reading on Medium »
Read more...
How I access other domains in infinityfree.net using Directory Traversal
Hi, it’s me again haha Kurt Russelle Marmol aka xkurtph, Web Developer (noobie) and Security Researcher.Continue reading on Medium »
Read more...
Hi, it’s me again haha Kurt Russelle Marmol aka xkurtph, Web Developer (noobie) and Security Researcher.Continue reading on Medium »
Read more...
From Recon via Censys and DNSdumpster, to Getting P1 by Login Using Weak Password — “password”
A simple story when Allah allowed me to get P1 by combining several issues, one of which was related to “weak credentials”.Continue reading on InfoSec Write-ups »
Read more...
A simple story when Allah allowed me to get P1 by combining several issues, one of which was related to “weak credentials”.Continue reading on InfoSec Write-ups »
Read more...
My Pentest Log -10- (A Little Tip)
Greetings to all from Khrysokeras,Continue reading on Medium »
Read more...
Greetings to all from Khrysokeras,Continue reading on Medium »
Read more...
How I Made The BBC Hall Of Fame 3 Times
Happy Monday to anyone reading this write up. Today I am going to describe how I was able to make the BBC Hall Of Fame 3 times. My…Continue reading on Medium »
Read more...
Happy Monday to anyone reading this write up. Today I am going to describe how I was able to make the BBC Hall Of Fame 3 times. My…Continue reading on Medium »
Read more...
Story about more than 3.5 million PII leakage in Yahoo!!!
Hello GUYS,Continue reading on Medium »
Read more...
Hello GUYS,Continue reading on Medium »
Read more...
SQL Injection at Spotify.Continue reading on Medium » (https://eslam3kl.medium.com/sql-injection-at-spotify-d19e0861ddf0?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
A Detailed Guide on httpx
Introductionhttpx is a fast web application reconnaissance tool coded in go by www.projectidscovery.io. With a plethora of multiple modules effective in manipulating HTTP requests and filtering out responses, it is proving to be an effective tool in Bug Bounty Hunter’s arsenal. While tools like curl already exist that can perform almost all the features covered in this tool, httpx has its own place among the analysts because of its speed and ease of access. You can download the source code from here. Table of content* Installation of go version 1.17
* Installation of httpx
* Basic usage
* Subdomain enum using subfinder and scanac
* Content probes
* Content comparers
* Content filters
* Rates and timeouts
* Show responses and requests
* Filtering for SQL injections
* Filtering for XSS reflections
* Web page fuzzing
* File output
* TCP/IP customizations
* Post login
* HTTP methods probe
* Routing through proxy
* Conclusion Installation of go version 1.17Installation and proper running of httpx tool depends on go version 1.17. You can download, extract, add go in environment variables as follows. I am using Kali on amd64 architecture. Please feel free to download the appropriate package for your system on go.dev/dl
wget https://go.dev/dl/go1.17.8.linux-amd64.tar.gz
tar -C /usr/local/ -xzf go1.17.8.linux-amd64.tar.gz
Please make sure that you add the following lines in ~/.zshrc file:
#go variables
export GOPATH=/root/go-workspace
export GOROOT=/usr/local/go
PATH=$PATH:$GOROOT/bin/:$GOPATH/bin
After you have added the lines, zshrc file can be loaded with the source command and then we’ll be ready to go. If all goes well, the “go version” command will give version 1.17.8 as output.
source ~/.zshrc
go version
https://blogger.googleusercontent.com/img/a/AVvXsEg9AlSPddp5OUP_eU8i-3YbkJlkZJQELrrftSGwMmXT5lYo3-YZMV3QCLPK8BG1PH6c3p6IKS-ra1HACHLrGFwdx56x2fCsJR6xbQzMQankB_t01kYJ7ZQLFGl5aBZWZ-dnDBQzF5Uw_2m37KQ62BmKRR8ZWVWOmq5nMQ0PiXeNjBUJ9BMrMiDMiblRfg=s16000 Installation of httpxInstallation of the tool is also possible by cloning the github repository and using a makefile to compile but we have an easier alternative. We can use go install to do the same like:
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
https://blogger.googleusercontent.com/img/a/AVvXsEjxO12ZcCBpqMjShSZDpioqub4yeqXqeR6x1ecum7XOuXIsn4DX8DUM1PuFaOcO5DdM20TYt9I5LHkMAJqXbDyV3aDvj5d3wROMhdAYMjRlDtnT8VNQpaSznN7AFHdq-Q-rrRQi53ElM0B1xFL6Jap_wwA_H3Zmz_AZVCkHYT4AyWrhs3RYul_Y25CsHw=s16000
Once done, you can now run the tool. Help menu can be popped up to check the installation success
httpx --help
https://blogger.googleusercontent.com/img/a/AVvXsEgQLt7Z5uf7fSqnkq2bX7Pp0sE8QNdVxj-uyi_ZHLji4PyrwM1LzY7c6aVhGQbH3C7ZZJo4hrJxKXr5C-lwlULWSsJ6dDZyjKFLhmyI5MEtZ8BmiGkIuwtp2F0-_JwJh6A6mJcGUlYPI85CNwPvfV4fGe9BFME4N2gTMS5oaRWNn6p1w-a1HdkPg6pWmA=s16000 Basic UsageHttpx tool accepts STDIN input for scanning. Here, we run a blank scan that only hits the server and does nothing and then the same scan with some basic options.
-title: displays the title of the webpage
-status-code: displays the response code. 200 being valid or OK status while 404 being the code for not found
-tech-detect: detects technology running behind the webpage
-follow-redirects: Enables following redirects and scans the following page too
echo "http://testphp.vulnweb.com" | httpx
echo "http://testphp.vulnweb.com" | httpx -title -status-code -tech-detect -follow-redirects
https://blogger.googleusercontent.com/img/a/AVvXsEg75NMZ3dVd_eJ8SGIUvdw9JiHUZUm9IGz5xyH7owm4SDgMqiHocUXSqxL7Ph3fltfSYKxxb9Izqv_2m65W085tcXWZKrysSRJiDuBusKUKUzCQJABsBJSUEu54wnhneq0HHEQJLx2qZV_UEwgwlLd96Mj8DfRL16871RQwqeMkIiAxt3_sbL8xB-OqYw=s16000
The same can be run on a list of websites that can be fed to the tool [...]
A Detailed Guide on httpx
Introductionhttpx is a fast web application reconnaissance tool coded in go by www.projectidscovery.io. With a plethora of multiple modules effective in manipulating HTTP requests and filtering out responses, it is proving to be an effective tool in Bug Bounty Hunter’s arsenal. While tools like curl already exist that can perform almost all the features covered in this tool, httpx has its own place among the analysts because of its speed and ease of access. You can download the source code from here. Table of content* Installation of go version 1.17
* Installation of httpx
* Basic usage
* Subdomain enum using subfinder and scanac
* Content probes
* Content comparers
* Content filters
* Rates and timeouts
* Show responses and requests
* Filtering for SQL injections
* Filtering for XSS reflections
* Web page fuzzing
* File output
* TCP/IP customizations
* Post login
* HTTP methods probe
* Routing through proxy
* Conclusion Installation of go version 1.17Installation and proper running of httpx tool depends on go version 1.17. You can download, extract, add go in environment variables as follows. I am using Kali on amd64 architecture. Please feel free to download the appropriate package for your system on go.dev/dl
wget https://go.dev/dl/go1.17.8.linux-amd64.tar.gz
tar -C /usr/local/ -xzf go1.17.8.linux-amd64.tar.gz
Please make sure that you add the following lines in ~/.zshrc file:
#go variables
export GOPATH=/root/go-workspace
export GOROOT=/usr/local/go
PATH=$PATH:$GOROOT/bin/:$GOPATH/bin
After you have added the lines, zshrc file can be loaded with the source command and then we’ll be ready to go. If all goes well, the “go version” command will give version 1.17.8 as output.
source ~/.zshrc
go version
https://blogger.googleusercontent.com/img/a/AVvXsEg9AlSPddp5OUP_eU8i-3YbkJlkZJQELrrftSGwMmXT5lYo3-YZMV3QCLPK8BG1PH6c3p6IKS-ra1HACHLrGFwdx56x2fCsJR6xbQzMQankB_t01kYJ7ZQLFGl5aBZWZ-dnDBQzF5Uw_2m37KQ62BmKRR8ZWVWOmq5nMQ0PiXeNjBUJ9BMrMiDMiblRfg=s16000 Installation of httpxInstallation of the tool is also possible by cloning the github repository and using a makefile to compile but we have an easier alternative. We can use go install to do the same like:
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
https://blogger.googleusercontent.com/img/a/AVvXsEjxO12ZcCBpqMjShSZDpioqub4yeqXqeR6x1ecum7XOuXIsn4DX8DUM1PuFaOcO5DdM20TYt9I5LHkMAJqXbDyV3aDvj5d3wROMhdAYMjRlDtnT8VNQpaSznN7AFHdq-Q-rrRQi53ElM0B1xFL6Jap_wwA_H3Zmz_AZVCkHYT4AyWrhs3RYul_Y25CsHw=s16000
Once done, you can now run the tool. Help menu can be popped up to check the installation success
httpx --help
https://blogger.googleusercontent.com/img/a/AVvXsEgQLt7Z5uf7fSqnkq2bX7Pp0sE8QNdVxj-uyi_ZHLji4PyrwM1LzY7c6aVhGQbH3C7ZZJo4hrJxKXr5C-lwlULWSsJ6dDZyjKFLhmyI5MEtZ8BmiGkIuwtp2F0-_JwJh6A6mJcGUlYPI85CNwPvfV4fGe9BFME4N2gTMS5oaRWNn6p1w-a1HdkPg6pWmA=s16000 Basic UsageHttpx tool accepts STDIN input for scanning. Here, we run a blank scan that only hits the server and does nothing and then the same scan with some basic options.
-title: displays the title of the webpage
-status-code: displays the response code. 200 being valid or OK status while 404 being the code for not found
-tech-detect: detects technology running behind the webpage
-follow-redirects: Enables following redirects and scans the following page too
echo "http://testphp.vulnweb.com" | httpx
echo "http://testphp.vulnweb.com" | httpx -title -status-code -tech-detect -follow-redirects
https://blogger.googleusercontent.com/img/a/AVvXsEg75NMZ3dVd_eJ8SGIUvdw9JiHUZUm9IGz5xyH7owm4SDgMqiHocUXSqxL7Ph3fltfSYKxxb9Izqv_2m65W085tcXWZKrysSRJiDuBusKUKUzCQJABsBJSUEu54wnhneq0HHEQJLx2qZV_UEwgwlLd96Mj8DfRL16871RQwqeMkIiAxt3_sbL8xB-OqYw=s16000
The same can be run on a list of websites that can be fed to the tool [...]