Ethical Hacking Tutorials

BUG BOUNTY TIPS Tip #1 Use GIT as a recon tool. Find the target's GIT repositories, clone them, and then check the logs for information on the team not necessarily in the source code. Say the target is Reddit and I want to see which developers work on certain projects. Link : https://gist.github.com/EdOverflow/a9aad69a690d97a8da20cd4194ca6596 Tip #2 Look for GitLab instances on targets or belonging to the target. When you stumble across the GitLab login panel, navigate to /explore. Misconfigured instances do not require authentication to view the internal projects. Once you get in, use the search function to find passwords, keys, etc. This is a pretty big attack vector and I am finally revealing it today, because I am sure it will help a lot of you get some critical issues. Tip #3 Bug bounty tip: test applications of a company that costs money or requires manual setup. Chances are only few to none would have tested it leaving it vulnerable. Tip #4 If you’ve found an IDOR where you’re able to change data of others then don’t jump out of your seat to report it > modify it to XSS payload & if inputs are not sanitized & variables are echo’d without getting escaped then IDOR>XSS>ATO. Tip #5 Look for hackathon-related assets. What I mean by this is sometimes companies run hackathons and give attendees special access to certain API endpoints and/or temporary credentials. I have found GIT instances that were set up for Hackathons full of information that allowed me to find more issues in the target several times. Tip #6 Keep all your directory brute force results so when a CVE like Drupalgeddon2 comes out, you can look for previously found instances (cat dirsearch/reports// | grep INSTALL.mysql.txt | grep 200 | less)/ Tip #7 When you have a form, always try to change the request method from POST to GET in order to improve the CVSS score. For example, demonstrating a CSRF can be exploited simply by using [img] tag is better than having to send a link to the victim. Share ! #bugbounty

🔺A BUG HUNTER'S MINI GUIDE 🔺 (@ethicalhackx - @infoseczone) What Is Bug Bounty ? A bug bounty program, also called a vulnerability rewards program (VRP), is a crowdsourcing initiative that rewards individuals for discovering and reporting software bugs. How to get started / what to study ? https://medium.com/swlh/mastering-the-skills-of-bug-bounty-2201eb6a9f4 Resources To Learn : Course : Bug Hunting By Zaid Sabih (Udemy) Course : Bug Hunting with Burpsuite (Udemy) Course : Web Bug Bounty by NahamSec (Udemy) Course : Bug Bounty Course by Rohit Gautam v1 Course : Bug Bounty Course By Rohit Gautam v2 Ebook : Web Application Hacker's Handbook Ebook : The Bug Bounty Bootcamp Ebook : A Bug Hunter's Guide Ebook : Bug Hunting For web security Ebook : Real World Bug Hunting YouTube Channels : 1. Live Overflow 2. Hackersploit 3. Hackerone 4. Hak5 5. NahamSec 6. PratikDabhi 7. Bitten Tech (Hindi) Platforms providing Bug Bounty Programs 1. hackerone.com 2. bugcrowd.com 3. Synack.com 4. yogosha.com 5. yeswehack.com 6. Intigriti.com At Last, Learn to write better Vulnerability reports https://medium.com/swlh/how-to-write-a-better-vulnerability-report-20163ab913fb This list don't claim to be complete , suggestions are welcomed in comments. @infoseczone • @ethicalhackx

🔺A BUG HUNTER'S MINI GUIDE 🔺 (@ethicalhackx - @infoseczone) What Is Bug Bounty ? A bug bounty program, also called a vulnerability rewards program (VRP), is a crowdsourcing initiative that rewards individuals for discovering and reporting software bugs. How to get started / what to study ? https://medium.com/swlh/mastering-the-skills-of-bug-bounty-2201eb6a9f4 Resources To Learn : Course : Bug Hunting By Zaid Sabih (Udemy) Course : Bug Hunting with Burpsuite (Udemy) Course : Web Bug Bounty by NahamSec (Udemy) Course : Bug Bounty Course by Rohit Gautam v1 Course : Bug Bounty Course By Rohit Gautam v2 Ebook : Web Application Hacker's Handbook Ebook : The Bug Bounty Bootcamp Ebook : A Bug Hunter's Guide Ebook : Bug Hunting For web security Ebook : Real World Bug Hunting YouTube Channels : 1. Live Overflow 2. Hackersploit 3. Hackerone 4. Hak5 5. NahamSec 6. PratikDabhi 7. Bitten Tech (Hindi) Platforms providing Bug Bounty Programs 1. hackerone.com 2. bugcrowd.com 3. Synack.com 4. yogosha.com 5. yeswehack.com 6. Intigriti.com At Last, Learn to write better Vulnerability reports https://medium.com/swlh/how-to-write-a-better-vulnerability-report-20163ab913fb This list don't claim to be complete , suggestions are welcomed in comments. @infoseczone • @ethicalhackx

Where do Russian Hackers store their exploits? /ussr/bin/ @ethicalhackxcom for more

🔰 UPLOAD VULNERABILITIES - TRYHACKME writeup - In Deep @hacklido 🔗 https://hacklido.com/blog/163-upload-vulnerabilities-tryhackme-writeup ⚡️ By @illucist

Hello Guys, organizing a free Webinar : Related to How you can make a Successfull Career in CyberSecurity Interested participants can register: https://forms.gle/uGba5gBkrwUuGDBa6

API Security Testing:- Part 1:- https://t.co/VvUJu1Emnf Part 2:- https://t.co/hyBfcfOLzl https://t.co/fhdYdiUdZ0

The WhatsApp Question : Why Traceability matters ! https://faq.whatsapp.com/general/security-and-privacy/what-is-traceability-and-why-does-whatsapp-oppose-it/?lang=en

What is Unified Memory and how does it work on Apple Silicon? https://www.xda-developers.com/apple-silicon-unified-memory/

Hackers at @EthicalHackXCom

<pre><font color="#5EBDAB">┌──(</font><font color="#277FFF"><b>abhinav㉿ETHICALHACKX</b></font><font color="#5EBDAB">)-[</font><b>~</b><font color="#5EBDAB">]</font> <font color="#5EBDAB">└─</font><font color="#277FFF"><b>$</b></font> <font color="#5EBDAB">grep</font> VERSION <u style="text-decoration-style:single">/etc/os-release</u> <font color="#EC0101"><b>VERSION</b></font>=&quot;2021.2&quot; <font color="#EC0101"><b>VERSION</b></font>_ID=&quot;2021.2&quot; <font color="#EC0101"><b>VERSION</b></font>_CODENAME=&quot;kali-rolling&quot; <font color="#5EBDAB">┌──(</font><font color="#277FFF"><b>abhinav㉿ETHICALHACKX</b></font><font color="#5EBDAB">)-[</font><b>~</b><font color="#5EBDAB">]</font> <font color="#5EBDAB">└─</font><font color="#277FFF"><b>$</b></font> <font color="#5EBDAB">uname</font> <font color="#9755B3">-v</font> #1 SMP Debian 5.10.28-1kali1 (2021-04-12) <font color="#5EBDAB">┌──(</font><font color="#277FFF"><b>abhinav㉿ETHICALHACKX</b></font><font color="#5EBDAB">)-[</font><b>~</b><font color="#5EBDAB">]</font> <font color="#5EBDAB">└─</font><font color="#277FFF"><b>$</b></font> <font color="#5EBDAB">uname</font> <font color="#9755B3">-r</font> 5.10.0-kali7-amd64 <font color="#5EBDAB">┌──(</font><font color="#277FFF"><b>abhinav㉿ETHICALHACKX</b></font><font color="#5EBDAB">)-[</font><b>~</b><font color="#5EBDAB">]</font> <font color="#5EBDAB">└─</font><font color="#277FFF"><b>$</b></font> </pre>

hmmm Interesting , folks at @EthicalHackXCom , time to run sudo apt-get update && apt-get full-upgrade https://www.kali.org/blog/kali-linux-2021-2-release/

Join Hacking Discussions at @EthicalHackXCom . We are now 20k+ aspiring Hackers on channel @EthicalHackX

Proudly helping 20000+ Aspiring Hackers @EthicalHackX channel. Thanks all for being here.

🔰 Hacklido's Practice tests grounds are up finally! 1) Login using Google Oauth 2) Confirm your email from your inbox 3) Enjoy the feature 🔗 https://practise.hacklido.com/ Use Desktop for better experience and response