Bug Bounty Tools & Writeups | Hide Club
Open in Telegram
π» Welcome to HideClub! π Bug Bounty tools & tips π Vulnerability exploits π» Web App Security π Hunting insights & Write-up analysis
Show moreNo data
Subscribers
+4724 hours
+2837 days
+73530 days
Data loading in progress...
Similar Channels
Tags Cloud
Incoming and Outgoing Mentions
---
---
---
---
---
---
Attracting Subscribers
November '25
November '25
+428
in 4 channels
October '25
+370
in 1 channels
Get PRO
September '25
+199
in 5 channels
Get PRO
August '25
+214
in 4 channels
Get PRO
July '25
+414
in 9 channels
Get PRO
June '25
+109
in 3 channels
Get PRO
May '25
+166
in 6 channels
Get PRO
April '25
+203
in 9 channels
Get PRO
March '25
+176
in 8 channels
Get PRO
February '25
+408
in 8 channels
Get PRO
January '25
+783
in 19 channels
Get PRO
December '24
+959
in 10 channels
Get PRO
November '24
+2 970
in 16 channels
Get PRO
October '24
+1 859
in 8 channels
Get PRO
September '24
+1 290
in 15 channels
Get PRO
August '24
+1 095
in 13 channels
Get PRO
July '24
+630
in 13 channels
Get PRO
June '24
+124
in 2 channels
Get PRO
May '24
+319
in 9 channels
Get PRO
April '24
+361
in 9 channels
Get PRO
March '24
+518
in 10 channels
Get PRO
February '24
+490
in 6 channels
Get PRO
January '24
+473
in 6 channels
Get PRO
December '23
+204
in 4 channels
Get PRO
November '23
+95
in 0 channels
Get PRO
October '23
+120
in 1 channels
Get PRO
September '23
+84
in 0 channels
Get PRO
August '23
+39
in 0 channels
Get PRO
July '23
+40
in 0 channels
Get PRO
June '23
+29
in 0 channels
Get PRO
May '23
+24
in 0 channels
Get PRO
April '23
+24
in 0 channels
Get PRO
March '23
+77
in 0 channels
Get PRO
February '23
+162
in 0 channels
Get PRO
January '23
+156
in 0 channels
Get PRO
December '22
+65
in 0 channels
Get PRO
November '22
+116
in 0 channels
Get PRO
October '22
+145
in 0 channels
Get PRO
September '22
+132
in 0 channels
Get PRO
August '22
+17
in 0 channels
Get PRO
July '22
+20
in 0 channels
Get PRO
June '22
+20
in 0 channels
Get PRO
May '22
+53
in 0 channels
Get PRO
April '22
+139
in 0 channels
Get PRO
March '22
+21
in 0 channels
Get PRO
February '22
+15
in 0 channels
Get PRO
January '22
+46
in 0 channels
Get PRO
December '21
+152
in 0 channels
Get PRO
November '21
+131
in 0 channels
Get PRO
October '21
+58
in 0 channels
Get PRO
September '21
+60
in 0 channels
Get PRO
August '21
+43
in 0 channels
Get PRO
July '21
+83
in 0 channels
Get PRO
June '21
+755
in 0 channels
| Date | Subscriber Growth | Mentions | Channels | |
| 13 November | 0 | |||
| 12 November | +47 | |||
| 11 November | +21 | |||
| 10 November | +42 | |||
| 09 November | +47 | |||
| 08 November | +36 | |||
| 07 November | +26 | |||
| 06 November | +64 | |||
| 05 November | +36 | |||
| 04 November | +29 | |||
| 03 November | +17 | |||
| 02 November | +41 | |||
| 01 November | +22 |
Channel Posts
I've created the Nuclei-Community-Templates repo to collect and share useful Nuclei templates with the community. Feel free to add your own if you've created one or know of any good templates. It's open to pull requests I will review and add them. Good luck!
β’ Repository: https://github.com/Spix0r/Nuclei-Community-Templates
#infosec #cybersecurity #Hacking #bugbounty #Nuclei
β― Share & Support Us
β― Channel : @Hide_Club
| 2 |  +1β³ A Comprehensive Guide on Modern iOS Pentesting
A collection of awesome tools, books, courses, blog posts, and cool stuff about iOS Application Security and Penetration Testing
β’ Github: Link
Modern iOS Pentesting: No Jailbreak Needed
β’ Blog: Link
#infosec #cybersecurity #Hacking #bugbounty #ios
β― Share & Support Us
β― Channel : @Hide_Club | 1 513 |
| 3 |  β³ Bypassing The Cloudflare mTLS Protection
#Cloudflare has started blocking proxy tools like Burp Suite. If you encounter this error, download the Bypass Bot Detection extension from the BApp Store in Burp Suite. It should resolve the issue for Burp Suite.
β’ Extension: Github
#infosec #cybersecurity #WAF #Hacking #bugbounty #bugbountyTools #bugbountyTips
β― Share & Support Us
β― Channel : @Hide_Club | 2 382 |
| 4 |  β³ Hacking AI-Powered Tools With Old School Vulnerabilities
If you want to learn how to hack AI-powered apps, this research is a brilliant resource. These are the slides from the Black Hat USA presentation Hack To The Future: Owning AI-Powered Tools With Old School Vulns. During the research, the researchers identified vulnerabilities in AI-powered developer productivity tools. These tools extend far beyond AI coding assistants.
β’ Research: Download
#infosec #cybersecurity #bugbountyTools #Hacking #bugbounty #AI
β― Share & Support Us
β― Channel : @Hide_Club | 2 582 |
| 5 | β³ Bypassing CDN WAFs With Alternate Domain Routing
I will provide a summary, and please read the full blog post to learn the concept. This technique is inspired by the idea in this tweet.
β’ How this attack works?
Imagine that the #CDN acts as a trusted proxy between you and the target web server (the "origin"). In this setup the origin server trusts requests coming from the CDNβs IP range, so it only accepts traffic that appears to come from the CDN. If you (the attacker) want to talk to the origin, you must route your request through the CDN. The CDN receives your request, filters and checks it (to ensure it isnβt flagged as malicious), then forwards it to the origin server.
Now imagine a scenario where youβve found the originβs IP, but direct communication wonβt work, because the origin expects only requests coming from the CDNβs IP range. However, if you register an account with the same CDN provider, turn off the WAF in your account, and point your CDN configuration at that origin IP, then you can send requests via the CDN to the origin (WAF IS OFF!). Since the origin sees that the request appears to come from the CDN, it will accept it!
β’ Tools for deploying the infrastructure and scanning for affected origins:
cdn-proxy & cdn-scanner: Github
#infosec #cybersecurity #bugbountyTools #Hacking #bugbounty #WAF
β― Share & Support Us
β― Channel : @Hide_Club | 2 950 |
| 6 | I'm struggling to find the origin IP behind the CDN, but I can't. I found some unique methods which I'll share in 2 days, but first I want to ask you guys: what is your methodology to find the origin IP behind the CDN? | 2 755 |
| 7 |  β³ Deep dive into Android Pentesting basics
Covered everything from static & dynamic analysis, Frida, Drozer, SSL pinning bypass, deep links, broadcast receivers, and more
If you're into mobile security, this one's packed with real-world scenarios & tools
β’ Notion: Link
#infosec #cybersecurity #Hacking #bugbounty #Android
β― Share & Support Us
β― Channel : @Hide_Club | 5 624 |
| 8 |  +1β³ CVE-2025-55752 - Exploit PoC for Apache Tomcat Rewrite Valve Relative Path Traversal, no RCE (for now)
#Pruva tried to fake it playing with the rewrite, relaxing it a lot, but after some pass was able to reproduce.
β’ Exploit: Github
#infosec #cybersecurity #CVE #Hacking #bugbounty #Apache
β― Share & Support Us
β― Channel : @Hide_Club | 3 462 |
| 9 | +2 β³ I often encounter Google Tag Managers on websites while hunting and usually just ignore them. Today I saw this on X:
Two Google Tag Managers were found opening a WebSocket to the known #Magecart domain jquery.net.
β’ GTM-T89D4THJ
β’ GTM-K9KWWGX4 (formerly used by gstatlc.org)
Found on dozens of e-commerce websites worldwide. A Magecart attack on a Brazilian ecommerce website sends stolen payment data to a Discord channel :)))
#WebSkimming #FormJacking #PCIDSS #Hacking #cybersecurity #infosec
β― Share & Support Us
β― Channel : @Hide_Club | 3 680 |
| 10 | Daily Bug Bounty Write-Ups:
@Daily_Writeups
Group:
@Cybersecurity_Forum | 1 131 |
| 11 | β³ Frida Detection Bypass - Custom Codes Like Above
Bypassing First Checker Function
private static boolean checkForFridaFiles() {
String[] strArr = {"/data/local/tmp/frida-server", "/data/local/tmp/frida", "/data/local/tmp/re.frida.server"};
β’ It's kinda easy, just rename the Frida server file to another name, like: fsrv
Bypassing Second Checker Function
private static boolean checkForFridaPorts() {
int[] iArr = {27042, 27043};
β’ It's checking the ports that Frida runs on by default, which are 27042 and 27043. Simply, you should change the ports to something different:
adb forward tcp:27044 tcp:27042
adb forward tcp:27045 tcp:27043
# Please note that you should specify the port and use the -H option instead of -U (example)
frida -H 127.0.0.1:27044 -f (process name) -l anti-detection.js
Bypassing Third Checker Function
β’ It's kinda tricky because you'll see different codes in different targets. I can't send a code that bypasses all checker functions, but you can use the following code to get an idea and create your own target-specific bypasser code:
Java.perform(function() {
// Hook the file detection method
var fridaDetection = Java.use('PROCESSNAME.FridaDetection');
//This line finds and loads the FridaDetection class from the appβs code (the full class path is processname.path.FridaDetection).
//Java.use() gives access to the app's Java classes and methods, allowing you to modify or intercept them.
fridaDetection.checkForFridaFiles.implementation = function() {
console.log("Bypassed Frida file detection");
return false; // Always return false to bypass the check
};
// Hook the port detection method
fridaDetection.checkForFridaPorts.implementation = function() {
console.log("Bypassed Frida port detection");
return false; // Always return false to bypass the check
};
// Hook the process detection method
fridaDetection.checkForFridaServerProcesses.implementation = function() {
console.log("Bypassed Frida process detection");
return false; // Always return false to bypass the check
};
});
#infosec #cybersecurity #bugbountyTools #Hacking #bugbounty #Frida
β― Share & Support Us
β― Channel : @Hide_Club | 3 460 |
| 12 | β³ Example of Anti Frida Mechanism Code
public class FridaDetection {
private static final String TAG = "FridaDetection";
private static boolean checkForFridaFiles() {
String[] strArr = {"/data/local/tmp/frida-server", "/data/local/tmp/frida", "/data/local/tmp/re.frida.server"};
for (int i2 = 0; i2 < 3; i2++) {
String str = strArr[i2];
if (new File(str).exists()) {
StringBuilder sb = new StringBuilder();
sb.append("Frida file detected: ");
sb.append(str);
return true;
}
}
return false;
}
private static boolean checkForFridaPorts() {
int[] iArr = {27042, 27043};
try {
BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(Runtime.getRuntime().exec("netstat -an").getInputStream()));
while (true) {
String readLine = bufferedReader.readLine();
if (readLine == null) {
break;
}
for (int i2 = 0; i2 < 2; i2++) {
int i3 = iArr[i2];
if (readLine.contains(String.valueOf(i3))) {
StringBuilder sb = new StringBuilder();
sb.append("Frida port detected: ");
sb.append(i3);
return true;
}
}
}
} catch (IOException e2) {
Log.e(TAG, "Error checking for Frida ports", e2);
}
return false;
}
private static boolean checkForFridaServerProcesses() {
String readLine;
String[] strArr = {"frida-server", "frida"};
int i2 = 0;
while (i2 < 2) {
String str = strArr[i2];
try {
BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(Runtime.getRuntime().exec("ps").getInputStream()));
do {
readLine = bufferedReader.readLine();
if (readLine != null) {
}
} while (!readLine.contains(str));
StringBuilder sb = new StringBuilder();
sb.append("Frida process detected: ");
sb.append(str);
return true;
} catch (IOException e2) {
Log.e(TAG, "Error checking for Frida server processes", e2);
}
}
return false;
i2++;
}
public static void detectFrida() {
if (!checkForFridaServerProcesses() && !checkForFridaFiles() && !checkForFridaPorts()) {
} else {
throw new RuntimeException("null");
}
}
}
// T.me/Hide_Club
In the next post, I'll talk about how to bypass these mechanisms. | 2 759 |
| 13 |  β³ Using Burp Suite and Facing Unexpected Website Behavior Donβt Worry, It Happens Often
The screenshot here shows a Java TLS limit. Recent JDKs added jdk.tls.maxHandshakeMessageSize (default 32768 bytes)
Use "-Djdk.tls.maxHandshakeMessageSize=65536" to solve this. Add this to the end of the ".vmoptions" file if you have it installed.
While this can be a support ticket candidate, hereβs what I recommend:
1. Install Burp fresh and fully configure it, including all extensions.
2. Save your default settings.
3. Export settings, this includes user and project configurations.
4. On startup, set Burp to load project settings by default.
5. If settings go missing, reload user settings inside Burp to restore them.
This prevents configuration loss and eases troubleshooting unexpected issues.
#infosec #cybersecurity #bugbountyTools #Hacking #bugbounty #Burpsuite
β― Share & Support Us
β― Channel : @Hide_Club | 2 975 |
| 14 |  β³ Interesting HTTP Connection State Attack - SSRF
HTTP is supposed to be stateless, but sometimes... it isn't! Some servers create invisible vulnerabilities by only validating the first request on each TCP/TLS connection. James Kettle published a Custom Action to help you detect & exploit this.
β’ You can install this Custom Action via the Extensibility Helper extension, or copy+paste from here: github
β’ Lab: Portswigger
#infosec #cybersecurity #bugbountyTools #Hacking #bugbounty #HTTP
β― Share & Support Us
β― Channel : @Hide_Club | 3 431 |
| 15 | Why can't I find good sources for dynamic JavaScript analysis and reading JS files? Most sources focus on running tools on downloaded JS files to detect secrets like API keys or leaked credentials. Do you know any good books or resources for dynamic analysis of JavaScript files? | 769 |
| 16 | β³ Common Rate Limit Bypass Techniques
IP Spoofing
Altering a requestβs source IP to appear from another device, and rotating IPs lets an attacker bypass per-IP limits. You can use the following Burp Extensions for IP Spoofing:
β’ BurpFakeIP: GitHub
β’ IP-Rotate: GitHub
Changing User-Agent
Rate-limit systems often track the User-Agent header; changing or randomizing it makes requests appear from different clients, and attackers may brute-force the User-Agent field (e.g., with tools like Burp Suite Intruder).
Header Manipulation
Header manipulation alters HTTP headers (e.g., X-Forwarded-For, X-Real-IP) to trick servers β bypassing IP restrictions, evading rate limits, or hiding the real IP from logs and filters.
β’ Common Headers by π·Spix0r
Requesting with Different HTTP Methods
Some rate-limiters monitor only certain HTTP methods (e.g., GET/POST); attackers may bypass them by sending requests with other methods (PUT, DELETE, OPTIONS) and testing alternatives (e.g., with Burp Suite Repeater).
β’ HTTP request methods
Parameter Name Variation
Some backends accept alternate parameter names and still process requests, enabling attackers to bypass input filters, WAFs, or login restrictions.
username=admin&password=1234
user=admin&pass=1234
uname=admin&pwd=1234
login=admin&passwd=1234
u=admin&p=1234
email=admin&key=1234
id=admin&token=1234
Encoding Tricks
Encoding represents characters in different formats; attackers use encoding to obfuscate payloads and bypass input filters, WAFs, or validation rules.
user=admin%20 # space after admin
user=admin%00 # null byte injection
user=%61%64%6d%69%6e # 'admin' in hex
user=ad%6Din # only 'm' is encoded
user=%2561%2564%256d%2569%256e # double-encoded 'admin'
Case Sensitivity and Font Tricks
Case or character-variant changes in strings (emails, usernames, paths) can let attackers bypass security checks or exploit improper validation.
Email: Test@Example.com # Mixed case
Email: test@example.com # Lowercase
Email: TEST@example.com # Uppercase
Using Look-Alike Characters
Email: t3st@3xample.com # '3' instead of 'e'
Email: t@est@example.com # Replacing 'l' with 'I' or vice versa
Blank Characters
Inserting spaces, null bytes, or invisible characters (e.g., TAB, CRLF) can bypass filters, break input validation, or exploit server input handling.
email=" test@example.com " # Adding spaces at the beginning and end
email=test@example.com%20 # Adding a space encoded as %20
email=test@example.com%E2%80%8B # Injecting a zero-width space
email=test@example.com%09 # Tab character
email=test@example.com%0A # Newline character
#infosec #cybersecurity #bugbountyTools #Hacking #bugbounty #ratelimit
β― Share & Support Us
β― Channel : @Hide_Club | 4 409 |
| 17 | β³ Setting Up Android Emulator using Burp Suite and Android Studio and Bypass SSL Pinning
Today, I tried setting up an Android emulator to capture app traffic through Burp Suite. At first, I used Genymotion, which offers a free 30-day trial. However, itβs quite buggy! and after the trial, you either need to pay or reinstall it. So, I switched to Android Studio, which turned out to be a better option.
After installing Android Studio, I discovered an easier way to install Burpβs certificate using rootAVD.
Just follow the installation steps from the github page.
If you get stuck, this YouTube video helps a lot:
Installing (AND ROOTING) Android Emulator
π‘Tip: If the emulator freezes, restart it using Cold Boot.
Once rootAVD is set up, install the AlwaysTrustUserCerts Magisk module. It allows your emulator to trust Burp Suiteβs certificate automatically.
At this point, Burp can capture traffic but not everything, because some apps use SSL pinning. To bypass SSL pinning, use Frida.
Thereβs another great video that explains how to set up both AlwaysTrustUserCerts and Frida:
Burp Suite and Frida on an Android Emulator
π‘Tip: Again, use Cold Boot if your device gets stuck.
After setup, start Frida on the emulator via ADB shell:
./frida-server
Then, on your computer, list all running app processes:
frida-ps -Uia
Find the package name of the app you want to hook, then run this command to bypass SSL pinning:
frida --codeshare akabe1/frida-multiple-unpinning -f com.identifier.name -U
And thatβs it! Now you can capture and intercept HTTPS traffic from your Android apps using Burp Suite.
#infosec #cybersecurity #bugbountyTools #Hacking #bugbounty #Android #frida #sslpinning
β― Share & Support Us
β― Channel : @Hide_Club | 4 459 |
| 18 | β³ FindSomething Extension: Find interesting things in the webpage's source code or JavaScript
This tool is used to quickly extract some interesting information from the HTML source code or JS code of the web page, including possible requested resources, interface URLs, possible requested IPs and domain names, leaked ID numbers, mobile phone numbers, email addresses, etc.
β’ Function change details document
β’ Installation
#infosec #cybersecurity #bugbountyTools #Hacking #bugbounty #javascript
β― Share & Support Us
β― Channel : @Hide_Club | 4 494 |
| 19 | I'm busy setting up my blog. I've submitted exciting vulnerabilities in OAuth, reset password, and Windows applications, which I want to share with you soon on my blog. Good luck, see you soon!β€οΈβπ₯ | 4 243 |
| 20 |  β³ Simple IP Rotation & URL Redirection via Cloudflare Workers
FlareProx automatically deploys HTTP proxy endpoints on Cloudflare Workers for easy redirection of all traffic to any URL you specify. It supports all HTTP methods (GET, POST, PUT, DELETE, etc.) and provides IP masking through Cloudflare's global network
β’ Github
#infosec #cybersecurity #bugbountyTools #Hacking #bugbounty
β― Share & Support Us
β― Channel : @Hide_Club | 4 410 |
