Bug Bounty Tools & Writeups | Hide Club

I've created the Nuclei-Community-Templates repo to collect and share useful Nuclei templates with the community. Feel free to add your own if you've created one or know of any good templates. It's open to pull requests I will review and add them. Good luck! • Repository: https://github.com/Spix0r/Nuclei-Community-Templates #infosec #cybersecurity #Hacking #bugbounty #Nuclei ➯ Share & Support Us ➯ Channel : @Hide_Club

↳ A Comprehensive Guide on Modern iOS Pentesting A collection of awesome tools, books, courses, blog posts, and cool stuff about iOS Application Security and Penetration Testing • Github: Link Modern iOS Pentesting: No Jailbreak Needed • Blog: Link #infosec #cybersecurity #Hacking #bugbounty #ios ➯ Share & Support Us ➯ Channel : @Hide_Club

↳ Bypassing The Cloudflare mTLS Protection #Cloudflare has started blocking proxy tools like Burp Suite. If you encounter this error, download the Bypass Bot Detection extension from the BApp Store in Burp Suite. It should resolve the issue for Burp Suite. • Extension: Github #infosec #cybersecurity #WAF #Hacking #bugbounty #bugbountyTools #bugbountyTips ➯ Share & Support Us ➯ Channel : @Hide_Club

↳ Hacking AI-Powered Tools With Old School Vulnerabilities If you want to learn how to hack AI-powered apps, this research is a brilliant resource. These are the slides from the Black Hat USA presentation Hack To The Future: Owning AI-Powered Tools With Old School Vulns. During the research, the researchers identified vulnerabilities in AI-powered developer productivity tools. These tools extend far beyond AI coding assistants. • Research: Download #infosec #cybersecurity #bugbountyTools #Hacking #bugbounty #AI ➯ Share & Support Us ➯ Channel : @Hide_Club

↳ Bypassing CDN WAFs With Alternate Domain Routing I will provide a summary, and please read the full blog post to learn the concept. This technique is inspired by the idea in this tweet. • How this attack works? Imagine that the #CDN acts as a trusted proxy between you and the target web server (the "origin"). In this setup the origin server trusts requests coming from the CDN’s IP range, so it only accepts traffic that appears to come from the CDN. If you (the attacker) want to talk to the origin, you must route your request through the CDN. The CDN receives your request, filters and checks it (to ensure it isn’t flagged as malicious), then forwards it to the origin server. Now imagine a scenario where you’ve found the origin’s IP, but direct communication won’t work, because the origin expects only requests coming from the CDN’s IP range. However, if you register an account with the same CDN provider, turn off the WAF in your account, and point your CDN configuration at that origin IP, then you can send requests via the CDN to the origin (WAF IS OFF!). Since the origin sees that the request appears to come from the CDN, it will accept it! • Tools for deploying the infrastructure and scanning for affected origins: cdn-proxy & cdn-scanner: Github #infosec #cybersecurity #bugbountyTools #Hacking #bugbounty #WAF ➯ Share & Support Us ➯ Channel : @Hide_Club

I'm struggling to find the origin IP behind the CDN, but I can't. I found some unique methods which I'll share in 2 days, but first I want to ask you guys: what is your methodology to find the origin IP behind the CDN?

↳ Deep dive into Android Pentesting basics Covered everything from static & dynamic analysis, Frida, Drozer, SSL pinning bypass, deep links, broadcast receivers, and more If you're into mobile security, this one's packed with real-world scenarios & tools • Notion: Link #infosec #cybersecurity #Hacking #bugbounty #Android ➯ Share & Support Us ➯ Channel : @Hide_Club

↳ CVE-2025-55752 - Exploit PoC for Apache Tomcat Rewrite Valve Relative Path Traversal, no RCE (for now) #Pruva tried to fake it playing with the rewrite, relaxing it a lot, but after some pass was able to reproduce. • Exploit: Github #infosec #cybersecurity #CVE #Hacking #bugbounty #Apache ➯ Share & Support Us ➯ Channel : @Hide_Club

Daily Bug Bounty Write-Ups: @Daily_Writeups Group: @Cybersecurity_Forum

↳ Frida Detection Bypass - Custom Codes Like Above Bypassing First Checker Function

private static boolean checkForFridaFiles() {
 String[] strArr = {"/data/local/tmp/frida-server", "/data/local/tmp/frida", "/data/local/tmp/re.frida.server"};

• It's kinda easy, just rename the Frida server file to another name, like: fsrv Bypassing Second Checker Function

private static boolean checkForFridaPorts() {
        int[] iArr = {27042, 27043};

• It's checking the ports that Frida runs on by default, which are 27042 and 27043. Simply, you should change the ports to something different:

adb forward tcp:27044 tcp:27042
adb forward tcp:27045 tcp:27043

# Please note that you should specify the port and use the -H option instead of -U (example)

frida -H 127.0.0.1:27044 -f (process name) -l anti-detection.js

Bypassing Third Checker Function • It's kinda tricky because you'll see different codes in different targets. I can't send a code that bypasses all checker functions, but you can use the following code to get an idea and create your own target-specific bypasser code:

Java.perform(function() {
    // Hook the file detection method
    var fridaDetection = Java.use('PROCESSNAME.FridaDetection');
//This line finds and loads the FridaDetection class from the app’s code (the full class path is processname.path.FridaDetection).
//Java.use() gives access to the app's Java classes and methods, allowing you to modify or intercept them.
    fridaDetection.checkForFridaFiles.implementation = function() {
        console.log("Bypassed Frida file detection");
        return false; // Always return false to bypass the check
    };

    // Hook the port detection method
    fridaDetection.checkForFridaPorts.implementation = function() {
        console.log("Bypassed Frida port detection");
        return false; // Always return false to bypass the check
    };

    // Hook the process detection method
    fridaDetection.checkForFridaServerProcesses.implementation = function() {
        console.log("Bypassed Frida process detection");
        return false; // Always return false to bypass the check
    };
});

#infosec #cybersecurity #bugbountyTools #Hacking #bugbounty #Frida ➯ Share & Support Us ➯ Channel : @Hide_Club

↳ Example of Anti Frida Mechanism Code

public class FridaDetection {
    private static final String TAG = "FridaDetection";

    private static boolean checkForFridaFiles() {
        String[] strArr = {"/data/local/tmp/frida-server", "/data/local/tmp/frida", "/data/local/tmp/re.frida.server"};
        for (int i2 = 0; i2 < 3; i2++) {
            String str = strArr[i2];
            if (new File(str).exists()) {
                StringBuilder sb = new StringBuilder();
                sb.append("Frida file detected: ");
                sb.append(str);
                return true;
            }
        }
        return false;
    }

    private static boolean checkForFridaPorts() {
        int[] iArr = {27042, 27043};
        try {
            BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(Runtime.getRuntime().exec("netstat -an").getInputStream()));
            while (true) {
                String readLine = bufferedReader.readLine();
                if (readLine == null) {
                    break;
                }
                for (int i2 = 0; i2 < 2; i2++) {
                    int i3 = iArr[i2];
                    if (readLine.contains(String.valueOf(i3))) {
                        StringBuilder sb = new StringBuilder();
                        sb.append("Frida port detected: ");
                        sb.append(i3);
                        return true;
                    }
                }
            }
        } catch (IOException e2) {
            Log.e(TAG, "Error checking for Frida ports", e2);
        }
        return false;
    }
    private static boolean checkForFridaServerProcesses() {
        String readLine;
        String[] strArr = {"frida-server", "frida"};
        int i2 = 0;
        while (i2 < 2) {
            String str = strArr[i2];
            try {
                BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(Runtime.getRuntime().exec("ps").getInputStream()));
                do {
                    readLine = bufferedReader.readLine();
                    if (readLine != null) {
                    }
                } while (!readLine.contains(str));
                StringBuilder sb = new StringBuilder();
                sb.append("Frida process detected: ");
                sb.append(str);
                return true;
            } catch (IOException e2) {
                Log.e(TAG, "Error checking for Frida server processes", e2);
            }
        }
        return false;
        i2++;
    }

    public static void detectFrida() {
        if (!checkForFridaServerProcesses() && !checkForFridaFiles() && !checkForFridaPorts()) {
        } else {
            throw new RuntimeException("null");
        }
    }
}
// T.me/Hide_Club

In the next post, I'll talk about how to bypass these mechanisms.

↳ Using Burp Suite and Facing Unexpected Website Behavior Don’t Worry, It Happens Often The screenshot here shows a Java TLS limit. Recent JDKs added jdk.tls.maxHandshakeMessageSize (default 32768 bytes) Use "-Djdk.tls.maxHandshakeMessageSize=65536" to solve this. Add this to the end of the ".vmoptions" file if you have it installed. While this can be a support ticket candidate, here’s what I recommend: 1. Install Burp fresh and fully configure it, including all extensions. 2. Save your default settings. 3. Export settings, this includes user and project configurations. 4. On startup, set Burp to load project settings by default. 5. If settings go missing, reload user settings inside Burp to restore them. This prevents configuration loss and eases troubleshooting unexpected issues. #infosec #cybersecurity #bugbountyTools #Hacking #bugbounty #Burpsuite ➯ Share & Support Us ➯ Channel : @Hide_Club

↳ Interesting HTTP Connection State Attack - SSRF HTTP is supposed to be stateless, but sometimes... it isn't! Some servers create invisible vulnerabilities by only validating the first request on each TCP/TLS connection. James Kettle published a Custom Action to help you detect & exploit this. • You can install this Custom Action via the Extensibility Helper extension, or copy+paste from here: github • Lab: Portswigger #infosec #cybersecurity #bugbountyTools #Hacking #bugbounty #HTTP ➯ Share & Support Us ➯ Channel : @Hide_Club

Why can't I find good sources for dynamic JavaScript analysis and reading JS files? Most sources focus on running tools on downloaded JS files to detect secrets like API keys or leaked credentials. Do you know any good books or resources for dynamic analysis of JavaScript files?

↳ Common Rate Limit Bypass Techniques IP Spoofing Altering a request’s source IP to appear from another device, and rotating IPs lets an attacker bypass per-IP limits. You can use the following Burp Extensions for IP Spoofing: • BurpFakeIP: GitHub • IP-Rotate: GitHub Changing User-Agent Rate-limit systems often track the User-Agent header; changing or randomizing it makes requests appear from different clients, and attackers may brute-force the User-Agent field (e.g., with tools like Burp Suite Intruder). Header Manipulation Header manipulation alters HTTP headers (e.g., X-Forwarded-For, X-Real-IP) to trick servers — bypassing IP restrictions, evading rate limits, or hiding the real IP from logs and filters. • Common Headers by 🕷Spix0r Requesting with Different HTTP Methods Some rate-limiters monitor only certain HTTP methods (e.g., GET/POST); attackers may bypass them by sending requests with other methods (PUT, DELETE, OPTIONS) and testing alternatives (e.g., with Burp Suite Repeater). • HTTP request methods Parameter Name Variation Some backends accept alternate parameter names and still process requests, enabling attackers to bypass input filters, WAFs, or login restrictions.

username=admin&password=1234
user=admin&pass=1234
uname=admin&pwd=1234
login=admin&passwd=1234
u=admin&p=1234
email=admin&key=1234
id=admin&token=1234

Encoding Tricks Encoding represents characters in different formats; attackers use encoding to obfuscate payloads and bypass input filters, WAFs, or validation rules.

user=admin%20        # space after admin
user=admin%00        # null byte injection
user=%61%64%6d%69%6e # 'admin' in hex
user=ad%6Din  # only 'm' is encoded
user=%2561%2564%256d%2569%256e  # double-encoded 'admin'

Case Sensitivity and Font Tricks Case or character-variant changes in strings (emails, usernames, paths) can let attackers bypass security checks or exploit improper validation.

Email: Test@Example.com  # Mixed case
Email: test@example.com   # Lowercase
Email: TEST@example.com   # Uppercase

Using Look-Alike Characters

Email: t3st@3xample.com   # '3' instead of 'e'
Email: t@est@example.com   # Replacing 'l' with 'I' or vice versa

Blank Characters Inserting spaces, null bytes, or invisible characters (e.g., TAB, CRLF) can bypass filters, break input validation, or exploit server input handling.

email=" test@example.com "  # Adding spaces at the beginning and end
email=test@example.com%20  # Adding a space encoded as %20
email=test@example.com%E2%80%8B  # Injecting a zero-width space
email=test@example.com%09  # Tab character
email=test@example.com%0A  # Newline character

#infosec #cybersecurity #bugbountyTools #Hacking #bugbounty #ratelimit ➯ Share & Support Us ➯ Channel : @Hide_Club

↳ Setting Up Android Emulator using Burp Suite and Android Studio and Bypass SSL Pinning Today, I tried setting up an Android emulator to capture app traffic through Burp Suite. At first, I used Genymotion, which offers a free 30-day trial. However, it’s quite buggy! and after the trial, you either need to pay or reinstall it. So, I switched to Android Studio, which turned out to be a better option. After installing Android Studio, I discovered an easier way to install Burp’s certificate using rootAVD. Just follow the installation steps from the github page. If you get stuck, this YouTube video helps a lot: Installing (AND ROOTING) Android Emulator 💡Tip: If the emulator freezes, restart it using Cold Boot. Once rootAVD is set up, install the AlwaysTrustUserCerts Magisk module. It allows your emulator to trust Burp Suite’s certificate automatically. At this point, Burp can capture traffic but not everything, because some apps use SSL pinning. To bypass SSL pinning, use Frida. There’s another great video that explains how to set up both AlwaysTrustUserCerts and Frida: Burp Suite and Frida on an Android Emulator 💡Tip: Again, use Cold Boot if your device gets stuck. After setup, start Frida on the emulator via ADB shell:

./frida-server

Then, on your computer, list all running app processes:

frida-ps -Uia

Find the package name of the app you want to hook, then run this command to bypass SSL pinning:

frida --codeshare akabe1/frida-multiple-unpinning -f com.identifier.name -U

And that’s it! Now you can capture and intercept HTTPS traffic from your Android apps using Burp Suite. #infosec #cybersecurity #bugbountyTools #Hacking #bugbounty #Android #frida #sslpinning ➯ Share & Support Us ➯ Channel : @Hide_Club

↳ FindSomething Extension: Find interesting things in the webpage's source code or JavaScript This tool is used to quickly extract some interesting information from the HTML source code or JS code of the web page, including possible requested resources, interface URLs, possible requested IPs and domain names, leaked ID numbers, mobile phone numbers, email addresses, etc. • Function change details document • Installation #infosec #cybersecurity #bugbountyTools #Hacking #bugbounty #javascript ➯ Share & Support Us ➯ Channel : @Hide_Club

I'm busy setting up my blog. I've submitted exciting vulnerabilities in OAuth, reset password, and Windows applications, which I want to share with you soon on my blog. Good luck, see you soon!❤️‍🔥

↳ Simple IP Rotation & URL Redirection via Cloudflare Workers

FlareProx automatically deploys HTTP proxy endpoints on Cloudflare Workers for easy redirection of all traffic to any URL you specify. It supports all HTTP methods (GET, POST, PUT, DELETE, etc.) and provides IP masking through Cloudflare's global network

• Github #infosec #cybersecurity #bugbountyTools #Hacking #bugbounty ➯ Share & Support Us ➯ Channel : @Hide_Club