Bug Bounty
Open in Telegram
Bugbounty Resources • Tips • Security Zines • Writeups • Vulnerability Update • Notes • Mindmaps • Cheatsheets • Checklists • Article / Blogs • PDFs • ebooks •
Show more9 446
Subscribers
No data24 hours
-37 days
-6030 days
Posts Archive
9 446
Focus on learning new stuffs and improving skills more then just go for hunt with only some common bugs..it takes time be patience pick one vulnerability eg: ssrf solve its all labs on portswigger/bwapp/rootme etc master it give you some confidence
then read all hackerone reports of it give you real world idea and payloads try some bypasses from some github repo or hacktricks give 1 week time on one vulnerability then move to other one it take you only 3-5 month to master all owsp top 10 if u do with passion and hardwork
9 446
to get other Unicode characters go to https://compart.com/en/unicode and put the blacklisted character and you will find other Unicode characters to use for your testing.
9 446
when you are looking for bugs like SSRF & Open Redirect. and there is a blacklisted character.
try to bypassed using other Unicode characters.
I found Open Redirect Bypass Using (。) Chinese dot "%E3%80%82".
poc:
redirect_to=////evil%E3%80%82com
#BugBounty #bugbountytip9 446
Which type of XSS vulnerability do you find most frequently in your bug bounty hunting?
9 446
Just wrote a ~2.5 page blog post on Client Side Path Traversal, covering what CSPT is, why it can be so impactful, some advanced exploitation and WAF bypass techniques, and a bug which I found in a live hacking event (redacted ofc)
https://matanber.com/blog/cspt-levels9 446
Just wrote a ~2.5 page blog post on Client Side Path Traversal, covering what CSPT is, why it can be so impactful, some advanced exploitation and WAF bypass techniques, and a bug which I found in a live hacking event (redacted ofc)
https://matanber.com/blog/cspt-levels9 446
here is Complete SSRF Guide
Very Good Guide For Beginner to Advance UserHit a Like 👍
9 446
+1
Do you guys know about Gourlex ✔️ Tool ?
📢It is a simple tool that can be used to extract URLs and paths from web pages. It can be helpful during web application assessments to uncover additional targets.
Try the tool :
https://github.com/trap-bytes/gourlex9 446
After reading 500 top SQLi reports this is my feedback :)
1)most sqli is found in php and asp based application that are running on php and aspx so always check site is on php or asp by checking its page source code,buitwith, Wappalyzer extension or check in burp response header & or you can use curl also for that.
2)test sqli in every endpoint where the database is fetched from the server bcz if there is database there is high chance for sqli you just need to look at right endpoint and right bypass
3)dont demotivate if you did'nt find sqli bcz i see that everbody found sqli in simple param you just need to be become first one to explore and test that endpoint..
3)use xor payloads bcz its has obfuscating in its payloads that will bypass most of firewall wafs
4)try most sqli in login fields bcz there is high chance of sqli bcz its check login from database
5)always check which waf is there and use waf bypass payloads according to that.
6)dont just check any param by putting ' in param first for getting error not always you get error by this you need to use your mind if there is any data that fetched or checked from the server database you just need to check your all blind payloads
7)and most times i checked these all guys use space2comment tamper to bypass sqli but for me i use many mix combination but not long bcz it make your payload long and make ids ips waf triggers or drop the payloads..
All the best guysss for hunting hope my suggetion will help you ❤️😇
9 446
Symfony has a built-in profiler that can be accessed during development to provide information about the application's performance and behavior. The URL
/app_dev.php/_profiler/ is used to access this profiler.
In the tip, it suggests adding /app_dev.php/_profiler/open?file=app/config/parameters.yml to a wordlist. A wordlist is a list of words used for testing purposes, often in password cracking or in this case, for trying different URLs.
By adding this specific URL to the wordlist and attempting to access it on a Symfony application in development mode, an attacker might be able to access sensitive data stored in the parameters.yml file. This file often contains configuration settings, including database credentials and other sensitive information.9 446
If you find Web frameworks like Symfony, add '/app_dev.php/_profiler/open?file=app/config/parameters.yml' to the wordlist, and you may get juicy data. Enjoy!"
#bugbountytips #bugbountytip #cybersecurity #ethicalhacking
9 446
CloudFlare XSS protection WAF Bypassed !
payload used:
<Img Src=OnXSS OnError=confirm(document.cookie)>
#bugbounty #infosec
9 446
+1
Two P3 after successfully bypassing the Cloudflare WAF on a private program. A simple SVG-based payload proved effective. 😎💪
Payload: ⚙️
"%3cSvg%20Only%3d1%20OnLoad%3dconfirm(1)%3e"#bugbountytips #infosec
9 446
Story of very quick RCE 📝
• Target/cgi-bin/dmt/reset.cgi?db_prefix=%26id%26
You can to add this paths for ur wordlist
• cgi-bin/dmt/reset.cgi?db_prefix=%26id%26
• cgi-bin/reset.cgi?db_prefix=%26id%26
fuzzing as well
• cgi-bin/FUZZ.cgi?FUZZ=%26id%26
#bugbountytips ❤️
9 446
Path Traversal Affecting Multiple CData Products
CRITICAL
SRC: https://tenable.com/security/research/tra-2024-09
PoC: 👆
