cookie

We use cookies to improve your browsing experience. By clicking «Accept all», you agree to the use of cookies.

avatar

#bugbountytips

#bugbountytips

Show more
Advertising posts
2 579
Subscribers
+924 hours
+557 days
+23530 days

Data loading in progress...

Subscriber growth rate

Data loading in progress...

Бо Яіі)99) ю хдд ю це. ЯєюєіЄж ґюж
Show all...
🥰 1
Я,,Яз /.) є чяі#) юя їх ьдюю. Є
Show all...
1
Ч22#2#яцовч,є єя'івяяяі як іієііціціі хяє Яі ці цє увів, є Ц.я ґіявюює єє я і,і2
Show all...
1
Photo unavailableShow in Telegram
Mass hunting exposed git with hednsextractor: Tools: hednsextractor + httpx + DotGit Plugin
hednsextractor -target "target" -silent | httpx -path /.git/config -mc 200 -silent
#bugbountytips
Show all...
🔥 8👍 1🖕 1
Photo unavailableShow in Telegram
95% from hunters remove pics from endpoint, but... 1. Gathering all target endpoints 2. Filter the results just for pic extensions
cat endpoints.txt | egrep 'jpg|jpeg|png' > results.txt
3. Filter to alive
httpx -l results.txt -mc 200 -o alive.txt
4. Found a passport on specific endpoint => app.com/xxxx/cdn/file/xxx.jpg 5. Visit app.com/xxxx/cdn/ ==> dir listing open and the results is tons of PII 💡Don't forget checking (jpg/jpeg/etc..) all the time by @GodfatherOrwa #bugbountytips
Show all...
🔥 11👍 2😘 1
See the differences on https://www.tesla.com. Without the flag you will get nothing, but with the flag you will see that crawling works. P.S Use -show-browser to see what's going on (debugging mode). #bugbountytips
Show all...
🤪 1
Some people like using a command-line spider for gathering endpoints. Katana is one of these security focused spiders: https://github.com/projectdiscovery/katana When using katana: 1) use "-headless" as modern CDN WAFs block many command-line spiders. 2) use "-js-crawl" to enable javascript parsing 3) use "-jsluice" to enable syntax-tree (better) javascript parsing 4) use "-display-out-scope" to know when the spider find links to other domains that might be related to your target #bugbountytips
Show all...
🔥 6👍 2
#bugbountytips #доклады https://youtu.be/vFk0XtHfuSg
Show all...

👍 3
Modern WAF Bypass Techniques on Large Attack Surfaces https://youtu.be/0OMmWtU2Y_g #bugbountytips #доклады
Show all...
#NahamCon2024: Modern WAF Bypass Techniques on Large Attack Surfaces

Modern WAF Bypass Techniques on Large Attack Surfaces 👇 Shubham Shah is a security researcher and entrepreneur, known for co-founding Assetnote - a leading attack surface management platform. He's ranked as the #1 bug bounty hunter in Australia for three consecutive years and #27 in the world on HackerOne. Shubham specializes in discovering complex vulnerabilities in enterprise software and engineering security automation. nowafpls:

https://github.com/assetnote/nowafpls

JOIN DISCORD: discord.gg/NahamSec 💬 Social Media -

https://twitter.com/nahamsec

-

https://instagram.com/nahamsec

-

https://twitch.com/nahamsec

-

https://facebook.com/nahamsec1

❤‍🔥 4
Shodan & WAF Evasion Techniques | @godfatherOrwa https://youtu.be/wH6FEvmyo4A #bugbountytips #доклады
Show all...
#NahamCon2024: Shodan & WAF Evasion Techniques | @godfatherOrwa

#NahamCon2024: Shodan & WAF Evasion Techniques | @godfatherOrwa ⚒️Tools:

https://github.com/phor3nsic/favicon_hash_shodan

🧑🏽‍💻 Commands: $ shodan download --limit 1000 myresults.json.gz 'DORK' $ shodan parse --fields ip_str,port --separator " " myresults.json.gz | awk '{print$1":"$2}' | httpx 📚 Purchase my Bug Bounty Course here 👉🏼 bugbounty.nahamsec.training 💵 Support the Channel: You can support the channel by becoming a member and get access exclusive content, behind the scenes, live hacking session and more! ☕️ Buy Me Coffee:

https://www.buymeacoffee.com/nahamsec

JOIN DISCORD:

https://discordapp.com/invite/ucCz7uh

❤‍🔥 2
Choose a Different Plan

Your current plan allows analytics for only 5 channels. To get more, please choose a different plan.