Bug Bounty - GitBook

Old School Out-of-Band (OOB) SQL Injection Manual Approach: https://anontuttuvenus.medium.com/old-school-out-of-band-oob-sql-injection-manual-approach-cc50b81c5984?source=rss------bug_bounty-5

Session Hijacking Vulnerability in Password Reset Flow Leading to Cross-Account Access: https://medium.com/@iPsalmy/session-hijacking-vulnerability-in-password-reset-flow-leading-to-cross-account-access-4823d88e680a?source=rss------bug_bounty-5

Unleashing My Recon Weapon: A Custom Bash Tool for Bug Bounty: https://medium.com/@kumawatabhijeet2002/unleashing-my-recon-weapon-a-custom-bash-tool-for-bug-bounty-d946b5f26dd9?source=rss------bug_bounty-5

This is a writeup of how can I get critical $$$$ bounty from PII Disclosure - Broken Access: https://medium.com/@0xNayelx/this-is-a-writeup-of-how-can-i-get-critical-bounty-from-pii-disclosure-broken-access-7a113e5dc50c?source=rss------bug_bounty-5

How to Find Origin IP of any Website Behind a WAF: https://infosecwriteups.com/how-to-find-origin-ip-of-any-website-behind-a-waf-c85095156ef7?source=rss------bug_bounty-5

Mastering Wfuzz: Uncover Hidden Web Vulnerabilitiese: https://medium.com/@kumawatabhijeet2002/mastering-wfuzz-uncover-hidden-web-vulnerabilitiese-351cbbef18d6?source=rss------bug_bounty-5

HTML Injection: https://medium.com/@mastergojo122/html-injection-b6f4151c7d6a?source=rss------bug_bounty-5

Automating Authenticated scans in burp suite for 2FA applications https://freedium.cfd/https://medium.com/@thelazypentester/automating-authenticated-scans-in-burp-suite-for-2fa-applications-ae93882e26c9

❗️ A new reverse shell called ReverseShell_2025_01.ps1 At the time of publication, none of the scripts were flagged by antivirus systems. However, typically within 2-3 weeks after publication, some vendors begin to detect and flag the malicious files. 🖥 GitHub

HTTP version 1.X sends requests as clear-text, and uses a new-line character to separate different fields and different requests. HTTP version 2.X, on the other hand, sends requests as binary data in a dictionary form. I am sharing this because you can actually add this in your next pentest report

Pentester's Promiscuous Notebook >Pentest >Red Team >Exploit Dev >Admin https://ppn.snovvcrash.rocks/