Bug Bounty Diary

رفتن به کانال در Telegram

A diary documenting the journey of finding bugs, with daily notes and useful tricks. Follow for real experiences, discoveries, and practical tips in bug bounty hunting. Group: @BugBounty_Forum

نمایش بیشتر

الهند48 807 فناوری و برنامه‌ها15 077

7 018

مشترکین

+524 ساعت

+407 روز

+13630 روز

2 278

نمایش های پست

~ 67324 ساعت

~ 83548 ساعت

32.46%

نرخ مشارکت

اطلاعاتی وجود ندارد

پست های در روز

Ads index

beta

در حال بارگیری داده...

کانال‌های مشابه

34.9K

Hide01

12.2K

YashaHime || SUB INDO

Hadyu ' Muhammad Dāw'ah Forum.

کانال‌های بیشتر

ابر برچسب‌ها

هیچ داده‌ای

مشکلی وجود دارد؟ لطفاً صفحه را تازه کنید یا با مدیر پشتیبانی ما تماس بگیرید.

اشارات ورودی و خروجی

---

جذب مشترکین

اوت '26

+192

در 3 کانال‌ها

ژوئیه '26

+247

در 4 کانال‌ها

Get PRO

ژوئن '26

+319

در 6 کانال‌ها

Get PRO

مه '26

+231

در 2 کانال‌ها

Get PRO

آوریل '26

+129

در 0 کانال‌ها

Get PRO

مارس '26

+90

در 0 کانال‌ها

Get PRO

فوریه '26

+174

در 1 کانال‌ها

Get PRO

ژانویه '26

+189

در 1 کانال‌ها

Get PRO

دسامبر '25

+482

در 6 کانال‌ها

Get PRO

نوامبر '25

+1 348

در 3 کانال‌ها

Get PRO

اکتبر '250

در 0 کانال‌ها

Get PRO

سپتامبر '250

در 0 کانال‌ها

Get PRO

اوت '250

در 0 کانال‌ها

Get PRO

ژوئیه '250

در 1 کانال‌ها

Get PRO

ژوئن '250

در 0 کانال‌ها

Get PRO

مه '25

+73

در 0 کانال‌ها

Get PRO

آوریل '25

+219

در 0 کانال‌ها

Get PRO

مارس '25

+161

در 0 کانال‌ها

Get PRO

فوریه '25

+209

در 3 کانال‌ها

Get PRO

ژانویه '25

+301

در 3 کانال‌ها

Get PRO

دسامبر '24

+446

در 1 کانال‌ها

Get PRO

نوامبر '24

+716

در 1 کانال‌ها

Get PRO

اکتبر '24

+765

در 2 کانال‌ها

Get PRO

سپتامبر '24

+365

در 1 کانال‌ها

Get PRO

اوت '24

+280

در 1 کانال‌ها

Get PRO

ژوئیه '24

+191

در 1 کانال‌ها

Get PRO

ژوئن '24

+133

در 1 کانال‌ها

Get PRO

مه '24

+211

در 1 کانال‌ها

Get PRO

آوریل '24

+457

در 3 کانال‌ها

تاریخ	رشد مشترکین	اشارات	کانال‌ها
26 اوت	+9
25 اوت	+8
24 اوت	+12
23 اوت	+12
22 اوت	+4
21 اوت	+7
20 اوت	+5
19 اوت	+11
18 اوت	+17
17 اوت	+8
16 اوت	+3
15 اوت	+25
14 اوت	+13
13 اوت	+26
12 اوت	+4
11 اوت	+1
10 اوت	+3
09 اوت	+4
08 اوت	+1
07 اوت	+2
06 اوت	+2
05 اوت	+3
04 اوت	+7
03 اوت	+1
02 اوت	+2
01 اوت	+2

پست‌های کانال

✎ Unhar - Extract, Unminify, Beautify Javascript files from .Har file In the previous post, I explained my approach to capturing and downloading a website’s JavaScript resources into a .HAR file for further local analysis. Now, let’s take it a step further with unhar and process that HAR files. unhar turns a raw .HAR file into a structured set of web assets for local analysis. It extracts unique JavaScript and HTML resources while preserving the original URL structure, fetches available source maps, beautifies/unminifies JavaScript, and extracts inline scripts from HTML pages. In short: HAR → Extract → Source Maps → Beautify → Ready for Analysis ● Installation

git clone https://github.com/Spix0r/unhar
cd unhar

● Usage

# custom output directory
python3 unhar.py site.har --output folder

# skip source map fetching
python3 unhar.py site.har --no-srcmap

# skip beautify
python3 unhar.py site.har --no-beautify

2	✎ Extract & Download All JavaScript Files for Recon For modern web apps, scraping <script> tags or relying on Burp's Site Map often isn't enough. Why? Because applications may dynamically load JavaScript from CDNs, cross-origin domains, specific routes (Lazy Loading), or after user interactions. My Approach: 1. Open DevTools → Network 2. Enable Preserve log 3. Crawl the target and visit relevant pages/features 4. Interact with the application to trigger dynamic resources 5. Export the traffic as a HAR 6. Extract all JavaScript files from .HAR file using unhar (I'll talk about it in the next post.) #bugbounty #javascript #recon © T.me/BugBounty_Diary	966
3	✎ Using LLMs to Unminify JavaScript Most JavaScript minification is lossless. Transformations like true → !0 can be reversed with traditional AST-based tools such as Babel. Variable renaming is different: recovering meaningful names requires understanding the code's intent. This is where LLMs can help. Instead of letting an LLM rewrite the source directly, which can break functionality, we can use it only to suggest meaningful names, then perform the actual renaming deterministically at the AST level. A practical pipeline looks like this: 1. Unbundle Webpack with webcrack 2. Reverse lossless minification with AST transformations 3. Ask an LLM to infer the purpose of identifiers 4. Rename them safely at the AST level 5. Format the result with Prettier One tool that implements this approach is Humanify: ● Repository: Github #bugbounty #javascript #reverse_engineering © T.me/BugBounty_Diary	2 278
4	بدون متن...	0
5	✎ Network Basics - Module 5 Chapter 5 is live now - hope you find it helpful! -- Configuring Routing and Advance Switching — part 1-- • Blog: Network Basics - Module 5 #bugbounty #network © telegram.me/BugBounty_Diary	2 672
6	-------‐----------------------------- cURL Cheatsheet — The Swiss Knife of HTTP Requests -------‐----------------------------- ● Basic Requests 1. GET request curl https://example.com 2. Save response to a file curl -o output.html https://example.com 3. Follow redirects curl -L https://example.com -------‐----------------------------- ● HTTP Methods 1. POST request curl -X POST https://example.com/login 2. Send JSON data curl -X POST https://api.example.com/users \ -H "Content-Type: application/json" \ -d '{"username":"admin","password":"1234"}' 3. PUT request curl -X PUT https://example.com/user/1 4. DELETE request curl -X DELETE https://example.com/user/1 -------‐----------------------------- ● Headers & Authentication 1. Add custom header curl -H "Authorization: Bearer TOKEN" https://api.example.com 2. View response headers curl -I https://example.com 3. Include headers in output curl -i https://example.com -------‐----------------------------- ● Cookies 1. Send cookies curl -b "session=abc123" https://example.com 2. Save cookies curl -c cookies.txt https://example.com 3. Load cookies curl -b cookies.txt https://example.com -------‐----------------------------- ● Proxy Usage 1. HTTP Proxy curl -x http://127.0.0.1:8080 https://example.com 2. SOCKS5 Proxy curl --socks5 127.0.0.1:9050 https://example.com -------‐----------------------------- ● Useful Flags 1. "-v" → Verbose output 2. "-I" → Headers only 3. "-L" → Follow redirects 4. "-k" → Ignore SSL verification 5. "-s" → Silent mode 6. "-o" → Output to file 7. "-X" → Specify HTTP method 8. "-H" → Add header 9. "-d" → Send data #BugBounty #curl #CheatSheet © T.me/BugBounty_Diary	3 332
7	+1 ✎ FlareProx - Simple IP Rotation & URL Redirection via Cloudflare Workers FlareProx automatically deploys HTTP proxy endpoints on Cloudflare Workers for easy redirection of all traffic to any URL you specify. It supports all HTTP methods (GET, POST, PUT, DELETE, etc.) and provides IP masking through Cloudflare's global network. (100k requests per day are free.) ● How It Works? FlareProx deploys Cloudflare Workers that act as HTTP proxies. 1. Request Routing: When you make a request, your request is sent to a FlareProx endpoint. 2. URL Extraction: The Worker extracts the target URL from query params or a custom HTTP header. 3. Request Proxying: The Worker forwards your request to the target URL. 4. Response Relay: The target's response is relayed back through Cloudflare. 5. IP Masking: Your original IP is masked by Cloudflare's infrastructure. ● Repository: Github #bugbounty #burp © T.me/BugBounty_Diary	2 565
8	✎ Hacking Google with A.I. for $500,000 After earning $500,000 in Google bug bounties, BruteCat shared the AI-powered prompts, workflows, and techniques used to analyze Google's massive attack surface, which offers valuable insights for security researchers looking to scale their reconnaissance and vulnerability discovery. I highly recommend you read this writeup because it gives you a good methodology for hacking using AI. • Blog: Hacking Google with A.I. for $500,000 #bugbounty #AI © T.me/BugBounty_Diary	3 954
9	✎ CompTIA Network+ Summary - Module 4 Chapter 4 is now live - hope you find it helpful! --Configuring Network Addressing-- • Blog: Network+ Summary - Module 4 #bugbounty #network © T.me/BugBounty_Diary	3 103
10	So close! Just 9 more stars to reach 256. Thank you all for the incredible support. 🫡❤️‍🔥	1 731
11	✎ RoboFinder v0.2.2 is out RoboFinder is now more powerful, stable, and easier to fit into your recon workflow. ● Installation pip install robofinder ● What's new? • Supports both single and multiple URLs robofinder -u https://example.com #or robofinder -u urls.txt • Pipe results directly into other tools: robofinder -u https://example.com -c \| httpx • JSON output for automation: robofinder -u https://example.com -c -f json I also focused more on data quality than raw speed. Wayback lookups, especially on older targets, may take a little longer :( but you'll get much more complete results instead of missing valuable historical data. • Repository: Github #bugbounty #recon © T.me/BugBounty_Diary	5 794
12	-----‐------------------------------- ✎ Discovering Domains via NS Correlation -----‐------------------------------- ● What is a Nameserver? A nameserver (NS) is a specialised server within the Domain Name System (DNS) which translates human-readable domain names into IP addresses. Essentially, nameservers tell the internet where to find your web server. In this post I will describe a simple technique which can be used to correlate one or more websites using NS data. ● Finding Nameservers To find the nameservers for a domain name, the simplest way is to use the dig tool: $ dig +noall +answer ns deliveroo.com deliveroo.com. 86400 IN NS mona.ns.cloudflare.com. deliveroo.com. 86400 IN NS phil.ns.cloudflare.com. ● Finding Related Domains Some DNS providers like Cloudflare will assign you a NS pair at the account level. This means that all domain names you add to your account will share the same NS pair. In the example above, deliveroo.com uses the Cloudflare nameserver pair mona.ns.cloudflare.com and phil.ns.cloudflare.com. Domains added under the same Cloudflare account are often assigned the same NS pair. Since the number of possible Cloudflare NS pair combinations is limited, many domains share them, making it relatively easy to identify other domains that may be managed by the same operator. ● Downloading The Dataset Merklemap provides a DNS record database containing 4 billion+ records. You can download it here. The dataset is provided in JSONL format and is compressed using xz. The uncompressed raw data is around ~500GB in size. If you just want to extract domain/NS pairs in the format domain,ns1,ns2,ns... you can use xzcat with jq like so: xzcat dns_records_database.jsonl.xz \| jq -r ' select([.results[] \| .success?.records?.NS? // empty] \| length > 0) \| [.hostname] + [.results[].success?.records?.NS? // empty \| .[]] \| join(",") ' > domains.csv ● Querying the Dataset One way to query the parsed data is using DuckDB. grep will also work but will probably be a bit slower. NS1="phil.ns.cloudflare.com." NS2="mona.ns.cloudflare.com." duckdb -csv -noheader -c " SELECT column0 AS domain, column1 AS ns FROM read_csv('domains.csv', header=false) WHERE list_sort(str_split(column1, ',')) = list_sort(['${NS1}','${NS2}']) " > results.csv Looking at results.csv we have ~300 entries. A lot are false positives, but there are some new domains which definitely belong to the same operator: $ grep -i deliveroo results.csv \| cut -d, -f1 deliveroo.de deliveroo.blog deliveroo.xn--9dbq2a ... 32 more In a lot of cases you might not be able to correlate one website to another based on just a keyword in the domain name. In those cases you can do things like: • Fingerprint HTTP responses • Compare WHOIS information • Compare technologies used • DNS similarities #bugbounty #recon #DNS © T.me/BugBounty_Diary	2 655
13	-----‐------------------------------- ✎ Discovering Domains via NS Correlation -----‐------------------------------- ● What is a Nameserver? A nameserver (NS) is a specialised server within the Domain Name System (DNS) which translates human-readable domain names into IP addresses. Essentially, nameservers tell the internet where to find your web server. In this post I will describe a simple technique which can be used to correlate one or more websites using NS data. ● Finding Nameservers To find the nameservers for a domain name, the simplest way is to use the dig tool: $ dig +noall +answer ns deliveroo.com deliveroo.com. 86400 IN NS mona.ns.cloudflare.com. deliveroo.com. 86400 IN NS phil.ns.cloudflare.com. ● Finding Related Domains Some DNS providers like Cloudflare will assign you a NS pair at the account level. This means that all domain names you add to your account will share the same NS pair. In the example above, deliveroo.com uses the Cloudflare nameserver pair mona.ns.cloudflare.com and phil.ns.cloudflare.com. Domains added under the same Cloudflare account are often assigned the same NS pair. Since the number of possible Cloudflare NS pair combinations is limited, many domains share them, making it relatively easy to identify other domains that may be managed by the same operator. ● Downloading The Dataset Merklemap provides a DNS record database containing 4 billion+ records. You can download it here. The dataset is provided in JSONL format and is compressed using xz. The uncompressed raw data is around ~500GB in size. If you just want to extract domain/NS pairs in the format domain,ns1,ns2,ns... you can use xzcat with jq like so: xzcat dns_records_database.jsonl.xz \| jq -r ' select([.results[] \| .success?.records?.NS? // empty] \| length > 0) \| [.hostname] + [.results[].success?.records?.NS? // empty \| .[]] \| join(",") ' > domains.csv ● Querying the Dataset One way to query the parsed data is using DuckDB. grep will also work but will probably be a bit slower. NS1="phil.ns.cloudflare.com." NS2="mona.ns.cloudflare.com." duckdb -csv -noheader -c " SELECT column0 AS domain, column1 AS ns FROM read_csv('domains.csv', header=false) WHERE list_sort(str_split(column1, ',')) = list_sort(['${NS1}','${NS2}']) " > results.csv Looking at results.csv we have ~300 entries. A lot are false positives, but there are some new domains which definitely belong to the same operator: $ grep -i deliveroo results.csv \| cut -d, -f1 deliveroo.de deliveroo.blog deliveroo.xn--9dbq2a ... 32 more In a lot of cases you might not be able to correlate one website to another based on just a keyword in the domain name. In those cases you can do things like: • Fingerprint HTTP responses • Compare WHOIS information • Compare technologies used • DNS similarities #bugbounty #recon #DNS © T.me/BugBounty_Diary	1
14	-----‐------------------------------- ✎ Linux Security → SUID & Privilege Boundaries -----‐------------------------------- In Linux, security heavily depends on permission architecture. One critical mechanism is SUID (Set User ID). ● What is SUID? When SUID is applied to an executable, it runs with the file owner’s permissions instead of the executing user’s. If the file is owned by root, it grants elevated privileges. [me@linux ~]$ ls -l /usr/bin/passwd -rwsr-xr-x 1 root root ... • The s indicates SUID. This allows normal users to run passwd, which needs root access to update /etc/shadow. SUID itself is legitimate, misconfigured SUID binaries are dangerous. If powerful binaries like: • bash • vim • find are improperly assigned SUID, they may be abused for privilege escalation. ● Enumerating SUID Binaries find / -perm -4000 -type f 2>/dev/null This way we can find the files with SUID. ● A Usage example: Let's say find has SUID find . -exec /bin/sh -p \; -quit With this you can open a shell as the root. ● To Audit You need find the files with SUID the way I said before and delete the tag : chmod u-s /path/to/binary #bugbounty #Linux © T.me/BugBounty_Diary	2 369
15	✎ CompTIA Network+ Summary - Module 3 Module 3 is now live on my Hashnode series. --Interfaces & Switches-- As always stripped down to the essentials with no fluff. • Blog: Network+ Summary - Module 3	2 235
16	✎ ASN → IP Recon Workflow (BGPView alternative) I used to rely on bgpview.io for extracting IP ranges from ASNs it was free and useful for recon workflows. But after it went down, I looked for an alternative and found this awesome repo: • as-ip-blocks: Github It lets you pull IPv4/IPv6 prefixes per ASN directly from raw GitHub data, which is ideal for automation. </> Bash Function for ASN → IP Enumeration You can plug this directly into your recon pipeline or customize it for your tools asn2ip() { local base="https://raw.githubusercontent.com/ipverse/as-ip-blocks/master/as" fetch_asn() { curl -fsSL "$base/$1/aggregated.json" \ \| jq -r '.prefixes.ipv4[]?' 2>/dev/null \ \| sort -u } if [ ! -t 0 ]; then while IFS= read -r asn; do fetch_asn "$asn" done else fetch_asn "$1" fi } • Single ASN → IP Ranges asn2ip 1234 • List of ASNs → IP Ranges cat asnList \| asn2ip #bugbounty #recon #automation © T.me/BugBounty_Diary	0
17	✎ ASN → IP Recon Workflow (BGPView alternative) I used to rely on bgpview.io for extracting IP ranges from ASNs it was free and useful for recon workflows. But after it went down, I looked for an alternative and found this awesome repo: • as-ip-blocks: Github It lets you pull IPv4/IPv6 prefixes per ASN directly from raw GitHub data, which is ideal for automation. </> Bash Function for ASN → IP Enumeration You can plug this directly into your recon pipeline or customize it for your tools asn2ip() { local base="https://raw.githubusercontent.com/ipverse/as-ip-blocks/master/as" fetch_asn() { curl -fsSL "$base/$1/aggregated.json" \ \| jq -r '.prefixes.ipv4[]?' 2>/dev/null \ \| sort -u } if [ ! -t 0 ]; then while IFS= read -r asn; do fetch_asn "$asn" done else fetch_asn "$1" fi } • Single ASN → IP Ranges asn2ip 1234 • List of ASNs → IP Ranges cat asnList \| asn2ip #bugbounty #recon #automation © T.me/BugBounty_Diary	0
18	✎ CompTIA Network+ Summary - Module 2 Module 2 is now live on my Hashnode series. Stripped down to the essentials, focusing only on what actually matters for understanding networks from a cybersecurity perspective. • Blog: Network+ Summary - Module 2 #bugbounty #network © T.me/BugBounty_Diary	0
19	✎ IP Spoofing to Account Takeover: You Patched It? Really? In my previous article, I described how I found a security flaw in a popular desktop app's OAuth flow that allowed me to steal any user's account with just one click. I reported it, saw it patched, and then bypassed the patch again. Since the process of bypassing and exploiting the flaw is interesting to me, I decided to write a second article about it. • Blog: IP Spoofing to Account Takeover #bugbounty #ipspoofing #oauth © T.me/BugBounty_Diary	0
20	If you have any questions regarding this writeup, feel free to ask me at @Spix0r	0

مشاهده همه پست‌ها