Bug Bounty

#BugBountyTips If server only allows GET and POST method, then try adding “X-HTTP-Method -Override: PUT to achieve RCE via PUT method.

In addition between string and integer. Js convert int to string sk '50'+1= 501 But for subtraction it convert string to int so '40'-1=39

[1,2,3]==[1,2,3] is false because JavaScript actually has two different approaches for testing equality. Primitives like strings and numbers are compared by their value, while objects like arrays, dates, and plain objects are compared by their reference. That comparison by reference basically checks to see if the objects given refer to the same location in memory.

🚀 Amazing XSS Guide Collection of Awesome XSS resources and help you to understand XSS sanitization and tricks to bypass it https://github.com/s0md3v/AwesomeXSS #bugbounty #infosec #hacking #cybersecurity #penetrationtesting

API SECURITY TIP "Trying to find BOLA (IDOR) in APIs, got 401/403 errors? AuthZ bypass tricks: • Wrap ID with an array {“id”:111} --> {“id”:[111]} • JSON wrap {“id”:111} --> {“id”:{“id”:111}} • Send ID twice URL?id=&id= • Send wildcard {""user_id"":""*""}"

js support unicode so 'ü' this is allowed in the variable name so the answer is true!!

If You wanna Enter the field of Android Penetration Testing Then, You should Open This Thread 🧵 Check Out My Thread Tweet: https://twitter.com/Aacle_/status/1613027118874759170?s=20&t=OsOm8ggHNNP9PY3yJYfLdA

Penetration Testing Certifications Field Wise Categorized #bugbounty #infosec #cybersecurity

Type of f is undefined and we are adding typeof f to 1 So it is "1undefined"

If a string is not empty == will convert it into boolean value of true so they both are equal 😊

In js array, it ignore last ,

Undefined is not a reserved keyword

In JS (==) convert both values in the same type. In this case Empty String and Empty Array both are boolean value of false So, they evaluate as equal