Hacking Vidhya

Shodan dorks help you filter specific types of devices and information 👇 ssl.cert.fingerprint:”${target}” ssl:”${target}” org:”${target}” hostname:”${target}” http://ssl.cert.issuer.cn:”${target}” http://ssl.cert.subject.cn:”${target}” ssl.cert.subject.commonName:”.${target}” http.title:”Index of /” hostname:”.${target}”* http.title:”Index of /” http://ssl.cert.subject.cn:”${target}” ftp port:”10000" hostname:”*.${target}” ftp port:”10000" http://ssl.cert.subject.cn:”${target}” “Authentication: disabled” port:445 product:”Samba” hostname:”*.${target}” title:”Login — Adminer” hostname:”*.${target}” title:”Login — Adminer” http://ssl.cert.subject.cn:”${target}” http.title:”sign up” http://ssl.cert.subject.cn:”${target}”z

Kali Linux meets Claude: Control pentesting tools on Kali via natural language prompts through Claude Desktop GUI on macOS + Anthropic Sonnet LLM via MCP. Terminal optional now! 🚀 Finally you don’t have to use -h for any tool or remember commands https://www.kali.org/blog/kali-llm-claude-desktop/

Sharing this here in case it may be useful to those exploring the Cyber Crime / Digital Investigation domain. Free 5-Hour CCI MasterSession (1 March) — structured, practical, career-focused. Registere Here: https://samcommunity.in/free-cci

Bypassed SSRF in Skype, an old report but definitely a must-read!! ☁️ POC -> 1. Analysing requests in burp, found one endpoint *.skype[.]com/path?url=https://example.com 2. Hacker tried multiple ssrf cloud metadata payloads but no success, like localhost/internal ip address -> Failed Tried to bypass localhost/internal ip address using url redirect/url shortner methods -> Failed External ip address/webpage -> Success Common Azure/AWS/DigitalOcean Meta data IP addresses -> Failed 3. A lesser-known, Microsoft Azure specific IP address http://168.63.129[.]16/metadata/v1/maintenance -> 200 OK This endpoint can be used to check the health status of the virtual machine. Here’s something interesting I came across.

✎ Grep Tips for JavaScript Analysis 🥀 • Extract JavaScript files from recursive directories find /path/to/your/folders -name "*.js" -exec mv {} /path/to/target/folder/ \;; • Search for API keys and passwords cat * | grep -rE "apikey|api_key|secret|token|password|auth|key|pass|user" • Identify dangerous function calls cat * | grep -rE "eval|document\.write|innerHTML|setTimeout|setInterval|Function" • Check URL Manipulation cat * | grep -rE "location\.href|location\.replace|location\.assign|window\.open" • Search for Cross-Origin requests cat * | grep -rE "XMLHttpRequest|fetch|Access-Control-Allow-Origin|withCredentials" /path/to/js/files • Analyze use of postMessage cat * | grep -r "postMessage" • Find URL Endpoints or Hardcoded URLs cat * | grep -rE "https?:\/\/|www\." • Identify Debugging information cat * | grep -rE "console\.log|debugger|alert|console\.dir" • Check how user input is handled cat * | grep -rE "document\.getElementById|document\.getElementsByClassName|document\.querySelector|document\.forms" Use these tips to analyze JavaScript code and identify weaknesses, and share your experiences and findings in the comments! What other tools or methods do you suggest for reviewing JavaScript code?

Low Hanging Fruit - Simplest MFA Bypass check 🔑 POC -> 1. Set up 2FA on the account and generate recovery codes. 2. Securely store these recovery codes. 3. Disable turn off 2FA. 4. Reactivate 2FA on the account. 5. Log out of the account. 6. Try logging back in using one of the old recovery codes. Impact -> An attacker with old recovery codes could bypass 2FA, leading to unauthorized account access. This could result in data breaches, loss of sensitive information, and unauthorized actions taken on behalf of users. Credited to the respected owner #bugbounty #bughunting #bounty #hacking #ethicalhacking #infosec #cybersecurity #bugbountytips #bugbounty #bugbountytip #bughunting #infosecurity #OWASP #ApplicationSecurity #Bugcrowd #Hackerone@Hacking_Vidhya

GraphQL Pentesting for Bug Bounty Hunters: From Endpoint Discovery to High-Impact Exploits…! https://medium.com/@mpjani294/graphql-pentesting-for-bug-bounty-hunters-from-endpoint-discovery-to-high-impact-exploits-821f64a953b5

Firefox RCE 0.0.0.0 Day: Exploiting Localhost APIs From the Browser #research

𝗟𝗲𝗮𝗸𝗶𝗻𝗴 𝘁𝗵𝗲 𝗘𝗺𝗮𝗶𝗹 𝗼𝗳 𝗔𝗻𝘆 𝗬𝗼𝘂𝗧𝘂𝗯𝗲 𝗨𝘀𝗲𝗿 A vulnerability was discovered in YouTube that allowed exposing the email address linked to any user or channel without compromising the account itself. And any platform that relies on: • Internal IDs • Secondary features • Multiple APIs can fall into the same scenario. What happened and how it worked: Every YouTube account has an internal identifier (Gaia ID). This identifier is supposed to remain internal and never be exposed outside the system. In certain interactions within the platform, the Gaia ID could appear within the requests sent to YouTube’s servers. Google operates multiple internal services. Some of these services accepted the internal ID and returned data associated with it. 𝗕𝘆 𝗰𝗼𝗿𝗿𝗲𝗹𝗮𝘁𝗶𝗻𝗴: • the internal ID • with another internal service it was possible to resolve that ID directly to the user’s real email address. This was not a single bug, but a chain of design and access issues. No special permissions or account compromise were required, and the method was potentially scalable. 𝗦𝘁𝗮𝘁𝘂𝘀 : The vulnerability has been fixed (patched). 𝗕𝘂𝗴 𝗯𝗼𝘂𝗻𝘁𝘆 𝗮𝘄𝗮𝗿𝗱𝗲𝗱 : $10,000. 𝗙𝗼𝗿 𝘁𝗲𝗰𝗵𝗻𝗶𝗰𝗮𝗹 𝗱𝗲𝘁𝗮𝗶𝗹𝘀: https://lnkd.in/dBfZMzSm - #CyberSecurity #Privacy #YouTube #DataExposure #Vulnerability #PlatformSecurity #sarabadran #Sara_Badran