Bug Bounty Diary

✎ IDN Homograph Attacks: From Phishing to Account-Collision Bugs Most people know the classic IDN story: register a domain with lookalike Unicode characters ( á U+00E1 vs a U+0061 ), get it Punycode-encoded as xn--..., and trick a browser address bar into rendering something that looks like apple.com. That's old news from 2005/2017 and browsers mostly catch it now. ● The Core Bug Apps often accept Unicode in email/username fields, then normalize them "for convenience" before using them as a lookup key. If normalization happens at a different stage than validation/storage, two different values can end up pointing to the same identity. Imagine a password reset functionality with an arbitrary mail server and MySQL. Let's see how it works: 1. The user enters their email address. 2. The web app checks the database to see if the user exists. 3. It runs a SELECT query using the user's input. 4. If the user is found, a reset token is generated and saved. 5. The token is then emailed to the user. 💡If the user-controlled email is passed directly to the SMTP server, things can get interesting. But how? • MySQL (Default Settings) → a and á can be treated as equal during the database lookup → The victim's account is found → A reset token is generated • SMTP Server → victim@gmail.com and victim@gmáil.com are treated as different email addresses → The email is sent to victim@gmáil.com So, the application finds the victim's account (victim@gmail.com) in the database, but sends the reset email to the attacker-controlled address (victim@gmáil.com). And that's where the account-collision happens. #bugbounty #IDN_Homograph #punycode © T.me/BugBounty_Diary

✎ Network Basics - Module 5 Chapter 5 - Part 2 is live now — hope you find it useful!

-- Configuring Routing and Advanced Switching — Part 2 --

If you're new to networking, this chapter might feel a bit overwhelming at first. Don't worry I’ve tried to include quick reviews throughout the article to help reinforce the key concepts step by step. The quick review sections can also help you identify topics you're struggling with, so you can revisit them later (or do a bit of research) and reinforce your understanding. • Blog: Network Basics - Module 5 #bugbounty #network © T.me/BugBounty_Diary

✎ Network Basics - Module 5 Chapter 5 - Part 2 is live now — hope you find it useful!

-- Configuring Routing and Advanced Switching — Part 2 --

In this part, we continue exploring routing technologies, NAT, PAT, and firewall concepts that are essential for understanding how modern networks operate. • Blog: Network Basics - Module 5 #network #bugbounty © T.me/BugBounty_Diary

✎ Network Basics - Module 5 Chapter 5 - Part 2 is live now — hope you find it useful!

-- Configuring Routing and Advanced Switching — Part 2 --

In this part, we continue exploring routing technologies, NAT, PAT, and firewall concepts that are essential for understanding how modern networks operate. • Blog: Network Basics - Module 5#network #bugbounty © T.me/BugBounty_Diary

Successfully identified an Account Takeover (ATO) vulnerability in a public program. The attack chain started with a flaw in the interaction between the web application and its WebSocket layer, which eventually led me down a rabbit hole into the Windows desktop client. I ended up reverse engineering its .dll files to understand the authentication flow and how JWTs were generated and signed. Definitely one of those findings where following the attack surface beyond the web app paid off. And honestly, this one made me even more interested in reverse engineering. A new writeup is coming 👀

✎ Unhar - Extract, Unminify, Beautify Javascript files from .Har file In the previous post, I explained my approach to capturing and downloading a website’s JavaScript resources into a .HAR file for further local analysis. Now, let’s take it a step further with unhar and process that HAR files. unhar turns a raw .HAR file into a structured set of web assets for local analysis. It extracts unique JavaScript and HTML resources while preserving the original URL structure, fetches available source maps, beautifies/unminifies JavaScript, and extracts inline scripts from HTML pages. In short: HAR → Extract → Source Maps → Beautify → Ready for Analysis ● Installation

git clone https://github.com/Spix0r/unhar
cd unhar

● Usage

# custom output directory
python3 unhar.py site.har --output folder

# skip source map fetching
python3 unhar.py site.har --no-srcmap

# skip beautify
python3 unhar.py site.har --no-beautify

• Repository: Github #bugbounty #javascript #recon © T.me/BugBounty_Diary

✎ Extract & Download All JavaScript Files for Recon For modern web apps, scraping <script> tags or relying on Burp's Site Map often isn't enough. Why? Because applications may dynamically load JavaScript from CDNs, cross-origin domains, specific routes (Lazy Loading), or after user interactions. My Approach: 1. Open DevTools → Network 2. Enable Preserve log 3. Crawl the target and visit relevant pages/features 4. Interact with the application to trigger dynamic resources 5. Export the traffic as a HAR 6. Extract all JavaScript files from .HAR file using unhar (I'll talk about it in the next post.) #bugbounty #javascript #recon © T.me/BugBounty_Diary

✎ Using LLMs to Unminify JavaScript Most JavaScript minification is lossless. Transformations like true → !0 can be reversed with traditional AST-based tools such as Babel. Variable renaming is different: recovering meaningful names requires understanding the code's intent. This is where LLMs can help. Instead of letting an LLM rewrite the source directly, which can break functionality, we can use it only to suggest meaningful names, then perform the actual renaming deterministically at the AST level. A practical pipeline looks like this: 1. Unbundle Webpack with webcrack 2. Reverse lossless minification with AST transformations 3. Ask an LLM to infer the purpose of identifiers 4. Rename them safely at the AST level 5. Format the result with Prettier One tool that implements this approach is Humanify: ● Repository: Github #bugbounty #javascript #reverse_engineering © T.me/BugBounty_Diary

✎ Network Basics - Module 5 Chapter 5 is live now - hope you find it helpful!

-- Configuring Routing and Advance Switching — part 1--

• Blog: Network Basics - Module 5 #bugbounty #network © telegram.me/BugBounty_Diary

-------‐----------------------------- cURL Cheatsheet — The Swiss Knife of HTTP Requests -------‐----------------------------- ● Basic Requests 1. GET request

curl https://example.com

2. Save response to a file

curl -o output.html https://example.com

3. Follow redirects

curl -L https://example.com

-------‐----------------------------- ● HTTP Methods 1. POST request

curl -X POST https://example.com/login

2. Send JSON data

curl -X POST https://api.example.com/users \
-H "Content-Type: application/json" \
-d '{"username":"admin","password":"1234"}' 

3. PUT request

curl -X PUT https://example.com/user/1

4. DELETE request

curl -X DELETE https://example.com/user/1

-------‐----------------------------- ● Headers & Authentication 1. Add custom header

curl -H "Authorization: Bearer TOKEN" https://api.example.com

2. View response headers

curl -I https://example.com

3. Include headers in output

curl -i https://example.com

-------‐----------------------------- ● Cookies 1. Send cookies

curl -b "session=abc123" https://example.com

2. Save cookies

curl -c cookies.txt https://example.com

3. Load cookies

curl -b cookies.txt https://example.com

-------‐----------------------------- ● Proxy Usage 1. HTTP Proxy

curl -x http://127.0.0.1:8080 https://example.com

2. SOCKS5 Proxy

curl --socks5 127.0.0.1:9050 https://example.com

-------‐----------------------------- ● Useful Flags 1. "-v" → Verbose output 2. "-I" → Headers only 3. "-L" → Follow redirects 4. "-k" → Ignore SSL verification 5. "-s" → Silent mode 6. "-o" → Output to file 7. "-X" → Specify HTTP method 8. "-H" → Add header 9. "-d" → Send data #BugBounty #curl #CheatSheet © T.me/BugBounty_Diary

✎ FlareProx - Simple IP Rotation & URL Redirection via Cloudflare Workers FlareProx automatically deploys HTTP proxy endpoints on Cloudflare Workers for easy redirection of all traffic to any URL you specify. It supports all HTTP methods (GET, POST, PUT, DELETE, etc.) and provides IP masking through Cloudflare's global network. (100k requests per day are free.) ● How It Works? FlareProx deploys Cloudflare Workers that act as HTTP proxies. 1. Request Routing: When you make a request, your request is sent to a FlareProx endpoint. 2. URL Extraction: The Worker extracts the target URL from query params or a custom HTTP header. 3. Request Proxying: The Worker forwards your request to the target URL. 4. Response Relay: The target's response is relayed back through Cloudflare. 5. IP Masking: Your original IP is masked by Cloudflare's infrastructure. ● Repository: Github #bugbounty #burp © T.me/BugBounty_Diary

✎ Hacking Google with A.I. for $500,000 After earning $500,000 in Google bug bounties, BruteCat shared the AI-powered prompts, workflows, and techniques used to analyze Google's massive attack surface, which offers valuable insights for security researchers looking to scale their reconnaissance and vulnerability discovery. I highly recommend you read this writeup because it gives you a good methodology for hacking using AI. • Blog: Hacking Google with A.I. for $500,000 #bugbounty #AI © T.me/BugBounty_Diary

✎ CompTIA Network+ Summary - Module 4 Chapter 4 is now live - hope you find it helpful!

--Configuring Network Addressing--

• Blog: Network+ Summary - Module 4 #bugbounty #network © T.me/BugBounty_Diary

So close! Just 9 more stars to reach 256. Thank you all for the incredible support. 🫡❤️‍🔥

✎ RoboFinder v0.2.2 is out

RoboFinder is now more powerful, stable, and easier to fit into your recon workflow.

● Installation

pip install robofinder

● What's new? • Supports both single and multiple URLs

robofinder -u https://example.com
#or
robofinder -u urls.txt

• Pipe results directly into other tools:

robofinder -u https://example.com -c | httpx

• JSON output for automation:

robofinder -u https://example.com -c -f json

I also focused more on data quality than raw speed. Wayback lookups, especially on older targets, may take a little longer :( but you'll get much more complete results instead of missing valuable historical data. • Repository: Github #bugbounty #recon © T.me/BugBounty_Diary

-----‐------------------------------- ✎ Discovering Domains via NS Correlation -----‐------------------------------- ● What is a Nameserver? A nameserver (NS) is a specialised server within the Domain Name System (DNS) which translates human-readable domain names into IP addresses. Essentially, nameservers tell the internet where to find your web server. In this post I will describe a simple technique which can be used to correlate one or more websites using NS data. ● Finding Nameservers To find the nameservers for a domain name, the simplest way is to use the dig tool:

$ dig +noall +answer ns deliveroo.com
deliveroo.com.          86400   IN      NS      mona.ns.cloudflare.com.
deliveroo.com.          86400   IN      NS      phil.ns.cloudflare.com.

● Finding Related Domains Some DNS providers like Cloudflare will assign you a NS pair at the account level. This means that all domain names you add to your account will share the same NS pair. In the example above, deliveroo.com uses the Cloudflare nameserver pair mona.ns.cloudflare.com and phil.ns.cloudflare.com. Domains added under the same Cloudflare account are often assigned the same NS pair. Since the number of possible Cloudflare NS pair combinations is limited, many domains share them, making it relatively easy to identify other domains that may be managed by the same operator. ● Downloading The Dataset Merklemap provides a DNS record database containing 4 billion+ records. You can download it here. The dataset is provided in JSONL format and is compressed using xz. The uncompressed raw data is around ~500GB in size. If you just want to extract domain/NS pairs in the format domain,ns1,ns2,ns... you can use xzcat with jq like so:

xzcat dns_records_database.jsonl.xz | jq -r '
  select([.results[] | .success?.records?.NS? // empty] | length > 0) |
  [.hostname] + [.results[].success?.records?.NS? // empty | .[]] |
  join(",")
' > domains.csv

● Querying the Dataset One way to query the parsed data is using DuckDB. grep will also work but will probably be a bit slower.

NS1="phil.ns.cloudflare.com."
NS2="mona.ns.cloudflare.com."
duckdb -csv -noheader -c "
  SELECT column0 AS domain, column1 AS ns
  FROM read_csv('domains.csv', header=false)
  WHERE list_sort(str_split(column1, ',')) = list_sort(['${NS1}','${NS2}'])
" > results.csv

Looking at results.csv we have ~300 entries. A lot are false positives, but there are some new domains which definitely belong to the same operator:

$ grep -i deliveroo results.csv | cut -d, -f1
deliveroo.de
deliveroo.blog
deliveroo.xn--9dbq2a
... 32 more

In a lot of cases you might not be able to correlate one website to another based on just a keyword in the domain name. In those cases you can do things like: • Fingerprint HTTP responses • Compare WHOIS information • Compare technologies used • DNS similarities #bugbounty #recon #DNS © T.me/BugBounty_Diary

-----‐------------------------------- ✎ Discovering Domains via NS Correlation -----‐------------------------------- ● What is a Nameserver? A nameserver (NS) is a specialised server within the Domain Name System (DNS) which translates human-readable domain names into IP addresses. Essentially, nameservers tell the internet where to find your web server. In this post I will describe a simple technique which can be used to correlate one or more websites using NS data. ● Finding Nameservers To find the nameservers for a domain name, the simplest way is to use the dig tool:

$ dig +noall +answer ns deliveroo.com
deliveroo.com.          86400   IN      NS      mona.ns.cloudflare.com.
deliveroo.com.          86400   IN      NS      phil.ns.cloudflare.com.

● Finding Related Domains Some DNS providers like Cloudflare will assign you a NS pair at the account level. This means that all domain names you add to your account will share the same NS pair. In the example above, deliveroo.com uses the Cloudflare nameserver pair mona.ns.cloudflare.com and phil.ns.cloudflare.com. Domains added under the same Cloudflare account are often assigned the same NS pair. Since the number of possible Cloudflare NS pair combinations is limited, many domains share them, making it relatively easy to identify other domains that may be managed by the same operator. ● Downloading The Dataset Merklemap provides a DNS record database containing 4 billion+ records. You can download it here. The dataset is provided in JSONL format and is compressed using xz. The uncompressed raw data is around ~500GB in size. If you just want to extract domain/NS pairs in the format domain,ns1,ns2,ns... you can use xzcat with jq like so:

xzcat dns_records_database.jsonl.xz | jq -r '
  select([.results[] | .success?.records?.NS? // empty] | length > 0) |
  [.hostname] + [.results[].success?.records?.NS? // empty | .[]] |
  join(",")
' > domains.csv

● Querying the Dataset One way to query the parsed data is using DuckDB. grep will also work but will probably be a bit slower.

NS1="phil.ns.cloudflare.com."
NS2="mona.ns.cloudflare.com."
duckdb -csv -noheader -c "
  SELECT column0 AS domain, column1 AS ns
  FROM read_csv('domains.csv', header=false)
  WHERE list_sort(str_split(column1, ',')) = list_sort(['${NS1}','${NS2}'])
" > results.csv

Looking at results.csv we have ~300 entries. A lot are false positives, but there are some new domains which definitely belong to the same operator:

$ grep -i deliveroo results.csv | cut -d, -f1
deliveroo.de
deliveroo.blog
deliveroo.xn--9dbq2a
... 32 more

In a lot of cases you might not be able to correlate one website to another based on just a keyword in the domain name. In those cases you can do things like: • Fingerprint HTTP responses • Compare WHOIS information • Compare technologies used • DNS similarities #bugbounty #recon #DNS © T.me/BugBounty_Diary