Bug bounty Tips

Proxychains-ng

Essential OSCP Exam Toolkit

Netdiscover

Zmap

Arp-scan

API Pentesting Series — Part 7 Before you attack APIs, you need a solid lab. This part covers: • Tooling (Burp, DevTools, Postman) • Discovery tools (Kiterunner, Nikto) • Docker-based vulnerable APIs • Full environment setup Notion Notes 🔗: https://notion.so/aacle/PART-7-API-PenTesting-Series-LAB-SETUP-2b9f7b9ea30e809f8e8ddc938eb0fb1a

✎ Common Rate Limit Bypass Techniques IP Spoofing Altering a request’s source IP to appear from another device, and rotating IPs lets an attacker bypass per-IP limits. You can use the following Burp Extensions for IP Spoofing: • BurpFakeIP: GitHub • IP-Rotate: GitHub Changing User-Agent Rate-limit systems often track the User-Agent header; changing or randomizing it makes requests appear from different clients, and attackers may brute-force the User-Agent field (e.g., with tools like Burp Suite Intruder). Header Manipulation Header manipulation alters HTTP headers (e.g., X-Forwarded-For, X-Real-IP) to trick servers — bypassing IP restrictions, evading rate limits, or hiding the real IP from logs and filters. • Common Headers by 🕷Spix0r Requesting with Different HTTP Methods Some rate-limiters monitor only certain HTTP methods (e.g., GET/POST); attackers may bypass them by sending requests with other methods (PUT, DELETE, OPTIONS) and testing alternatives (e.g., with Burp Suite Repeater). • HTTP request methods Parameter Name Variation Some backends accept alternate parameter names and still process requests, enabling attackers to bypass input filters, WAFs, or login restrictions.

username=admin&password=1234
user=admin&pass=1234
uname=admin&pwd=1234
login=admin&passwd=1234
u=admin&p=1234
email=admin&key=1234
id=admin&token=1234

Encoding Tricks Encoding represents characters in different formats; attackers use encoding to obfuscate payloads and bypass input filters, WAFs, or validation rules.

user=admin%20        # space after admin
user=admin%00        # null byte injection
user=%61%64%6d%69%6e # 'admin' in hex
user=ad%6Din  # only 'm' is encoded
user=%2561%2564%256d%2569%256e  # double-encoded 'admin'

Case Sensitivity and Font Tricks Case or character-variant changes in strings (emails, usernames, paths) can let attackers bypass security checks or exploit improper validation.

Email: Test@Example.com  # Mixed case
Email: test@example.com   # Lowercase
Email: TEST@example.com   # Uppercase

Using Look-Alike Characters

Email: t3st@3xample.com   # '3' instead of 'e'
Email: t@est@example.com   # Replacing 'l' with 'I' or vice versa

Blank Characters Inserting spaces, null bytes, or invisible characters (e.g., TAB, CRLF) can bypass filters, break input validation, or exploit server input handling.

email=" test@example.com "  # Adding spaces at the beginning and end
email=test@example.com%20  # Adding a space encoded as %20
email=test@example.com%E2%80%8B  # Injecting a zero-width space
email=test@example.com%09  # Tab character
email=test@example.com%0A  # Newline character

#bugbounty #ratelimit © T.me/BugBounty_Diary

How I track the latest CVEs — top 20, fast 🔥 curl -s 'https:/ /cvedb.shodan.io/cves' \ | jq -r '.cves[:20][]?.cve_id' ==> Want id+summary? curl -s 'https:/ /cvedb.shodan.io/cves' \ | jq '[.cves | sort_by(.published? // .Published? // .modified? // "1970-01-01") | reverse | .[:20][]? | {cve_id, summary}]' Note : Make sure you remove the space between https:/ and /cvedb before using the command must be https:// Tool: cvedb.shodan.io

#exploit 1⃣ CVE-2025-50165: Critical Flaw (RCE) in Windows Graphics Component // Windows 11 24H2 x64/ARM64, Windows Server 2025 2⃣ CVE-2025-9491: Windows UI misrepresentation vulnerability // PoC tool for demonstrating the Windows Shortcut (LNK) file vulnerability  3⃣ CVE-2025-60718: Windows 11 Insider Preview EoP // Vulnerability exists in the Windows Administrator Protection feature that allows a low privileged process to get full access to a UI Access process which can be leveraged to access to a shadow administrator process leading to EoP

#Analytics #Threat_Research An analytical review of the main cybersecurity events for the week (November 15-22, 2025) 1⃣  With blazing-fast WiFi 7 speeds come extra security risks // Bitdefender's Practical Tips for Protecting Your Data on WiFi 7 Networks 2⃣  New RCE vulnerabilities in D-Link DIR-878 routers // CVE-2025-60672, CVE-2023-60673, CVE-2025-60674, CVE-2025-60676. The device is still available for purchase, but support ended in 2021... 3⃣  Oracle E-Business Suite RCE (CVE-2025-61882) // PoC + Detect Scripts 4⃣  BADAUDIO Malware // This nearly three-year campaign is a clear example of the continued evolution of APT24’s operational capabilities 5⃣  IBM AIX NIMSH High Criticality Vulnerabilities // CVE-2025-36251, CVE-2025-36250, CVE-2025-36096, CVE-2025-36236 6⃣  Cloudflare outage on Nov. 18, 2025 // The issue was not caused, directly or indirectly, by a cyber attack or malicious activity of any kind 7⃣ Multiple OS command injection in Fortinet API and CLI // CVE-2025-64446 and CVE-2025-58034 ]-> Analytical review (Nov. 8-15, 2025)