Scal3r

RIP' Chelsea. 🐾

[Scal3r @0xScal3r]

Most ppl gets really excited upon a triaged, I get anxiety from externally tracked submissions :/
#BugBounty

[Scal3r @0xScal3r]

@HashKeyGroupCHI AI is definitely used but with manual work, IDORs were typical ones just hidden endpoints. The LFI one was peak for me cuz of how my agent managed to escalate it twice with proper direction from me. If you can imagine the scenario your ai can really do a lot for you.

[Scal3r @0xScal3r]

Tough week, private bbp btw :/
#BugBounty

[Dimple Arora @DimpleAroro23s]

POV: using Claude Fable 5 to rename variables

[Intigriti @intigriti]

when someone asks what my plans are this weekend

[Abdulkadir | Cybersecurity @cyber_razz]

Any USA citizen wanna marry me?

I’m tryna access Fable 5

[Bipin Jitiya @win3zz]

Scan Git orgs 4 secrets:
/(?i)(password|passwd|pwd|secret|token|apikey|api_key|access_key|secret_key|access_token|api_secret|apiSecret|app_secret|application_key|app_key|appkey|auth_token|authsecret)\s*=\s*["'][^"']{4,}["']/ AND org:adobe AND NOT language:Markdown NOT is:archived

[dirty0124 @dirtycoder0124]

Found Algolia key in the DOM using my own Chrome extension. It searches the defined keywords in the DOM and JS files.
https://t.co/sGf3CjgTS8

Exploit the key by following the steps given on
https://t.co/eQk7tJHksV
#bugbounty #bugbountytips

[bugcrowd @Bugcrowd]

If you’re hunting for IDORs or dealing with messy, ID-heavy applications, you need Logger++ in your toolkit.

Logger++ is a Burp Suite extension that helps you track, search, and filter requests. It’s particularly powerful when working with large volumes of API traffic and chasing down leaked IDs.

Features:

🐞 Full HTTP request/response logging within Burp Suite
🐛 Real-time filtering and advanced search to spot patterns
🐜 Saves time when tracing where sensitive IDs are exposed
🪲 Crucial when testing APIs and multi-step auth flows
🪳 Perfect for beginners learning manual request analysis

Install now: https://t.co/oqfjgWx079

[Tur.js @Tur24Tur]

Finally, with @hw16, we managed to bypass the @Cloudflare mTLS protection after around 5 days of work. I'd like to share a few golden tips for bug bounty hunters who might face something similar in the future. But first, here's a quick summary:

The target was a banking app with multiple security layers:
• Heavy Frida detection mechanisms
• Strong root detection
• Google SafetyNet/Play Integrity checks
• Runtime hooking detection
• APK tampering protection (crashed immediately if repackaged/modified)

At first, @fridadotre was detected and crashed the app on my device but strangely worked on another device even though both had the same Android version, root method, Frida server version, and architecture. After investigation, we discovered the app had anti-hooking detection that triggered when using aggressive Frida hooks on sensitive KeyStore operations.

The Solution:
We wrote a minimal Frida script that:
1. Passively monitored certificate operations without modifying behavior

2. Intercepted KeyManagerFactory.init() - the exact moment when mTLS certificates are loaded

3. Extracted the X.509 client certificate and RSA private key (4096-bit)

4. Encoded them using Android's Base64 encoder

5. Formatted as PEM files ready for use

Found the mTLS certificate with a unique UUID-based alias in the Android KeyStore. The certificate was being dynamically loaded during the SSL handshake initialization

Extracted Files:

• client_cert.pem → Client certificate (valid for 2 years)
• client_key.pem → RSA private key (PKCS#8 format)

We then created a PKCS#12 bundle using OpenSSL to combine the certificate and key into a single file, which could be imported into various tools and browsers for testing or @Burp_Suite

Key Takeaway:

When facing anti-tampering mechanisms, be surgical hook only what you need, when you need it. Aggressive hooking triggers detection; passive monitoring flies under the radar.

This was an awesome challenge and my first time encountering such strong ssl Pinning defenses

Attached some image from the mobile api and frida output the certificates

#bugbountytips #frida #Magisk #mtls

[Scal3r @0xScal3r]

@Bugcrowd Burp

[🇷🇴 cristi @CristiVlad25]

How I configure Autorize in Burp Suite 90% of the time, to identify IDOR/BOLA:

- Uncheck Ignore 304/204 (they can often uncover issues)
- Check unauthenticated
- (the first 2 filters are default)
- Filter: Scope items only
- Filter: Ignore OPTIONS requests

#pentesting #appsec #cybersecurity #bugbounty

[Scal3r @0xScal3r]

@YourFinalSin Nice work out there 👏🏻 dude you inspired me to start daily feedbacks like u ♥️

[RogueSMG @RogueSMG]

When testing for IDORs, don't just increment IDs. Try different HTTP methods (PATCH/PUT/DELETE) on the same endpoint with another user's ID.
Sometimes auth is only enforced on the primary method🤡
Found a LOT of such cases over the years :)

#bugbountytips #BugBounty #Pentesting

[X @TheMsterDoctor1]

Advanced Guide to Detecting and Exploiting SQL Injection

Introduction:

In this guide, we’ll delve into a more advanced method for detecting SQL Injection vulnerabilities and efficiently exploiting them using SQLMap. This approach will help identify vulnerable endpoints more accurately and allow for precise exploitation, targeting various databases.

⸻

Step 1: Automating SQL Injection Discovery

To streamline the process of identifying SQL Injection points, we’ll use a powerful combination of tools and commands:

Command:

echo "http://<target>/" | gau | uro | grep "\?" | sed "s/=.*/=A'/" | uniq > params.txt;
cat params.txt | httpx -mc 200 -mr ".*SQL.*|.*syntax.*|.*error.*" -silent

Explanation:
1.gau (Get All URLs): Retrieves a comprehensive list of endpoints for the target.
2.uro: Removes duplicate URLs to reduce redundancy.
3.grep “?”: Filters only endpoints with parameters.
4.sed: Replaces parameter values with a typical SQL Injection payload (=A').
5.uniq: Ensures unique endpoints are recorded.
6.httpx: Probes each endpoint for SQL error messages, displaying only successful hits (-mc 200).
7.-mr: Matches responses containing SQL error patterns.
8.-silent: Reduces clutter for a cleaner output.

Pro Tip:
Add more patterns to the regex search for better detection:

-mr ".*SQL.*|.*syntax.*|.*error.*|.*database.*|.*ODBC.*|.*mysqli.*|.*MySQL.*|.*pgSQL.*"

⸻

Step 2: Analyzing the Results

Upon executing the command, you’ll obtain a list of potential vulnerable endpoints. To further verify these, perform a manual inspection using simple payloads:

Manual Payloads:

curl -s "http://<target>/vuln?param=1'" | grep -i "SQL syntax"
curl -s "http://<target>/vuln?param=-1 UNION SELECT 1,2,3" | grep -i "SQL syntax"

If the response contains SQL syntax errors or related messages, proceed to exploitation.

⸻

Step 3: Advanced Exploitation with SQLMap

Once a potential vulnerability is identified, leverage SQLMap for exploitation. Fine-tune your attack by specifying the database type and increasing risk and level for deeper analysis.

Command:

sqlmap -u "http://<target>/vuln?param=A" -p param --dbms=MSSQL --level 5 --risk 3 --banner --batch --random-agent --tamper=space2comment

Explanation:
•-p param: Specifies the vulnerable parameter.
•–dbms: Indicates the database management system (e.g., MSSQL, MySQL, PostgreSQL).
•–level 5 –risk 3: Sets the level and risk to the highest for more comprehensive testing.
•–banner: Retrieves the database banner for identification.
•–batch: Automates the process by skipping interactive prompts.
•–random-agent: Uses a random user agent to evade detection.
•–tamper=space2comment: Obfuscates payloads to bypass WAF or filters.

⸻

Step 4: Extracting Data from the Database

After confirming the vulnerability, proceed with data extraction. To enumerate databases and dump tables, use the following commands:

Enumerate Databases:

sqlmap -u "http://<target>/vuln?param=A" -p param --dbs

Dump Tables from a Specific Database:

sqlmap -u "http://<target>/vuln?param=A" -p param -D database_name --tables

Dump Data from a Table:

sqlmap -u "http://<target>/vuln?param=A" -p param -D database_name -T table_name --dump

⸻

Advanced Techniques:
1.WAF Bypass:
Utilize multiple tamper scripts to obfuscate your payload:

--tamper=space2comment,between,percentage

2.Proxy for Monitoring:
Integrate Burp Suite for traffic inspection:

--proxy=http://127.0.0.1:8080

3.OS Shell Access:
In case of command execution capabilities:

sqlmap -u "http://<target>/vuln?param=A" -p param --os-shell

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

Top 100 Easy-to-Automate Exploits for Bug Bounty Hunters

SQL Injection (SQLi) – Automate with sqlmap
Cross-Site Scripting (XSS) – Automate with XSStrike or Dalfox
Cross-Site Request Forgery (CSRF) – Automate form discovery
Open Redirect – Automate detection with payload fuzzing
Host Header Injection – Automate with Burp Suite Intruder
Clickjacking – Automate with X-Frame-Options misconfig checks
HTML Injection – Automate input field enumeration
HTTP Parameter Pollution (HPP) – Automate with ffuf
DOM-based XSS – Automate scanning with dom-extractor
Stored XSS via SVG file uploads
Content Security Policy (CSP) Bypass – Automate policy analysis
Subdomain Takeover – Automate with Subfinder & Nuclei
Insecure Direct Object References (IDOR) – Automate endpoint discovery
Directory Listing Enabled – Automate path enumeration
Misconfigured CORS – Automate testing with Corsy
Reflected File Download (RFD) – Automate with URL payloads
Open API Endpoints – Automate API enumeration
XML External Entity (XXE) Injection – Automate testing with XXEinjector
SSRF (Server-Side Request Forgery) – Automate with Burp Collaborator
SSTI (Server-Side Template Injection) – Automate testing with tplmap
Broken Authentication – Automate login brute-force with Hydra
JWT Token Cracking – Automate with jwt_tool
API Rate Limit Bypass – Automate with Turbo Intruder
Excessive Data Exposure – Automate API fuzzing
Mass Assignment – Automate with request parameter bruteforcing
GraphQL Misconfigurations – Automate scanning with GraphQLmap
Unrestricted File Upload – Automate with UploadScanner
Default Credentials – Automate with hydra or medusa
HTTP Method Tampering – Automate detection with HTTP verb tampering
Weak Password Policies – Automate brute-force with JohnTheRipper
Broken Logout Functionality – Automate session validation
Path Traversal – Automate testing with dotdotpwn
Hardcoded Secrets in JavaScript – Automate with SecretFinder
API Key Leaks in Repositories – Automate with truffleHog
Bypass 2FA – Automate OTP brute-force
Authorization Bypass via Parameter Pollution – Automate fuzzing
HTTP Header Injection – Automate with Burp Suite
Misconfigured .git Exposed – Automate scanning with GitTools
Misconfigured .env Files – Automate scanning with gf patterns
Broken Object-Level Authorization (BOLA) – Automate with API fuzzing
Unprotected Admin Panels – Automate discovery with Gobuster
Referrer Header Manipulation – Automate with Burp Suite
Cache Poisoning – Automate with cachebuster
Email Spoofing – Automate SMTP misconfig checks
HTTP Smuggling – Automate with https://t.co/VRu2DoGf29
WebSockets Security Flaws – Automate with wstool
Hardcoded API Tokens in Mobile Apps – Automate with apktool
Weak SSL/TLS Configurations – Automate with https://t.co/XNR72QHSCc
No Rate Limiting on Password Reset – Automate brute-force attempts
Session Fixation – Automate with session token tracking
No Logout Mechanism – Automate logout session handling
Bypassing WAF Rules – Automate payload generation with WAFNinja
No Restriction on Allowed File Types – Automate with upload fuzzing
Improper Server-Side Input Validation – Automate with fuzzers
Deserialization Attacks – Automate with ysoserial
Broken File Download Restrictions – Automate testing for arbitrary file access
Misconfigured Firebase Databases – Automate with firebaseScanner
DNS Zone Transfer Misconfiguration – Automate with dig axfr
Unauthenticated API Access – Automate testing with wfuzz
Sensitive Data in Client-Side Storage – Automate with LocalStorage Scanner
Weak JWT Secrets – Automate brute-force with jwtcrack
GraphQL Query Batching – Automate request testing
Publicly Exposed Database – Automate with Shodan
Bypassing Content-Length Restrictions – Automate with payload obfuscation
Forced Browsing – Automate with dirsearch
LDAP Injection – Automate with LDAPMiner
Leaked Sensitive Data in URL Parameters – Automate scanning with GF patterns
OAuth Misconfigurations – Automate with oauth2Scanner
API Pagination Abuse – Automate API scraping
Privilege Escalation via Role Manipulation – Automate parameter tampering
Exposed Debug Endpoints – Automate with gf and dirsearch
SSRF via Image Processing Libraries – Automate file upload testing
Misconfigured Caching Headers – Automate response analysis
Exposed Web Shells – Automate scanning with Gobuster
CRLF Injection – Automate header manipulation testing
CSP Misconfigurations – Automate with CSP Evaluator
Server-Side Memory Leak Detection – Automate with fuzzing tools
Timing Attacks on Authentication – Automate request timing analysis
Excessive Permissions in Cloud Buckets – Automate scanning with CloudSploit
Bypassing HSTS – Automate protocol downgrades
Log Injection Attacks – Automate with log fuzzing
No CSRF Protection on Critical Actions – Automate CSRF token validation
WebSockets Open to External Origins – Automate WebSocket policy checks
CORS Misconfigurations – Automate testing with Corsy
Missing Secure HTTP Headers – Automate with Security Headers Scanner
Misconfigured S3 Buckets – Automate scanning with AWSBucketDump
Email Enumeration via Login Form – Automate response analysis
Server Misconfigurations in .htaccess – Automate scanning with Gobuster
File Inclusion Vulnerabilities – Automate testing with LFI/RFI scanners
Leaked API Keys in Source Code – Automate scanning with truffleHog
Webhook Security Issues – Automate testing with Burp Collaborator
Default Credentials in IoT Devices – Automate brute-force attacks
User Enumeration via Response Differences – Automate with ffuf
API Token Revocation Issues – Automate token validation
Outdated Libraries with Known CVEs – Automate dependency scanning
Subdomain Enumeration – Automate with Amass
Broken Single Sign-On (SSO) Implementations – Automate OAuth testing
URL Shortener Abuse – Automate with Shortscan
Password Reset Token Leaks – Automate token discovery
Misconfigured WebSocket Authentication – Automate WebSocket auth checks

#BugBounty #EthicalHacking #CyberSecurity #BugBountyHunter #InfoSec #Pentesting #WebSecurity #APISecurity #CyberSec #Hacking #BugBountyTips #XSS #SQLi #OSINT #Automation #SecurityTesting #VulnerabilityScanning #RedTeam #CTF #SecurityResearch #WebHacking #OWASP #Recon #SecurityTools #PenetrationTesting #APIHacking #CyberThreats #HackThePlanet #InfosecCommunity #CyberSecTraining #BugHunting

[Sunil Yedla @sunilyedla2]

Always check for ID’s disclosed in response:
1. Found a json POST request without user ID to fetch user information in the response
2. Adding new parameter “user_id”:&lt;victims ID&gt; in the request body
3. Victims full PII details fetched in response
#bugcrowd #bugbountytips

[Monika Sharma @Commanak46]

Automating Google Dorking for Bug Bounty
Link: https://t.co/M46pOYHmyp

#bugbounty #bugbountytip

[N$🌟 @__nav1n_]

Wayback > hidden subdomain > Fuzz > Intruder > P1 🔥

Found a hidden subdomain https://t.co/iTDtEnMf2C in Wayback Machine dated back to 2019. Got 301 to the homepage in browser. While fuzzing, I found an interesting empty directory: `bin`. Used Burp Intruder and found a directory traversal bug. 💥 #BugBounty