youmedevs

I Make Modern Farmer Website Template with a unique and professional design

[Framer @framer]

Introducing Framer 3.0 with Agents, Branching, Community, and an all-new design. See everything that’s new below.

[youmedevs @6ixytwo]

@emonpixels cool

[youmedevs @6ixytwo]

@CusanoBill hI BILL I'M A GRAPHIC DESIGNER JUST DM IF YOU WANNA WORK

[youmedevs @6ixytwo]

@authorseven26 hI I can make for you better cover and propffesional one just DM'S ME

[encodedguy - jsmon.sh @3nc0d3dGuY]

🔍Digging through JS files to find ports, parameters, sensitive paths, and root domains? I've pushed a new video on youtube. Checkout below.
https://t.co/nUF3NjJyky

[Niraj Mahajan @niraj1mahajan]

Find more IDOR!

#Bugbountytips #Bugbounty #IDOR #vulnerability #cybersecurity #infosec #vapt #penetrationtesting #pentest #bug #bugbountytip #hackerone #bugcrowd

[Professor the Hunter @bughuntar]

Best Checklist IDOR:

#bugbounty #bugbountytip #bugbountytips #idor

[youmedevs @6ixytwo]

@lporiginalg What do you except from a person who worship a cow

[pwd0_ls @ImoJOnDz]

@lud_vy you can try this tool Atlas; it will help you quickly identify the right tamper to bypass WAF without passing through all tampers because It'll take a long time and send a lot of requests, which could get banned by the WAF https://t.co/dkvA3rdKPL

[shay @shaybt12]

add to your JS finder

VITE_SUPABASE_ANON_KEY
https://t.co/VNHxOaHfli

mabye you get lucky and find live token :)

[JS0N Haddix @Jhaddix]

I've dropped my 403 bypass tampers on @DanielMiessler , @g0tmi1k , and I's project SecLists this afternoon.

I have found many bugs with these tricks.

Enjoy 🫶✌️🤫

https://t.co/cjbTBVGCMg

[youmedevs @6ixytwo]

@daoud_youssef @Meta Hi daoud what's your query to find shodan ips belongs to a company

[x1337loser @x1337loser]

@saur1n yup, you can verify the js file from its name like 'example-payments-prod.min.js'

[/ XNL -н4cĸ3r (and @xnl-h4ck3r in the new Sky) @xnl_h4ck3r]

Not sure if you all know about this amazing tool from @glitchedgitz already, and I'm just late to find it, but if not, check it out! 👇🔥🤘
https://t.co/q5o6E71Oan
#BugBounty

[Jayesh Madnani @Jayesh25]

Bug Bounty Tips: Uncover misconfigured Google Drive links, open S3 buckets, Interesting APIs, Secrets, and other sensitive files with JSLuice! 🔍

JSLuice is a powerful Go package and command-line tool for extracting URLs, paths, secrets, and intriguing data from JavaScript source code. Find it at https://t.co/DM70LbSCNR 🚀

Here's my approach to using this tool:

1️⃣ Collect URLs from Katana and Waymore, then filter out .JS files.
2️⃣ Download those JS files using wget or curl and run JSLuice on them.
3️⃣ Filter the URLs extracted by JSLuice using keywords like Firebase, Amazon, CloudFront, Google Drive, etc. Manually investigate the results for bucket/cloud misconfigurations and report them for quick wins.
4️⃣ Repeat this process for other Interesting API endpoints, hardcoded credentials, and valuable data within JavaScript source code.

You can even create custom scripts to monitor JS files for changes, like new links, secrets, APIs, and more.

Learn more about this exceptional tool and its usage here:
https://t.co/lpMwXUTTCN
https://t.co/X9goDCmKZF

Level up your bug bounty game! 🐛💰 #BugBountyTips #HackerOne #BugCrowd #SecurityTips #InfoSec #JSLuice #BountyHunting

[InfoSec Community @InfoSecComm]

🔊 Videos and slides of @samm0uda 's talk at IWCON 2.0 on "Account Hijacking Featuring OAuth and JavaScript" is out.

Check it out here below: https://t.co/CAF5aW8w5G

#bugbounty #cybersecurity #infosec

[Eslam Monex 🕵️🧑‍💻 @eslam_monex]

Alhamdulillah for the blessings،

My first Subdomain takeover (S3 bucket) and my first High vulnerability in HackerOne (private program) by using this tool

https://t.co/HZXV7nFb9G

#bugbountytip #bugbounty

[Bogdan Tcaciuc @bogdantcaciuc7]

http://example(.)com/app?origin=https://evil(.)com/
-
Forbidden

http://example(.)com/app?origin=http:/evil.com/

redirect ->

https://t.co/3dZu4hZ2jV....

🤯

It's always a good idea to revisit your old reports & try to bypass the fix.

[Mayank Pandey🇮🇳 @mayank_pandey01]

A couple of Recent Findings.

1st: Use Arjun [by @s0md3v] on sensitive endpoints. It's highly possible that some other functions use them but with a Hidden Parameter.

2nd: Look for Search Endpoints, they sometimes leak too much info

#bugbounty #bugbountytips #cybersecurity

[youmedevs @6ixytwo]

@TasteAtlas it's very delicious !! One of the best