We just dove into our shelf of archived bug bounty write-ups from the most notable hackers! 🤠
In this issue, we selected 5 compelling articles (that are still relevant today) to share with you, from which you can learn something new! 😎
🧵 👇
Okay i noticed something; as long as the query contains the string ".js", the bypass succeeds; so ext like .jsp,.jsanything bypasses the Page. I will share more information on why this is possible and what layer causes that to happen; i am still studying the case.
OAuth Bypass Testbed
https://t.co/pZ5n7xwqPk
Test your skills against a LOGIN (randomly vulnerable) and/or 17 AUTHENTICATION SERVER endpoints.
Like with JWT (JBroken), our fully automated OAuth tool (OBroken) with complete FFF (Find, Forge, Fire) PoCs, aces this testbed.
Looking for a list of awesome bug bounty tools to run ?
Awesome-bugbounty-tools by @vavkamil is a curated repository of bug bounty tools organized by category, covering everything from recon and fuzzing to exploitation and reporting! 🤠
Check it out! 👇
https://t.co/0RotRmvjWD
@vijay8844@amitkilhor These weren't random passwords. They were weak P-384 private keys, making brute-force recovery trivial. A cryptographic failure, not a sophisticated hack. Strong crypto is useless if key generation fails.
@ShriSwayam@vijay8844@amitkilhor These weren't random passwords. They were weak P-384 private keys, making brute-force recovery trivial. A cryptographic failure, not a sophisticated hack. Strong crypto is useless if key generation fails.