B0n3toHack

Web application defender by day, Web application hacker by night.

[B0n3toHack @B0n3toHack]

🔥

[Gareth Heyes \u2028 @garethheyes]

Shazzer will automatically create cheat sheets from all relevant vectors on the system.

https://t.co/JFa5dw7pbt

[B0n3toHack @B0n3toHack]

@XssPayloads @akaclandestine This is blocked by their bug bounty XSS test page - https://t.co/DUUf5MQNOz

[B0n3toHack @B0n3toHack]

@MrDott_ @KN0X55 It’s blocked here on their XSS bug bounty test page - https://t.co/B7e2mUFnRU

[B0n3toHack @B0n3toHack]

Must be old and now fixed - https://t.co/DUUf5MQNOz

[XSS Payloads @XssPayloads]

A cloudflare WAF bypass payload, reposted by @akaclandestine
%3CSVG/oNlY=1%20ONlOAD=confirm(document.domain)%3E

[B0n3toHack @B0n3toHack]

Request for all #BugBounty participants sharing “WAF Bypasses” please include JSfiddle or SQLFiddle links as proof these payloads actually work. So many examples I see do bypass WAF but are broken & don’t execute in DBs or browsers due to obfuscation techniques. #bugbountytips

[B0n3toHack @B0n3toHack]

@KN0X55 Nice!
Context - Case 8 - JS Injection with Single Quote
Obfuscation 1 - Whitespace alt NewLine
Obfuscation 2 - String reassignment for 'e' char
https://t.co/gGKg0G9XfA

[B0n3toHack @B0n3toHack]

@ynsmroztas I assume the app is sending requests to a different domain (vs the normal one for browsers) that doesn’t have WAF protection.

[B0n3toHack @B0n3toHack]

@XssPayloads @shohel_96 JSfiddle example with the right context?

[B0n3toHack @B0n3toHack]

@akaclandestine Got a https://t.co/N1N8W62VvI example PoC? This needs to have an "OR" to test tautology logic correct?

[B0n3toHack @B0n3toHack]

@BlackHatEvents @u21h2 Are you going to release this tool?

[B0n3toHack @B0n3toHack]

@g0ziem @0x0SojalSec I would try to wrap your XSS with html open/close tag and inject a new content-length header that matches your new body size.

[B0n3toHack @B0n3toHack]

w00t!

[Ben Sadeghipour @NahamSec]

📣📣📣#NahamCon2023 CTF registration is open now!

🗓️ Event dates: June 15-17
🧑‍💻10+ categories
💰 $5000 in cash prizes!

Sign up ➡️ https://t.co/tqVAKJnWYN

[B0n3toHack @B0n3toHack]

@0x0SojalSec How are you validating these against CF? Do you have a JSFiddle example of this executing JS?

[B0n3toHack @B0n3toHack]

@fattselimi Did you try to injecting something like this -

[B0n3toHack @B0n3toHack]

@fattselimi I see where you are going with trying to leverage basic htmli into something more severe however an href that a user has to click on isn't imho an Open Redirect issue as there was no legit "redirect" that you are abusing.

[B0n3toHack @B0n3toHack]

@LogicalHunter It is interesting that both these payloads are caught in the CF Cumulus test bed: https://t.co/vt3iGCMvnb\u0065rt,document.cooki\u0065%22%3EClick+Here

[B0n3toHack @B0n3toHack]

@BowTiedCyber @4ng3lhacker

[B0n3toHack @B0n3toHack]

@4ng3lhacker

[TheCyberChef👨‍🍳| Cybersecurity | Educator🇬🇭🎓 @IamTheCyberChef]

To All Beginners in Cybersecurity

I’m here to inform you that

You don’t need a gaming laptop to begin the journey

This should help you get started

Core i5 or i7 CPU
8GB or 16GB RAM
500GB or 1TB HDD

Then, learn the basics

CompTIA A+, Network+ & Security+

Happy learning🤝

[Social Engineering Community @sec_defcon]

Want to help out in the village this year? Our Call for Volunteers is currently open until June 1st!

You can submit here: https://t.co/dEhyAfEBMU

[B0n3toHack @B0n3toHack]

@sec_defcon Do volunteers get a complimentary DEFCON human badge?