cmx

[Rikesh Baniya @rikeshbaniya]

~ tried @deepseek_ai w @claudeai code
~ consumed 350M tokens in a day
~ cost me just about 6$ in total

~ found a SSRF bypass worth 2500$ 💸💰

#BugBounty #bugbountytips

[cmx @Clim4xog]

@bsysop @Bugcrowd @RelentlessT7 can you pm me please? you messages are blocked.

[cmx @Clim4xog]

@gilileoB לא

[cmx @Clim4xog]

@thedawgyg No brain sometimes is great luck. I guess you already know that.

[cmx @Clim4xog]

@KarivGilad אחלה מרדכי

[cmx @Clim4xog]

@hasolidit את בכלל עוד מתעסקת בדברים שקשורים לכלכלה?
אני שואל ברצינות ולא בקטע רע.
פשוט ניראה שאת נטו בקטע על "הממשלה חרא".

[cmx @Clim4xog]

@Daniazlan6 Imagine you are not a dog shit
What a great feeling could it be @Daniazlan6

[Het Mehta @hetmehtaa]

Top 8 MCP servers for cybersecurity:

1. Wiz MCP Server
— cloud security
🔗 https://t.co/fDEXJwbTd5

2. Cloudflare MCP Server
— Infrastructure and security
🔗 https://t.co/sO9LQPPRHJ

3. PortSwigger MCP Server
— Webapp security testing
🔗 https://t.co/EyPoPUCqCB

4. GitHub MCP Server
—  Developer security & automation
🔗 https://t.co/JTpHwGtcR3

5. https://t.co/TUC3UaFy4m MCP Server
— API Security
🔗 https://t.co/7tPWfYvsuA

6. Check Point Software Point MCP Server
— Network and threat prevention
🔗 https://t.co/Yr15KnTUrP

7. Google MCP Security
— Cloud security and threat intelligence
🔗 https://t.co/8IXJTz99u8

8. Elastic Security MCP Server
— SIEM and detection
🔗 https://t.co/0BI4Xw6OaB

[Sina @_SecurityAttack]

Race Condition + Host Header Injection + Redis(Cache)= Zero Click XSS
The first attempts were not successful and the reflect was not observed, but using the RACE, I saw that my sampler is displayed for the rest of the users
🫥
I will publish it after permission.
#BugBounty

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

🚀 Sensitive data leakage using .json

Here’s a tip to achieve sensitive data leak using .json extension.

Notice the added .json extension in our request which resulted in obtaining the secret token!

#bugbounty #bugbountytips #bugbountytip #hackerone #bugcrowd #infosec #cybersecurity #pentesting #redteam #informationsecurity #securitycipher #technology #coding #code #recon #ai #llm #owasp

[HackGit @hack_git]

Nuclei Bug Hunter

I will upload more #nuclei templates that help bug bounty Hunters.

https://t.co/pxt5eHLYg6

#infosec #pentesting #bugbounty

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

How i am hunting for phpmyadmin logins:-

nuclei -l live-subs.txt -t nuclei-templates/http/exposed-panels/phpmyadmin-panel.yaml

## Then :-
- Test for default creds : root & password,..etc
- Fuzzing
- Test SQLi
- Response Manipulation

#bugbountytips #cybersecurity #Security

Credit - @wadgamer10

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

#bugbountytip #bugbountytips

i found phpmyadmin template on nuclei
phpmyadmin-setup.yaml

next step edit that template for
/admin/

template endpoint was [/pma/setup/index.php]
i found 2 on [/admin/pma/setup/index.php]

happy hunting ♥
#BugBounty

[Ravindra Lakhara🇮🇳 @RootxRavi]

Easy P1 😀 #bugbountytips #bugbounty
Endpoint
/elmah
/ELMAH
or you can use the below Template to find out the issue
https://t.co/FoVjxHBnki

[cmx @Clim4xog]

@kaks3c @Bugcrowd There is no impact if you cant do anything with the key

[JS0N Haddix @Jhaddix]

Bug bounty hunters: want a #bugbountytip on finding the right public programs to participate in?

1️⃣ Look at some of the more successful bounty hunter's profiles (if they are public)
2️⃣ Scroll down to their most awarded or participated in.
3️⃣ Hack those. There's vulns there.

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

95% from hunters remove pics from endpoint
my steps
gathering all target endpoints
filter the results just for pic extensions
(cat endpoints.txt | egrep 'jpg|jpeg|png' > results.txt)
filter to live
send results for screenshot tool

1/2
#bugbountytips #bugbountytip #bugbounty

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

url/?f=etc/passwd ==> 403
encode etc/passwd as base64

url/?f=L2V0Yy9wYXNzd2Q= ==> 200

#note
you can use this trick in SQL , SSTI , XSS , LFI , Etc...

#bugbountytips #bugbountytip

[Ali @111xNagashy]

Tip :

1-Site https://t.co/HsP3izDRcl
2-Add first subdomain in first directory .sql.gz like
https://t.co/hYyYcTdjur

Severity depending on content of files most of time is (Critical)

#bugbountytip #bugbountytips #bugbounty #hackerone #bugcrowd #h1

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

🚨 Bug Bounty hunting - Udemy Couse 🚨

Source : https://t.co/BV3igqzzZp

#bugbounty #bugbountytips #bugbountytip #hackerone #bugcrowd #infosec #cybersecurity #pentesting #redteam #informationsecurity #securitycipher #technology #coding #code #recon #ai #llm #owasp