MrpentestGuy

Security Researcher

[divyanshjain @itsdivyanshjain]

@CristiVlad25 built my own tool https://t.co/3aq4sh113o

[Aryan Bhetwal @yamarajislitaf]

Arjun + Piper + Knoxnl + @KN0X55 = XSS

cc: @xnl_h4ck3r @KN0X55

Found a path for creating address.
Used Arjun for finding parameters
Used Knoxnl + Piper + Knoxss API key
Found Reflected XSS, Escalated to Account Takeover.

[Erick Fernando @erickfernandox]

If the WAF doesn't allow the creation of a JavaScript term like 'alert' or 'confirm' in any way, write it inverted and then use reverse() with self[].

Payload:

<a%20href=%0dj	avascript:x='trela'.split('').reverse().join('');self[x](origin)>

#Bugbounty #AkamaiBypass

[hackerhijeck @ManabjyotiDow]

@nav1n0x https://t.co/zQo9ihJt6F

You can use this site for testing xss

[Coffin @lostsec_]

Best list of top xss Polyglots to Bypass WAF's
https://t.co/pRB67xTGI0

[Valerio Brussani @val_brux]

This is honestly one of the best pieces of web security research I have read in years
https://t.co/Y4cZwcsYam

[mr noob @MrXssor]

add this to your wordlist /buildPasswordreset.xml
its contain CVS repository credentials and Sensitive Information ...
#bugbountytips

[MrpentestGuy @MRiambatman]

@mijanhaque_ @coffinxp7 I mean sudo apt update && sudo apt upgrade

[MrpentestGuy @MRiambatman]

@mijanhaque_ @coffinxp7 Sudo update && upgrade
Install all the essential tools . Make sure you have installed python properly.

[Yunus Emre Öztaş @ynsmroztas]

If you encounter the default IIS Windows window, do not forget to add /haproxy and /netdata to your wordlist and scan them, if you gain unauthorized access here, you will earn a reward 🌹🥰

#bugbountytips #BugBounty

[MrpentestGuy @MRiambatman]

@narendramodi What kind of PM are you. Because of you she had the most worst phase of her life. Things will change You will also see the worst phase in your life as well. That day you will remember how you tormented someone's life and efforts.
#uselessmodi #uselesspm

[Karim Habeeb @NoRed0x]

Add 'app/config/config.local.neon' to the wordlist, and maybe you will get juicy data. Enjoy!

#bugbountytips #bugbountytip #cybersecurity #ethicalhacking

[Het Mehta @hetmehtaa]

Bug Bounty Checklist for Web Applications
https://t.co/hAn7VLy8Q6

[Masato Kinugawa @kinugawamasato]

ooh, this works on Chrome Canary :D
<input type="hidden" oncontentvisibilityautostatechange="alert(/ChromeCanary/)" style="content-visibility:auto">

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

I used BBOT to enumerate subdomains, and I found New subs I had never seen in My Targets!

Very Very useful on Large targets

https://t.co/U96KyE2fnE

#BugBounty #bugbountytips #infosec

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

How I Exploited an Auth0 Misconfiguration to Bypass Login Restrictions
https://t.co/Fyh0OX3TzG

#bugbounty #bugbountytips #bugbountytip

[dirty0124 @dirtycoder0124]

#bugbountytip #BugBounty
A list of companies that accept responsible disclosure
https://t.co/m4y85jZhHQ

[N$🌟 @__nav1n_]

I recently found a cool #RCE/path traversal bug on a target in Intigriti. It was rejected because of OoS :( But I am proud that I found this cool bug through a full manual testing of the endpoint. This video just simplifies the steps, but I took hours to figure out. #BugBounty

[MrpentestGuy @MRiambatman]

@nav1n0x Thank you buddy