- First Test with (htt[]ps://web.archive.org/cdx/search/cdx?url=*.domain&fl=original&collapse=urlkey)
- Found a subdomain (sub.domain[.]com/scripts/sys_getpass.php?usercode=1)
- Sql Injection found here :D
- I was awarded a $4,050 bounty :D
#TogetherWeHitHarder
Alhamdulillah, just discovered a new bug!
-Tip:
When hunting Open Redirects, try inserting
//evil.com/..;/css in the URL
The server treats it as a local path but the browser redirects outside
Add a .js or .css file at the end.
#CyberSecurity#Hacker101#bugbountytips#BugBounty
Triple Fuzzing :-
If you for example have https://test[.]com:8443/phpmyadmin
# Fuzz :-
1- https://test[.]com/FUZZ
2- https://test[.]com:8443/FUZZ
3- https://test[.]com:8443/phpmyadmin/FUZZ
This technique helped me in getting sensitive files & directories
#bugbountytips
SQLi Pentest Toolkit
Learn & test SQLi hands-on!
🔹 Multi-DB support
🔹 Auto commands + Dorks
🔹 LOXS (time-based)
🔹 Tutorials & method
👨💻 By @adce626 & @coffinxp7
⚠️ Legal & educational use only
🌐 https://t.co/BBEpt5kql8
Want to zero in on endpoints with query parameters only?
Use Katana’s -f qurl flag to extract URLs with query strings!
Perfect for targeting inputs that may be vulnerable.
rXSS via url parameter
1. I discovered reflection in a URL parameter
2. All inputs I submitted were being HTML encoded
3. I submitted the following input: https://sss'"<>, and in the response, my payload was displayed without proper sanitization.
#xss#BugBounty#infosec
1- Found path for portal in wayback
2- Fuzz it
3- Found login page
4- Another Fuzzing
5- See /manage-users.php with big content length but 302 status
6- Setup match & replace with 302 to 200
7- Bypass authentication and access to admin panel
#bugbountytips#bugbounty