Raunak Singhvi

XO💀

[Bug bounty wizard @bugbountywizard]

Practical IDOR Hunting: Real Findings From My November Reports https://t.co/xFL68JQuJz #bugbounty #bugbountytips #bugbountytip

[termireum @termireum]

From 403 Forbidden to a €1,500 Bounty
https://t.co/uwD4qPcxM4

[Densel @luckyhacker43]

$1100 Zoho Account Takeover: How a Single Click Can Lead to Full Control over your Zoho account

👨‍💻 @0xUsername
🔗 https://t.co/Imv7chkDac
More On Telegram Channel. Don't Miss. Link On Bio

[Harish @CoderHarish]

Finally I jail breaked chatgpt lol😂😂

[Bug X Hunter 💻 @Bug_X_hunter]

Another Great tool by @divadbate

👉Plution👈

It is Prototype pollution scanner using headless chrome.
#bugbountytips #BugBounty

[mhmd berro (badcracker) @badcrack3r]

⚙️ Simple tool to scan a website for (DOM-based) XSS vulnerabilities and Open Redirects!

created by @_lauritz_ 🔥

https://t.co/8T27f3OcI2

#bugbounty #bugbountytip #bugbountytips #ethicalhacking #hacking #infosec #pentesting #penetrationtesting #hackforgood #vdp

[ReconOne @ReconOne_bk]

[Oh noo] AdobeColdFusion just dropped a crucial security update tackling 3 main issues, including CVE-2023-29300, a pre-auth Remote Code Execution (RCE) vulnerability.

Here is how to detect it with #Nuclei 👇

#recon #BugBounty #AttackSurface #coldFusion #Adobe #cve #rce

[Rohit @7srambo]

Account Takeover Checklist:-
𝐋𝐨𝐠𝐢𝐧 𝐅𝐮𝐧𝐜𝐭𝐢𝐨𝐧:
1. Test brute force password
2. Check OAuth misconfig
3. Test brute force login OTP
4. Check JWT misconfig
5. Test SQLi to bypass auth (admin" or 1=1;--)
6. Check OTP/Token validation
7. Check response manipulation

[Abdelrhman Amin @0xUchihamrx]

always check GitHub for Leaked credentials
tips
org:targetname password ,DB_USERNAME
maybe get some DB credentials
#bugbountytips #bugbountytip

[0xRAYAN 🇸🇦 @0xRAYAN7]

I hate recon but here a good tip :

1 - Get the company IPs range X.X.X.X/24

2 - Run nmap -p 80,448,8080 IP/24 -oN file.txt

3 - Use any IP extractor or API in case of automation or bash then save it on IPs.txt

4- run httpx -l IPs.txt -o final.txt

5 - run nuclei -l final.txt

[Alamin @iam_chonchol]

Harvard University is offering free online courses.

No Payment Needed.

Here are 12 FREE courses to become skilled in 2023 [ Thread ]:

[Donato Scaramuzzo @ramirezVII]

🚨 Some signs of possible Vulnerabilities

/?userId=1 = IDOR
"admin"="false" = B A C
/?check=http://site = SSRF
/?search=12-12-2023 = SQLi
/?title="Hello" = Reflected XSS
/?image=file.jpg = Directory Traversal

#pentesting #cybersecurity #idor #bugbounty #vulnerability #xss #sqli

[Daily OSINT @DailyOsint]

Do you want to discover subdomains?

Knockpy, a modular #python #tool, allows you to do passive and dictionary scans.

https://t.co/QmOrhwKszW

@guelfoweb

#OSINT #reconnaissance #ThreatIntel #cli #BlueTeam #infosec #investigation #intelligence #cybersecurity

[Nithin 🦹‍♂️ @thebinarybot]

🍀 I went back to @Farah_Hawaa 's "5 COMMON CRITICAL/P1 BUGS TO LOOK OUT FOR!" and summarized the video with additional resources you can use to find P1 bugs and earn that $$$$

Check out this thread to know more 🧵👇

[Professor the Hunter @bughuntar]

403 Bypass techniques

#BugBounty #403bypass #bugbountytip

[Luke Stephens (hakluke) @hakluke]

Quickly and easily check URL HTTP response codes with hakcheckurl!

Install hakcheckurl 👉 https://t.co/QbntxSpqil

#haktools #hacking #recon

[Bipin Jitiya @win3zz]

Find leaked API Keys and Secrets using a single GitHub search query

https://t.co/lozYSGv4La

Tip: Never commit your keys/secrets to your public repository

#Security #DataLeak #Hacking

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Injecting Payload In Phone Numbers field !

#infosec #bugbountytip #cybersecuritytips

[Ninad Mishra @NinadMishra5]

JavaScript

Discovery

1.Burp:

Spider and discover content
Sitemap > filter
Sitemap > right-click domain >
Engagement tools > Find scripts

2.WaybackURLs:

waybackurls <domain> |grep -i "\.js" |sort -u

#bugbountytips #BugBounty

[Intigriti @intigriti]

Look at this checkout page 👀

There are multiple vulnerabilities present. Can you spot them all?

We've made a list of 6 of the most common price manipulation vulnerabilities found in the checkout process 👇️