spidersec

- Suvadip Kar

[spidersec @SpiderSec]

HTTP Request Smuggling in one Screenshot. 🙂

[spidersec @SpiderSec]

If you’re around for Black Hat Asia Singapore ( April 1-4 ), let’s catch up!

[payloadartist @payloadartist]

⚙️ A lesser known tool, Osmedeus is the closest to Nuclei, that comes with an amazing web UI. You can use custom YAML workflows and vulnerability signatures just like Nuclei.

🔗 https://t.co/AA21Rx7L7p

#bugbounty #bugbountytips #infosec #cybersecurity #Pentesting

[spidersec @SpiderSec]

Nice one!

[Siddhesh Parab @sidxparab]

Just Updated my Subdomain Enumeration Guide with new techniques, fixes, etc.

Have a look 😊
Boost your Recon game !!🚀🚀

https://t.co/MhzM6poLh9

#bugbounty #infosec

[Nate @nnwakelam]

https://t.co/vx7cIbsYVS

This is fucking bananas and I can't believe I missed it.

[Johnny Xmas @J0hnnyXm4s]

hashcat -w 4

[Nicolas Krassas @Dinosn]

Exploiting Redis Through SSRF Attack https://t.co/C9hhxocO65

[spidersec @SpiderSec]

@payloadartist Its always about skills.

[Ahmed Sultan 🇪🇬🇵🇸 @0x4148]

Just created a working POC for CVE-2021-40444 with folks @EG_CERT

[Thanh Nguyen @redragonvn]

Our Pre-Auth RCE exploit for Atlassian Confluence (CVE-2021–26084) was leaked after reporting it to @VMware. They have refused to admit the leak and ignored our emails.

https://t.co/cwainPWv9y

[spidersec @SpiderSec]

@Helpmelearnhack @Devil79830787 North bro.

[spidersec @SpiderSec]

Hard work, new car 🙂🧘

[spidersec @SpiderSec]

@ADITYASHENDE17 Thanks man

[spidersec @SpiderSec]

@satish28888 @satish28888 I personally use these nuclei templets and tools for my day-to-day work, they give good results.

https://t.co/ClVd6nYFsW
https://t.co/lVrxaNhWRv
https://t.co/O81Uo9mmnm
https://t.co/ddeoymQ7Cz
https://t.co/PcHm8yNRm7
https://t.co/4orMT84XHh

[CySuite @CySuite_]

Yet another Account Takeover technique.

Seperator:
[email protected],[email protected]
[email protected]%[email protected]
[email protected]|[email protected]

Array:
{"email":["[email protected]","[email protected]"]}

Follow for more #infosec updates and #bugbountytips

[spidersec @SpiderSec]

@DenFox93 No, 200 is the server response status

[spidersec @SpiderSec]

Rate Limiting Bypass : (429 Too many Requests)

Append the headers to a request where the server is responding with 429

Client-Ip: IP -> 200
X-Client-Ip: IP -> 200
X-Forwarded-For: IP -> 200
X-Forwarded-For: 127.0.0.1, IP -> 200

IP = Random IP Address that you want to spoof

🙂

[spidersec @SpiderSec]

@hummus_ful Yes you are correct, its not a valid test case for layer 4

[spidersec @SpiderSec]

If ip based rate Limiting is implemented, you can block a legitimate user from accessing the website

Client-Ip: Victim-Ip-Address -> 500 request -> Blocked

[spidersec @SpiderSec]

This is mostly effective on : "Ip Based Rate Limiting"

[spidersec @SpiderSec]

@0x01titsec Thanks mate.