Tarunkant Gupta (SpyD3r)

Security Engineer @JioHotstar | Ex @FireCompass | Web Security Enthusiast | Ex CTFer @teambi0s | Ex Organiser of @InCTF & @InCTFj | Author: Gopherus

[Tarunkant Gupta (SpyD3r) @TarunkantG]

@GeniusGracious MongoDB is a NoSQL database that uses a document based data model. So it does not have its own server like MySQL server and hence cannot be directly exploited with gopher using the same technique.

[Tarunkant Gupta (SpyD3r) @TarunkantG]

Generate Gopher payload for exploiting SSRF and lead to RCE, on SSRF vulnerable sites.
I've written this tool for MySQL, FastCGI, Memcached, Redis, Zabbix, SMTP servers.
A detailed description can be found here:
https://t.co/wSpNUqwhSu
#tool #infosec #hacking #gopher #SSRF #RCE

[Cyber Detective💙💛 @cyb_detective]

https://t.co/ZAXhqYZEYy

Search in data leaks database (14, 491, 682, 918 records) by:
First/Last name
Password
IP Address
Phone
VIN
City

and other fields.

(use of the service may violate the laws of your country)

[bobbyrsec @bobbyrsec]

@_JohnHammond @ngriffin_uk @_JohnHammond

Here's a quick write-up:

https://t.co/wciJ6ixhYS

[Intigriti @intigriti]

Recon is an art! Have you ever used Google Tag Manager IDs to find new domains belonging to your target? 🤔

@g0rchy has, and today he's sharing this trick with all of you!

#bugbounty #bugbountytips 👇

[Tarunkant Gupta (SpyD3r) @TarunkantG]

@nojonesuk They had given me a green flag to publish the blog.

[Hossein NafisiAsl @MeAsHacker_HNA]

20 Top Videos to Master Recon 👑

#bugbountytips 🧵👇🏻

[Sayaan Alam @ehsayaan]

Blind SSRFs could be exploited to get RCE if particular services are in-use by server like MySQL etc and the target is following GOPHER redirects, So we can generate GOPHER payload using this amazing tool GOPHERUS by @TarunkantG
#bugbounty
https://t.co/I76BRpdnqR

[Tarunkant Gupta (SpyD3r) @TarunkantG]

#CTF #BugBounty #Infosec #CTFTime #Hacking

[shubs @infosec_au]

Damn. This is really cool. Achieving RCE via LFI using Nginx as a way to upload a temporary file, even when PHP is hardened so other techniques will fail - https://t.co/LYBOKLHgS8

[Tarunkant Gupta (SpyD3r) @TarunkantG]

@_1nt3rc3pt0r_ @DisneyPlusHS Thanks!

[Tarunkant Gupta (SpyD3r) @TarunkantG]

I am delighted to share the good news that I have joined @DisneyPlusHS.
I am very excited to work with Hotstar Security Team and help them to make Hotstar more secure.

Thanks everyone for the support!

[Tarunkant Gupta (SpyD3r) @TarunkantG]

@_abhiramkumar @DisneyPlusHS Thanks Abhiram!

[Luan Herrera @lbherrera_]

A contrived solution for the "Basic context length limit, arbitrary code" impossible lab working on Firefox: https://t.co/Y706j4I0Nl @PortSwiggerRes

[Tarunkant Gupta (SpyD3r) @TarunkantG]

@Yassineaboukir @PaulosYibelo https://t.co/BexpXPtS25

[Tarunkant Gupta (SpyD3r) @TarunkantG]

Actually not only this, we can use "?https://t.co/F5XdizaBr5", "?account+id".
However you can not use "[" twice in one parameter, example: a_b_c != a[b[c, so in these cases you can do "a[b.c"

#security #infosec #bugbountytips #hacking #bugbountytip

[Tarunkant Gupta (SpyD3r) @TarunkantG]

Actually not only this, we can use "?https://t.co/F5XdizaBr5", "?account+id".
However you can not use "[" twice in one parameter, example: a_b_c != a[b[c, so in these cases you can do "a[b.c"

#security #infosec #bugbountytips #hacking #bugbountytip

[Paulos Yibelo @PaulosYibelo]

Parameter Pollution: PHP internally uses parse_str() to parse parameters so it sees the char "[" & "_" as the same. PHP by default will use the last param as valid. In cases PHP is running on backend but front end validates the param, we can smuggle fake params to php. #BugBounty

[Clint Gibler @clintgibler]

@albinowax @theopenssf @IAmMandatory @travismcpeak @Cyb3rWard0g @security_contra @Accurics @praetorianlabs @bernardo_amc Ensuring postMessage Origin validation w/ Semgrep
https://t.co/D5Ar4IgSQH

@TarunkantG Generate Gopher SSRF payloads
https://t.co/Z3VFIyVXOw

Understand your org's attack surface
https://t.co/sMPqJxTl5k

@albinowax Attacking HTTP/2
https://t.co/Mz7suelGWt

[Tarunkant Gupta (SpyD3r) @TarunkantG]

@clintgibler Thank you so much!

[Tarunkant Gupta (SpyD3r) @TarunkantG]

Similar thing happened with me, I reported 2 Criticals(ATO) to a private program and both got duped as they were already known to them from Bugcrowd submissions.

[Julien | MrTuxracer 🇪🇺 @MrTuxracer]

I've just been invited to a private #BugBounty program on @Hacker0x01 that pays decent bounties.

Interestingly, the same company also runs a private program on @Bugcrowd with exactly the same scope, but no bounties at all.

This is next level shit. Seriously.

[Jas502n @jas502n]

#CVE-2021-21972 vmware vcenter unauth RCE

https://172.16.242.130/ui/vropspluginui/rest/services/uploadova

POST:
name="uploadFile"; filename="xxx.tar"

[Tarunkant Gupta (SpyD3r) @TarunkantG]

@Al_Grigor