The first-ever "Flysec Hack Trip" #FSHT49, has ended, and what an incredible 10 days it was! This #FSHT49 was just for Flysec members only and our members embarked on a journey to the beautiful city of Da Lat, Vietnam where they combined their passion for hacking with the serene landscapes and cool weather:
⚔️ This exclusive event brought together Flysec members to compete in teams, focusing their skills on a single, challenging target: a product from Zoom. Over the course of the trip, participants demonstrated incredible collaboration and ingenuity. Their hard work paid off with a remarkable total of 33 submissions, a testament to the high level of talent and dedication within our community.
❤️🔥 But it wasn't all just hacking. The trip was filled with joyful moments—from team outings to exploring the city's scenic spots.
In short, the Flysec Hack Trip is more than just a competition. It’s a chance to build a community, solve complex problems, and create lasting memories with other cybersecurity enthusiasts, all while traveling.
🚀 The next "Flysec Hack Trip" event will come soon and open for more hackers/bug bounty hunters. Waiting for our announcement!
🥳 I'm in the Top 10 on @yeswehack for May 2025!
This community makes hacking fun and meaningful — thank you all!
Let’s keep hacking happy 💻✨
https://t.co/tFVX2EdUBS
It was an amazing experience in Prague. Although we didn’t make it to the next round, I’m grateful for the effort of all teams and the fantastic events. Big shout-out to Team Spain for giving it your all! Stay tuned for more in the next #AmbassadorWorldCup#Vietnam#Flysec
Give it up for the four teams headed to the next round of the #AmbassadorWorldCup! 🏆 👏
The teams from Greece 🇬🇷, Egypt 🇪🇬, Spain 🇪🇸 and The Netherlands 🇳🇱 dominated the Elite 8 round and will move on to go head-to-head as the final four.
Who do you think will make it to the #1 spot and take home the gold?🥇
Hello everyone ♥
a little bit write-up of #bugbountytip#bugbountytips I am going to write here .....
Title:
getting unauthorized access on 3rd party's/workspaces & and building your checklist for quickly locating bugs there via massive recon
we know that its helpful to look for google
groups/docs/etc..
Slack as well just like when the amazing @h4x0r_dz shared days ago ..
Use google dork "site:https://t.co/ravW2tHHcP"
so I was not in a good mode the last months to doing Google Dorks, so what I did was build a checklist ready for me & very huge one
for EX:
https://t.co/wPxAHXvC18
https://t.co/hs3VHvhT92
https://t.co/ravW2tHHcP
and here is just an example you can add more similar workspaces for your checklist
thin I extracted all internet endpoints and as example here join[.]slack[.]com
https://t.co/OlHQSEQ6Qz
https://t.co/e8jB8H6nMS
https://t.co/w5h4VkESyQ
you can use the ready tools to do it such as waymore
important note: you have to keep your checklist updated every week
and from here I just keep looking for the company name or domain name to see if there's anything connected
and mostly the company name or domain name in the URL it self EX: tesla
https://t.co/QesyI4MHu2
Ex For Bugs found:
1 unauthorized access to the workspaces
(PII | Information disclose)
2 account takeover as Ex: valid signup employee link
3 account takeover as Ex: valid reset password employee link
now about Slack, as an example if you found an invitation link for tesla
Tesla https://t.co/QesyI4MHu2 and that link was not valid, don't stop here
it will redirect for Ex:
tesla-internal[.]slack[.]com
here back and start looking manually for endpoints of this subdomain as well EX:
https://t.co/w2dhvfdBhL
now there are a lot of 3rd party's/workspaces I just shared here
slack & Google Docs/groups
What I wrote is a bit long and annoying to some, so I apologize. I hope, as usual, that this will be useful to all who follow me here.
#Bugounty
don't forget to retweet if you like it ♥♥♥
Congrats🇻🇳squad's good win with 2nd highest score in the 1/8 finals of the #AmbassadorWorldCup, secure a spot in the Elite Eight round at Prague, 🇨🇿!
🔥Flysec has a great hacking experience in AWC 1/8 finals being in Top 1 of Report Leaderboard!
Fighting for semi-final spot!
Looking for a quick and easy-to-use tool to help with file upload vulnerabilities? 😎
Upload Bypass is a simple Python tool that performs checks for several file upload vulnerabilities! 🤑
Check it out on Github 👇
https://t.co/8l6cXsooFM
Congrats our great member @LamScun on being selected as a new HackerOne Ambassador representing Vietnam 🇻🇳 along with @haxor31337
❤️🔥@LamScun and @flysec_corp try our best to hack/secure harder together with 🇻🇳 hackers!
Check out this RedTeam/Pentest notes and experiments tested on several infrastructures related to professional engagements
Credit: https://t.co/EFkryTeMvb
#BugBounty#bugbountytip#bugbounty#bugbountytips
🐛 Bug Bounty Tips: Unlocking GraphQL's Hidden Potential 🌐
When it comes to GraphQL, it's easy to assume that all operations are accessible through a target app's functionality. But by limiting your research, you might miss out on valuable opportunities.
Today, I'll share steps to expand your attack surface on GraphQL target apps, gaining a competitive advantage in finding and reporting security issues that could lead to some rewarding bounties!
1️⃣ Identifying GraphQL Targets: Start by identifying GraphQL targets using the powerful Nuclei Scanning: nuclei -l <targetlist.txt> -t graphql-detect.yaml
You can find the nuclei template at https://t.co/av1sIKpUZh
2️⃣ Retrieve the GraphQL Schema for hidden Query/Mutations: If Introspection is enabled, you can obtain the GraphQL Schema, revealing hidden GraphQL Operations and Mutations using the following GraphQL Query:
{"query":"{__schema{queryType{name}mutationType{name}subscriptionType{name}types{...FullType}directives{name description locations args{...InputValue}}}}fragment FullType on __Type{kind name description fields(includeDeprecated:true){name description args{...InputValue}type{...TypeRef}isDeprecated deprecationReason}inputFields{...InputValue}interfaces{...TypeRef}enumValues(includeDeprecated:true){name description isDeprecated deprecationReason}possibleTypes{...TypeRef}}fragment InputValue on __InputValue{name description type{...TypeRef}defaultValue}fragment TypeRef on __Type{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name}}}}}}}}"}
3️⃣ Visualize with GraphQL Voyager: To visualize the GraphQL Schema effectively and craft your attack vector, use GraphQL Voyager—a powerful tool to help you navigate the schema: https://t.co/43jwfF5SCv
4️⃣ Retrieve Hidden Queries and Mutations: Retrieve GraphQL Queries and Mutations from JavaScript files when Introspection is disabled. These files may list hidden methods not accessible via the app's regular functionality. Try making direct requests to these.
5️⃣ Craft Your Attack: Craft your attack using the identified GraphQL Queries and Mutations. These methods are often vulnerable to various bug classes, including IDOR, RBAC, Race Condition, SQL, and more.
If you can't find more GraphQL Queries and Mutations, don't worry! Stay tuned for upcoming insights on how to brute force and discover hidden ones.
Takeaways: Don't hit a dead end with GraphQL apps. Dive deeper, find those concealed GraphQL Queries and Mutations, and unlock unimaginable functionalities that can lead to significant bounties! 💰🔐 #Cybersecurity #BugBounty #GraphQL #HackingTips #InfoSec #Hackerone #Bugcrowd #GraphQL #SecurityTips #BugBountyTips
FlySec Journey's 1st month:
🔥Fired by A Critical Vulnerability affects massive companies
🔥Write-Up coming soon. Stay tune!
❤️🔥FlySec try our best to save the internet!
#FlySecJourney