Bug Bounty Tips

💡 A bug bounty tip once in a while, keeps every hunter hacking with a smile! 😃
Account created by @intigriti to host tips for the community, by the community

[Bug Bounty Tips @bug_bounty_tips]

Fuzz all the things, they say. So next time you're testing a Drupal site, remember @adrien_jeanneau's excellent #BugBountyTip! #HackWithIntigriti #BugBountyTips

[Bug Bounty Tips @bug_bounty_tips]

BOUNTY TIP: Get yourself a nice bounty present by buying giftcards with birthday discounts 🎁! Repeat & recycle your gift cards to generate infinite money. 💰🤑Thanks, and happy (real) birthday, @securinti! 👑🎂#BugBountyTip #HackWithIntigriti

[Bug Bounty Tips @bug_bounty_tips]

Alternate data streams sound like this 🤯 to you?

Well, thankfully we have @almroot jumping in to help, telling us how to leak source code or bypass authentication with that 🦀

#bugbountytips 👇

[Bug Bounty Tips @bug_bounty_tips]

SSO redirects can be deceiving 😈 Always scan SSO endpoints before redirection!
Thanks for the #BugBountyTip, @Th3G3nt3lman! #BugBountyTips

[Bug Bounty Tips @bug_bounty_tips]

A PDF file can tell more than you think! Great advice from @QuintenBombeke! #BugBountyTip #HackWithIntigriti #BugBounty

[Bug Bounty Tips @bug_bounty_tips]

Local file inclusion vulnerability found but no idea for further exploitation scenarios? Well, try going for a remote file inclusion vuln 🔥

@PinkDraconian is coming in to help us out today! 🎸

#bugbountytips 👇

[Bug Bounty Tips @bug_bounty_tips]

Woa, this #BugBountyTip from @hakluke works surprisingly well! Someone please automate this 🙏 #BugBountyTips

[Bug Bounty Tips @bug_bounty_tips]

Context is key. Find out what your target cares about to score higher bounties. Great advice from @jackds1986! #BugBountyTip #HackWithIntigriti

[Bug Bounty Tips @bug_bounty_tips]

Ever put yourself into the shoes of a DEV? It's not an easy job and sometimes you forget to remove some dev tools from production code 🛠️

@alph4byt3 is helping us out today with his #bugbountytip! He also has a handy tool to share -> https://t.co/qXOYOhJZph

#bugbountytips 👇

[Bug Bounty Tips @bug_bounty_tips]

In #BugBounty, one character can make a huge difference. Always make sure to also append a slash to your directory bruteforces, so you don't miss out on directory listings! Thanks for the #BugBountyTip, @StanFaas! #BugBountyTips #HackWithIntigriti

[Bug Bounty Tips @bug_bounty_tips]

Start your weekend & your recon with this #BugBountyTip from @hacker_! But remember... always stay in-scope! 😉#HackWithIntigriti

[Bug Bounty Tips @bug_bounty_tips]

Ever dreamed of magically finding SSRF vulnerabilities? 🦄

Well, thanks to @Regala_ and today's #bugbountytip, this is finally becoming reality!

#bugbountytips👇

[Bug Bounty Tips @bug_bounty_tips]

Everyone uses generic wordlists, so unless you want to find duplicates, create your own! Target based wordlists are easy to compile and often result in easy bounties, even on public programs. Thanks for the #BugBountyTip, @Rhynorater! #BugBountyTips

[Bug Bounty Tips @bug_bounty_tips]

Bug bounty tip: if none of your XSS payloads are firing - try to insert them through the API! 😈#BugBountyTip #HackWithIntigriti

[Bug Bounty Tips @bug_bounty_tips]

Finding juicy information is not always a one-step process! 💡

@Random_Robbie helps you with today's #bugbountytip to find your way through the maze!

#bugbountytips 👇

[Bug Bounty Tips @bug_bounty_tips]

One character, 5 digit bounties! 💰
This #BugBountyTip from @filedescriptor (@0xReconless) is a classic example of "think like a developer". 👇 #BugBountyTips #HackWithIntigriti

[Bug Bounty Tips @bug_bounty_tips]

Have you ever checked the text version of a HTML e-mail for template injection? Always make sure to inspect the original e-mail source for hidden treasures 🕵. Thanks for the #BugBountyTip, @honoki! #HackWithIntigriti

[Bug Bounty Tips @bug_bounty_tips]

Found a potential SSRF vuln but no luck? Don't give up just now! 💪

@joohoi is helping us out today with his #bugbountytip 🧑‍💻

#bugbountytips

[Bug Bounty Tips @bug_bounty_tips]

This is your weekly reminder that you can use any arbitrary amount of 0️⃣'s in an IP address to bypass SSRF blacklists. Thanks for the #BugBountyTip, @naategh_! 👌

[Bug Bounty Tips @bug_bounty_tips]

The X-Forwarded-For header turns out to be a perfect place to hide your blind XSS or SQL injection payloads, according to @_zulln. Thanks for the tip, Linus! #BugBountyTip #HackWithIntigriti