fatal7error

#BugBounty @hacker0x01 | Computer Science @unihh | #DeepLearning #Linux #AndroidDev

[Intigriti @intigriti]

Wanna see three brand new OAuth attacks and how our very own @securinti hacked Shopify with a single dot?

It's all in this week's #BugBytes! Along with fantastic resources on Elasticsearch, SAML and API hacking 🗞️👇

https://t.co/3Tstjwvgfk

[HolyBugx @HolyBugx]

My OAuth Checklist while facing them on bug bounty programs.

The link to the checklist: https://t.co/8GjoX7vFwB

#BugBounty #BugBountyTip #BugBountyTips #InfoSec
#TogetherWeHitHarder

[Emad Shanab - أبو عبد الله @Alra3ees]

BugBug Bounty Roadmaps Collection:-

https://t.co/ZY94o3ECbv

[Intigriti @intigriti]

Check out this #BugBountyTip by @Intigriti OG @mr_hacker0007! This technique is often overseen when testing for SSRF, so make sure to add it to your checklist! ✅ #BugBountyTips

[Hack3rScr0lls @hackerscrolls]

Found a hidden HTTP param? Look deeper, maybe there is a mass assignment/autobinding vulnerability.

Sometimes changes in objects are hidden too and you need to closely explore the app.

Source:
https://t.co/9lURrqkxVh

#CyberSecurity #BugBountyTip #BugBounty

[Emad Shanab - أبو عبد الله @Alra3ees]

Computer Science courses with video lectures:-

https://t.co/hpBt6Stajx

[Intigriti @intigriti]

We've seen @c0rv4x put this #BugBountyTip into practice a few times and we're amazed! If you're testing rails or symfony apps, keep this in mind! #BugBountyTips

[m4ll0k @m4ll0k]

Have you ever found yourself in the situation where the server says for e.g: ”customer_id parameter not found", if you put the customer_id parameter in url, the server returns the same error! This tool will help you, creating a combination of the parameter passed as an argument:

[ΡΛSCΛLSΞC @PascalSec]

OIDC, Oauth2, SAML, what you are asking? 🤯

Read this article -> https://t.co/fT4nKvU5Kl

Literally the best security related, most compact read I have found on this!

[Intigriti @intigriti]

Great #BugBountyTip by @JR0ch17: before copy pasting blind XSS payloads, think about the context they might render in! Use blind template injection payloads to increase your chances of success! #HackWithIntigriti #BugBountyTips

[Ammar Amer @cry__pto]

Secure code scanning tools:
Retire.JS
DREK
Clang Static Analyzer
Flawfinder
CPP Check
DawnScanner
Pylint
PHPMD
MobSF
CPP Check
SpotBugs
Infer
ESLint
JSHint
VisualCodeGrepper
Phan
PHP Security Checker
SonarQube
Graudit
PMD
Brakeman
bandit
Dawn
Error Prone
#bugbountytip #Hacking

[Hack3rScr0lls @hackerscrolls]

Got root access to a server? Run 3snake and grab the attention to the server. Wait for admins and grab their ssh passwords!

https://t.co/L6yPqunVpy

Trick by @cherboff

#redteam #cybersecurity #Pentest

[Patrik Grobshäuser @ITSecurityguard]

I just uploaded some of the most common file types for my Patrik's Bug Bounty Tools mind map here:

SVG: https://t.co/IJhzII3XNf
PDF: https://t.co/gyA2RxQbpZ
XMIND: https://t.co/PUC8ur6ldT
PNG: https://t.co/zKucgzsACm

enjoy! 🥰🥳👑

#bugbountytips
#BugBounty

[Hack3rScr0lls @hackerscrolls]

Yet another trick about CORS!

Do not forget to check Origin: null

#CyberSecurity #BugBountyTip #BugBounty

[Vickie Li @vickieli7]

Intro to XPATH injections:
https://t.co/teACyOI9xZ

[Hack3rScr0lls @hackerscrolls]

We continue to talk about attacks on CORS.
This time, we have prepared a set of ideas for bypassing lists of allowed hosts.

#CyberSecurity #BugBountyTip #BugBounty

[𝘻𝘰𝘪𝘥𝘴𝘦𝘤 @z0idsec]

TIP:

Blind XSS in User-Agent

You can also use Auto-Repeater or Chrome Dev tools the more options the better.

Thanks for the tip!!

@NahamSec @d0nutptr @IAmMandatory

Your podcast was awesome as always ❤️ I'm going to donate to XSSHunter Shortly

[m4ll0k @m4ll0k]

Trick that allowed me to find many IDORs..

#bugbountytips #bugbountytip #bugbounty #IDORS

[Web Security Academy @WebSecAcademy]

We've just released a new topic on next-level web cache poisoning, integrating novel research from our research team @PortSwiggerRes #BHUSA

https://t.co/0sZGCOOjuk