gurux090

Just another cyber security guy on #intigriti #gurux090

[gurux090 @gurudattch]

@hetmehtaa and it's admin:admin123

[bugcrowd @Bugcrowd]

When testing a GraphQL target, verifying array batching is one of the first checks. ☑️ 

Here’s a quick process:
➡️ Intercept a single query.
{"query": "{ user { id } }"}

➡️ Wrap the JSON object in an array and duplicate the query.
[{"query": "{ user { id } }"}, {"query": "{ user { id } }"}]

➡️ If the server returns a JSON array of responses:
[{"data":...}, {"data":...}]
Batch execution is supported.

Now, target high-value mutations like login, submit2FA, passwordReset, or query heavy nested objects to cause an application-level Denial of Service (DoS).

Here’s how you format the brute-force payload for a login mutation. You can easily script this to generate a massive array of credentials:

[
  {"query": "mutation { login(username: \"admin\", password: \"admin123\") { token } }"},
  {"query": "mutation { login(username: \"admin\", password: \"password1\") { token } }"},
  {"query": "mutation { login(username: \"admin\", password: \"qwerty\") { token } }"}
]

Hack GraphQL and catch some P1s. 😎

[雨苁-www.ddosi.org @gov_hack]

HackerOne 漏洞报告排行榜top 100 hackerone-reports
https://t.co/IfdaGW4we7

[gurux090 @gurudattch]

Anyone from the Netherlands, want to exchange https://t.co/t2Tjv6FNvl vouchers DM me

[gurux090 @gurudattch]

Does anyone know how to utilise the https://t.co/t2Tjv6FNvl voucher in India, or anyone know how to exchange

[SusluSec @suslu7616]

Trics;

CSRF

Normal Kullanıcı İsteği (Orijinal JSON İsteği)

POST /api/change-avatar HTTP/2
Host: https://t.co/fx4Usi2e2r
Content-Type: application/json
Cookie: session=abc123

{"avatar_url": "https://t.co/ayglVafo4N"}

CSRF Açığı Olduğunu Anlamak İçin denememiz gerekn Şey

POST /api/change-avatar HTTP/2
Host: https://t.co/fx4Usi2e2r
Content-Type: application/x-www-form-urlencoded
Cookie: session=abc123

avatar_url=https://t.co/m5ZSL68bAk

2. istek başarılı olursa burada #csrf olma ihtimali yüksek
#bugbounty #xss #cybersecurity #websecurity #sqli #infosec #redteam #AppSec #hacking #cybersecuritytips #bugbountytips #informationdisclousure #csrf

[gurux090 @gurudattch]

Got a small Amazon gift reward bounty #bounty #bugbounty #hack

[gurux090 @gurudattch]

Use Code: FIRST100 to get 100/- off your lab purchase

[gurux090 @gurudattch]

Completed the JVP vibe Security test labs really cool, must try and it's free ....
https://t.co/QndrXLHuCx but labs are worth of its pay

[Ahsan Khan @hunter0x7]

Critical: Client-Side Encryption Collapse

https://t.co/nbScR5c6hj
↓
some_javascript.js
↓
Line no 80519 → encObj + base64 key
↓
atob(val) → "Encoded_Password"
↓
CryptoJS.AES.decrypt(encObj, passphrase)
↓
55 configuration properties → 107 operational secrets exposed
→ Azure AD client_secret → OAuth client_credentials flow
→ RSA public keys → Forge encrypted /enc/ API requests
→ HMAC key → Backend-accepted payload signing
→ Direct Line token → Production chatbot access
→ Monitoring / RUM keys → Telemetry manipulation
→ Auth0 + reCAPTCHA config → Auth flow manipulation
→ 31+ encrypted authentication endpoints mapped
↓
Use extracted Azure AD credentials
↓
Request token from Microsoft OAuth endpoint (client_credentials)
↓
Receive valid JWT with high-privilege role (e.g., AllAccess)
↓
“Super token” accepted by backend across protected API routes
(No user interaction required, role-based authorization granted)
↓
All sensitive authentication and account endpoints
were wrapped in client-side hybrid encryption
→ Every request payload encrypted in browser
→ AES-256-CBC used for body encryption
→ RSA-OAEP used to wrap per-request AES key
→ Server accepts any request that decrypts successfully
→ Decryption success treated as implicit authorization
↓
Reverse-engineer encryption module (@**6246)
→ Algorithm: AES-256-CBC + RSA-OAEP (SHA-512)
→ Random 32-byte AES key per request
→ IV derived client-side
→ AES key wrapped with embedded RSA public key (promocode_pem)
→ Final format: { "key": base64(RSA_key), "body": hex(AES_ciphertext) }
↓
Hook JSON.stringify + XMLHttpRequest
↓
Capture plaintext BEFORE encryption (credentials, OTPs, tokens)
Capture encrypted wrapper AFTER encryption
Capture correlated server responses
↓
Analyze MFA implementation
↓
IP-based rate limiting only (lockout resets on IP change)
OTP expiration not strictly enforced server-side
Encrypted payload fields trusted after decryption
↓
Mass takeover method
↓
1. Trigger MFA or password reset
2. Rotate IP to bypass rate limiting
3. Reuse or brute-force OTP under weak enforcement
4. Complete password reset flow
5. Authenticate as victim
6. Capture decrypted OTP and auth tokens via runtime hook
7. Reuse valid 2FA tokens for subsequent authenticated requests
↓
Full attack chain achieved:
→ Extract secrets from client bundle
→ Generate high-privilege JWT (“super token”)
→ Read any plaintext request (credentials, PII, tokens)
→ Forge any encrypted request the server will accept
→ Bypass MFA protections via IP rotation
→ Reset victim passwords
→ Decrypt authentication flows in runtime
→ Mass account takeover

[gurux090 @gurudattch]

@om_patel5 Do not forget to mention server IP and username for more secure check :)

[gurux090 @gurudattch]

@vxunderground Let me clarify the joke there is nothing like that, the search functionality scrapes all the data from the website , not only Epstein files , you can even find some Active Directory Notes too. 🕊️

[gurux090 @gurudattch]

Every time literally, I imagine some shit things that can't be possible, the next a random dude on X posting the same thing with a guide how he manages to did

[dawgyg - WoH @thedawgyg]

Alright so to end 2025 I am going to post something that people have been requesting for quite some time.. As alot know, I have made over $1 million dollars from SSRF vulnerabilities alone. #ssrftips Below I will provide some information on some of the ways that I beat the blacklists/deny lists and cashed in. Any method I post below has worked for me personally in the past. I am not claiming that any of these ways are 'my' discoveries, and in no way am I trying to claim other's work as my own. Simply answering a question that gets asked of me almost daily. #bugbounty #bugbountytips #togetherwehitharder #ittakesacrowd #hackers #hacking #NewYearsEveBountyTips

So lets get into it:

Encoding:
Everyone knows (or should know) about the ability to encode IP addresses. What alot of people dont know is that you can combine encoding types on a single IP. SO instead of encoding the entire IP, encode single octets etc.
Example: Changing the Metadata IP to: 0251.254.169.254 this octal encodes the 1st octet only, leaving the rest of the IP the same. This is the exact method that allowed for my $180,000 from the Yahoo Bug Bounty Program in Oct 2018

Redirects:
Alot of SSRF vulnerable functionality will follow redirects. What many people dont consider is multiple redirects. Never stop at just one. I have found many instances where an SSRF followed all redirects, and would properly block the final redirect to the target internal service (internal ip/metadata server). DO NOT STOP AT 1 REDIRECT! Instead of a single redirect, setup a simple php redirect script that will redirect the request back to the same end point multiple times before finally sending to the target IP/host. I have had many instances in the past where the target properly checks the response of the first 1,2, 3 ....6 redirects then magically on the 7th it no longer performs any valdiation and allows you to hit the metadata. I can't explain why this happens, but its happened enough that this is one of the very first things i test for when it comes to SSRF testing.

TOCTOU:
This is one of my fav's because it almost always can be used to bypass the initial fixes for an SSRF vulnerability. TOCTOU stands for: Time of Check Time of Use. When you pass a url to an SSRF vuln end point, the backend will take the host of this, resolve it (if its not already an IP), check against the allow/block list, then take action. Many frameworks will not cache the DNS lookup response that happens during the initial validation phase. When they forget to do this, having a subdomain properly setup for a TOCTOU check can allow for tricking their checks to allow for hitting banned resources.
How it works: Server resolves https://t.co/aKo0eb63ft to 1.1.1.1 and does their checks to make sure its not a blocked IP. After passing these checks the domain is passed to the function that will actually make the call. If the server did not cache the previous response, it will then resolve the host again as part of the flow to make the request. If you have a properly setup nameserver for this attack, then the instance they make the 1st DNS call, your server quickly changes the DNS entry and points it to the target IP (Metadata/Internal), so that when it gets to the function that makes the request, it resolves the host again and makes the request.

HTTP 2 vs HTTP/1.1 vs HTTP/1.0 vs HTTP/0.9
Several have had success with this in the past. And again, I am not sure why this works sometimes. But if the request is using HTTP/2 and blocks your attempt, try and change it to an older version. I have had success with each of the above at least once (most of the time on Yahoo, but others as well).

Simple/more common things:
dns rebinding, create a hostname on your domain pointing to localhost or an internal IP.

simplify the IP. example: 127.0.0.1 is blocked, so try 127.1, or 0.0.0.0, 0 etc.

Theres tons of other ways that you can get creative and do things like this. This post is just sharing some of the more fun/more unique ways that I have had success in the past. This is not ment to be an exhaustive list of things to try, and is only ment to start your brain working to come up with weird/random/fun ways to beat the black lists.

If you like the information, drop a like/comment/follow and let me know which of the above you have tried in the past, or are looking forward to trying out in 2026. If you end up having success with these, let me know as well!

[gurux090 @gurudattch]

Dear @PathaoBD I have reported a security issue a really long time ago , got resolved but haven't received a bounty ...

[gurux090 @gurudattch]

@k_wijewardhane Subdomain takeover 10.0 how?

[gurux090 @gurudattch]

Burnout and self hate is a part of progress?

[gurux090 @gurudattch]

Found a cool stored xss Bypass On a program at @intigriti
Application accepts only png files but also allows content-type: text/plain : modified first line of html file with PNG header > file upload successfully and boom... got Stored XSS popup

[gurux090 @gurudattch]

@intigriti SSRF, and BAC, Stored XSS and a RCE

[gurux090 @gurudattch]

@coffinxp7 Can you share the generator tool