parth

technology enthusiast ,pursuing engineering

[Bug Bounty Village @BugBountyDEFCON]

Time for another giveaway!

We will pick 6 winners to win one of the following:

1x Annual VIP @hackthebox_eu Licence
5x @PentesterLab 3 Month Licences

To enter:
1️⃣ Follow us @BugBountyDefcon
2️⃣ Like this post ❤️
3️⃣ Re-tweet this post 🔁

Giveaway open until Monday June 15th! GOOD LUCK!

[Jack Rhysider 🏴‍☠️ @JackRhysider]

When I align the OSI layers just right, I achieve network nirvana. My data flow is in such perfect harmony, that I stopped measuring uptime in days, but instead I measure it in lifetimes. ☮️ 🪷

[Abdullah Nawaf (HackerX007)🇯🇴 @XHackerx007]

The writeup is ready
(Subdomain Fuzzing worth 35k bounty!)
I tried my best to make everything clear,and useful
Enjoy :)
https://t.co/k8Erzh8dsq
#BugBounty #bugbountytip #bugcrowd

[Paul Seekamp @nullenc0de]

IDORs are lucrative in app testing and the Authorize plugin is really helpful, but I'm going to share my favorite tip that personally gets me the most coverage.

Match and replace, and it's my favorite way to find IDORs. How do I use it?

👇

[Corben Leo @hacker_]

Understanding how systems work is a competitive advantage as a hacker.

How do you get to this point?

Build.

Code a complex, modern application that relies on:
-> a database
-> caching/memory-store (redis)
-> message broker (rabbitmq)
etc.

Deploy it.

#typefully

[GuidedHacking @GuidedHacking]

🚀Join us as we complete @cyberdefenders RE101
📚6 Challenges for Beginner Malware Analysts
🔍Extracting Encrypted Flags
🔓Decoding in CyberChef
🔧Fixing file headers
🔎Used a debugger to find a flag
🔐Xor Encrypted Strings
🔗https://t.co/PYoIztXPPJ

[The SecOps Group @TheSecOpsGroup]

🥇 FREE Certified AppSec Practitioner (CAP) exam! 🥇
** No Discount Code Needed**

To get the offer:
1. Retweet this post.
2. Fill this Google form -
📄 https://t.co/WVFmLaO3CZ
3. We will email you the exam details. 💯

🔗 Read more about our CAP exam -
https://t.co/iW47bEhG0s

#pentesting #CAPExam #Applicationsecurity #informationsecurity

[Jayesh Madnani @Jayesh25]

🔐Secrets no one will share with you - Here's a technique that might grant you access to takeover other users' accounts using "Login with Facebook":

Are you working on a target site that supports "Login with Facebook"?

Disable email sharing during Facebook login and be ready for unusual design flows that could enable you to take over other users' accounts.

Here's how to disable email sharing when using "Login with Facebook":

1️⃣ Log in with Facebook on any app.
2️⃣ Click "Edit Access."
3️⃣ Uncheck the email address checkbox.
4️⃣ Click Continue.

Here are some scenarios of account takeovers I've reported based on different target app behaviors:

Account Takeover via Linking Facebook Flow:
1️⃣ Went to http://example[.]com, used "Login with Facebook" (Uncheck share email on Facebook).

2️⃣ The target site asked to enter an email to link my FB account as no email was shared from FB. Entered [email protected], a confirmation link was sent to the victim's email to bind the account.

3️⃣ Repeated the same steps on the target site using the same FB account, this time choose to link [email protected] on target site – received the same link as step (2) on the attacker controlled email!

4️⃣ Knowing this, repeated the same steps again to link [email protected], and used earlier link which was received on [email protected] to takeover [email protected] account.

Direct Account Takeover via Login with Facebook:
1️⃣ Went to http://example[.]com, used "Login with Facebook" (Uncheck share email on Facebook).

2️⃣ The target site prompted me to enter an email to link the FB account to an existing account since no email was shared from FB. Entered [email protected]. It directly logged me into [email protected] without any further verification, leading to a complete account takeover.

Pre-Account Takeovers:
Do you have a target app that heavily relies on a user's email domain to grant access to organizations or critical features based on whitelisted domains? Using this technique can help you bypass email verification requirements, allowing you to claim any email. Consequently, you may be able to access critical features of other organizations permitted for emails with the same domain.

Lesson: Always test unusual login flows by logging in with a 3rd party provider without sharing email with the target site. These designs can be flawed and lead to nice bounties! 💰 #BugBounty #CyberSecurity #HackerOne #bugcrowd #securitytips #bugbountytips

[parth @Har5hX]

@TheMsterDoctor1 Send

[X @TheMsterDoctor1]

🔒 Elevate your cybersecurity skills with these courses:

1️⃣ Ethical Hacking From Scratch: 1 folder, 2 files
2️⃣ Python & Ethical Hacking: 3 folders, 2 files
3️⃣ Website Hacking & Penetration Testing: 20 folders, 217 files
4️⃣ Ultimate Dark Web, Anonymity, Privacy: 3 folders, 2 files
5️⃣ Learn Hacking Using Android: 13 folders, 140 files
6️⃣ Network Hacking Continued: 13 folders, 201 files
7️⃣ Learn Network Hacking From Scratch: 2 folders, 1 file
8️⃣ Learn Social Engineering From Scratch: folders, 248 files
9️⃣ Learn Wi-Fi Password Penetration Testing: 12 folders, 99 files
🔟 ARP Spoofing & Man In The Middle(MITM): 2 folders, 1 file

100% Free For First 1000 User's..

Simply:
1. Follow @TheMsterDoctor1 (So I Will Dm) 📥
2. Like and Repost
3. Comment “ Send ” to receive your lonk!! 📚

"I do not own this content. For any issues or concern, please contact the rightful owner directly."

Share this post to spread the word!

👍 #Infosec #Cybersecurity #EthicalHacking #FollowMe #Cybersecurity #Infosec
#infosec #Hacking #infosecurity #Malware #bugbountytips #CTF #BugBounty #vulnerability #pwn #CyberSecurityAwareness #CyberSecurity #cybersecuritytips @SaveToNotion @threadreaderapp #oscp #osed #oswe #osep #osce #hacking #infosecnotes #cybersecurity
#Cybersecurity #EthicalHacking #LearnPython #DarkWeb #AndroidHacking #NetworkSecur

[LiveOverflow 🔴 @LiveOverflow]

The fact that they developed a complete zero-click to kernel chain, JUST to then force the device to open a web page to trigger the "real" chain, is the most bureaucratic exploit I can imagine 🙈

https://t.co/ZCZqQfRUoE

[Cal J Hudson @caljhud]

How to become a Security Engineer in 2024

(and actually get a job)

Here's a step by step roadmap even if have no degree or technical knowledge 👇

[Embedded Systems @embedsys]

⚡Embedded Systems Engineering Roadmap (v1.2.0)

An update easier to read and more practical. More details, along with learning resources, are available here:
https://t.co/Xc6R4zS76x

[Sachin Pandey @sachin_pandey98]

My first Critical on hackerone with a $6,400 bounty — SQL Injection by @AryaaSec

https://t.co/qMpRCpgvvm

[X @TheMsterDoctor1]

➕ USEFUL WEBSITES FOR PENTESTERS & HACKERS ➕

Exploits Database 💥

https://t.co/Z35X6jNrjh
https://t.co/PhtfMhlZeI
https://t.co/0MDpJFoGAe
https://t.co/upMZYGosoi

Vulnerabilities Database  🎯

https://t.co/y3ERKzkbWb
https://t.co/ONiom2Koai
https://t.co/986YVyzCng
https://t.co/lNE1Hn1ApV
https://t.co/U3J42zVEZN
https://t.co/hcqm15FWBg
https://t.co/sGDvrTuGqo
https://t.co/NSOCtd5Yya
https://t.co/Xo4EPy5F5i
https://t.co/nNvRC01DvA
https://t.co/2l48PoyTel
https://t.co/fPQQM2I7OR

Hacking Tutorials 💻

https://t.co/i3Y1Nb3F3i
https://t.co/bK1uhtCYzH
https://t.co/ai4QtPP68g
https://t.co/gGYwyry6L6
https://t.co/FFmEMEX02s
https://t.co/ZzCE3rZ5WJ
https://t.co/Ba9Qt1hccG
https://t.co/hcqm15FWBg
https://t.co/fFvTUE8TmV
https://t.co/jMmbwFjWHY
https://t.co/xKp8Kyd8qW
https://t.co/90agXDh2kA
https://t.co/Dv51yQGlgh

Virus Scan 🦠

https://t.co/K9WlyD5Y7w
https://t.co/d3mCpNYg9P
https://t.co/MNDVBANOlk

--Not distribute to AV--

https://t.co/PKdQcbNjuN
https://t.co/3Oi21htFck
https://t.co/ccjP0PUObQ
https://t.co/GUK1QChZ9p
https://t.co/mTBCzbeaBa

Tools Download 🛠

https://t.co/xAm4EN1ab5
https://t.co/6aM98yukFZ
https://t.co/RabhhFyFEl
https://t.co/I2aXT3ZXS4
https://t.co/TwPliUMQzf
https://t.co/wChR477w1c
https://t.co/hcqm15FWBg
https://t.co/fgIckLZPWa
https://t.co/WrfPqE941y
https://t.co/qyTtFIKeGE
https://t.co/5fArblTz9r
https://t.co/pwQWlRXQW8

[Md Ismail Šojal 🕷️ @0x0SojalSec]

OSCP Journeys and Preparation guides full bookmark 📓

1n/3
-https://t.co/icSyjwRbV0

- https://t.co/BxI1lW7JiB

- https://t.co/uwA9pvlTEL

- https://t.co/Jn4xNtLv9e

- https://t.co/SHcTpuK6tx

- https://t.co/WHRv0qeE9B

-https://t.co/A8AxwbbOwA

-https://t.co/TZwbUFutFO

#OSCP

[DragonJAR - Seguridad Informática @DragonJAR]

LogoFAIL es una vulnerabilidad crítica en la interfaz de firmware unificada extensible (UEFI) que afecta a dispositivos x86 y ARM, incluyendo marcas como Intel, Acer y Lenovo.

El problema se origina en bibliotecas de análisis de imágenes durante el arranque, permite a los atacantes inyectar imágenes de logotipos maliciosas para ejecutar cargas útiles y eludir mecanismos de seguridad como Secure Boot e Intel Boot Guard.

Descubierta por Binarly, esta vulnerabilidad no altera la integridad en tiempo de ejecución pero compromete profundamente la seguridad del sistema. Los proveedores afectados han emitido avisos y la mitigación efectiva incluye la actualización de firmware y la configuración de múltiples capas de defensas en UEFI para más información visita (https://t.co/PT0oYHXTGS)

[X @TheMsterDoctor1]

🔖#SEARCH ENGINES FOR PENTESTERS

01. https://t.co/SUwtICa7YT —> (Server , Vulnerabilities)
02. https://t.co/863j3iqn7t —> (Dorks)
03. https://t.co/9shAcMP5s3 —> (Wifi Networks)
04. https://t.co/68teNksLcl —> (Codes Search)
05. https://t.co/1DsGuoiv40 —> (Threat Intelligence)
06. https://t.co/GwHthyJrAR —> (Server)
07. https://t.co/fvUPZ3pDJA —> (Threat Intelligence)
08. https://t.co/bPjA7RlTAB —> (Server)
09. https://t.co/M0tck9dzol —> (Email Addresses)
10. https://t.co/1kMj2Esd0d —> (Threat Intelligence)
11. https://t.co/rsXkfhqzFr —> (Threat Intelligence)
12. https://t.co/b0VURGvrFU —> (Threat Intelligence)
13. https://t.co/txpnVqmgWH —> (OSINT)
14. https://t.co/jIx7c286YA —> (Attack Surface)
15. https://t.co/qAVo9YGQQw —> (Code Search)
16. https://t.co/F2p3Xkr50D —> (Threat Intelligence)
17. https://t.co/ly0sko6zYS —> (Code Search)
18. https://t.co/jfCFPeL3Xn —> (Attack Surface)
19. https://t.co/uiC5kGAAO3 —> (Threat Intelligence)
20. https://t.co/XtSl8AQ6qO —> (Attack Surface)
21. https://t.co/ZoOdzH2UL6 —> (Server)
22. https://t.co/3SNVM49m71 —> (Certificate Search)
23. https://t.co/GtNzqQJhAz —> (Vulnerabilities)
24. https://t.co/NtylEGKkhn —> (Threat Intelligence)

— Share & Support Us —
➯ Channel : dm me for the channel

[Gareth Heyes \u2028 @garethheyes]

*{color:red;} is the new alert(1)

[ReconOne @ReconOne_bk]

How to get JavaScript files to use for further analysis in the BugBounty

Some ways 👇💣

#recontips #bugbountytips #attacksurface #recon #BugBounty #javascript #js #secrets