HD

[HD @harshadodderi]

@getsupermoney I can’t pay my credit card bill via PhonePe ,owned by your parent company @Flipkart @FlipkartStories. The app keeps asking me to register repeatedly. If @Utkarshsfbl cards aren’t supported on other payment apps(phonepe) why launch the card? Not a great experience.

[HD @harshadodderi]

@getscapia @scapiasupport hello , app does not even with ios26 . Could you please help or fix this ?

[Jayesh Madnani @Jayesh25]

🌐Bug Bounty Tips: Working on a wide-scope target? Here's how you can discover all related assets! 🕵️‍♂️

Working on a comprehensive bug bounty program? Here are my top 5 strategies to identify all related assets:

1️⃣ IP Ranges: Discover IP ranges using the target's ASN. Visit https://t.co/0pQS70hOLL for a comprehensive list.

2️⃣ Favicon Hash: Use tools like https://t.co/okwcs6vYb1 to obtain the favicon hash of your target site. Find similar sites using the hash with a Shodan search, e.g., https://t.co/XBlzBej10B

3️⃣ DNS Records: Leverage tools like https://t.co/RgUOx5c7Ht to uncover DNS records. Search for domains pointing to the same name servers or MX records.

4️⃣ Associated Domains: Explore domains associated with your target based on factors like registrant orgs and addresses.

5️⃣ Acquisitions: Check for acquisitions via https://t.co/YPdavfLboE and gather all related domains. Apply steps 1 to 5 to these as well.

Feel free to share your ideas in the comments! 🚀 #BugBounty #Cybersecurity #BugHunting #BugBountyTips #SecurityTips #InfoSec #HackerOne #BugCrowd

[Jayesh Madnani @Jayesh25]

🤔Question of the day: How to Spot CORS Misconfigurations?

It is almost year 2024, yet I continue to discover CORS misconfigurations, adding $$$ to my bug bounty earnings each month.

Here's my approach to finding CORS Issues:

1️⃣ Nuclei Scan - Identify vulnerable targets with the cors-misconfig.yaml nuclei template using the command nuclei -u http://target -t cors-misconfig.yaml. You can find the template at https://t.co/UAI5ctNY4y

2️⃣ Manual Approach - If you're manually hunting on a target app and believe that specific GET/POST/PATCH/PUT/DELETE endpoints were missed by nuclei, add an Origin header to your requests with null or your attacker site. Check the response headers for Access-Control-Allow-Origin: <your_arbitrary_origin> or <null> and Access-Control-Allow-Credentials: true.

3️⃣ Craft your POC - To ensure your report doesn't get closed as "Informative" or "NA," provide a working PoC. Here's JavaScript code I host on my attacker-controlled server to demonstrate CORS misconfiguration on a sensitive endpoint:

var xhr = new XMLHttpRequest();
xhr.onreadystatechange = function() {
if(xhr.readyState === XMLHttpRequest.DONE && xhr.status === 200) {
alert(xhr.responseText);
}
}
https://t.co/BoiBScrY4G('GET', 'http://targetapp/api/v1/user', true);
xhr.withCredentials = true;
xhr.send(null);

Takeaways: Always include CORS misconfig-specific checks in your bug hunting checklist. Many target apps are still vulnerable to these Issues, which can lead to a high severity payout. #BugBounty #WebSecurity #InfoSec #CORSMisconfigurations #HackerOne #BugCrowd #BugBountyTips

[Jayesh Madnani @Jayesh25]

Bug Bounty Tips: 🐛 Working on a wide-scope target and need to quickly pinpoint Interesting assets for your security assessment? Here's a nifty one-liner to help you do just that:

1️⃣ Create a list of your target/subdomains in 'targets.txt'.
2️⃣ Use the 'httpx' tool with the '-mr' flag to search for specific keywords. For example, you can look for the term 'register' in the responses using the command like:

cat targets.txt | httpx -mr "register"

🔍 What happens next? You'll get a list of assets where the keyword 'register' appears in the HTTP responses. These assets often lead to registration or sign-up pages. Exploring these can reveal security vulnerabilities waiting to be discovered.

⚙️ Want to take it a step further? Build your custom keyword lists, including terms like 'login,' 'signup,' 'admin', and more. Tailor your searches to uncover assets of interest quickly.

🚀 I've used this simple yet effective technique countless times on expansive scopes to gain an edge in bug hunting. Stay proactive and stay secure! 💡💻 #CyberSecurity #bugbountytips #hackerone #bugcrowd #Infosec"

[Jayesh Madnani @Jayesh25]

You can Install the tool from https://t.co/ISLWOI0WUr

[what_web @jae_hak99]

POST /user/password-reset/ HTTP 1.1
Host : https://t.co/1HcdQpTGyp

Response
- 403 , 404 : False

POST /https://user/password-reset/ HTTP 1.1
Host : https://t.co/1HcdQpTGyp

Response
- 200 , 302 : Success

#bugbountytip #bugbountytips

[what_web @jae_hak99]

#bugbountytip #bugbountytips

POST /user/password-reset HTTP/1.1
Host: https://t.co/QZ9YOzbhEv

- 200OK

POST /user/password-reset HTTP/1.1
Host: https://t.co/a2GcVxwTGu

- 403 , 404 False

POST /user/password-reset HTTP/1.1
Host: https://t.co/mogxHNExCn

- 200 OK - True

[what_web @jae_hak99]

X-Rewrite-Url Header is Can be used to bypass WordPress 403 pages.

POST /xmlrpc HTTP/1.1
Host: https://t.co/abEB8wxYw2
X-Rewrite-Url: xmlrpc.php
X-Rewrite-Url: wp-json/v2/users
X-Rewrite-Url: wp-login.php

Happy Hacking !

#bugbounty #bugbountytip #bugbountytips

[Corben Leo @hacker_]

3/

Resources:
• https://t.co/Tm9HLNo01U
• https://t.co/JnvpWKB4ph
• https://t.co/Rb8wOUup6x
• https://t.co/OWezzvH0MB
• https://t.co/9lOUHu6YW6
• https://t.co/AOvWBZ33aZ

[HD @harshadodderi]

@SBICard_Connect @TheOfficialSBI hey despite my debit card is expired, do you think I need to visit bank to fill a form get the new card ? There is no option to raise a request via app as well .
Do you charge for a card that is expired ?

Just close my account

#worstbank #sbi

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

Giveaway time!!

https://t.co/RAolfsgGFC
https://t.co/qoboRbfyw5
https://t.co/WhcPs0onsI
https://t.co/Oh9SPhpNya

Like, comment, share and follow. I will pick 10 amazing hackers for the following prizes:

- 3x 1 hour coaching call
- 5x endless bundle
- 2x endless bundle + 1 hour coaching call

That is an insane near 4000$ in prizes we are giving away!

Deadline: 29th of december 2023 - 00:01

EDIT: ADDING 10x bug bounty guide to prize pool
EDIT2: ADDING 10x Jenkins course to pool

Much love and good luck!

[Jayesh Madnani @Jayesh25]

🔍 Question of the day: Which tools are your go-to choices for bug bounty automation?

1) amass
2) subfinder
3) github-subdomains
4) findomain
5) assetfinder
6) securitytrails
7) Rapid DNS
8) crt(.)sh
9) dnsx
10) massdns
11) puredns
12) httpx
13) naabu
14) RustScan
15) katana
16) hakrawler
17) wayback
18) gau
19) waymore
20) nuclei
21) Intelx
22) Short Name Scanner
23) axiom
24) ShadowClone
25) anew
26) qsreplace
27) chaos
28) notify
29) ffuf
30) gotator
31) gowitness
32) dorks_hunter
33) dehashed
34) dirbuster
35) LinkFinder
36) Param Miner
37) Arjun
38) clairvoyance
39) sqlmap
40) Ghauri
41) XSStrike
42) dalfox
43) dnsReaper

Let me know If I've missed out on any other Important ones :)

#BugBountyTips #HackerOne #BugCrowd #SecurityTips #InfoSec #CyberSecurity

[Library Mindset @librarymindset]

48 Books To Read In 2024

[Jayesh Madnani @Jayesh25]

Bug Bounty Tips: 🐛💰 Here's a simple bug bounty tip for shopping site targets that can earn you some serious $$$$.

I've stumbled upon 10+ similar issues on shopping sites that allow guest checkouts 🛒.

Many overlook these issues because they require placing an order 📦. However, some services support cash on delivery 💸 or allow you to place a cheap order and then cancel it for a refund 🔄, making it worth adding to your checklist if other prerequisites are met.

Here's what to look for:

1️⃣ Target app that permits guest orders without creating an account 🕵️‍♂️
2️⃣ Target app doesn't require email verification for new account creation, or you've found an email verification bypass on sign-up 📧🔓

If these prerequisites are met, you can often find target apps with a misconfiguration that lets you access a guest user's order history by creating a new account with the same email used for the guest order.

Here's how it usually goes down:

1️⃣ Place an order on the site as a "Guest" and use the victim's email during checkout, e.g., [email protected] 📩
2️⃣ The victim receives an email with the receipt 📧
3️⃣ As an attacker, sign up using the email [email protected] assuming there's no email verification 🧑‍💻
4️⃣ Navigate to the account's order history page, and you might strike gold 🪙 by finding the previously made orders, leading to Order History and PII leaks 🔍📜

Takeaways: Don't ignore workflows involving payments; you might discover workarounds like cheap payments or cash on delivery 💡💳. Test for unusual flows and be ready for pleasant surprises with some lucrative bounties 💰💎 #BugBounty #CyberSecurity #HackerOne #BugBountyTips #SecurityTips #Bounties #infosecurity

[Jayesh Madnani @Jayesh25]

🔐 Question of the Day: How to bypass 2FA?

Here are some of the known techniques using which you could bypass 2FA on a target app.

1️⃣ Password Reset - Initiate a password reset, follow the link, reset the password, and observe if it grants immediate access to the victim's account without having to go through 2FA
2️⃣ Partial Authentication - Log in using credentials, inspect if the server issues session cookies or JWT tokens, yet still prompts for 2FA. In such cases, attempt utilizing the JWT/Session cookies on the target app APIs without circumventing 2FA – it may just work.
3️⃣ OAuth Login - Check if the target app supports logins via platforms like Google or Facebook. Attempt logging in via a compromised OAuth platform and check If it still asks you for 2FA or lets you in directly
4️⃣ Rate Limit Gap - Examine the 2FA implementation for proper rate limits. If it lacks these limits, consider a brute force attack to guess the correct OTP.
5️⃣ Legacy Paths - Explore if the target app has legacy subdomains or outdated mobile apps that might still be using older login endpoints without 2FA enforcement. These routes could provide a 2FA bypass.
6️⃣ Race Condition Magic - During the authentication process, the app might briefly transition through a state where the user holds a valid logged-in session, but 2FA isn't enforced. An attacker could potentially exploit this by sending a login request alongside a request to a sensitive, authenticated endpoint with the valid session, which may result in a successful bypass.

Keep in mind that some programs may categorize these issues as "Informative" because of their high attack complexity, requiring access to the victim's username/password as a prerequisite for these attacks. Stay ethical and responsible! 💡🔒

Please feel free to share your 2FA bypass Ideas in comments below!

#cybersecurity #2FA #bugbounty #infosec #ethicalhacking #bugbountytips

[Jayesh Madnani @Jayesh25]

🐛Bug Bounty Tips: Using "Waymore" to discover more security Issues🌐

In the bug bounty world, having the right tools is essential. While there are many useful ones like waybackurls and gau, let's focus on "waymore" from @xnl_h4ck3r today. It's a handy tool for finding archived URLs, and it can give you an advantage when hunting for bugs.

🕵️‍♂️ Why "waymore"? It's my favorite tool for deep investigations. Whether I'm exploring a specific target or a new area, "waymore" helps me collect ALL the archived URLs I need.

Here's where "waymore" gets its data:

📜 Wayback Machine (https://t.co/gAWRY0MUeD): It stores old versions of websites, which can be a goldmine.

🌐 Common Crawl (https://t.co/nZLLYOdzJr): This resource has a massive amount of web data.

🛸 Alien Vault OTX (https://t.co/QrvZM2ns9A): It offers threat intelligence, including valuable URL data.

🔎 URLScan (https://t.co/Uyq55teG9R): This service scans and analyzes websites, giving you crucial insights.

Now, let's dive into using "waymore":

Installation is straightforward:

git clone https://github[.]com/xnl-h4ck3r/waymore.git
cd waymore
sudo python https://t.co/t3WrbvoEzi install
sudo pip3 install -r requirements.txt

Once it's set up, you can run "waymore" on your target like this:

python3 https://t.co/28vL8nki98 -i target[.]com -mode U

If you want to go deeper, use -mode R to download all archived responses. This sets the stage for local analysis, where you might uncover hidden treasures like passwords or forgotten APIs. 💎

But what's next in your bug bounty journey? 🤔

1️⃣ One-Liner Magic: Check out this list of one-liners at https://t.co/QNkVnXD86A. You can apply these to your "waymore" dataset. With a bit of automation, you'll be surprised by the results! 🚀

2️⃣ Testing Tools: Use tools like dalfox, try out nuclei templates, and other XSS detection methods to find vulnerabilities like XSS, SQLI, SSTI, and more.

3️⃣ Custom Searches: Create your checklist for specific keywords like "user," "admin," "orderId=," "id=," "login," "signup," and others. Tailor your searches to what matters most.

4️⃣ Dive into JS: Look at .JS (JavaScript) files, find API endpoints, and test them for issues like IDORs, information leaks, or hardcoded credentials. The details matter.

And if you haven't found any bugs yet? 🤷‍♂️ Don't worry; there are many creative paths to explore within this dataset. Stay tuned for more insights!

Key Takeaways: Gathering URLs is your secret weapon in bug bounty hunting. Always include testing archived URLs in your research and testing methods – you'll be amazed at what you discover. 🚀 #BugBounty #InfoSec #Cybersecurity #HackerOne #BugCrowd #BugBountyTips

[Jayesh Madnani @Jayesh25]

Show & Tell: Exploiting an Unusual XXE Vulnerability on a Target App 🕵️‍♂️💻

1/ Often overlooked, XXE vulnerabilities can hide in plain sight, especially in apps seemingly devoid of XML calls to the backend. In this thread, I'll walk you through how I discovered and exploited such an issue in one of my pentest engagements.

[HD @harshadodderi]

there is no point in giving 5star ncap rating if car door itself does not lock and has safety feature #tata #tatapunch #TataMotors

[HD @harshadodderi]

@RNTata2000 @TataMotors Hi Sir , Could you please advice Tata motors to fix interior door handle hazard released on punch and altroz ? There are so many negative feedback on it and tatamotors still did not fix it . It’s a child safety hazard