Amanuel

Computer Science Student and Interested in Cyber Security

[Amanuel @is_your_boy]

@elonmusk @grok explain this in details

[Intigriti @intigriti]

Testing for file upload vulnerabilities? 🧐

Check out Malicious PDF Generator, an open-source toolkit to help you generate tens of malicious PDF files designed to exploit various vulnerabilities and insecure features found in PDF readers! 🤠

🔗 https://t.co/2rGxRmfyAx

[Amanuel @is_your_boy]

@heywayden Ux

[Amanuel @is_your_boy]

@LinkedInHelp Okay thanks I have set you my Email address. Please check your DMs.

[Amanuel @is_your_boy]

Just woke up to find my @LinkedIn account restricted with no explanation 😞. This couldn’t have come at a worse time! @LinkedInHelp I need your assistance to resolve this please.

[7h3h4ckv157 @7h3h4ckv157]

Hey Hackers 👋

Bookmark & share this Practical Cyber Security Resources!

- Web Pentest 📝
- Mobile Pentest 📝
- Cloud Security & Pentest 📝
- Bug Bounty 📝
- OSINT & Google Dorks 📝
- API Security & Pentest 📝
- Active Directory 📝
- Red Teaming 📝
- AppSec & Code Review 📝
- Exploit Development 📝
.
.
.
etc.

Source: https://t.co/5qIIFsuqQG

Thanks to: @brcyrr

#Hacking #infosecurity #infosec #Pentesting #redteam #pwn #CyberSecurity #CTF #CyberSecurity #BugBounty #cybersecuritytips #CyberSecurityAwareness #bug #bugbountytips

[Wise Chimp @wise_chimp]

Be patient

[Nick Singh | The Data Science Guy 📕 @NickSinghTech]

3 SQL Games that will take your SQL skills to the next level

🧵👇

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

Broad scope bug bounties

When it comes to bug bounty hunting, one of the most important things to do is to gather as much information as possible about your target website. This can include understanding the architecture of the website, identifying all of the subdomains, and scanning for potential vulnerabilities. In this document, we will explore some of the most useful tools for subdomain enumeration, live subdomain checking, subdomain flyovers, port scanning, vulnerability scanning, and targeted scanning.

1. Subdomain Enumeration with Sublist3r

Sublist3r is a powerful tool that can help you collect subdomains of your target website. It does so by scraping various web sources and also using other tools like SubBrute and DNSdumpster. You can use it to create a comprehensive list of subdomains for your target website.

To install Sublist3r, you need to follow some simple steps. First, install python-pip using the following command:

bash
sudo apt-get install python-pip
Next, clone the Sublist3r repository using the following command:
bash
git clone <https://t.co/M5DGNd9AnH>

Then, navigate to the Sublist3r directory using the following command:

bash
cd Sublist3r

Finally, install the required packages using the following command:
bash
sudo pip install -r requirements.txt
To use Sublist3r at its full potential, you can use different switches. For example, you can specify the use of engines (like Google, Bing, etc.) with the -e switch or enable the use of brute force with the -b switch. Here is an example command to use Sublist3r:

bash
python https://t.co/445qOSR50g -d https://t.co/MMXjRZ32vN -e google,bing -b

2. Checking Live Subdomains with httprobe

Httprobe is a tool written in Go that probes for working HTTP and HTTPS servers from a list of domains. You can use it to check which subdomains are live and running.
To install httprobe, you need to follow some simple steps. First, install golang-go using the following command:
bash
sudo apt-get install golang-go

Next, install httprobe using the following command:

bash
go get -u https://t.co/dFxy4AhfAR

To use httprobe to its full potential, take the output from Sublist3r, save it in a file, and pass it to httprobe. The -c switch specifies the number of concurrent requests, and the -t switch sets a timeout. Here is an example command to use httprobe:
bash
cat subdomains.txt | httprobe -c 50 -t 3000
3. Subdomain Flyover with Aquatone

Aquatone is a tool for visual inspection of websites across a large amount of hosts and is convenient for quickly gaining an overview of HTTP-based attack surface. You can use it to get a better visualization of the subdomains of your target website.

To install Aquatone, you need to follow some simple steps. First, install ruby-full using the following command:

bash
sudo apt-get install ruby-full
Next, install Aquatone using the following command:
bash
sudo gem install aquatone

Aquatone takes a list of domain names as input and outputs a directory with screenshots, HTML files, and JSON files containing information about the HTTP response of every host. Here is an example command to use Aquatone:

bash
cat hosts.txt | aquatone -http-timeout 1000 -scan-timeout 300 -screenshot-timeout 3000

4. Port Scanning with Nmap

Nmap is an open-source tool for network scanning and security auditing. You can use it to scan the ports of your target website.

To install Nmap, you need to follow some simple steps. First, install Nmap using the following command:
bash
sudo apt-get install nmap
For comprehensive scanning with Nmap, use different switches for specifying ports, scan types, timings, and output formats. For instance, -p- scans all 65535 ports, -sC uses default scripts, -sV enables version detection, and -oA outputs in the three major formats at once. Here is an example command to use Nmap:

bash
nmap -p-x -sC -sV -T4 -oA output target

5. Scanning with Nikto

Nikto is a Perl-based vulnerability scanner that identifies potential issues and security weaknesses in web servers. You can use it to identify vulnerabilities in your target website.
To install Nikto, you need to follow some simple steps. First, install Nikto using the following command:
bash
sudo apt-get install nikto

To use Nikto fully, use different options to specify tuning, port, SSL, and output file. Here is an example command to use Nikto:

bash
nikto -h https://t.co/DAXb48PfCx -p 443,80 -Tuning 9 -ssl -output result.txt

6. Scanning with Nuclei
Nuclei is a fast tool for configurable targeted scanning based on templates offering massive extensibility and ease of use. You can use it to scan for a variety of vulnerabilities in your target website.
To install Nuclei, you need to follow some simple steps. First, install golang-go using the following command:
bash
sudo apt-get install golang-go

Next, install Nuclei using the following command:

bash
GO111MODULE=on go get -v https://t.co/r8d8w1mzml

Nuclei is designed to be fast and easy to use while providing a high degree of configurability. It uses templates as input to run scans. You can specify a list of targets, choose a template, set timeout, and even specify the number of concurrent requests. Here is an example command to use Nuclei:

bash
nuclei -l target_urls.txt -t nuclei-templates/ -timeout 3 -c 50

While all of these tools can be effective, they can also be resource-intensive or noisy from the perspective of a system administrator. It is important to remember that when using these tools, to use them responsibly and ethically. You can also use other tools, such as dnsrecon, dnsenum, etc., to gather more information about your target website.
Checklist
[ ] Gather information about the target website

[ ] Use Sublist3r to collect subdomains of the target website

[ ] Use httprobe to check which subdomains are live and running

[ ] Use Aquatone to get a better visualization of the subdomains of the target website
[ ] Use Nmap to scan the ports of the target website
[ ] Use Nikto to identify vulnerabilities in the target website

[ ] Use Nuclei to scan for a variety of vulnerabilities in the target website

[Bishop Fox @bishopfox]

Today's #redteamtool is discover from Lee Baird. Use these custom #bash scripts to automate various #pentesting tasks including #recon, scanning, enumeration, and malicious payload creation via #Metasploit. #KaliLinux required; check it out today! https://t.co/nK6emUZdiA

[Pratham @Prathkum]

You should start using these AI tools for your various tasks:

1. Write bug free Code
https://t.co/9CaiJzJSra

2. Design logo, poster, more
https://t.co/OBnTpEFSUS

3. Writing
https://t.co/xx72rAIPAp

4. Search engine and notes taking
https://t.co/RrWKsoM1nK

5. Emails
https://t.co/Me2C5zD2RA

6. YouTube video to proper course
https://t.co/zMHZhyXD5H

[Het Mehta @hetmehtaa]

𝐅𝐑𝐄𝐄 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐞𝐫𝐭𝐢𝐟𝐢𝐜𝐚𝐭𝐢𝐨𝐧 𝐢𝐧 𝟐𝟎𝟐𝟑 :
𝐁𝐫𝐞𝐚𝐤𝐢𝐧𝐠 𝐢𝐧𝐭𝐨 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲

#Infosec Thread
👇

[Intigriti @intigriti]

Did you know a new JWT Attack was recently published?! 🤯️

CVE-2023-30845 bypasses JWT checking by using the X-HTTP-Method-Override request header!

[Intigriti @intigriti]

4 Tools to help you automate JWT Attacks 🧵👇

[TRÄW🤟 @thatstraw]

I just finished reading this fantastic book by @francecarlucci and wanted to share this with you all.

Comment down👋so I can DM it to you.

Make sure to retweet so that others can benefit as well.

[haksec.io @haksecio]

🕸 Mutillidae - https://t.co/CiI4mn5KJq
🥋 Web Security Dojo - https://t.co/yFn7Z6AAS1
🧃 Juice Shop - https://t.co/NCqMphtHZ9
🔮 Broken Crystals - https://t.co/ASof8Lhjsq
🏦 Altoro Mutual - https://t.co/Iw63FWhiYE

🧵 2/2

[haksec.io @haksecio]

10 intentionally vulnerable web applications to practice #hacking:

🐝 bWAPP - https://t.co/fQpALZGrnF
🦫 DVWA - https://t.co/roiBaWNreu
🧀 Gruyere - https://t.co/aPQb5yFg0s
🐐 WebGoat - https://t.co/34zR2FbfCj
🛡 Metasploitable - https://t.co/ieltFmL3W0

Thread 🧵👇

[Justin Gardner @Rhynorater]

Becoming a pro in finding client-side bugs is simple. Not easy, but simple.

1. Go through a JS tutorial and understand the basics.
2. Ready everything on this blog 8x until you understand it: https://t.co/OxfS2YJmbr
3. Read JS for Hackers by @garethheyes 4x

Then go hack stuff