Niraj Dhalani

🖥👨‍💻Computer Engineer | Security Consultant

[Niraj Dhalani @niraj_dhalani]

@7h3h4ckv157 not working

[Aditya @ADITYASHENDE17]

Recon Smarter: Finding Sensitive Files in Large URL Lists
Most bug hunters stop at URLs.
Real impact comes from what those URLs expose.
This workflow combines:
• high-risk file extensions
• real-world secret patterns
• automated URL discovery
Result → fewer URLs, higher signal, better findings.

Step 1: Asset discovery
subfinder -d https://t.co/L5yl0Td0lI | httpx -mc 200,401,403,404 | tee domains.txt

Step 2 URL extraction
cat domains.txt | katana | tee urls.txt

Step 3: Smart grep (FILES + SECRETS)
We combine:
• Sensitive file extensions
• High-signal secret regex

cat urls.txt | grep -aiE "\.(zip|rar|tar|gz|config|log|bak|backup|java|old|xlsx|json|pdf|doc|docx|pptx|csv|htaccess|7z)$|(?i)(?:(?:access_key|access_token|admin_pass|admin_user|algolia_admin_key|algolia_api_key|alias_pass|alicloud_access_key|amazon_secret_access_key|amazonaws|ansible_vault_password|aos_key|api_key|api_key_secret|api_key_sid|api_secret|api.googlemaps AIza|apidocs|apikey|apiSecret|app_debug|app_id|app_key|app_log_level|app_secret|appkey|appkeysecret|application_key|appsecret|appspot|auth_token|authorizationToken|authsecret|aws_access|aws_access_key_id|aws_bucket|aws_key|aws_secret|aws_secret_key|aws_token|AWSSecretKey|b2_app_key|bashrc password|bintray_apikey|bintray_gpg_password|bintray_key|bintraykey|bluemix_api_key|bluemix_pass|browserstack_access_key|bucket_password|bucketeer_aws_access_key_id|bucketeer_aws_secret_access_key|built_branch_deploy_key|bx_password|cache_driver|cache_s3_secret_key|cattle_access_key|cattle_secret_key|certificate_password|ci_deploy_password|client_secret|client_zpk_secret_key|clojars_password|cloud_api_key|cloud_watch_aws_access_key|cloudant_password|cloudflare_api_key|cloudflare_auth_key|cloudinary_api_secret|cloudinary_name|codecov_token|config|conn.login|connectionstring|consumer_key|consumer_secret|credentials|cypress_record_key|database_password|database_schema_test|datadog_api_key|datadog_app_key|db_password|db_server|db_username|dbpasswd|dbpassword|dbuser|deploy_password|digitalocean_ssh_key_body|digitalocean_ssh_key_ids|docker_hub_password|docker_key|docker_pass|docker_passwd|docker_password|dockerhub_password|dockerhubpassword|dot-files|dotfiles|droplet_travis_password|dynamoaccesskeyid|dynamosecretaccesskey|elastica_host|elastica_port|elasticsearch_password|encryption_key|encryption_password|env.heroku_api_key|env.sonatype_password|eureka.awssecretkey)[a-z0-9_.,-]{0,25})[:<>=|]{1,2}.{0,5}['\"]([0-9A-Za-z\-_=]{8,64})['\"]"

#bugbounty
#recon
#infosec
#cybersecurity
#pentesting
#websecurity
#hacking

[Niraj Dhalani @niraj_dhalani]

@daviddiaul Intrested

[Niraj Dhalani @niraj_dhalani]

🚨 New initiative just launched! 🚀
Support matters ❤️

👉 Like • Share • Subscribe • Follow

🎥 YouTube: https://t.co/XNyf4ykJdb
📘 Facebook: https://t.co/EVZ3adbMPS
📸 Instagram: https://t.co/aCVxlKVJez

🔁 RT to support
#SupportCreators #FollowNow #NewStart #CyberSec

[Niraj Dhalani @niraj_dhalani]

@Xuser0_0 @Xuser0_0 which commands did you use for perform following actions: - Introspect the database schema - Query sensitive user data, including: - Email addresses - Phone numbers - Names - IDs

[Niraj Dhalani @niraj_dhalani]

@hunter0x7 @Bugcrowd @Hacker0x01 True words💯

[Niraj Dhalani @niraj_dhalani]

@Priyaa_Purohit 0

[Niraj Dhalani @niraj_dhalani]

@ved4vyasan What was the command used ?

[Niraj Dhalani @niraj_dhalani]

@codecancare @theSpaghettiSec @Hacker0x01 Congratulations @codecancare

[Niraj Dhalani @niraj_dhalani]

@Amr_MustafaAA @Besho83298755 Link is not working

[Niraj Dhalani @niraj_dhalani]

@ThisIsDK999 Hi @ThisIsDK999 nice thread btw could you give some insights like how you are finding this groovy console like are you using some tool to find these type of panels and other aem related things

[Niraj Dhalani @niraj_dhalani]

@kuroOowannafly @GodfatherOrwa @Bugcrowd @ADITYASHENDE17 I checked that, but I'm not getting emails. That's why i asked to x fam..

[Niraj Dhalani @niraj_dhalani]

Received email addresses like [email protected] and cba@@bugcrowdninja.com from a client. Any tips on how I can access these mailboxes for testing or verifying? #BugBounty #Cybersecurity #EthicalHacking #InfoSecCommunity @GodfatherOrwa @Bugcrowd @ADITYASHENDE17

[Niraj Dhalani @niraj_dhalani]

Credit : @CristiVlad25
#BugBounty #bugbountytip #bugbountytips #appsec

[🇷🇴 cristi @CristiVlad25]

Finally, it's up!

Uncovering Critical Financial Bugs in a High-Profile Target - [A Pentester’s Diary]

Don't mind if you share :)

#pentesting #fintech #ai #cybersecurity

https://t.co/GpxyMFz0Kq

[Niraj Dhalani @niraj_dhalani]

@bug_vs_me You are lucky as this iframe issue i found in another program but bounty 200$

[Niraj Dhalani @niraj_dhalani]

In July, I submitted 12 vulnerabilities to 4 programs on @Hacker0x01. #TogetherWeHitHarder https://t.co/oM9EHMuDs0

[Niraj Dhalani @niraj_dhalani]

@HeBo117 What scam bro egar to know

[Niraj Dhalani @niraj_dhalani]

@f_aswadi 602