panch0r3d

Part time bug bounty hunter full time nerd 😆

[panch0r3d @panch0r3d]

Yay, I was awarded a $5,000 bounty on @Hacker0x01! https://t.co/oAnrrzuNHV #TogetherWeHitHarder

[panch0r3d @panch0r3d]

Just got my first crit triaged which is awesome! Unfortunately it’s on a VDP 😒 It was still a fun moment though!

[panch0r3d @panch0r3d]

@GASTONDERECK Well there’s no for sure way. If it is reflecting something that you provided start giving it weird values like XSS payloads or try CRLF injections or really long values. Basically just start giving it unexpected inputs and see if anything interesting happens.

[panch0r3d @panch0r3d]

This is a good way to view web source code from an iPhone #BugBounty #bugbountytips https://t.co/UKkMmfHUsq

[panch0r3d @panch0r3d]

@hakluke Pretty chill but upbeat enough to keep me focused https://t.co/qqJRcpOBgc

[panch0r3d @panch0r3d]

@Bugcrowd Found a bearer token that gave me access to an api with all customer orders placed through the site. That was fun 😎

[panch0r3d @panch0r3d]

I haven’t done much BB in months but I just got $1k for an info disclosure and I have a cache poisoning XSS being worked on 😎 taking a break seems like it helped me focus

[panch0r3d @panch0r3d]

@DavidYpez4 @0x0SojalSec Both 😂 it’s cool though

[panch0r3d @panch0r3d]

I finally got ffuf to output to a text file in a decent way for automation:

ffuf -w /tmp/wordlists.txt -u URL/FUZZ -r -ac -v &>> /tmp/output.txt ; sed -i 's/\:\: Progress.*Errors.*\:\://g' /tmp/output.txt ; sed -i 's/\x1B\[[0-9;]\{1,\}[A-Za-z]//g' /tmp/output.txt
#bugbounty

[panch0r3d @panch0r3d]

@0x8sksr Unfortunately no, but I would still run directory brute forcing with the .sh extension and the .php extension to see if you can find anything additional

[panch0r3d @panch0r3d]

If you find an API key in JS or somewhere else but aren't sure what calls it goes to you can try this:
gau https://t.co/QMHZrZ41Xs | httpx -silent -mc 400,401,403 | httpx -mc 200 -path "?apikey=keyhere"

#bugbountytip #bugbountytips #bugbounty #apihacking

[panch0r3d @panch0r3d]

@0x8sksr It really depends. Look through the shell scripts for hard coded secrets tokens etc. also look for other scripts referenced in there and see if you can access those. You may also want to do a directory brute force with the .sh extension to check for additional scripts.

[panch0r3d @panch0r3d]

@Bugcrowd Broken? I can’t get the word to work but it’s obvious what it is 🤷🏼‍♂️

[panch0r3d @panch0r3d]

@leo__rac Happy birthday 🎉🎂!!!

[panch0r3d @panch0r3d]

🤔 I’m ranked 2nd on a public program on Hacker One. Sweet!

[panch0r3d @panch0r3d]

@leo__rac Meh I just gave you a few pointers 🙂 you rocked it from there 😎

[panch0r3d @panch0r3d]

@LiveOverflow “The Invitation” is one of the best I’ve seen in a while:

https://t.co/B6H3d9ot8s

[panch0r3d @panch0r3d]

Does anyone else have any automation and do you ever get any bounties from it? I’m trying to beef mine up to do more than sub domains and XSS #BugBounty

[panch0r3d @panch0r3d]

@leo__rac @intigriti Killing it! Way to go!

[panch0r3d @panch0r3d]

Hmmm I went to read the documentation about an interesting site I found and this is literally in there 😂 I guess I have to try it now #rtfm #BugBounty

[panch0r3d @panch0r3d]

@leo__rac @intigriti Nice 😊!!!