PARIKSHIT PINGLE

Do smart work, not hard work 😎😎

[Nitin Gavhane @NitinGavhane_]

Android app vulnerabilities for bug bounty hunters

Here’s a thread to guide you through common vulnerabilities, how to find them, and some examples to kickstart your journey.

Let’s level up your skills! 🧵

#BugBounty #AndroidSecurity #CyberSec #cybersecurity #EthicalHacking

[Aryan Bhetwal @yamarajislitaf]

Arjun + Piper + Knoxnl + @KN0X55 = XSS

cc: @xnl_h4ck3r @KN0X55

Found a path for creating address.
Used Arjun for finding parameters
Used Knoxnl + Piper + Knoxss API key
Found Reflected XSS, Escalated to Account Takeover.

[William | IA @ia_william]

Chat GPT is a cash machine

But most people don’t know how to make more than $6,200 a month with it

Here are my 4 simple steps to do it ↓

[N$🌟 @__nav1n_]

Use #ProxyChains to trick #WAF. I was working with @jayesh25 yesterday on an SQLi and had trouble with the WAF. However, by using ProxyChains, I successfully bypassed it WAF. Make sure you know how to configure it correctly and use good proxy lists.

#bugbountytips #SQLi

[HackTube5 @HackTube5]

Find Easy XSS during your recon process beginners guide #bugbounty #bugbountytips https://t.co/53Nyjn0LNX

[dirty0124 @dirtycoder0124]

#BugBounty #bugbountytips #bugbountytip #blindxss
This script can crawl the website and find URLs that contain HTML Forms. Very useful for me to find Forms for Blind XSS.
https://t.co/CgioRiHF2k

[Raman_MG @Raman_Mohurle]

Great weekend on H1 @Hacker0x01

Found /.git/config while fuzzing ( medium )

used GitTools : https://t.co/a0DhwhXhpZ to dump whole .git directory form server

Found DB creds in dumped files which are not accessible directly ( Critical )

#bugbountytip #bugbountytips

[PARIKSHIT PINGLE @paresh_pingle]

@krishnsec which automated tool is it ?

[Emad Shanab - أبو عبد الله @Alra3ees]

“My First Account Takeover Via Password Reset Poisoning” by cyberpro151
https://t.co/4ybbUhyFqH

[Emad Shanab - أبو عبد الله @Alra3ees]

“Shodan - “Unauthorized access to setup panel”” by mo9kHu93r
https://t.co/FOnTlVgpAr

[Emad Shanab - أبو عبد الله @Alra3ees]

“How I Discovering the Origin IP In Bug Bounty — Bug Bounty Tuesday” by kerstan
https://t.co/3dQRCKmKBj

[Mike Takahashi @TakSec]

XSSHunter-go by @AdamJSturge 🚀

📲 Sends notifications to Slack, Discord, Telegram, and 18 other options

https://t.co/TQ94LYa3KZ

[Divyansh Sharma @divyansh2401]

How I found my first RCE on Bentley in 2020

Give it a read, Maybe you will learn something new.

https://t.co/ra4DKKmTOI

#bugbountytips #bugbountytip #BugBounty #cybersecuritytips #TogetherWeHitHarder #pentest #pentesting #CyberSecurity #appsec

[Emad Shanab - أبو عبد الله @Alra3ees]

When you are hunting for blind XSS. Go to forget password and add admin@company .com and add your blind XSS payload on the header.
Easy way and it will logged on admin log, if he checked his account you will exploit his account.
#bugbountytips

[Nithin 🦹‍♂️ @thebinarybot]

Finding origin IP is super useful to test for vulnerabilities when there's a WAF protection.

Here’s how you can find Origin IP 👇

[dirty0124 @dirtycoder0124]

#bugbountytips #bugbounty
Automation Hacks: Unearthing a Critical RCE the Easy Way
https://t.co/WVXxpj6s83

[KNOXSS @KN0X55]

Here's how fast the #KNOXSS API can reply with a FULL PoC, ready to be reported!

Just 1 second 🤩

in the classic TestPHP VulnWeb search page!

curl https://t.co/T3tFrmW0oA -d "target=https://t.co/dUJaLdu8dC" -H "X-API-KEY: exxxxxx3-0xx9-4xxc-9xxe-6xxxxxxxxxx6"

Try it yourself!

[Abdelrahman Yousef @0xWh0_4m_1_]

And yes, Jenkins CVE-2024-23897 was accepted !
Tip: Always use shodan to search for CVES.
here is the shodan query -> product:Jenkins -"2.442"-"2.426.3" then use @h4x0r_dz POC

#BugBounty #vulnerabilities #rce #bugcrowed #bugbountytip #bugbounty #CVE #security #Jenkins

[Nithin 🦹‍♂️ @thebinarybot]

8 one-liner commands to make your bug bounty life easier 👇

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

Slides of my talk in bsidesodisha
about

•Build your setup for hunting
Tools , Extensions , Etc…

• Quick Orwa Methodology 2023

• SQL Injection

• and for sure #bugbountytips

https://t.co/CJY6VgUKP2

feel free to ask about anything in comment and will try explained ❤️❤️