pseudogxd

Okay.

[Abhishek @aacle_]

🔰 How to Find XSS Like a Pro

Thread 🧵:👇

[AminDD @_AminDD]

Recon always wins.
1) Company and web application recon
2) Find legacy subdomains [This is my favorite :) ]
3) Parameter fuzz with private wordlist
4) Check reflection and XSS

#bugbountytips #BugBounty #bugbountytip #cybersecuritytips

[Avraham Eisenberg @avi_eisen]

The other day I deployed a shitcoin called Mango Inu and did absolutely no promotion. It got over 250k invested/gambled in like a half hour.

We're still so far away from the bottom.

(to be clear if you buy this you will definitely lose all your money)

[Maple Mapleson @MaplesonMaple]

I have working XSS https://url/%3cimg%20src%3da%20onerror%3dalert(document.domain)%3e. Can I source external javascript from within <img> tag? I need to src https://t.co/CqYRrdFRjj @brutelogic #XSS

[🐞Sara Badran @SaraBadran18]

DIOS technique is an excellent #SQL_injection technique, shortening the time and requests needed to dump SQL DB
In this quick thread, I will explain a DIOS payload that is capable of bypassing WAF.
-
#hackerone #BugBounty 
#bugbountytips
#bugbountytip #hackeronereport
#writeups

[Neh Patel 🇮🇳 @thecyberneh]

New Writeup:-
$6000 with Microsoft Hall of Fame | Microsoft Firewall Bypass | CRLF to XSS | Microsoft Bug Bounty

https://t.co/rsVtkipcR2
#bugbountytips #cybersecuritytips #bugbounty #writeup

[ShreKy @shrekysec]

#XSS payloads for https://t.co/8KFXwt855p endpoints:

/(A('onerror=%22alert%601%60%22testabcd))/

/Orders/(A(%22onerror='alert%60xss%60'testabcd))/Login.aspx?ReturnUrl=/Orders

(A(%22onerror='alert%601%60'testabcd))/Login.aspx?ReturnUrl=%2f

For more ➡️ https://t.co/qwvY1MFRec

[publiclyDisclosed @disclosedh1]

Reddit disclosed a bug submitted by criptex: https://t.co/0Siut5D0OX - Bounty: $5,000 #hackerone #bugbounty

[XSS Payloads @XssPayloads]

Escalating SSTI to reflected XSS using curly braces {}, a good artcile by @Sagar__Sajeev
https://t.co/vvg0ky6vcB

[The Bug Bounty Hunter @tbbhunter]

Worldwide Server-side Cache Poisoning on All Akamai Edge Nodes ($50K+ Bounty Earned)

https://t.co/OwMEgoSsf1

[Rood @0x_rood]

Good write up about how to use google dorking effectively

https://t.co/VvUAPv9IAA

#bugbounty #bugbountytips

[🐞Sara Badran @SaraBadran18]

Clickjacking on Google My account = bounty 7,500$🔥🔥🔥
--------
By @LocalHost31337
-------
https://t.co/Rq30IgEXUb
-------
#hackerone #BugBounty 
#hackeronereport
#writeups #Bugbountywriteupspublished
#bugbountytips
#bugbountytip

[Corben Leo @hacker_]

1/ The scope of this program was *.███.com

With a wildcard, basic recon is:

Subdomain Enumeration + HTTP server probing:

$ subfinder -d example[dot]com | httpx -o example.httpx

[TheMayor - Joe Helle @joehelle]

Compromised a domain tonight in the craziest of ways.

VNC Server with no authentication -> LastPass vault open in browser -> main DA account in LastPass vault -> $$$

[Rood @0x_rood]

Cool Recon techniques every hacker misses!

https://t.co/OloLIi08vz

#bugbounty #bugbountytips

[🐞Sara Badran @SaraBadran18]

From blind XXE to root-level file read access $$$$ 🔥🔥
---------
By @honoki
---------
https://t.co/xgDrQ45Zo5
--------
#hackerone #BugBounty 
#hackeronereport
#writeups #Bugbountywriteupspublished
#bugbountytips
#bugbountytip #xxe

[publiclyDisclosed @disclosedh1]

Reddit disclosed a bug submitted by criptex: https://t.co/lo3HFIRkb3 - Bounty: $5,000 #hackerone #bugbounty