PenTestical

Penetration Tester | OSCP | Super Nintendo Generation 🎮 | German Content Creator / Hacking Macking auf yt 🎥

[PenTestical @PTestical]

@thecybermentor

[Neh Patel 🇮🇳 @thecyberneh]

Just got another CRLF injection, and exploiting it to #XSS but Server is returning 302 status code with location param which is preventing my javascript to return XSS promot

Any tips to bypass this thing and get xss prompt?
#bugbountytips #cybersecuritytips

[PenTestical @PTestical]

Just found my first SQL injection on a bug bounty platform. Tip: postgreSQL has a lot of tricks to escalate from SQLi to RCE. Don't stop at the SQLi itself. #bugbountytips #bugbounty #rce #sqli #postgresql #hacking #hacken

https://t.co/lvWcGSovWf

[PenTestical @PTestical]

@haksecio Chrome Dev Tools

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Command Injection: by @0xJin
~Find Your subdomains
~cat subdomains.txt | httpx | gau | qsreplace “aaa%20%7C%7C%20id%3B%20x” > fuzzing.txt
~ ffuf -ac -u FUZZ -w fuzzing.txt -replay-proxy 127.0.0.1:8080
~search for ”uid” in burp proxy intercept
#infosec #bugbountytips

[Josh Hawley @HawleyMO]

The FBI actively interfering in multiple elections is the biggest threat to our constitutional democracy today

[Ben Sadeghipour @NahamSec]

Just released @securinti "RTFR (Read The Bleeping RFC)" from #NahamConEU2022! These attack vectors are incredible creative and worth implementing them in your day to day testing!

https://t.co/RJAHzhBgtu

[PenTestical @PTestical]

@NahamSec @WebSecAcademy really enjoyed the stream. my head's spinning around kids now

[Ben Sadeghipour @NahamSec]

Streaming @WebSecAcademy - What should we do? https://t.co/zR0azHNvet

[YesWeHack ⠵ @yeswehack]

#14 Vulnerable snippets!🏆
@anand_himanshu, @abdilahrf

Read their solution:
➡️ https://t.co/L5B5RTFSoO
➡️ https://t.co/Fl6EbEibyZ

[Intigriti @intigriti]

We let ChatGPT write today's #BugBytes tweet and this is what it wrote 👇
I'm sorry, but I am not able to write about anything related to Bug Bytes or chatGPT, as I am a large language model trained by OpenAI and do not have access to curren-

oh nvm lets bring the human back

[PenTestical @PTestical]

@abdulx01t @pdnuclei Now the money rains. Good job

[AbdulRahman🇮🇳 @abdulx01t]

Found My first XSS.. on Swagger UI.

@pdnuclei is awesome 😀
#bugbounty

[an0n @an0n_r0]

1. remove disk from target laptop
2. virtualize system (VBoxManage convertfromraw)
3. abuse local admin (chntpw using alt booted system)
4. run mimikatz by reflective loading (bypass ESET :) )
5. extract machine cert / secrets

NEVER deploy company laptop without BitLocker.

[Intigriti @intigriti]

[1️⃣] Spot The Vulnerability 📜

Hackers love spotting vulnerabilities! Spot the vulnerability in this code snippet and get your first flag!

🔗 https://t.co/pMan4O85Rb

[PenTestical @PTestical]

@intigriti easy

https://t.co/Na5EREfQ3z</title><script>window.environment='';&debug=alert('intigriti rocks')

[Nihad @Nihad_rekany]

Yay, I was awarded a $x,xxx bounty on @Hacker0x01!

I found Critical bug Time-based SQL injection on JSON parameter

Payload: (select*from(select(sleep(20)))a)

#TogetherWeHitHarder

[PenTestical @PTestical]

@nihad_rekany @Hacker0x01 my fav bug type. ok to be fair, I say this to every vuln. good job

[PenTestical @PTestical]

@yeswehack learned a lot from this challenge, thank you @yeswehack

[YesWeHack ⠵ @yeswehack]

⏰ DOJO Challenge - DOM XSS (Butters Adventure)

🎁 Top 3 reports win a swag pack!
🗓️ Submit your solution before 05/01/2023

Check out it out here 😼👇
https://t.co/0qaya5PJJT

#BugBounty #YesWeRHackers #YWHDOJO

[PenTestical @PTestical]

@NahamSec still stuck at the first lab.

!flag