ifhsec

Web application security ⚡ |
@Bugcrowd P1 vulnerability submission top 20, overall ranking top 100,from ifhsec security team

[Intigriti @intigriti]

Mini crash course on web fuzzing! 🤠

A thread! 🧵 👇

[Shreyas Chavhan @shreyas_chavhan]

It's been 1000+ hours into bug bounties since the day I started.

Hunting: 1002 hrs
Cyberstudy: 363 hrs
Days worked: 271 days

Here's the top 59 lessons/advice/learning I've been giving myself since day one that have helped me reach where I am today (a thread 1/60):

#BugBounty

[ifhsec @redchen5]

open url redirect bypass:
/login?url=https://*.whitlistdomain
bypass:
/login?url={anything}&url={anything}
Then it will jump to the third-party domain name to bypass restrictions.
#bugbountytips ,#bugbountytip

[Het Mehta @hetmehtaa]

𝐌𝐚𝐥𝐰𝐚𝐫𝐞 𝐀𝐧𝐚𝐥𝐲𝐬𝐢𝐬 𝐓𝐨𝐨𝐥𝐬 𝟐𝟎𝟐𝟑

1- IP & URL Reputation:

✅1. Virus Total : https://t.co/O28VMYCBYq
✅2. URL Scan : https://t.co/vbXyYKCEix
✅3. AbuseIPDB: https://t.co/y2YAjgoW3i
✅4. Cisco Talos: https://t.co/F7IHOmqeTo
✅5. IBM X-Force: https://t.co/geosokpqgw
✅6. URL Filtering(Palo Alto): https://t.co/NxRj9pr9d7
✅7. URL Filtering(Symantec): https://t.co/CTNS5SdOv9
✅8. IP Void: https://t.co/9ssAszK5Cc
✅9. URL Void: https://t.co/oEzgZe3KVL
…

2- File | Hash | Search | Analysis | Sandboxing:

✅ 1. File Extension
https://t.co/4LOF9iLtTo
✅ 2. LOLBAS
https://t.co/MB6HMLQDL6
✅ 3. GTFOBins
https://t.co/eyCqp64KuG
✅ 4. File Hash Check
https://t.co/SR4mWDf3Hk
✅ 5. Hash Search
https://t.co/8oQSimSwmP
✅ 6. Hash Search
https://t.co/DNmoplnViz
✅ 7. MetaDefender
https://t.co/ENtmxRE0AD
✅ 8. Kaspersky Threat Intel
https://t.co/FT2unTWu6L
✅ 9. Cuckoo Sabdbox
https://t.co/TRnV7714oG
✅ 10. AnyRun Online sandboxing
https://t.co/zf6qL7jKRQ
✅ 11. Hybrid-Analysis
https://t.co/I2m1np1GZs
✅ 12. Joe Sandbox
https://t.co/GMd6mMHmvq
✅ 13. VMRay Sandbox
https://t.co/fcs8JLlHLs
✅ 14. Triage
https://t.co/XxHGILZs8H
✅ 15. Browser Sandbox
https://t.co/JK1q8ODYN9
…

3- Getting File hash:

✅ HashTools Windows
https://t.co/ldZC04zU98
Powershell :
Get-FileHash -Path C:\path\to\file.txt -Algorithm MD5
Get-FileHash -InputObject "This is a string" -Algorithm MD5
✅QuickHash MacOS
https://t.co/DAgQeyfFHM
Terminal: shasum -a 256 filename
…

4- Find Suspicious Artifacts | Reverse Engineer | Debug Files:

✅ 1. PeStudio: https://t.co/AgmdKojzt7
✅ 2. CFF Explorer: https://t.co/iNEsRbhx6f
✅ 3. DocGuard files: https://t.co/ewYfC56aQ8
✅ 4. File Scan: https://t.co/H58YWFDJRo
✅ 5. Ghidra: https://t.co/fco0OaGq8E
✅ 6. IDA Pro: https://t.co/rsDuHhwfDo
✅ 7. Radare2/Cutter: https://t.co/rBwTnmlEUq
https://t.co/1HaxwNK9wP
…

5- Monitor System Resources | Detect malware:

✅ 1. Process Hacker >> https://t.co/TcxPHt6P6D
✅ 2. Process Monitor >> https://t.co/6v3LnqFGCM
✅ 3. ProcDot >> https://t.co/NXSswxMSsi
✅ 4. Autoruns >> https://t.co/cOHhGsiiCa
✅ 5. TcpView >>https://t.co/zqnEaIxrRb
…

6- Web proxy:
✅ Fiddler >> https://t.co/QwXghPRpxw
…

7- Malware Samples - https://t.co/b8hMZDZCUA:

✅ 1. MalwareBazaar ==> https://t.co/getrVFlukR
✅ 2. FeodoTracker ==> https://t.co/CIOvj9uN4T
✅ 3. SSLBlacklist ==> https://t.co/Cw7Vyoc0O9
✅ 4. URLHaus ==> https://t.co/ttIbtVttk5
✅ 5. ThreatFox ==> https://t.co/5I2OvMvVSL
✅ 6. YARAIfy ==> https://t.co/WxXUTTTsaM
…

8- Malware Traffic | Pcap & Malware Samples:
✅ https://t.co/cxzBJk1ZJs

+Free Malware Analysis Trainings:

Malware Analysis BootCamp >> https://t.co/bz2og88yk5
Malware Analysis In 5+ Hours >> https://t.co/lilLfGdFMZ

#malware #spyware #adware #antivirus #antimalware #sophos #symantec #bitdefender #android #edr #recovery #vmware #windows #linux #mac #apple #google #twitter #technology #paloaltonetworks #virus #sandbox #splunk #sandbox #malwareanalysis #malwaredetection #infosec #data #hacked #infosec #soc #TheSecureEdge

[ifhsec @redchen5]

@Bugcrowd @JR0ch17 cool!

[Youssef Sammouda (sam0) @samm0uda]

ATO of FB/OC accounts after stealing access_tokens ($44,250)
https://t.co/79z5LwgN2n
DOM-XSS in Instant Games due to improper verifications ($62,500?)
https://t.co/Hf63ib7g4x
ATO in Canvas Games due to weak cross window message Origin validations ($62,500)
https://t.co/BUziBmRbjj

[bugcrowd @Bugcrowd]

December Top 10 🔥

#ItTakesACrowd #OuthackThemAll

[Harsh Makadia @MakadiaHarsh]

16 Excellent websites I discovered in 2022 ( that are extremely useful ) :

[ifhsec @redchen5]

Thank you @Bugcrowd #bugcrowd #bugbounty

[ifhsec @redchen5]

#HackerCup2022 and #BCTeamHunt
We seem good too

[ifhsec @redchen5]

@ynjhgfddrafsz cool

[David Schütz @xdavidhu]

I found a vulnerability that allowed me to unlock any @Google Pixel phone without knowing the passcode. This may be my most impactful bug so far.

Google fixed the issue in the November 5, 2022 security patch. Update your devices!

https://t.co/LUwSvEMF3w

[ifhsec @redchen5]

@0cat4 i only use 0catScan 。

[James Kettle @albinowax]

Facebook's servers give a mystery error if you send any HTTP header that contains " and ends in \. But not if you omit the " or the \ isn't at the end 🤔

This cryptic and likely pointless finding was brought to you by Backslash Powered Scanner
https://t.co/JrjhMeUETq

[ifhsec @redchen5]

@teamssix cool

[ifhsec @redchen5]

@cyku_tw good job

[ifhsec @redchen5]

@Meizjm3i 赞同

[ifhsec @redchen5]

@fransrosen Amazing！ very cool！ good

[ifhsec @redchen5]

@Botami143 @bugbounty0 good

[ifhsec @redchen5]

@Cx02Z cool