Saqib Chand 🇵🇸

💉 Web & Mobile Penetration tester | OSCP+ | 🐞 Bug Hunter | 🛡 Synack Red Team Member

[Saqib Chand 🇵🇸 @sakyb7]

Here is writeup for an interesting Account takeover vulnerability.
#bugbounty #bugbountytip #TogetherWeHitHarder

https://t.co/aZe7EB0SYY

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

I’ve added here
https://t.co/HoZmigQxkT

PDF file for XSS, it can bypass any waf
for who looking for Stored XSS , and it can be changed to blind if you want to

Simply I encoded the payload as ASCII hex

You can edit the payload over notepad++

#bugbountytips #bugbountytip #bugbounty

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

JAVASCRIPT IS A GOLDMINE FOR #BugBounty HUNTERS

https://t.co/6YkSO49WOY

Check out my playlist to learn how <3 treat yoselfff rats is freeeee

[Behi @Behi_Sec]

This is a great resource on Prompt Injection.

Huge thanks @rez0__!
https://t.co/eZz92ZLcIS

[André Baptista @0xacb]

How to grab subs for a target using subfinder, validate them and extract the text body from each response using httpx and jq, extract a wordlist of keywords using NLP then resolve them using puredns to find valid subdomains 👇

You can also use LLMs and tools like alterx to generate a list of permutations from the extracted wordlist!

[Jsmon | AI-Powered Attack Surface Management @jsmonsh]

❌GraphQL introspection disabled?
✅No problem! Extract all GraphQL operations from Javascript files!

1. go install https://t.co/DQNzYUwAGt
2. Scan the JS URL with -u flag.

🚀View all the GraphQL operations in seconds -- no introspection needed.

[Dan Bilzerian @DanBilzerian]

If you’re not Jewish but you support Israel

Congrats

You’re one of the dumbest and most gullible motherfuckers on the planet.

[Shuvo Kumar Saha 🇧🇩 @syper_shuvo]

$20,300 Bounties from a 200 Hour Hacking Challenge

Credit: Mohammad Zaheri
.
.
.
.
.
.

#bugbountytips #bughunting #infosec

https://t.co/yVX4VQ19An

[Saqib Chand 🇵🇸 @sakyb7]

@AnkitCuriosity @Atlassian @Bugcrowd Can you share some small write up ...? And what type of bug you look on atlassian program?

[Abdulaziz @stuipds]

How we gained full control over 3,000 companies and all their registered branches.

This took us about 3 weeks of studying the target to find about all the vulnerabilities explained.

Hope you enjoy reading!
https://t.co/Gz1xlo7LJb

[Saqib Chand 🇵🇸 @sakyb7]

@_tkusa @HUNTYT07 @Accredible @offsectraining Thank for the explanation...

[Saqib Chand 🇵🇸 @sakyb7]

@_tkusa @HUNTYT07 @Accredible @offsectraining OSS ?? Can you explain?

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

Hello everyone ♥
a little bit write-up of #bugbountytip #bugbountytips I am going to write here .....

Title:
getting unauthorized access on 3rd party's/workspaces & and building your checklist for quickly locating bugs there via massive recon

we know that its helpful to look for google
groups/docs/etc..

Slack as well just like when the amazing @h4x0r_dz shared days ago ..

Use google dork "site:https://t.co/ravW2tHHcP"

so I was not in a good mode the last months to doing Google Dorks, so what I did was build a checklist ready for me & very huge one

for EX:

https://t.co/wPxAHXvC18
https://t.co/hs3VHvhT92
https://t.co/ravW2tHHcP

and here is just an example you can add more similar workspaces for your checklist

thin I extracted all internet endpoints and as example here join[.]slack[.]com

https://t.co/OlHQSEQ6Qz

https://t.co/e8jB8H6nMS

https://t.co/w5h4VkESyQ

you can use the ready tools to do it such as waymore

important note: you have to keep your checklist updated every week

and from here I just keep looking for the company name or domain name to see if there's anything connected

and mostly the company name or domain name in the URL it self EX: tesla

https://t.co/QesyI4MHu2

Ex For Bugs found:

1 unauthorized access to the workspaces
(PII | Information disclose)
2 account takeover as Ex: valid signup employee link
3 account takeover as Ex: valid reset password employee link

now about Slack, as an example if you found an invitation link for tesla
Tesla https://t.co/QesyI4MHu2 and that link was not valid, don't stop here
it will redirect for Ex:
tesla-internal[.]slack[.]com

here back and start looking manually for endpoints of this subdomain as well EX:

https://t.co/w2dhvfdBhL

now there are a lot of 3rd party's/workspaces I just shared here
slack & Google Docs/groups

What I wrote is a bit long and annoying to some, so I apologize. I hope, as usual, that this will be useful to all who follow me here.

#Bugounty
don't forget to retweet if you like it ♥♥♥

[🇷🇴 cristi @CristiVlad25]

Read further: https://t.co/2rgugGaCL6

[Saqib Chand 🇵🇸 @sakyb7]

@CristiVlad25 Can you post some tutorial or write on this?

[Somdev Sangwan @s0md3v]

Got 2FA? Here are 13 ways to test its security.

https://t.co/TSxCMK8gcP

[Saqib Chand 🇵🇸 @sakyb7]

@Fatnass1F1ras @msftsecresponse Can you share some bugs writeup which are discovered in microsoft..? I want to read it before I get started on msftresponse

[Saqib Chand 🇵🇸 @sakyb7]

https://t.co/UR1H2Dsfaz

[Ian Carroll @iangcarroll]

Our talk was accepted at @defcon this summer! Come watch @LennertWo and I give a talk about the Unsaflok vulnerability in hotel locks and the technical details behind it.

https://t.co/K6HIMf1YDn

[Saqib Chand 🇵🇸 @sakyb7]

@TheSecOpsGroup @Rashtriyan @Victortaiwo123 @NeoCyberx @PabloChiquis Mail Sent !

[Yasho @YShahinzadeh]

How I reverse-engineered an Android app, bypassed custom encryption layer, achieved server-side RCE, and earned a $5000 bounty. read the full story here (TLDR; but worth reading)

https://t.co/xgvffzspiB