kiyo_

informatics uni student && cybersec enthusiast
・運勢は自分で決めろ

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

Bug bounties in 2023 - extended roadmap

1.1. Common web vulnerabilities
Injection attacks
1.1. SQL Injection
1.2. NoSQL Injection
1.3. Command Injection
1.4. LDAP Injection
1.5. XML Injection
1.6. XPath Injection
1.7. Server-Side Template Injection (SSTI)
1.8. Code Injection
1.9. Log Injection
1.10. CRLF Injection

Cross-Site Scripting (XSS)
2.1. Stored XSS
2.2. Reflected XSS
2.3. DOM-based XSS

Cross-Site Request Forgery (CSRF)

Authentication and Authorization attacks
4.1. Broken Authentication
4.2. Broken Access Control
4.3. Privilege Escalation
4.4. Insecure Direct Object Reference (IDOR)
4.5. Missing Authentication for Critical Function
4.6. Password-related attacks
4.6.1. Brute Force attacks
4.6.2. Credential Stuffing
4.6.3. Password Spraying
4.6.4. Dictionary attacks

Session Management attacks
5.1. Session Fixation
5.2. Session Hijacking
5.3. Session Timeout

Insecure Deserialization

Security Misconfiguration

Sensitive Data Exposure
8.1. Insecure Storage of Sensitive Data
8.2. Information Leakage and Improper Error Handling
8.3. Insecure Data Transfer

Using Components with Known Vulnerabilities

Insufficient Logging and Monitoring
.... etc

1.2. Reconnaissance techniques
- OSINT (Open Source Intelligence)
- DNS enumeration
- Subdomain discovery

1.3. Exploitation tools
- Burp Suite
- OWASP ZAP
- SQLMap
- Nmap
2. Focus on automation

Automation can save you valuable time and help you discover vulnerabilities more efficiently. Familiarize yourself with scripting languages like Python or Bash to automate repetitive tasks, such as:

2.1. Subdomain enumeration
2.2. Port scanning
2.3. Web content discovery
2.4. Vulnerability scanning
3. Stay up-to-date with new vulnerabilities and attack techniques

The cybersecurity landscape is constantly evolving, and attackers are always finding new ways to exploit systems. Make sure to:

3.1. Follow industry news and blogs
3.2. Attend conferences and workshops
3.3. Participate in online forums and social media discussions
4. Learn from other bug bounty hunters

Collaborate and share knowledge with the bug bounty community to learn from others' experiences and improve your skills. Engage in:

4.1. Reading write-ups and case studies
4.2. Watching video tutorials and walkthroughs
4.3. Participating in bug bounty challenges and Capture the Flag (CTF) events
5. Develop a systematic approach to bug hunting

To maximize your chances of finding vulnerabilities, follow a systematic approach that covers:

5.1. Reconnaissance and information gathering
5.2. Vulnerability scanning and identification
5.3. Exploitation and proof-of-concept (PoC) development
5.4. Reporting and documentation
6. Practice responsible disclosure

When you discover a vulnerability, always follow responsible disclosure guidelines and communicate your findings clearly and professionally. This includes:

6.1. Providing a detailed description of the vulnerability
6.2. Including steps to reproduce the issue
6.3. Suggesting possible mitigations or fixes
6.4. Adhering to the target organization's disclosure policies
7. Build a personal brand

A strong personal brand can help you establish credibility in the bug bounty community and attract the attention of potential employers or clients. To build your brand:

7.1. Network with other cybersecurity professionals
7.2. Create a blog or YouTube channel to share your experiences and insights
7.3. Engage with the community on social media platforms like Twitter and LinkedIn

[Daniel Kelley @danielmakelley]

30 cybersecurity search engines for researchers:

1. Dehashed—View leaked credentials.
2. SecurityTrails—Extensive DNS data.
3. DorkSearch—Really fast Google dorking.
4. ExploitDB—Archive of various exploits.
5. ZoomEye—Gather information about targets.

[🇷🇴 cristi @CristiVlad25]

All of my top tips on #hacking now available as blogs. Read below.

(thread)

[Intigriti @intigriti]

📈 Top 20 bug bounty YouTube channels of 2022 🧵

Let's look back at 2022 and specifically at the creators who ruled the bug bounty scene in 2022

These are the top 20 bug bounty creators! 👇