Th3Hack3rW!z

Dhruv Kandpal,
21
Bug Hunter | Tool maker | BASH | Ethical Hacker | Researcher | Cyber Security Enthusiast

[Th3Hack3rW!z @th3hack3rwiz]

Looking for bugs is like looking for love. You don't know whether you'll find anything or not, but you believe in the process and keep looking.
Eventually, the universe is by your side as you find something real.

#bugbounty #philosophy #braindump

[Traceix @usetraceix]

Today we are releasing our FREE educational course: "Intro to Exploit Dev"!

This course is perfect for those trying to start exploit dev and covers:
- Tooling
- Fuzzing
- Exploitation techniques
- And more!

You can take the course here: https://t.co/kejXkinsGR

[Rishika Desai @ich_rish99]

Good resources on #BugBounty for you to bookmark!🌟

1. https://t.co/hdFRamEyc5

2. https://t.co/RiV3ukxQhS

3. https://t.co/6uxHvZ0BAK

4. https://t.co/7YoEUOQK4N

5. https://t.co/cSAii723GF

#dorking #vulnerability #bugbountytip

[OSINT 🪙 @0xtechrock]

OSINT TIP #248🔐

Telerecon - a comprehensive OSINT reconnaissance framework for researching, investigating, and scraping Telegram.

🔗https://t.co/dxmVvEXYaf

#OSINT #recon #telegram

[Nagli @galnagli]

AI helps greatly translating JavaScript to "Human Readable Language", here's how I found a very straight forward DOM Based XSS in 2 minutes.

#BugBounty

[Bug X Hunter 💻 @Bug_X_hunter]

💻File Upload Vulnerabilities | Guide 💻

#bugbountytips #bugbounty #bug

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

Slides of my talk in @bsidesahmedabad
you can downloaded form here
https://t.co/GUO3PUFSjH

#bugbountytips #bugbountytip

happy hunting

[X @TheMsterDoctor1]

autoSSRF (Automatic SSRF Testing)
-
Smart fuzzing on relevant SSRF GET parameters and Context-based dynamic payload generation
-
Repo: https://t.co/GuWmii5lAW
-
Creator: @Th0h0
-
-
#CyberSecurity #bugbountytips #infosec #CTF #tools

[Doyensec @Doyensec]

Announcing ProtoBurp++ a #burpsuite extension to encode/decode & fuzz custom Protobuf messages! Fuzz using Repeater, Intruder & Active Scanner & proxy traffic from other tools (e.g., sqlmap). Check it out!

#doyensec #appsec #websecurity #bugbountytips

https://t.co/mjrnpdjC0N

[SANS Offensive Operations @SANSOffensive]

The #SANSHackFest agenda is LIVE and packed with 17 highly technical talks from @chompie1337 @inversecos @NahamSec @jhaddix @FuzzySec @33y0re and more!

Join us in Hollywood for a chance to connect with legends in the #pentest community!

Register here: https://t.co/gxtdt6D4eN

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

100 tools every self respecting web app hacker should know

Acunetix Web Vulnerability Scanner
Aircrack-ng
Amass
Arachni
Assetfinder
bbqsql
BeEF
BruteForcer
Brutus
Burp Suite
Cain and Abel
Cewl
CMSmap
crackMapexec
Dalfox
DAVScan
Dirbuster
Dirb
Dnsmasq
Dnsx
Evil-WinRM
Fiddler
Fuff
Go Buster
Grabber
Grendel-Scan
Hashcat
hping
Httpx
Hydra
IronWASP
John the Ripper
Joomfish Scanner
JoomlaScan
JoomScan
jwt tool
Kali Linux
LFI Suite
MassDNS
Masscan
Maltego
Mantra
Medusa
Metagoofil
Metasploit Framework
Nabuu
Nessus
Netcat
Nikto
Nmap
NoSQLMap
Nuclei
ODAT
OpenVAS
OWASP
OWASP ZAP
Paros
RainbowCrack
Ratproxy
Recon-ng
RIPS
postman
Scrawlr
Shodan
Skipfish
Spiderfoot
Sniper
SQL Inject Me
sqlmap
sqlmapgui
Sqlninja
sqlsus
Subfinder
Sublist3r
Tamper Data
Tcpdump
THC Hydra
THC-SSL-DOS
The Harvester
Vega
Vulnerability Scanner
w3af
Wafw00f
Waybackurls
Wapiti Web Application Vulnerability Scanner
WebScarab
Websecurify
WebSlayer
Wfuzz
Wireshark
WPScan
WPScan Desktop
WP Security Audit Log
X-Forwarded-For Spoofer
Xsstrike
XSSer
XssPy
Xss Vibes

[James Kettle @albinowax]

About @Burp_Suite and your RAM...

Over time, Java deliberately uses all the RAM you feed it, in order to minimise CPU cycles spent freeing memory. To feed it less memory, you can use the -XX:MaxRAMPercentage argument. For other RAM tips see:
https://t.co/CorkyyFjQm

[Justin Gardner @Rhynorater]

Just popped another crazy XSS. Check this one out 👀

So a CRLF was passed to me by a podcast listener. The CRLF was in the path, so it couldn't contain a /.

We could do response splitting, but couldnt change the content-type to text/html because we couldn't use a /.

So we...

[Hatab @hatab0x]

1- create 2 accounts (A , B )
2- reset password for account A
3- follow the regular flow and study the link sent to your email
I noticed that it had mail param https://t.co/Ng1Ls99Wpc
4- change the mail value to account B
happy hunting
#BugBounty #bugbountytips

[Jon Bottarini @jon_bottarini]

Here's a #bugbountytip I've used a couple times to find some really interesting functionality - if you're doing recon, check out this endpoint:

<targetdomain>/.well-known/apple-app-site-association

This endpoint is used for Apple's associated domains feature - you would really

[Eyisha Zyer @eyishazyer]

No need to hire a photographer again.

This AI photographer is available for 24hrs.

Here's how you can get professional headshots in only 3 steps:

[David Bombal @davidbombal]

If you can't stop thinking about it, don't stop working for it.

#DailyMotivation #inspiration #motivation #bestadvice #lifelessons #changeyourmindset

[Justin Gardner @Rhynorater]

I've made over 100k on SSRF vulnerabilities.

They aren't always as simple as pointing it at localhost or AWS Metadata service.

Here are some tricks I've picked up over the past 5 years of web app testing:

[Th3Hack3rW!z @th3hack3rwiz]

@mufaddal_vohra @RoastHimJim

[Nuclei by ProjectDiscovery @pdnuclei]

Secrets Scanning with Nuclei 🔍

🪝 Slack webhooks
👎 Improper certificate-validation
🔑 Leaking keys

Learn more 👇 #nuclei101 #nucleitemplates #hackwithautomation

https://t.co/6sAcKV6FSP