#BurpHacksForBounties - Tip 19/30

Adding your own scan rules to Burp Suite active/passive scanner. Include custom checks in scanner for #bugbounties without writing a single line of code.

Using a plugin developed by @BurpBounty @egarme

#infosec #appsec #burp #bugbountytips

#BurpHacksForBounties - Day 22/30

🤓🤓 Create your own Burp Extender Plugin in 3 tweets with Java.
Thank you Burp Suite for making it easy

#infosec #appsec #burp @BurpSuiteGuide #bugbountytips #bugbountytip #security

#BurpHacksForBounties - Day 24/30

This is an amazing writeup which talks about using plugin in Burp that ease the journey for catching IDORs.

Writeup link: https://infosecwriteups.com/leveraging-burp-suite-extension-for-finding-idor-insecure-direct-object-reference-2653f9b89fd4
By
@dhanush

#infosec #appsec #bugbountytips #bugbountytip #bugbounty #security

#BurpHacksForBounties - Day 25/30

Optimizing Burp Suite for better performance, these 4 simple steps and you would notice a big difference in performance.

#infosec #appsec #burp #security #bugbountytips #bugbounty

#BurpHacksForBounties - Day 26/30

Красное сердцеUnderstand the different intruder attack types in Burp Suite

With visualizations at code level for better understanding.

Code level understanding in follow up thread 👇

#infosec #appsec #security #cybersecurity #bugbounty #bugbountytips

#BurpHacksForBounties - Day 28/30 - Super CSRF POC Generator Hack.


CSRF POC generator is only available in Burp Suite pro, but not anymore.

Use this -> https://github.com/merttasci/csrf-poc-generator by @mertistaken


#infosec #burp #appsec #security #bugbountytips #bugbountytip #cybersecurity

IDOR Techniques

https://www.xmind.net/m/CSKSWZ/

#IDOR #bugbountytips

Git-Secret

Go scripts for finding an API key / some keywords in a github repository

https://github.com/daffainfo/Git-Secret

#bugbounty #bugbountytips #pentest #api #infosec

Search JS using Gau

gau -subs DOMAIN |grep -iE '\.js'|grep -iEv '(\.jsp|\.json)' >> js.txt

#bugbounty #bugbountytips

Forget Password Vulns

https://www.xmind.net/m/nZwbdk/

#AppSec #hacking #bugbountytips #websecurity #xmind

Cookie Based Auth Vulnerabilities

https://www.xmind.net/m/2FwJ7D/

#AppSec #hacking #bugbountytips #websecurity #xmind

Scope Based Recon

https://www.xmind.net/m/hKKexj/

#AppSec #hacking #bugbountytips #websecurity #xmind

Search Subdomains using Jldc

curl -s "jldc.me/anubis/subdomains/example.com" | grep -Po '(?<=")[\w*.-]*(?=")'

#bugbounty #bugbountytips

Search JS using Gau

gau -subs DOMAIN |grep -iE '\.js'|grep -iEv '(\.jsp|\.json)' >> js.txt

#bugbounty #bugbountytips