■■□□□ #GoodReport #XXE via File upload (#SVG)

https://0xatul.github.io/posts/2020/02/external-xml-entity-via-file-upload-svg/

■■■■□ #Iran|ian #BlackHat hacker group @Cra3ked [telegram] released an efficient #BruteForce utility to hack web logins with #PoC

https://github.com/Fr13ND3/1tinymvz.net/

■■■□□ #GoodReport: LFI + file upload = #RCE (#CodeExecution)

https://medium.com/@armaanpathan/chain-the-bugs-to-pwn-an-organisation-lfi-unrestricted-file-upload-remote-code-execution-93dfa78ecce

Source

Title: BugBounty types — HTML injection via email

Description: HTML injection é um ataque muito parecido com o Cross-site Scripting (XSS), enquanto no XSS o invasor pode injetar e executar códigos em…

Continue reading on Medium »

XSS To Good XSS With ClickJacking on Subdomain Microsoft

https://link.medium.com/4EXo7G8Sk1

#XSS
#ClickJacking
#BugBounty

Open-redirect on Facebook (Bypass Linkshim)

https://noobsec.org/project/2020-02-16-open-redirect-on-facebook/

Bypassing WAFs and cracking XOR with Hackvertor



https://portswigger.net/research/bypassing-wafs-and-cracking-xor-with-hackvertor

Multiple sites for Obfuscation or JavaScript code obscurity.


http://utf-8.jp/public/aaencode.html

http://utf-8.jp/public/jjencode.html

http://www.jsfuck.com

#JS
#OBF

Burp Extension:

https://github.com/Netflix-Skunkworks/sleepy-puppy/tree/master/burp-extension

XMLHttpRequest:

https://xhr.spec.whatwg.org/

“Undetectable C# & C++ Reverse Shells” by Bank Security https://link.medium.com/kIIc9Ch5b4

■■■□□ From Recon to Optimizing RCE Results - Simple Story with One of the Biggest ICT Company in the World

https://medium.com/@YoKoKho/from-recon-to-optimizing-rce-results-simple-story-with-one-of-the-biggest-ict-company-in-the-ea710bca487a

Source Code + Sensitive Information Disclosure lead to InstaMoney and SendGrind Account Takeover
https://medium.com/@denypradana/source-code-sensitive-information-disclosure-lead-to-instamoney-and-sendgrind-account-takeover-fc9adf7d8501

Fun with Amazon S3— Leaks and bucket takeover attack
https://medium.com/@woj_ciech/fun-with-amazon-s3-leaks-and-bucket-takeover-attack-ddb17da1c431

[ Writeup — Bugbounty Facebook ] Disclosure the verified phone number in Checkpoint.
https://medium.com/@tiendat253/writeup-bugbounty-facebook-disclosure-the-verified-phone-number-in-checkpoint-aa652faeaf21

HOW I BYPASSED 2 FACTOR AUTHENTICATION
https://medium.com/@manralhemant10/how-i-bypassed-2-factor-authentication-899750421331

Sentive Data Exposure
https://medium.com/@Sheshasai/sentive-data-exposure-fad568b7875

How PayPal helped me to generate XSS
https://medium.com/@pflash0x0punk/how-paypal-helped-me-to-generate-xss-9408c0931add