Matheus @pwn0bot1

Joined October 2016

Tweets

323
Followers

151
Following

814
Likes

554

ईशान सिंह @R0X4R

4 years ago

Fuzz for directories without killing the host: cat subdomains.txt | while read -r host;do bash fuzy.sh $host;done Save the following code in a file, for example fuzy.sh Code: gist.github.com/R0X4R/411f2ac4… #bugbounty #bugbountytips

0 54 95 0 34

Download Image

H4x0r.DZ @h4x0r_dz

4 years ago

If you Are Interested In Developing your Hacking skills Read some amazing @BlackHatEvents pdf <3. Demo Google dork: site:blackhat.com intext:"RCE" filetype:pdf #CyberSecurity #BugBounty #infosec

16 478 1K 0 690

Download Image

Safaras @iam_j0ker

5 years ago

Added 3 more bypasses and included response length, so that we can use it to compare responses on various conditions #bugbounty #bugbountytips click on the below link to check that out. github.com/iamj0ker/bypas… @stokfredrik @ADITYASHENDE17 @sillydadddy

2 132 403 0 137

Download Image

Niemand @niemand_sec

5 years ago

So many Drupal apps vulnerable to this :) Endpoint: /node/1?_format=hal_json write up: ambionics.io/blog/drupal8-r…

1 118 281 0 83

Ammar Amer @cry__pto

5 years ago

Android security testing Tools: Dex2JAR ByteCodeView JADX Dex2JAR JD-GUI Drozer Baksmali AndroGuard ApkTool QARK AndroBugs AppMon MobSF #Pentesting #bugbountytip #Hacking

7 182 492 0 121

Safaras @iam_j0ker

5 years ago

Accessing Unauthorized Directories. Various tips not by me, it's collected from various guys and I organized it. Hope it may help you. #bugbounty #bugbountytips @ADITYASHENDE17 @sillydadddy @Alra3ees

6 304 659 0 234

Download Image

Harsh Bothra @harshbothra_

5 years ago

Burp Extensions that I use: (1/n) 1. Autorize - To Test BACs 2. Burp Bounty - Profile-based Scanner 3. Active Scan++ - Add more power to Burp's Active Scanner 4. AuthMatrix - Authorization/PrivEsc Checks 5. Broken Link Hijacking - For BLH #bugbountytips #bugbounty

16 276 636 0 286

ShrimpGO @shrimp_go

5 years ago

How to brute-force steghide password with bash: $ while read i; do echo -n "$i => "; steghide extract -sf yourimage.jpg -p "$i"; if [ $? -eq 0 ]; then break; fi; done < rockyou.txt

1 1 9 0 1

what_web @jae_hak99

5 years ago

How to find local file read vulnerabilities based on cookies. Request GET /vulnerable.php HTTP/1.1 Cookie:usid=../../../../../../../../../../../../../etc/pasdwd Response HTTP/1.1 200 OK ... Server: Apache root:fi3sER6:0:1:System Operator:/:/bin/ksh// #bugbounty #bugbountytip

6 260 650 0 184

stoXe @DevinStokes

5 years ago

1. Send everything to @Burp_Suite for additional scanning. 2. ... 3. Profit? urlgrab --url SITE_HERE.com --ignore-ssl --proxy socks5://127.0.0.1:8080

6 35 123 0 42

Download Gif

Udit Bhadauria @udit_thakkur

6 years ago

Rate limit bypass: Add header/s with request X-Originating-IP: IP X-Forwarded-For: IP X-Remote-IP: IP X-Remote-Addr: IP X-Client-IP: IP X-Host: IP X-Forwared-Host: IP If bypass successful, & after a while blocking request again. Increment the last octate #infosec #bugbountytip

9 344 804 0 234

Emad Shanab - أبو عبد الله @Alra3ees

5 years ago

“Clickjacking to Account Takeover” by @abhishake100 link.medium.com/R0jhZFPFR6

0 56 136 0 25

Emad Shanab - أبو عبد الله @Alra3ees

5 years ago

How to Burp Good – n00py Blog n00py.io/2017/10/how-to…

1 33 91 0 14

siLLyDaddy @sillydadddy

5 years ago

#bugbounty #bugbountytips Automate sql injection 1.Browse all the application 2. Save all requests from burp to a file 3.Use github.com/Miladkhoshdel/… to automate . If WAF use github.com/m4ll0k/Atlas .thanks @HusseiN98D for showing this. Thanks tool creators !!

5 312 719 0 305

Andrei Abakumov @andrewaeva

5 years ago

SSRF + CRLF + HTTP Pipeline + Docker API = RCE… How dangerous is Request Splitting, a vulnerability in Golang or how we found the RCE in Portainer and hacked Uber link.medium.com/dSWQ6ewPL6

4 372 852 0 189

Emad Shanab - أبو عبد الله @Alra3ees

5 years ago

#noobtip . Find subdomains:- amass enum -brute -w /root/wordlist.txt -d target -o target.txt Scan ports:- naabu -ports full -exclude-ports 80,443 -hL target.txt -o out.txt Find vulnerabilities:- nuclei -l out.txt -t nuclei-templates/cves/ -o results

7 117 328 0 107

Download Gif

Aishwarya Kendle @aish_kendle

5 years ago

#day33 #100daystolearnandimprove #bugbounty - SSTI again mohamedharon.com/2018/01/reflec… ackcent.com/blog/in-depth-… - Dirsearch payload suggested by @D0rkerDevil raw.githubusercontent.com/danielmiessler…

0 46 88 0 38

Florian Hansemann @CyberWarship

5 years ago

Hide your Powershell script in plain sight. Bypass all (a lot of ;-) Powershell security features #infosec #pentest #redteam github.com/OmerYa/Invisi-…

0 113 320 0 62

Download Gif

Buguard @BuguardLLC

5 years ago

A Lot of developers only check the domain and forget about the tld. evil.com is blocked? e.g target.com try target.computer e.g target.net try target.network Simple tip but Effective! #BugBounty #BugBountyTips #Buguard

1 81 208 0 56

Download Image

Yumi @Yumi_Sec

5 years ago

If a web application allow you to upload a .zip file, zip:// is an interesting PHP wrapper to turn a LFI into a RCE. #BugBounty #BugBountyTips #InfoSec