p.yuvanesh @pyuvanesh

💥Easy RCE Ports Java RMI: 1090,1098,1099,4444,11099,47001,47002,10999 WebLogic: 7000-7004,8000-8003,9000-9003,9503,7070,7071 JDWP: 45000,45001 JMX: 8686,9012,50500 GlassFish: 4848 jBoss: 11111,4444,4445 Cisco Smart Install: 4786 HP Data Protector: 5555,5556 #ptswarmTechniques

This method have more success in any privilege escalation, good one.

Khizer Javed @KHIZER_JAVED47

5 years ago

This method have more success in any privilege escalation, good one.

7 78 526 0 76

Download Image

I just published Reflected XSS in Facebook’s mirror websites Hope you will like it. Feedbacks are appreciated link.medium.com/CqgFgAajM8

GiHub Dorks for Finding API Keys, Tokens and Passwords api_key “api keys” authorization_bearer: oauth auth authentication client_secret api_token: “api token” client_id password user_password user_pass passcode client_secret secret password hash OTP user auth #bugbountytips

Dear Followers, Vault Infosec would like to offer free vulnerability assessments for your applications to help companies to fight against cyber threats during this pandemic linkedin.com/feed/update/ur… #cybersecurity #vaultinfosec #wevowyoursecurity #Vulnerability #privacy #Covid_19

Note to self: Don't deploy on Fridays

When testing for SSRF using a black list, take internal IP addresses and when encoding them, dont encode entire IP. Encode 1 octet of the IP address, or 2 or 3. For Instance: AWS Metadata - 0251.254.169.254 (this got the $160,000 payout in Oct 2018) #bugbountytip #bugbounty

الحمد لله My 2020 Start with SSRF on @Google Here is an Amazing thing i wish to share to Noobs like me. medium.com/@maverickNerd/… #Bugbounty #Bugbountytips #Bugbounty2020goals

Great introduction to Shodan by @TomLawrenceTech that discusses how it works and shares a few tips to get started: youtube.com/watch?v=NPJUqR…

Hi, If you want to know how SSRF Vulnerability was exist in Vimeo, you should read: medium.com/@dPhoeniixx/vi… Reported through @Hacker0x01 ;)

Password dumps Collections 1-5's (.txt only): 27.47 B Records (806GB) 296 GB of usernames 260 GB of domain names 250 GB of passwords Unique: 18 GB of usernames (1.296.186.909) 2.3 GB of domain names (67.031.505) 16 GB of passwords (958.883.636) github.com/audibleblink/p…

@brok3npixels @J1GGY_ @phwd I strongly recommend read every bagipro's disclosed report on hackerone hackerone.com/bagipro and watch this awesome @Ben_RA talk youtube.com/watch?v=OLgmPx…, thoose resource are a very good start

Found HTML Injection in a web form but the CSP was blocking execution. I noticed *.google.com was allowed which is common for Google Analytics. Hosted an xss.js payload on Google Drive and found the raw download link. Passed that in to the script src location and💥! CSP Bypass.

keyboard_arrow_left Previous keyboard_arrow_right Next

Fellow hunters, what are the best books you've red? (not related to #bugbounty)

Be aware. Be secure. Follow us to stay updated on our posts. #cybersecurity #vaultinfosec #informationsecurity #informationtechnology #SocialMedia #posts #awareness #privacy

Great Initiative Vignesh 👍 @pwn_r00t

Vault Infosec @vaultinfosec

6 years ago

Great Initiative Vignesh 👍 @pwn_r00t

0 8 10 0 0

Download Image

A tip for finding SSRF using localhost. #bugbounty

I'm proud to share my first write-up, hope you enjoy it Think Outside the Scope: Advanced CORS Exploitation Techniques link.medium.com/UTKkk4wvGW

#xss #sharing j%0aAv%0dasCr%09ipt: J%0aa%0av%0aa%0as%0ac%0ar%0ai%0ap%0aT%0a: J%0aa%0dv%09a%0as%0dc%09r%0ai%0dp%09T%0d%0a CC : Random

This talk summarized the year 2018 in @GoogleVRP. Daniel, InfoSec Engineer @Google, talked about $$$, presented some of the most surprising and exciting #bugs & shared tips to find impactful bugs in 2019. #bugbounty #bugbountytips #Google #Security youtube.com/watch?v=mJwZfR…