​​Web application pentesting checklist

A OWASP Based Checklist With 500+ Test Cases.

https://github.com/Hari-prasaanth/Web-App-Pentest-Checklist

#infosec #pentesting #bugbounty

​​TeamFiltration

TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts.

https://github.com/Flangvik/TeamFiltration

#pentesting #redteam #bugbounty

Cross-site scripting is a type of security vulnerability that can be found in some web applications. XSS attacks enable attackers to inject client-side scripts into web pages viewed by other users.

Read full Article >>
bit.ly/cross-sites-cripting

#bugbounty #pentesting

​​Nuclear Pond

Nuclear Pond is a utility leveraging Nuclei to perform internet wide scans for the cost of a cup of coffee.

https://github.com/DevSecOpsDocs/nuclearpond

#infosec #pentesting #bugbounty

What's SQL injection & SQLi attack examples & How to prevent it.

SQLi, or SQL Injection, is a type of code injection technique where an attacker injects malicious code into a website’s SQL database through user input fields. It is one of the most common web application exploiting techniques.

Read full Article

bit.ly/sql-injections-and-preventions

#pentesting #bugbounty #sqli

@trickypenguin

​​uncover

A go wrapper using APIs of well known search engines to quickly discover exposed hosts on the internet. It is built with automation in mind, so you can query it and utilize the results with your current pipeline tools.

https://github.com/projectdiscovery/uncover

#OSINT #recon #bugbounty

​​Advanced SQL Injection Cheatsheet

This repository contains a advanced methodology of all types of SQL Injection.

• Find injection point
• Understand the website behaviour
• Send queries for enumeration
• Understanding WAF & bypass it
• Dump the database

https://github.com/kleiton0x00/Advanced-SQL-Injection-Cheatsheet

#infosec #pentesting #bugbounty

Bug Bounty Beginner's Roadmap

This is a resource factory for anyone looking forward to starting bug hunting and would require guidance as a beginner.

https://github.com/bittentech/Bug-Bounty-Beginner-Roadmap

#bugbounty #pentesting #infosec

​​wpfinger

WordPress scanning tool.

• Core version detection
• Plugin scanning through fingerprinting
• Vulnerability output, using database from Wordfence

https://github.com/LeakIX/wpfinger

#pentesting #redteam #bugbounty

​​Logger++

A multithreaded logging extension for #BurpSuite. In addition to logging requests and responses from all Burp Suite tools, the extension allows advanced filters to be defined to highlight interesting entries or filter logs to only those which match the filter.

https://github.com/nccgroup/LoggerPlusPlus

#infosec #pentesting #bugbounty

​​Top25 Parameter

For basic researches, top 25 vulnerability parameters that can be used in automation tools or manual #recon.

https://github.com/lutfumertceylan/top25-parameter

#infosec #pentesting #bugbounty

​​x8

Hidden parameters discovery suite written in Rust.

The tool aids in identifying hidden parameters that could potentially be vulnerable or reveal interesting functionality that may be missed by other testers. Its high accuracy is achieved through line-by-line comparison of pages, comparison of response codes, and reflections.

https://github.com/Sh1Yo/x8

#infosec #pentesting #bugbounty

​​Bug Bounty scripts

The scripts I write to help me on my bug bounty hunting.

https://github.com/victoni/Bug-Bounty-Scripts

#infosec #pentesting #bugbounty

​​Js Finding

A Python tool for extracting JavaScript (JS) files from a given list of domains. This tool utilizes various utilities such as waybackurls, gauplus, and subjs to perform JS file extraction from the specified domains.

https://github.com/pikpikcu/js-finding

#infosec #redteam #bugbounty

​​HBSQLI

Automated tool for testing header based blind sql injection.

https://github.com/SAPT01/HBSQLI

#infosec #pentesting #bugbounty

To find information disclosure vulnerabilities change the headers

- Change the Accept header to:

- Also trying sending null byte like

GET /%00

If error handling is not done properly, reveals server version information, stack and route information

#bugbounty #bugbountytip

CSP-bypass techniques ☘️

https://bhavesh-thakur.medium.com/content-security-policy-csp-bypass-techniques-e3fa475bfe5d

#bugbounty #bugbountytips

The Ultimate Guide to Vulnerability Scanning
Read here: https://blog.hackerinthehouse.in/the-ultimate-guide-to-vulnerability-scanning/

#vulnerability #vulnerabilityassessment #vulnerabilityscanning #cybersecurity #infosec #penetrationtesting #bugbounty

Let's talk about Advanced Persistent Threats differently and beginner-friendly!
Read here: https://blog.hackerinthehouse.in/a-comprehensive-guide-to-apt/

#cybersecurity #apt #threat #pentesting #bugbounty #hacking #ethicalhacking #infosec

Mark your calendar and Get Ready. Something really cool is Coming Soon this June!
Will be exclusively announced on "Nerd Plugin": https://connect.hackerinthehouse.in


#hacker #cybersecurity #announcement #bugbounty #pentest #penetrationtesting #bughunting #redteam #redteaming #security #informationsecurity #infosec #hackerinthehouse #hith