Find hidden params in javascript files
assetfinder *.com | gau | egrep -v '(.css|.svg)' | while read url; do vars=$(curl -s $url | grep -Eo "var [a-zA-Z0-9]+" | sed -e 's,'var','"$url"?',g' -e 's/ //g' | grep -v '.js' | sed 's/.*/&=xss/g');done; echo -e "\e[1;33m$url\n\e[1;32m$vars"
#bugbounty #bugbountytips #cybersecurity #infosec #hacking
assetfinder *.com | gau | egrep -v '(.css|.svg)' | while read url; do vars=$(curl -s $url | grep -Eo "var [a-zA-Z0-9]+" | sed -e 's,'var','"$url"?',g' -e 's/ //g' | grep -v '.js' | sed 's/.*/&=xss/g');done; echo -e "\e[1;33m$url\n\e[1;32m$vars"
#bugbounty #bugbountytips #cybersecurity #infosec #hacking
❤6👍2
Awesome Security Hardening
https://github.com/decalage2/awesome-security-hardening
#cybersecurity #infosec #hacking
https://github.com/decalage2/awesome-security-hardening
#cybersecurity #infosec #hacking
👍3❤2
Bug Bounty Report ✅
• Bug : Ethereum account balance manipulation
• Bug Type : Business Logic Errors
• Organization : Coinbase
• Bounty : $10000
• Technology : Blockchain or Web 3
Read This Report : 👇
📌 Summary :
➡️ By using a smart contract to distribute ether over a set of wallets you can manipulate the account balance of your Coinbase account.
➡️ If 1 of the internal transactions in the smart contract fails all transactions before that will be reversed.
➡️ But on Coinbase these transactions wasn't not reversed, meaning someone could add as much ether to their balance as they want.
When looking Coinbase wallet address after this transaction you will see that it is empty, but checking your Coinbase wallet will show your funds.
📌 Steps To Reproduce:
• Setup a smart contract with a few valid Coinbase wallets and 1 final faulty wallet
(always throw exception when receiving funds smart contract for example)
• Transfer appropriate funds to smart contract.
• Execute smart contract adding the set amount of ether to the Coinbase wallets without ever actually leaving the smart contract wallet because the complete transaction fails at the last wallet.
• Repeat until you have more than enough Ethereum in your Coinbase wallet.
• Cash out, transfer to off site wallet
How It Could Be Fix :
➡️ The issue was fixed by changing the contract handling logic.
#bugbounty #bugbountytips #cybersecurity #infosec #hacking
• Bug : Ethereum account balance manipulation
• Bug Type : Business Logic Errors
• Organization : Coinbase
• Bounty : $10000
• Technology : Blockchain or Web 3
Read This Report : 👇
📌 Summary :
➡️ By using a smart contract to distribute ether over a set of wallets you can manipulate the account balance of your Coinbase account.
➡️ If 1 of the internal transactions in the smart contract fails all transactions before that will be reversed.
➡️ But on Coinbase these transactions wasn't not reversed, meaning someone could add as much ether to their balance as they want.
When looking Coinbase wallet address after this transaction you will see that it is empty, but checking your Coinbase wallet will show your funds.
📌 Steps To Reproduce:
• Setup a smart contract with a few valid Coinbase wallets and 1 final faulty wallet
(always throw exception when receiving funds smart contract for example)
• Transfer appropriate funds to smart contract.
• Execute smart contract adding the set amount of ether to the Coinbase wallets without ever actually leaving the smart contract wallet because the complete transaction fails at the last wallet.
• Repeat until you have more than enough Ethereum in your Coinbase wallet.
• Cash out, transfer to off site wallet
How It Could Be Fix :
➡️ The issue was fixed by changing the contract handling logic.
#bugbounty #bugbountytips #cybersecurity #infosec #hacking
Please open Telegram to view this post
VIEW IN TELEGRAM
👍9
How to Find XSS Like a Pro 🫥
To find XSS (Cross-Site Scripting) bugs, you can use combination of manual testing and automated tools.
Some steps you can follow to find XSS:
➡️ identify potential entry points for XSS attacks, such as input fields in web forms, query parameters in URLs, or file uploads.
➡️ Use a web application scanner to test these entry points for XSS vulnerabilities.
These scanners can automatically scan your web application and identify potential vulnerabilities, including XSS.
➡️ Manually review your website's code for any places where user-supplied input is not properly sanitized or validated.
For example, look for places where the website includes user input in the page without properly encoding it first.
➡️ Test the website by trying to inject various types of malicious input, such as JavaScript code, into different parts of the website.
For example, try entering JavaScript code into forms, URL parameters, and other inputs to see if the website is vulnerable to XSS attacks.
➡️ If you find any potential XSS vulnerabilities, verify them by attempting to exploit them.
This will help you confirm that the issue is real and that it needs to be fixed
Once you have identified and verified any XSS vulnerabilities, work with your development team to fix the issues and prevent them from happening again in the future.
#bugbounty #bugbountytips #cybersecurity #infosec #hacking
To find XSS (Cross-Site Scripting) bugs, you can use combination of manual testing and automated tools.
Some steps you can follow to find XSS:
➡️ identify potential entry points for XSS attacks, such as input fields in web forms, query parameters in URLs, or file uploads.
➡️ Use a web application scanner to test these entry points for XSS vulnerabilities.
These scanners can automatically scan your web application and identify potential vulnerabilities, including XSS.
➡️ Manually review your website's code for any places where user-supplied input is not properly sanitized or validated.
For example, look for places where the website includes user input in the page without properly encoding it first.
➡️ Test the website by trying to inject various types of malicious input, such as JavaScript code, into different parts of the website.
For example, try entering JavaScript code into forms, URL parameters, and other inputs to see if the website is vulnerable to XSS attacks.
➡️ If you find any potential XSS vulnerabilities, verify them by attempting to exploit them.
This will help you confirm that the issue is real and that it needs to be fixed
Once you have identified and verified any XSS vulnerabilities, work with your development team to fix the issues and prevent them from happening again in the future.
#bugbounty #bugbountytips #cybersecurity #infosec #hacking
Please open Telegram to view this post
VIEW IN TELEGRAM
👍3❤1
RedTeaming CheatSheet
https://github.com/0xJs/RedTeaming_CheatSheet
#cybersecurity #infosec #hacking #redteam
https://github.com/0xJs/RedTeaming_CheatSheet
#cybersecurity #infosec #hacking #redteam
GitHub
GitHub - 0xJs/RedTeaming_CheatSheet: Pentesting cheatsheet with all the commands I learned during my learning journey. Will try…
Pentesting cheatsheet with all the commands I learned during my learning journey. Will try to to keep it up-to-date. - 0xJs/RedTeaming_CheatSheet
⚡2👍2
Awesome Kubernetes Security
https://github.com/magnologan/awesome-k8s-security
#cybersecurity #infosec #hacking
https://github.com/magnologan/awesome-k8s-security
#cybersecurity #infosec #hacking
❤1👍1
Android Security materials and resources For Pentesters and Bug Hunters
https://github.com/saeidshirazi/awesome-android-security?s=09
#bugbounty #bugbountytips #cybersecurity #infosec #hacking
https://github.com/saeidshirazi/awesome-android-security?s=09
#bugbounty #bugbountytips #cybersecurity #infosec #hacking
⚡3❤🔥2🔥1
Complete Practical Study Plan to become a successful cybersecurity engineer... :)
https://github.com/jassics/security-study-plan
#cybersecurity #infosec #hacking
https://github.com/jassics/security-study-plan
#cybersecurity #infosec #hacking
❤2
A collection of awesome tools used by Web hackers :)
https://github.com/hahwul/WebHackersWeapons
#bugbounty #bugbountytips #cybersecurity #infosec #hacking
https://github.com/hahwul/WebHackersWeapons
#bugbounty #bugbountytips #cybersecurity #infosec #hacking
🔥5👍2
Secondary context fuzzing:
/..%2f
/..;/
/../
/..%00/
/..%0d/
/..%5c
/..\
/..%ff/
/%2e%2e%2f
/.%2e/
/%3f (?)
/%26 (&)
/%23 (#)
via https://samcurry.net/hacking-starbucks/
100 million😲 sbux accounts disclosure
see also: https://docs.google.com/presentation/d/1N9Ygrpg0Z-1GFDhLMiG3jJV6B_yGqBk8tuRWO1ZicV8
#bugbounty #bugbountytips #cybersecurity #infosec #hacking
/..%2f
/..;/
/../
/..%00/
/..%0d/
/..%5c
/..\
/..%ff/
/%2e%2e%2f
/.%2e/
/%3f (?)
/%26 (&)
/%23 (#)
via https://samcurry.net/hacking-starbucks/
100 million😲 sbux accounts disclosure
see also: https://docs.google.com/presentation/d/1N9Ygrpg0Z-1GFDhLMiG3jJV6B_yGqBk8tuRWO1ZicV8
#bugbounty #bugbountytips #cybersecurity #infosec #hacking
🔥3
Bug Bounty Hint
How to turn Self-XSS into Reflected/Stored XSS
• Cache poisoning
• Copy+Paste trick using IFrame
• Cookie poisoning using auto login
#bugbounty #bugbountytips #cybersecurity #infosec #hacking
How to turn Self-XSS into Reflected/Stored XSS
• Cache poisoning
• Copy+Paste trick using IFrame
• Cookie poisoning using auto login
#bugbounty #bugbountytips #cybersecurity #infosec #hacking
⚡3👍2❤🔥1
Cloud Security Attacks
https://github.com/CyberSecurityUP/Cloud-Security-Attacks
#cybersecurity #infosec #hacking
https://github.com/CyberSecurityUP/Cloud-Security-Attacks
#cybersecurity #infosec #hacking
⚡1❤1
Bug Bounty Hint
Soon you will be able to use regular expression searches in GitHub repositories (in addition to basic dorking). You can join the waitlist @ cs.github.com
Meanwhile, you can use grep.app
👉 www.github.com/l4yton/RegHex
#bugbounty #bugbountytips #cybersecurity #infosec #hacking
Soon you will be able to use regular expression searches in GitHub repositories (in addition to basic dorking). You can join the waitlist @ cs.github.com
Meanwhile, you can use grep.app
👉 www.github.com/l4yton/RegHex
#bugbounty #bugbountytips #cybersecurity #infosec #hacking
GitHub
GitHub - l4yton/RegHex: A collection of regexes for every possbile use
A collection of regexes for every possbile use. Contribute to l4yton/RegHex development by creating an account on GitHub.
🔥4👍1
How to get Started into Bug Bounty ?
⚙ Basics:
1. Networking basics
2. Linux basics
3. Computer flow
4. Learning 1 at 1
⚙ How things works?
1. Website
2. Apps
3. Servers
4. Networks
5. Technologies
⚙ What Tools?
1. Proxy Tools
2. Tools installation
3. Virtual Box
4. Browser Usage
5. Linux Commands
⚙ Labs
1. Portswigger
2. Hacker101
3. CTFs
4. HackThisSite
5. Pentesterlab
⚙ Platforms
1. Bugcrowd
2. HackerOne
3. Intigriti
4. YesWeHack and more
#bugbounty #bugbountytips #cybersecurity #infosec #hacking
⚙ Basics:
1. Networking basics
2. Linux basics
3. Computer flow
4. Learning 1 at 1
⚙ How things works?
1. Website
2. Apps
3. Servers
4. Networks
5. Technologies
⚙ What Tools?
1. Proxy Tools
2. Tools installation
3. Virtual Box
4. Browser Usage
5. Linux Commands
⚙ Labs
1. Portswigger
2. Hacker101
3. CTFs
4. HackThisSite
5. Pentesterlab
⚙ Platforms
1. Bugcrowd
2. HackerOne
3. Intigriti
4. YesWeHack and more
#bugbounty #bugbountytips #cybersecurity #infosec #hacking
👍5
List of Awesome macOS Red Teaming Resources.
As more and more companies begin to adopt macOS as a daily office solution, we often encounter macOS operating system during our Pentest/Red Teaming process.
How to #hacking #macOS, how to achieve Persistence under macOS, and using this as a starting point Lateral Movement to DC is a topic worth research.
This list is for anyone who wants to learn about Red Teaming for macOS but has no starting point. 👇
https://github.com/tonghuaroot/Awesome-macOS-Red-Teaming
JOIN @h4ckerinthehouse FOR MORE! ✅
As more and more companies begin to adopt macOS as a daily office solution, we often encounter macOS operating system during our Pentest/Red Teaming process.
How to #hacking #macOS, how to achieve Persistence under macOS, and using this as a starting point Lateral Movement to DC is a topic worth research.
This list is for anyone who wants to learn about Red Teaming for macOS but has no starting point. 👇
https://github.com/tonghuaroot/Awesome-macOS-Red-Teaming
JOIN @h4ckerinthehouse FOR MORE! ✅
Tips for finding hardcoded credentials
Whenever you are searching for hardcoded credentails, don't forget to read "jquery.js" files as well. Sometime you might find 3rd party hardcoded credentials
#bugbountytips #hacking #infosec
Whenever you are searching for hardcoded credentails, don't forget to read "jquery.js" files as well. Sometime you might find 3rd party hardcoded credentials
#bugbountytips #hacking #infosec
👍3
Phishing Unmasked
Read here:
https://blog.hackerinthehouse.in/phishing-unmasked/
#phishing #hackerinthehouse #cybersecurity #infosec #cyberattacks #hacking
Read here:
https://blog.hackerinthehouse.in/phishing-unmasked/
#phishing #hackerinthehouse #cybersecurity #infosec #cyberattacks #hacking
HITH Blog - Hackerinthehouse - Learn, Contribute, Conquer
Phishing Unmasked - HITH Blog - Hackerinthehouse
Phishing is when someone pretends to be a trustworthy person or company to trick you into sharing your personal information.
❤2👍2
Let's talk about Advanced Persistent Threats differently and beginner-friendly!
Read here: https://blog.hackerinthehouse.in/a-comprehensive-guide-to-apt/
#cybersecurity #apt #threat #pentesting #bugbounty #hacking #ethicalhacking #infosec
Read here: https://blog.hackerinthehouse.in/a-comprehensive-guide-to-apt/
#cybersecurity #apt #threat #pentesting #bugbounty #hacking #ethicalhacking #infosec
HITH Blog - Hackerinthehouse - Learn, Contribute, Conquer
A Comprehensive Guide to APT - HITH Blog - Hackerinthehouse
Advanced persistent threats (APTs) are elite hacker groups that leverage sophisticated malware, zero-days, and relentless tactics to breach major targets.
❤3👍1
Persistence in Red Teaming
Read here: https://blog.hackerinthehouse.in/the-crucial-role-of-persistence-in-red-teaming
#cybersecurity #persistence #redteaming #pentest #hacking #hackerinthehouse
Read here: https://blog.hackerinthehouse.in/the-crucial-role-of-persistence-in-red-teaming
#cybersecurity #persistence #redteaming #pentest #hacking #hackerinthehouse
🔥2👍1
Modern Defensive Cybersecurity Services
Read here: https://blog.hackerinthehouse.in/modern-defensive-cybersecurity-services/
#cybersecurity #cybersecuritytips #vulnerability #security #infosec #hacker #hacking #soc #mdr #defensivesecurity #hith #hackerinthehouse #hacke@h4ckerinthehouse
Read here: https://blog.hackerinthehouse.in/modern-defensive-cybersecurity-services/
#cybersecurity #cybersecuritytips #vulnerability #security #infosec #hacker #hacking #soc #mdr #defensivesecurity #hith #hackerinthehouse #hacke@h4ckerinthehouse
HITH Blog - Hackerinthehouse - Learn, Contribute, Conquer
Modern Defensive Cybersecurity Services - HITH Blog - Hackerinthehouse
In today's interconnected world, understanding the various layers of defensive cybersecurity services isn't just good practice. It's essential for survival.