Shamem Ahmad @blkryd

InfoSec researcher #learn2hack #infosec Dhaka, Bangladesh Joined August 2017

Tweets

94
Followers

44
Following

263
Likes

90

Aseem Shrey @AseemShrey

2 years ago

🎯 Google Dorking 101 : 10x your Scope & Recon game 👇

6 87 275 40K 303

winteri3coming @winteri3coming

2 years ago

Two CORS bugs on two different domains: 1st bypass: target.com.evil.com 2nd bypass: eviltarget.com #bugbountytips #bugbounty #cybersecurity

2 15 96 7K 28

Download Image

Bipin Jitiya @win3zz

2 years ago

Find leaked API Keys and Secrets using a single GitHub search query gist.github.com/win3zz/0a1c705… Tip: Never commit your keys/secrets to your public repository #Security #DataLeak #Hacking

45 226 802 121K 571

Download Image

Some tips for testing fileupload functionality (accepting xlsx file) - formula injection to ssrf =WEBSERVICE(google.com ) - try xxe payloads inside xlsx files to exploit parsers, after unzipping xlsx file ( you can add xxe payload in files like…

4 17 83 7K 36

Ninad Mishra @NinadMishra5

2 years ago

Payloads to try on phone number input fields by @securinti XSs +441134960000;phone-context=<script>alert(0)</script> Parameter pollution (1) +441134960000;phone-context=&phone-context=+442.. Parameter pollution (2) +441134960000;ext=1;ext=? SQL injection…

24 159 368 17K 183

N$ @nav1n0x

2 years ago

My new favorite SQLi finding methodology returning some great results... SQL Injection in `X-Forwarded-For:` header. #BugBounty

12 229 927 71K 362

Download Image

shubs @infosec_au

2 years ago

Spent some time using github.com/fyoorer/Shadow… today. It's pretty good. Make sure your Python env matches the runtime Python env, besides that everything works out of the box. Thanks @fyoorer for your work on this! Httpx on 150k subdomains in about 3-4 minutes.

6 59 293 41K 104

N$ @nav1n0x

2 years ago

I found 2 Blind time-based SQL Injections in X-Forwarded-For: header just using Burp Intruder. Made a list of 500+ HTTP request and tested one by one for 3+ hours, here is the result.. X-Forwarded-For: 0'XOR(if(now()=sysdate(),sleep(6),0))XOR'Z #BugBounty

24 240 932 61K 404

Download Image

N$ @nav1n0x

2 years ago

If you happen to find Symfony Web Framework that has Symfony profiler debug mode enabled, fuzz the following endpoints: - /app_dev.php - /app_dev.php/_profiler/phpinfo - /app_dev.php/_profiler - Look for "profiler token" in phpinfo() #BugBounty #BugBountytips

18 228 785 53K 380

Download Image

ProjectDiscovery @pdiscoveryio

2 years ago

🚨 NEW Feature Alert! 🚨 📸 With the httpx v1.3.0 release you can now take screenshots of target URLs, pages, or endpoints along with the rendered DOM! 😱 ⌨️ Update httpx with the -up option now to try it out! What are you waiting for! 🤘 #hackwithautomation #bugbounty

23 148 602 78K 131

Download Video

Florian Hansemann @CyberWarship

2 years ago

"burp-vps-proxy: This Burp Suite extension allows for the automatic creation and deletion of an upstream SOCKS5 proxy on popular cloud services." #infosec #redteam #pentest github.com/d3mondev/burp-…

0 6 17 3K 4

Download Image

Ninad Mishra @NinadMishra5

2 years ago

500 hosts 65535 ports in 10 minutes :) Save your time on portscans use masscan with --max-rate 100000 to get it done within a few minutes #bugbountytips

11 20 77 8K 27

Lu3ky13 ⚡️⚡️ @lu3ky13

2 years ago

We currently have 1,600,000 domains and subdomains on 5 vps We have also run this command in two ways It waybacks the whole list one by one and then runs the nuclei Second subdomains list+wayback+sqlmap+ You can send billions of requests with @Arez_1110 #bugbountytips #bugbount

9 63 254 25K 114

Download Image

张惠倩 @momika233

3 years ago

echo xxx.com | alterx | httpx -nc -t 300 -p 80,443,8080,8443,8090,9090 -silent | nuclei -rl 300 -bs 35 -c 30 -mhe 10 -ni -t /root/nuclei-templates/ -stats -silent -severity critical,medium,high,low -es info

Cyber Detective💙💛 @cyb_detective

3 years ago

7 133 424 105K 172

Download Image

12 161 465 67K 254

N$ @nav1n0x

3 years ago

If you have a JSON login page, test blind-SQL injection directly in the username and/or password fields like below. #BugBounty #SQLInjection #BugBountytips Payload injected in username input field:

29 251 885 67K 459

Download Image

Ninad Mishra @NinadMishra5

3 years ago

Found a directory listing? You can use `wget -r --no-parent target.com/dir` to recursively fetch all the files (+structure) to your machine. Now you can view the structure, search, and grep in files. credit:@2RS3C #BugBounty #BugBountytips

10 68 291 15K 128

Download Image

Un9nPlayer @Un9nPlayer

3 years ago

WAF bypasses XSS payload in JSON Payload: ["');alert('XSS');//"]@xyz.xxx #WAF #xss #BugBounty #BugBountytips

21 198 573 25K 243

Download Image

Hammad 🇵🇰🇵🇸 @Hammad7361

3 years ago

Found another SQLi on @Bugcrowd 's private program #ItTakesACrowd #BugBounty #BugBountytips #BugBountytip Tip: Use this payload 0'XOR(if(now()=sysdate(),sleep(15),0))XOR'Z In the value of every parameter and check if response delays according to the provided time in payload