fuzz0exp @fuzz0exp

Joined July 2024

Tweets

19
Followers

9
Following

698
Likes

141

Mufaddal M @muffymas

4 years ago

I've created a mindmap consisting of various techniques to find IDOR vulnerabilities. This will ease your hunting and 'll try to ensure you don't miss this finding the next time. Detailed IDOR notes: notes.mufaddal.info/web/idor #pentest #bugbountytips #bugbounty #AppSec #cybersec

10 226 414 0 137

Download Image

洺熙 @xishan12509850

10 months ago

github.com/Acmesec/Prompt…，越狱框架——米斯特漏洞助手，截止目前已成功越狱openai，谷歌，微软，feckbook，亚马逊，克劳德等一线领先模型，国内自不必多说，通杀，本次研究所涉及的思路全流程，资料，目前已全部开源，链接自取，后续将持续更新，1.0版本仓促，有建议或错误，欢迎师傅们指正，拜谢诸君！

0 1 3 288 4

洺熙 @xishan12509850

10 months ago

市面上prompt书籍资料，大多徒有其表，华而不实或局限设计角度，当初prompt技术初衷是引导模型理解，从而唤醒模型对应的内部语料，涉及设计指令，算法处理，模型底座等环节，缺一不可，只关注道或只执着术，都是本末倒置，道术结合才为修行，没人写,那我自己动笔，正在逐步编写后续开源共享，诸君自取

2 8 32 4K 11

Download Image

James Kettle @albinowax

11 months ago

Ever wanted to fuzz a WebSocket? We've just updated WebSocket Turbo Intruder with some new features. If you've used Turbo Intruder already, it should feel familiar :)

5 83 554 31K 218

Download Image

ӉѦСҠіИԌ ҬЄѦӍ @HackingTeam777

11 months ago

Reduce Noise in Burp Suite with This Simple Trick! 🔥 💡 Just add the following patterns in Burp Suite under Proxy > Options > TLS Pass Through: .*\.google\.com .*\.gstatic\.com .*\.googleapis\.com .*\.pki\.goog .*\.mozilla\..* If you have any other filters to do share

1 100 465 25K 385

Download Image

RootMoksha Labs @RootMoksha

11 months ago

an XSS payload to bypass some waf & filters in Firefox <input accesskey=X onclick="self['wind'+'ow']['one'+'rror']=alert;throw 1337;"> Credits:@0x0SojalSec #bugbounty #bugbountytips

1 40 186 6K 103

Download Image

Ben Sadeghipour @NahamSec

12 months ago

I have pushed 3 massive updates to my course since July to include more labs/videos on SSRF, RCE, ATO, 403/401 Bypasses, and more! 🧑🏽‍💻 👀 I'll give away two free vouchers to two people who retweet and reply with 'RCE' under this post! ℹ️ More info 👉🏼 bugbounty.nahamsec.training

369 353 801 70K 307

Download Image

𝕏 Bug Bounty Writeups 𝕏 @bountywriteups

a year ago

🚨 E-mail address payloads 🚨 The following payloads are all valid e-mail addresses that we can use for pentesting of not only web based e-mail systems. 🧾 XSS (Cross-Site Scripting): test+(<script>alert(0)</script>)@example.com test@example(<script>alert(0)</script>).com…

1 74 271 13K 231

Download Image

STÖK ✌️ @stokfredrik

a year ago

I like XXE’s but testing xml parsers using docx files can be quite a tedious task. Yes you can use scanners for this but i have had the most amount of success while using a provided import template or when I have exported existing data from an app in a docx format. With in…

3 41 262 36K 219

Download Image

𝕏 Bug Bounty Writeups 𝕏 @bountywriteups

a year ago

🪲POC - Unauthenticated RCE Flaw in Rejetto HTTP File Server CVE-2024-23692 Fofa Dork: "HttpFileServer" && server=="HFS 2.3m" 💣Exploit Script: github.com/verylazytech/C…

0 39 142 7K 75

Download Image

𝕏 Bug Bounty Writeups 𝕏 @bountywriteups

a year ago

🚨 New Bug Bounty Programs Find the Latest Bug Bounty Programs below. Programs auto-refresh every 7 mins. bbradar.io

0 22 99 7K 64

Download Image

Aman (Shadow🔥) @being__aman

a year ago

I was awarded $$$ ❤️🦅 @Hacker0x01 Bug :- business logic + privilege escalation Tip:- try to change the content using burp like:- null to true #bugbounty

10 10 153 6K 31

Download Image

𝕏 Bug Bounty Writeups 𝕏 @bountywriteups

a year ago

🔥 Filter out noise in Burp Suite 🔥 ➡️ While you are testing with Burp Suite, you may want to add these patterns into the Burp Suite > Proxy > Options > TLS Pass Through settings: .*\.google\.com .*\.gstatic\.com .*\.googleapis\.com .*\.pki\.goog .*\.mozilla\..* 📃 Now all…

8 129 473 25K 449

Download Image

Rikesh Baniya @rikeshbaniya

a year ago

target.com/admin/registra… [404 ❌] changed user agent to android User-Agent: Target-Android 210.x.xx [200 ✅ ] #bugbountytip #bugbountytips

1 12 67 6K 53

Sayedv2 🕷️ @Sayed_v2

a year ago

- Replace the id in the delete request and send it >> 500 internal server error - Check the victim's account , and the content has been deleted - Don't rely on the status code or the response 🧐 #BugBounty #bugcrowd

3 10 139 6K 35

Download Image

🇪🇨🍫 @bxmbn

a year ago

What is this 😭 username=bombon&password=undefined 200 OK username=AnyUser&password=undefined 200 Ok It gives you the access token just by providing the username and requesting the password as ‘undefined’ letting you to basically authenticate to any account..

28 76 761 45K 343

Download Image

Coffin @coffinxp7

a year ago

so finally guys here is your final script for xss now its give you results with 0% false postive free tool for all 🔥and special thanks to my brother who make this tool more better and we will add all owsp top 10 vuln scan soon.. github.com/coffinsp/losto…