Malware @malware773

🎁Monthly Giveaway🎁 Hack The Box 1-year VIP+ & 3-month Prolab - Follow, Like, and Retweet to join! - Winners will be picked randomly on 18 Mar. #hackthebox #giveaway #projectsekaictf

@nav1n0x Tried that a lot of times, never worked 😪

@7h3h4ckv157 @C0d3Cr4zy why is the language set to Romanian 😅

@theXSSrat lmao

@gregxsunday @Hacker0x01 Me and my teammate reported an XSS -> Account Takeover, the minimum bounty for the XSS was 450, somehow after 3 months of ‘we are so busy’ we got 250. The minimum was 450 and our bug was way more then an XSS(we had eval access too). I guess that’s the new way of doing things

@xuanthanh2812 bc it's your own account you can get your own user infos, I saw a lot of programs that return your password. BUT, you should always think about 'what is the impact of this' if the response is nothing, well you got yourself an answer. (at least that's what i do) great find tho!

100 random #pentesting tips thexssrat.podia.com/?coupon=DFSDSF… Start with the OWASP Top 10 vulnerabilities and focus on those. Keep up to date with the latest vulnerabilities and exploitation techniques. Look for subdomains and hidden endpoints that are not well known. Test for cross-site scripting (XSS) and cross-site request forgery (CSRF) vulnerabilities. Use burp suite or similar tools to intercept and modify requests. Try to bypass client-side validations and look for server-side vulnerabilities. Check for open redirects and unauthorized access to sensitive data. Test for SQL injection and other database-related vulnerabilities. Pay attention to HTTP headers, such as "X-XSS-Protection" and "X-Content-Type-Options". Check for vulnerabilities in third-party components, such as plugins and libraries. Use tools such as DirBuster to find hidden directories and files. Use tools such as nmap to scan for open ports and services. Try to identify and exploit vulnerabilities in software versions that are no longer supported. Look for weak passwords and password reset mechanisms. Check for weak cryptography, such as weak ciphers or insufficient key lengths. Use tools such as Metasploit to automate the exploitation process. Look for vulnerabilities in session management, such as session fixation and session hijacking. Check for vulnerabilities in error handling, such as stack traces and debugging information. Test for vulnerabilities in file upload mechanisms, such as file inclusion or command execution. Look for vulnerabilities in web application firewalls (WAFs). Check for security misconfigurations, such as directory listing or insecure file permissions. Use tools such as Whois to gather information about the target. Try to find and exploit vulnerabilities in mobile applications. Look for vulnerabilities in single sign-on (SSO) systems. Check for vulnerabilities in cloud infrastructure, such as misconfigured S3 buckets. Use tools such as Shodan to find internet-connected devices and gather information about them. Look for vulnerabilities in web services, such as REST APIs. Check for vulnerabilities in virtual private networks (VPNs) and remote access systems. Use tools such as sqlmap to automate SQL injection attacks. Look for vulnerabilities in load balancers and content delivery networks (CDNs). Check for vulnerabilities in email systems, such as SPAM filters and email forwarding. Use tools such as Wireshark to analyze network traffic. Look for vulnerabilities in content management systems (CMSs), such as WordPress and Drupal. Check for vulnerabilities in DNS servers and domain registrars. Use tools such as John the Ripper to crack passwords. Look for vulnerabilities in network protocols, such as TCP/IP and DNS. Check for vulnerabilities in source code management systems, such as Git and SVN. Use tools such as hping to test firewall configurations and perform network scans. Look for vulnerabilities in web servers, such as Apache and IIS. Check for vulnerabilities in network-attached storage (NAS) devices and file servers. Use tools such as Nmap to map out network topologies and identify live hosts. Look for vulnerabilities in authentication systems, such as LDAP and Kerberos. Check for vulnerabilities in hypervisors, such as VMware and Xen. Look for vulnerabilities in encryption systems, such as SSL and TLS. Check for vulnerabilities in hardware, such as routers and switches. Use tools such as Telnet to test remote access to systems. Look for vulnerabilities in cloud-based services, such as AWS and Azure. Check for vulnerabilities in Internet of Things (IoT) devices. Use tools such as OWASP ZAP to perform automated security testing. Look for vulnerabilities in backup systems, such as tapes and disk images. Check for vulnerabilities in virtualization systems, such as VirtualBox and Hyper-V. Use tools such as Charles to debug HTTP requests and responses. Look for vulnerabilities in big data systems, such as Hadoop and Spark. Check for vulnerabilities in data storage systems, such as databases and file systems. Use tools such as Aircrack-ng to perform wireless network assessments. Look for vulnerabilities in email encryption systems, such as PGP and S/MIME. Check for vulnerabilities in software as a service (SaaS) platforms, such as Salesforce and Dropbox. Use tools such as Nessus to perform vulnerability scans. Look for vulnerabilities in containerization systems, such as Docker and Kubernetes. Check for vulnerabilities in supply chain management systems, such as procurement and logistics. Use tools such as Postman to test and debug APIs. Look for vulnerabilities in video conferencing systems, such as Zoom and Microsoft Teams. Check for vulnerabilities in project management systems, such as Asana and Trello. Use tools such as OpenVAS to perform vulnerability scans. Look for vulnerabilities in identity and access management systems, such as Active Directory and Okta. Check for vulnerabilities in content delivery networks (CDNs), such as Cloudflare and Akamai. Use tools such as OWASP Juice Shop to practice ethical hacking and identify vulnerabilities. Look for vulnerabilities in search engines, such as Google and Bing. Check for vulnerabilities in video streaming systems, such as YouTube and Netflix. Use tools such as OWASP OWTF to perform full-spectrum assessments. Look for vulnerabilities in domain name systems (DNS), such as registrars and resolvers. Check for vulnerabilities in remote desktop protocols (RDP), such as Microsoft Remote Desktop and VNC. Use tools such as OWASP WebScarab to analyze web application traffic. Look for vulnerabilities in wireless networks, such as Wi-Fi and Bluetooth. Check for vulnerabilities in virtual private networks (VPNs), such as OpenVPN and PPTP. Use tools such as OWASP ZED Attack Proxy (ZAP) to find security flaws in web applications. Look for vulnerabilities in instant messaging systems, such as WhatsApp and Telegram. Check for vulnerabilities in e-commerce platforms, such as Magento and Shopify. Use tools such as OWASP DefectDojo to manage vulnerability reports and track remediation efforts. Look for vulnerabilities in voice over IP (VoIP) systems, such as Skype and Slack. Check for vulnerabilities in document management systems, such as SharePoint and Google Drive. Use tools such as OWASP OWTF to perform advanced web application assessments. Look for vulnerabilities in email clients, such as Microsoft Outlook and Gmail. Look for vulnerabilities in payment systems, such as PayPal and Stripe. Check for vulnerabilities in chatbots, such as Facebook Messenger and Slackbot. Use tools such as OWASP WebGoat to practice identifying and exploiting security vulnerabilities. Look for vulnerabilities in online marketplaces, such as Amazon and eBay. Check for vulnerabilities in internet service providers (ISPs), such as Comcast and AT&T. Use tools such as OWASP ZAP to automate security testing and find vulnerabilities in real-time. Look for vulnerabilities in mobile device management (MDM) systems, such as AirWatch and MobileIron. Check for vulnerabilities in customer relationship management (CRM) systems, such as Salesforce and Zoho. Use tools such as OWASP ModSecurity to protect web applications from attacks. Look for vulnerabilities in digital rights management (DRM) systems, such as FairPlay and PlayReady. Check for vulnerabilities in blockchain systems, such as Bitcoin and Ethereum. Use tools such as OWASP Web Application Firewall (WAF) to defend against attacks on web applications. Look for vulnerabilities in virtual reality (VR) and augmented reality (AR) systems. Check for vulnerabilities in smart home devices, such as Amazon Echo and Google Home. Use tools such as OWASP Top 10 Proactive Controls to implement best practices for web application security. Look for vulnerabilities in web analytics systems, such as Google Analytics and Adobe Analytics. Check for vulnerabilities in content management systems (CMS), such as WordPress and Drupal.

#BugBounty recommended targets Web main app app.intigriti.com/programs/porto… A lot of possibilities here with not too much complexity app.intigriti.com/programs/suivo… Permission matrix … need I say more? app.intigriti.com/programs/innog… These games are all browser-based and hacker-friendly to intercept traffic from. All-in-all excellent program! Web broad scope app.intigriti.com/programs/innov… Great for broad scope hacking, though VDP so no rewards except points app.intigriti.com/programs/dpgm/… Not too complex, can be both main app and broad scope, older technology, strange servers? FUN! API app.intigriti.com/programs/lansw… A bit more complex but they do have an API that might be fun to poke at for some app.intigriti.com/programs/ninja… If you know how to hack games and like doing so, this could be the perfect match for you! Mobile app.intigriti.com/programs/innov…

@Bugcrowd hmh

@x1337loser good job brother

@I_Am_Jakoby @lsecqt

I Posted a recent 1 of my Priv8 Nuclei Template that helped me a lot in finding "Open Redirect" Bugs in various programs ^_^ Link: github.com/SirBugs/Priv8-… And here we go with the following one line command for running it directly #bugbountytips #bugbountytip #bugbounty

keyboard_arrow_left Previous keyboard_arrow_right Next

@ROHITSH42367350 Was the POC for the CVE

After almost a year of bug hunting on ~ daily basis, yesterday I managed to hit a 9.8 CVE - NoSQL injection via the Controller/Auth.php resetpassword function. It's not my first bug, I'm hunting along a very good friend and person but this was the first 'BIG' hit. #BugBounty

udemy.com/course/broad-s… Grab it while it lasts, only 1000 copies free <3

@SydAliHsn I was thinking about doing a writeup for this bug and I will, thank you for your support 😀

@Andreea07855783 Thank you 😀

@fattselimi that s for sure

@Jhaddix Might sound stupid but a lot of times I get new ideas just by looking at the ceiling 😂

@SydAliHsn thank you for the advice!