#tools
One-liner crlf finding script

https://github.com/kleiton0x00/CRLF-one-liner

Finding CORS misconfigurations
#scripts

site="example.com"; gau "$site" | while read url;do target=$(curl -s -I -H "Origin: evil.com" -X GET $url) | if grep 'evil.com'; then [Potentional CORS Found]echo $url;else echo Nothing on "$url";fi;done

❗️Disclaimer❗️

All information in the "@APT_Notes" channel and in the "@APT_Notes_PublicChat" chat is for research and/or educational purposes only, and you are responsible for the use of this information.

THE AUTHOR DOES NOT HAVE ANY responsibility and/or liability for how you choose to use any of the information available here. By using any information from this channel, you understand that you AGREE TO USE AT YOUR OWN RISK. Once again, All information and files available here are for EDUCATIONAL and/or RESEARCH PURPOSES ONLY.

Any actions and/or actions related to the materials contained in this channel are solely your responsibility.

This channel does not promote any activity related to hacking. All information in this channel is for research and educational purposes only.

#Disclaimer

#Security_in_pictures #memes

#tools Kubernetes RBAC visualization
https://github.com/appvia/krane

#TOP10 Some examples of Broken access control

#TOP10 Where an issue might appear

#TOP10 Sensitive data exposure typical places

#memes /b bugbounty 😂

#TOP10 Broken Authentication

#tools AWS public services detection tool
https://github.com/BishopFox/smogcloud

#TOP10 Use logs, but be careful

#Tools
Tracking cloud infrastructure on steroids

https://www.marcolancini.it/2020/blog-mapping-moving-clouds-with-cartography/

#Risks E-Commerce fraud cases

Full research here:
https://appriss.com/retail/wp-content/uploads/sites/4/2018/12/AR3018_2018-Customer-Returns-in-the-Retail-Industry_Digital.pdf

Really cool numbers

#scripts
Find SSRF with this simple pattern 😌

gau domain.tld | grep -E "\?.*https?"

#BugBounty #Tools A cool checklist from whitespots.io for Android
https://docs.whitespots.io/mobile/android-checks

Automate your scans with scanner aggregator
https://github.com/secureCodeBox/secureCodeBox-v2

#memes #bugbounty
H1 team as always :)
https://hackerone.com/reports/156098

Without any additional installations

docker run --rm -it --name corsfinder -e VULN_ID=1 -e DOMAIN=site.com whitespots/corsfinder