12.5K subscribers
550 photos
27 videos
24 files
889 links
This channel discusses:

— Offensive Security
— RedTeam
— Malware Research
— OSINT
— etc

Disclaimer:
t.iss.one/APT_Notes/6

Chat Link:
t.iss.one/APT_Notes_PublicChat
Download Telegram
🚨🚨
I am starting the #BurpHacksForBounties series for 30 days, each day will share a Burp hack, which makes my working with Burp Suite easier.

Starting Monday. Stay tuned.

They will not be the ones you find on the internet 😉😉

#infosec #appsec #bugbounties #bugbountytips
#BurpHacksForBounties - Day 1/30

Turbo intruder: Power of Python with Burp Suite Intruder.

I use it to tailor my pen-testing for a specific target and targetted #bugbounty

#infosec #appsec #bugbountytips #bugbountytip #security
How to - 🧵🙃👇
1/n
Using: CE so that everyone can explore.
Intruder in CE is limited in multithreading, Turbo-Intruder can overcome that.
- Install through Extender
- Send req to the plugin.
2/n
Once you send req to the plugin, a python editor will open. This will show a couple of existing python scripts to take reference from and to use.
3/n
Details in comments.
Code: https://gist.github.com/r0hi7/47e3d47efaa1ee3df63a6e936dade787

Increase concurrency or can add pipeline.
Then click attack.
n/n
You can do almost anything with Python inside Burp.
Eg.
- Handle custom login
- Tailored testing
- Filter out requests on "interesting" responses
- Scale your testing
- Add rate limiting, pipeline, etc

This approach can overcome intruder multithreading deficiencies in CE.
Snaffler

Snaffler - Gets a list of Windows computers from Active Directory, then spreads out its snaffly appendages to them all to figure out which ones have file shares, and whether you can read them

https://github.com/SnaffCon/Snaffler


#pentest
#BurpHacksForBounties - Day 2/30

Effective usage of Match and Replace feature of Burp Suite

False2True Trick & Injecting all fields with polyglot payloads 😉😉

How to thread 🧵👇

#infosec #security #appsec #burp #bugbounty #bugbountytips
1/n False2True trick, when access to a resource for the user is unauthorized.
By changing server response body from F to T in burp response body match and replace, there are great chances it can un-hide client-side controls.

1. Add Match and replace.
2. Add shown replacement.
2/n
This is an example trick to change the false returned body to true.
And this is a very common use case.

The major trick for today: Injecting payloads into forms instead of typing out the entire payload.
3/n
The above match and replace rule will replace all KKK in the request body to SQLi and XSS polyglot.

Say I use this :
'"><script src="somesrc"></script><h1>test

And put KKK in all fields. All fields will be replaced with this payload.

It will find trivial XSS and SQLi.
♥️ #BurpHacksForBounties - Day 3/30 ♥️

🔍🔎
Find References: The most underrated and underused feature of Burp Suite

Pro Only & Can find references for URIs across the entire Burp.

A short thread : 🧵👇

#infosec #appsec #security #burp #bugbountytip #bugbountytips
1/n
Pick request from anywhere, right click -> Engagement Tools -> Find References
2/n
A new window will open up which will show the references and location of those references as well.
Location can be a repeater, scanner, etc.

The reference can be in Request, Response, Headers. Will be highlighted like the one shown in the image.
3/n
Can be used to discover the request sent by script from the browser and learn it to craft your valid payload request to that endpoint.

More references:

https://portswigger.net/burp/documentation/desktop/functions/search
🍺🤡 #BurpHacksForBounties - Day 4/30

Don't ignore junk-looking information in Burp Suite.
Keep this setting on, and play with zipped data in Burp Suite.

🤫🤫 You can change zipped data in req

Learned from @stokfredrik

#infosec #appsec #security #burp #bugbountytips #bugbountytip