12.5K subscribers
550 photos
27 videos
24 files
889 links
This channel discusses:

— Offensive Security
— RedTeam
— Malware Research
— OSINT
— etc

Disclaimer:
t.iss.one/APT_Notes/6

Chat Link:
t.iss.one/APT_Notes_PublicChat
Download Telegram
1/n False2True trick, when access to a resource for the user is unauthorized.
By changing server response body from F to T in burp response body match and replace, there are great chances it can un-hide client-side controls.

1. Add Match and replace.
2. Add shown replacement.
♥️ #BurpHacksForBounties - Day 3/30 ♥️

🔍🔎
Find References: The most underrated and underused feature of Burp Suite

Pro Only & Can find references for URIs across the entire Burp.

A short thread : 🧵👇

#infosec #appsec #security #burp #bugbountytip #bugbountytips
1/n
Pick request from anywhere, right click -> Engagement Tools -> Find References
2/n
A new window will open up which will show the references and location of those references as well.
Location can be a repeater, scanner, etc.

The reference can be in Request, Response, Headers. Will be highlighted like the one shown in the image.
3/n
Can be used to discover the request sent by script from the browser and learn it to craft your valid payload request to that endpoint.

More references:

https://portswigger.net/burp/documentation/desktop/functions/search
🍺🤡 #BurpHacksForBounties - Day 4/30

Don't ignore junk-looking information in Burp Suite.
Keep this setting on, and play with zipped data in Burp Suite.

🤫🤫 You can change zipped data in req

Learned from @stokfredrik

#infosec #appsec #security #burp #bugbountytips #bugbountytip
1/n
Unzipping setting is disabled by default in Burp Proxy, enable it like this.
2/n Before & After.
#BurpHacksForBounties - Day 5/30

Check intruder, repeater, sequencer, etc response in one shot instead of every time sending the response to browser.

A short but important trick
🚨🚨 #BurpHacksForBounties - Day 6/30

Burp Suite and firefox 🔥🦊 match made in heaven.

Read the shortcomings of in-built browser and how to make firefox silent.
Down here 👇🍺

#infosec #appsec #burp #security #bugbounty #bugbountytips
0/n
First of all, why?
Why use Firefox if Burp Suite has Chromium browser built-in?

This is because :
- Burp inbuilt chromium does not persist settings on each different run.
- Plugin reinstallation each time
- Can't disable local CORS checks
- It's not flexible etc.
1/n
I personally use firefox, and if you have used it as I do, you must have seen a lot of detectportal.firefox.com requests.
They are noisy, you can right-click on that and mark "Do not intercept", but that is not a persistent way either.
in CE you don't have sessions. :(