New Writeup❗️
Date: Thu, 12 May 2022 16:09:11 GMT
Title: Forging OAuth tokens using discovered client id and client secret
Link: https://medium.com/p/d224e4e7892a
Date: Thu, 12 May 2022 16:09:11 GMT
Title: Forging OAuth tokens using discovered client id and client secret
Link: https://medium.com/p/d224e4e7892a
Medium
Forging OAuth tokens using discovered client id and client secret
Below is a short story about leaked OAuth client id and client secret which I found in the page source that led to generating foreign…
New Writeup❗️
Date: Fri, 18 Nov 2022 21:54:15 GMT
Title: Remediation Archeology — Finding and Decoding an Ancient XSS
Link: https://medium.com/p/ea541c1106d1
Date: Fri, 18 Nov 2022 21:54:15 GMT
Title: Remediation Archeology — Finding and Decoding an Ancient XSS
Link: https://medium.com/p/ea541c1106d1
Medium
Remediation Archeology — Finding and Decoding an Ancient XSS
One of my favorite pastimes in Bug Bounty is reviewing my ancient (read: 2 or 3 years old) vulnerability reports. I feel like I’ve come a…
New Writeup❗️
Date: Fri, 21 May 2021 05:22:43 GMT
Title: Finding and Exploiting Unintended Functionality in Main Web App APIs
Link: https://medium.com/p/6eca3ef000af
Date: Fri, 21 May 2021 05:22:43 GMT
Title: Finding and Exploiting Unintended Functionality in Main Web App APIs
Link: https://medium.com/p/6eca3ef000af
Medium
Finding and Exploiting Unintended Functionality in Main Web App APIs
While hunting for bugs on Main Web Apps, I encounter tons of interesting APIs. Some are well secured, obscurely documented, and keep you in…
New Writeup❗️
Date: Sun, 04 Apr 2021 01:17:12 GMT
Title: Journeys in Quoteless and Multi Reflection XSS
Link: https://medium.com/p/b1d67bb0c5dd
Date: Sun, 04 Apr 2021 01:17:12 GMT
Title: Journeys in Quoteless and Multi Reflection XSS
Link: https://medium.com/p/b1d67bb0c5dd
Medium
Journeys in Quoteless and Multi Reflection XSS
Cross Site Scripting is a tricky bug to fix, and bypasses for these fixes can be even trickier. While there are several ways to remediate…
New Writeup❗️
Date: Mon, 28 Dec 2020 20:02:53 GMT
Title: How I Got My First Bounty & Hof From Google (CSRF Lead To Account Delete)
Link: https://medium.com/p/85f9906ba9ec
Date: Mon, 28 Dec 2020 20:02:53 GMT
Title: How I Got My First Bounty & Hof From Google (CSRF Lead To Account Delete)
Link: https://medium.com/p/85f9906ba9ec
Medium
How I Got My First Bounty & Hof From Google (CSRF Lead To Account Delete)
I am Bhupendra Rajbhar (Final Year Computer Engineering Student ) I have been started my bug bounty journey from march 2020 it was a…
New Writeup❗️
Date: Sun, 16 Oct 2022 03:59:05 GMT
Title: Linux Privilege Escalation Part 1
Link: https://medium.com/p/8b4cc96b4ede
Date: Sun, 16 Oct 2022 03:59:05 GMT
Title: Linux Privilege Escalation Part 1
Link: https://medium.com/p/8b4cc96b4ede
Medium
Linux Privilege Escalation Part 1
After we gain an initial foothold on the machine, the next step is to escalate the privilege of that machine. So in this writeup, we will…
New Writeup❗️
Date: Mon, 22 Aug 2022 05:49:56 GMT
Title: Stabilizing Netcat Shell
Link: https://medium.com/p/33874606ed77
Date: Mon, 22 Aug 2022 05:49:56 GMT
Title: Stabilizing Netcat Shell
Link: https://medium.com/p/33874606ed77
Medium
Stabilizing Netcat Shell
The Basic Netcat shell has some limitations like we cannot use “Up arrow/Down arrow” to scroll through previous commands, cannot use the…
New Writeup❗️
Date: Tue, 22 Feb 2022 03:50:29 GMT
Title: 2FA Misconfiguration leads to adding any number as 2FA verification
Link: https://medium.com/p/30d5545d1b12
Date: Tue, 22 Feb 2022 03:50:29 GMT
Title: 2FA Misconfiguration leads to adding any number as 2FA verification
Link: https://medium.com/p/30d5545d1b12
Medium
2FA Misconfiguration leads to adding any number as 2FA verification.
I was testing 2FA on a website. At first, I tried to bypass 2FA but I was not successful, then I thought of something else. What if I can…
New Writeup❗️
Date: Thu, 16 Sep 2021 04:20:59 GMT
Title: [Metasploit]Upgrade Normal Shell To Meterpreter Shell
Link: https://medium.com/p/2f09be895646
Date: Thu, 16 Sep 2021 04:20:59 GMT
Title: [Metasploit]Upgrade Normal Shell To Meterpreter Shell
Link: https://medium.com/p/2f09be895646
Medium
[Metasploit]Upgrade Normal Shell To Meterpreter Shell
After we got access to the machine, sometimes we get Meterpreter Shell immediately after exploitation. Meterpreter Shell offers the easiest…
New Writeup❗️
Date: Thu, 29 Jul 2021 04:34:46 GMT
Title: TryHackMe: Bolt walkthrough
Link: https://medium.com/p/bee5d8cb79eb
Date: Thu, 29 Jul 2021 04:34:46 GMT
Title: TryHackMe: Bolt walkthrough
Link: https://medium.com/p/bee5d8cb79eb
Medium
TryHackMe: Bolt walkthrough
Hello People, In this write up I have covered a walkthrough for the Tryhackme box called “Bolt”. So let’s get started.
Link…
Link…
New Writeup❗️
Date: Thu, 15 Jul 2021 04:15:01 GMT
Title: How the simple flaw leads to leakage of all questions on the school examination website.
Link: https://medium.com/p/8e5827b31968
Date: Thu, 15 Jul 2021 04:15:01 GMT
Title: How the simple flaw leads to leakage of all questions on the school examination website.
Link: https://medium.com/p/8e5827b31968
Medium
How the simple flaw leads to leakage of all questions on the school examination website.
After the Covid blew up, everything has moved online. School started to teach online to its student and even decided to take exams online…
New Writeup❗️
Date: Thu, 24 Jun 2021 10:42:36 GMT
Title: Tryhackme- ‘Lazy Admin’ walkthrough
Link: https://medium.com/p/afe42873e233
Date: Thu, 24 Jun 2021 10:42:36 GMT
Title: Tryhackme- ‘Lazy Admin’ walkthrough
Link: https://medium.com/p/afe42873e233
Medium
Tryhackme- ‘Lazy Admin’ walkthrough
Hello People, In this write up I have covered a walkthrough for the Tryhackme box called Lazy Admin. So let’s get started.
New Writeup❗️
Date: Mon, 05 Apr 2021 12:01:32 GMT
Title: File Upload Leads to Stored XSS
Link: https://medium.com/p/1c0a43b07554
Date: Mon, 05 Apr 2021 12:01:32 GMT
Title: File Upload Leads to Stored XSS
Link: https://medium.com/p/1c0a43b07554
Medium
File Upload Leads to Stored XSS
A while ago I have written a post on “Unrestricted File Upload” by exploiting that bug I was able to upload any extension file, even…
New Writeup❗️
Date: Tue, 12 Jan 2021 03:47:46 GMT
Title: Unrestricted File Upload
Link: https://medium.com/p/e95e1c6fb80
Date: Tue, 12 Jan 2021 03:47:46 GMT
Title: Unrestricted File Upload
Link: https://medium.com/p/e95e1c6fb80
Medium
Unrestricted File Upload
I was testing on a website let’s call it “buggyweb.xyz”. After sometime i found that there was discussion forum which URL was something…
New Writeup❗️
Date: Wed, 18 Nov 2020 07:57:56 GMT
Title: No rate limit on the forgot password field.
Link: https://medium.com/p/bbefab1fdb47
Date: Wed, 18 Nov 2020 07:57:56 GMT
Title: No rate limit on the forgot password field.
Link: https://medium.com/p/bbefab1fdb47
Medium
No rate limit on the forgot password field.
Rate limiting is used to control the rate of requests sent or received and is used to prevent DoS attacks. Nowadays it is most to use the…
New Writeup❗️
Date: Wed, 27 Jan 2021 11:17:53 GMT
Title: $500 For No Rate Limit On Forgot Password Page
Link: https://medium.com/p/d534d1d750db
Date: Wed, 27 Jan 2021 11:17:53 GMT
Title: $500 For No Rate Limit On Forgot Password Page
Link: https://medium.com/p/d534d1d750db
Medium
$500 For No Rate Limit On Forgot Password Page
No Rate Limit on Forget Password page
New Writeup❗️
Date: Mon, 25 Jan 2021 07:14:58 GMT
Title: How Nepali Woman Finds bug in Facebook, Gets Awarded $3000
Link: https://medium.com/p/37f5209c6dec
Date: Mon, 25 Jan 2021 07:14:58 GMT
Title: How Nepali Woman Finds bug in Facebook, Gets Awarded $3000
Link: https://medium.com/p/37f5209c6dec
Medium
How Nepali Woman Finds bug in Facebook, Gets Awarded $3000
Prava Basnet, Nepali bug bounty hunter has been awarded $3,000 after discovering bugs on Facebook. The bugs (security vulnerability) were…
New Writeup❗️
Date: Thu, 08 Jul 2021 18:15:56 GMT
Title: the pen is mightier than the sword. (in bug hunting)
Link: https://medium.com/p/11166beada06
Date: Thu, 08 Jul 2021 18:15:56 GMT
Title: the pen is mightier than the sword. (in bug hunting)
Link: https://medium.com/p/11166beada06
Medium
the pen is mightier than the sword. (in bug hunting)
Hey folks, This is Captain_hook from BC. actually, I started my career about 1 and a half years ago, and I decided to share some things…
New Writeup❗️
Date: Fri, 24 Jun 2022 13:38:46 GMT
Title: Writing your own Burpsuite Extensions: Complete Guide
Link: https://medium.com/p/cb7aba4dbceb
Date: Fri, 24 Jun 2022 13:38:46 GMT
Title: Writing your own Burpsuite Extensions: Complete Guide
Link: https://medium.com/p/cb7aba4dbceb
Medium
Writing your own Burpsuite Extensions: Complete Guide
Recently I had to create some extensions for Burpsuite. I tried finding resources that could help me but couldn’t find much. Most of them…
New Writeup❗️
Date: Sat, 20 Nov 2021 11:00:47 GMT
Title: Peeping through a Web-Socket
Link: https://medium.com/p/936ed55a2c31
Date: Sat, 20 Nov 2021 11:00:47 GMT
Title: Peeping through a Web-Socket
Link: https://medium.com/p/936ed55a2c31
Medium
Peeping through a Web-Socket
Recently, I had found a bug related to web sockets through which I was able to view all the messages being sent to the victim user.