🌀 Find subdomains using RapidDNS
📡Add this small function into your .bash_profile to quickly find subdomains using RapidDNS API:

rapiddns(){
curl -s "https://rapiddns.io/subdomain/$1?full=1" \
 | grep -oP '_blank">\K[^<]*' \
 | grep -v http \
 | sort -u
}

We can then use it like this:
rapiddns target.com
☣️@InfoSecTube
‍‍‍

#Bug_Bounty_Tips_26
🛡BugBounty_Tips
🌀 Top 25 remote code execution (RCE) parameters
Here’s list of top 25 parameters that could be vulnerable to local file inclusion (LFI) vulnerabilities:

?cat={payload}
?dir={payload}
?action={payload}
?board={payload}
?date={payload}
?detail={payload}
?file={payload}
?download={payload}
?path={payload}
?folder={payload}
?prefix={payload}
?include={payload}
?page={payload}
?inc={payload}
?locate={payload}
?show={payload}
?doc={payload}
?site={payload}
?type={payload}
?view={payload}
?content={payload}
?document={payload}
?layout={payload}
?mod={payload}
?conf={payload}

Take notice anytime you see any of these parameters. Chances are that you may find LFI vulnerabilities.
☣️@InfoSecTube

#Red_Team #BOOK
Physical Red Team Operations

☣@infosectube

📡Link
📌 @Infosectube

📡Link
📌 @Infosectube

#book #web_security
Testing And Securing Web Applications

☣@infosectube

#Bug_Bounty_Tips_27
🛡BugBounty_Tips
🌀Mirror a web directory structure
Use the following ‘wget’ command to recursively fetch all the files (+structure) to your machine:

wget -r --no-parent target.com/dir

Now you can view the structure, search and grep in files.
How to find a directory listing on your target? A directory listing is a web server misconfiguration which we can identify using these:
1-Google Dorks
2-Shoadn Dorks
3-ffuf
4-dirsearch
Ex Shodan Dork:
Apache Directory Listings

http.title:"Index of /" http.html:".pem"

☣️@InfoSecTube

#book #PythonWebPenetrationTesting
Learning Python Web Penetration Testing
☢️@infosectube

📡Link
📌 @Infosectube

📡Link
📌 @Infosectube

#roadmap #MemoryLeaks
RoadMap Web PenTest

☢️@infosectube

#secure_coding #book #web_sec
Code Review Guide
secure coding OWASP
☣@infosectube

🛡Practice Platforms and sites that helpful for Bug Bounty hunters and Penetration testers

tryhackme
https://tryhackme.com

bWAPP
https://itsecgames.com

flAWS Cloud
https://flaws.cloud

Hack Yourself First
https://hackyourselffirst.troyhunt.com

2- OWASP Juice Shop
https://juice-shop.herokuapp.com

Google Gruyere
https://google-gruyere.appspot.com

Hack Me
https://hack.me

HackTheBox
https://hackthebox.eu

Root-Me
https://root-me.org

XSS Game
https://xss-game.appspot.com

Pentesterlab
https://pentesterlab.com


OverTheWire
https://overthewire.org/wargames/

Hacking Lab
https://hacking-lab.com/index.html

IO
https://io.netgarage.org

smashthestack
https://smashthestack.org

microcorruption
https://microcorruption.com/login

ExploitMe Mobile
https://securitycompass.github.io/AndroidLabs/index.html

Hax.Tor
https://hax.tor.hu/welcome/

Java Vulnerable Lab
https://github.com/CSPF-Founder/JavaVulnerableLab

Pwnos
https://pwnos.com

Ringzero
https://ringzer0team.com/challenges

Avatao
https://avatao.com

GameOver
https://sourceforge.net/projects/null-gameover/

HSCTF3
https://hsctf.com
☣️@InfoSecTube

#book #web_sec
advance api security
☢️@infosectube