Checking Multiple Subdomains for S3 Buckets
#bugbounty #bugbountytips

0NE 0F MY B.EST FINDlNGS 0F 2024 UPL0ADED lN P0C CHA.NNEL https://t.iss.one/brutsecurity_poc/36

RustScan is a ultra-fast port scanner written In Rust (e.g., can scan 64K ports merely in seconds). It passes the results directly to Nmap for in-depth service enumeration and vulnerability analysis. This integration streamlines workflows by combining RustScan's speed with Nmap's detailed scanning capabilities 😎👇

RustScan is available on #Linux, #macOS and #Android termux

https://github.com/RustScan/RustScan

SubScan: A Chrome Extension for Bug Bounty Hunters

Check it out here:
https://github.com/Ractiurd/SubScan

Bypass WAF using Burp Repeater - Unicode Encoding

Encode payloads into UTF-16 to bypass basic input validation.

CVE-2024-56529: Session Fixation in Mailcow, 7.5 rating❗️

The application does not disable old session IDs, which allows a remote attacker to use existing IDs in the victim's browser.

Search at Netlas.io:
👉 Link: https://nt.ls/AuyJw
👉 Dork: http.title:"mailcow UI"

Vendor's advisory: https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-23c8-4wwr-g3c6

⚡️Bugbounty Roadmap

Unauthorized Data Upload in Alibaba Cloud – PoC by Chirag Artani 🔥

A new video is out on our friend’s channel, showcasing the discovery of a fresh vulnerability. The video includes an interesting query and a practical example of exploitation. Don’t miss it! 🔍

We also recommend checking out Chirag Artani’s website and Twitter for more cybersecurity insights:

👉 Website: 3rag.com
👉 Twitter: x.com/Chirag99Artani

One-liner to gather and crawl subdomains, then generate a custom wordlist from the target's discovered URLs 👇🏽

subfinder -d bugcrowd.com -silent | httpx -silent | hakrawler | tr '[:punct:]' '\n' | sort -u

🚀 Brut Security Hits 10K Subscribers! 🎉

Thank you all for being part of this journey! From sharing knowledge and resources to building a strong cybersecurity community, Brut Security has grown beyond expectations.

Your support fuels everything we do—training, tools, research, and challenges like Breaking O-Auth. Whether you’re here for bug bounty tips, pentesting insights, or DFIR knowledge, this is just the beginning.

🔥 More exclusive content, live bug hunting, and deep-dive discussions coming soon! Stay tuned, stay curious, and keep hacking ethically.

#BrutSecurity #10KStrong #BugBounty #Cybersecurity