Please open Telegram to view this post
VIEW IN TELEGRAM
app.netlas.io
Discover, Research and Monitor any Assets Available Online
Internet intelligence apps that provide accurate technical information on IP addresses, domain names, websites, web applications, IoT devices, and other online assets.
🔥4
This media is not supported in your browser
VIEW IN TELEGRAM
Active link finding with xnLinkFinder! 🚀
Command breakdown:
-i https://bugcrowd.com → Target domain
-sp https://bugcrowd.com → Scope prefix
-sf "bugcrowd.*" → Scope filter
-d 2 → Crawl depth
-v → Verbose output
Command breakdown:
-i https://bugcrowd.com → Target domain
-sp https://bugcrowd.com → Scope prefix
-sf "bugcrowd.*" → Scope filter
-d 2 → Crawl depth
-v → Verbose output
👍10❤9
This media is not supported in your browser
VIEW IN TELEGRAM
Popping alert(1) doesn't show REAL impact.
Escalate your XSS by stealing cookies instead👇
Escalate your XSS by stealing cookies instead👇
🗿15🔥4❤2
Is your open URL redirect payload getting blocked? 🧐
Try one of these payloads to bypass it! 🤑
https://www.intigriti.com/researchers/blog/hacking-tools/open-url-redirects-a-complete-guide-to-exploiting-open-url-redirect-vulnerabilities
Try one of these payloads to bypass it! 🤑
https://www.intigriti.com/researchers/blog/hacking-tools/open-url-redirects-a-complete-guide-to-exploiting-open-url-redirect-vulnerabilities
❤7👍3🔥2
Crazy Aliyun WAF Bypass:
cat /etc/hosts - triggers WAF
tac /etc/hosts - 🧙♂️
Credit: @galnagli
#bugbountytips #bugbounty
cat /etc/hosts - triggers WAF
tac /etc/hosts - 🧙♂️
Credit: @galnagli
#bugbountytips #bugbounty
🔥5🤨3❤2👍2🗿2
Some will find their first bug in a week, while others might take months. Some will excel in recon, others in web exploitation. It’s not about how fast you get there—it’s about persistence, learning, and adapting. Every failed attempt is a step forward, every mistake a lesson.
So, don’t compare your journey to others. Focus on your progress. Keep hacking, keep improving, and most importantly, keep walking your own path. Success will follow.
Please open Telegram to view this post
VIEW IN TELEGRAM
❤25👍5
Brut Security pinned «💭 Everyone’s journey in bug bounty is unique. What worked for one hacker may not work for you, and that’s okay. Your growth isn’t defined by someone else’s timeline. You have your own challenges to face, your own lessons to learn, and your own way of mastering…»
⚡Linkook - An OSINT tool for discovering linked social accounts and associated emails across multiple platforms using a single username.
✅https://github.com/JackJuly/linkook
✅https://github.com/JackJuly/linkook
👍13🫡3❤2
CVE-2024-47051: RCE in Mautic, 9.1 rating 🔥
The vulnerability allows an attacker to conduct RCE through asset loading, as well as manipulate the file deletion process to delete arbitrary files.
Search at Netlas.io:
👉 Link: https://nt.ls/odIOX
👉 Dork: http.favicon.hash_sha256:67a5904d731636c114513a7df90d4d6bff7a3f690f305ef3487ac84844a5874e
Vendor's advisory: https://github.com/mautic/mautic/security/advisories/GHSA-73gx-x7r9-77x2
The vulnerability allows an attacker to conduct RCE through asset loading, as well as manipulate the file deletion process to delete arbitrary files.
Search at Netlas.io:
👉 Link: https://nt.ls/odIOX
👉 Dork: http.favicon.hash_sha256:67a5904d731636c114513a7df90d4d6bff7a3f690f305ef3487ac84844a5874e
Vendor's advisory: https://github.com/mautic/mautic/security/advisories/GHSA-73gx-x7r9-77x2
👍7😱3
Please open Telegram to view this post
VIEW IN TELEGRAM
👍15🔥5
When you test a Django, Rails, or NodeJs web app try the following payloads in the "Accept:" header.
Please open Telegram to view this post
VIEW IN TELEGRAM
👍27❤18
This media is not supported in your browser
VIEW IN TELEGRAM
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥18😱12❤7👍6