Forwarded from امنیت اطلاعات
Mysql waf bypasses to cash on SQL-Injection bugs
1. select '\f\l\a\g'='flag'; // This is true
2. All are same
* select 'abcd';
* select 0x61626364;
* select 0b01100001011000100110001101100100;
3. select 'admin' = 'àdmin'; // is true if utf8 is allowed
#bugbounty
#sqli
@sec_nerd
1. select '\f\l\a\g'='flag'; // This is true
2. All are same
* select 'abcd';
* select 0x61626364;
* select 0b01100001011000100110001101100100;
3. select 'admin' = 'àdmin'; // is true if utf8 is allowed
#bugbounty
#sqli
@sec_nerd
Accessing Localhost via Vhost | VIRTUAL HOST ENUMERATION
https://blog.securitybreached.org/2017/11/04/access-localhost-via-virtual-host-virtual-host-enumeration/
#Vhost
#BugBounty
#BugBountyTip
@web_priv8
https://blog.securitybreached.org/2017/11/04/access-localhost-via-virtual-host-virtual-host-enumeration/
#Vhost
#BugBounty
#BugBountyTip
@web_priv8
Security Breached Blog
Accessing Localhost via Vhost | VIRTUAL HOST ENUMERATION
The Blog post is about what are Virtual Host, how U can Enumerate them and get access to the vulnerable system, including POC of resent BugBounty Report.
Bug Bounty Tips #1
https://www.infosecmatter.com/bug-bounty-tips-1/
Bug Bounty Tips #2
https://www.infosecmatter.com/bug-bounty-tips-2-jun-30/
Bug Bounty Tips #3
https://www.infosecmatter.com/bug-bounty-tips-3-jul-21/
Bug Bounty Tips #4
https://www.infosecmatter.com/bug-bounty-tips-4-aug-03/
#BugBounty
#BugBountyTip
@web_priv8
https://www.infosecmatter.com/bug-bounty-tips-1/
Bug Bounty Tips #2
https://www.infosecmatter.com/bug-bounty-tips-2-jun-30/
Bug Bounty Tips #3
https://www.infosecmatter.com/bug-bounty-tips-3-jul-21/
Bug Bounty Tips #4
https://www.infosecmatter.com/bug-bounty-tips-4-aug-03/
#BugBounty
#BugBountyTip
@web_priv8
InfosecMatter
Bug Bounty Tips #1 - InfosecMatter
Heartbleed vulnerability, Use grep to extract URLs, Extract information from APK, Extract zip file remotely, Top 25 open redirect dorks, JWT token bypass, Finding subdomains, Curl + parallels one-liner, Simple XSS check, Filter out noise from Burp Suite
Black Hat USA: Your guide to the top web hacking sessions in 2020
https://portswigger.net/daily-swig/amp/black-hat-usa-your-guide-to-the-top-web-hacking-sessions-in-2020
#Blackhat
@web_priv8
https://portswigger.net/daily-swig/amp/black-hat-usa-your-guide-to-the-top-web-hacking-sessions-in-2020
#Blackhat
@web_priv8
Steal input DATA’s with CSS File injection
https://link.medium.com/6wGNHfL0F8
#CSSI
#BugBounty
#BugBountyTip
@web_priv8
https://link.medium.com/6wGNHfL0F8
#CSSI
#BugBounty
#BugBountyTip
@web_priv8
How I was Able To bypass CloudFlare WAF
https://link.medium.com/HZR2xGPHH8
#CDN
#WAF
#Bypass
#CloudFlare
#BugBounty
@web_priv8
https://link.medium.com/HZR2xGPHH8
#CDN
#WAF
#Bypass
#CloudFlare
#BugBounty
@web_priv8
Forwarded from digMeMore (r00t98)
This media is not supported in your browser
VIEW IN TELEGRAM
Google Account XSSI
آسیب پذیری XSSI جایی رخ میده که یکسری اطلاعات حساس داخل فایل های جاوااسکریپت قرار میگیره و از اونجایی که SOP واس src کردن فایل های جاوااسکریپت محدودیت نداره اجازه میده که فایل src شه و اطلاعات کاربر خونده شه.
#XSSI
#BugBounty
@digmemore
آسیب پذیری XSSI جایی رخ میده که یکسری اطلاعات حساس داخل فایل های جاوااسکریپت قرار میگیره و از اونجایی که SOP واس src کردن فایل های جاوااسکریپت محدودیت نداره اجازه میده که فایل src شه و اطلاعات کاربر خونده شه.
#XSSI
#BugBounty
@digmemore
Web Cache Entanglement: Novel Pathways to Poisoning
https://portswigger.net/research/web-cache-entanglement
#WCP
@web_priv8
https://portswigger.net/research/web-cache-entanglement
#WCP
@web_priv8
How i find Blind Remote Code Execution vulnerability
https://medium.com/@viveik.chauhan/blind-remote-code-execution-b9c4e119f7c3
#RCE
#Blind
#BugBounty
@web_priv8
https://medium.com/@viveik.chauhan/blind-remote-code-execution-b9c4e119f7c3
#RCE
#Blind
#BugBounty
@web_priv8
Medium
Blind Remote Code Execution
Introduction
banning users Race condition
https://wisdomfreak.com/2020/08/banning-users-race-condition/
#RC
#BugBounty
@web_priv8
https://wisdomfreak.com/2020/08/banning-users-race-condition/
#RC
#BugBounty
@web_priv8
WisdomFreak
Banning users Bug: Race condition - WisdomFreak
For example, you are booking a train ticket online and only a single seat ( assume seat no:5 ) is there. now you book a ticket for that seat and at the same
This media is not supported in your browser
VIEW IN TELEGRAM
Bypass Old Password with Array revive-adserver.com Bug Bounty
#Bypass
#BugBounty
#BugBountyTip
@web_priv8
#Bypass
#BugBounty
#BugBountyTip
@web_priv8
How to bypass Android certificate pinning and intercept SSL traffic
https://vavkamil.cz/2019/09/15/how-to-bypass-android-certificate-pinning-and-intercept-ssl-traffic/
#Android
#SSL
@web_priv8
https://vavkamil.cz/2019/09/15/how-to-bypass-android-certificate-pinning-and-intercept-ssl-traffic/
#Android
#SSL
@web_priv8
Kamil Vavra @vavkamil
How to bypass Android certificate pinning and intercept SSL traffic
Offensive website security Bug bounty Ethical hacking