madhuson retweeted
The new @Grafana CVE-2022-21703, is actually a 1 Click Authentication Bypass and full read SSRF via CSRF, all you need is XSS/TKO on Same site host and the CVSS bumps to 9.3 - Critical.
All @Grafana versions are VULNERABLE 🙃
Read more at jub0bs.com/posts/2022-02-08-…
#BugBounty
madhuson retweeted
🎉 100k Giveaway 🎉
Hackers walked so Bugcrowd could run. Thank you for being part of our community! 🏃 💯
To show our appreciation, we're giving away swag all day! 😎
To enter 🎟️ ⤵️
🔁 RETWEET
🧡 LIKE
✅ Drop your fave Bugcrowd memory below👇
#ItTakesACrowd
madhuson retweeted
If you ever found ssrf & failed to access internally hosted web services then always search localhost & 127.0.0.1 in main.js or in app.js , you may end up in accessing internal web resources.
#bugbountytips #bugbounty #cybersecurity #ssrf #infosec
madhuson retweeted
Alhamdolilah ..
How i was able to find it :
1- collect live subdomains using reconftw
2- run gospider -S subs -d 2 -o output (deepth of 2 is important)
3- then gf s3-buckets
#BugBounty
#bugbountytip #bughuntingtips
madhuson retweeted
Keep these two parameters in mind to get more invites to private programs 👀 👇
1️⃣ Proven skills that are specific to the program targets
2️⃣ Dollars earned on the platform
#Hackers #BugBounty
bugcrowd.com/blog/points-don…
madhuson retweeted
When you encounter a 403 Forbidden page 🚫 , try adding an "X-Client-IP" header with the value "127.0.0.1" #bugbountytips ✌🏽
