Decompiled an Android app and discovered an endpoint vulnerable to SQLi.
Don't overlook mobile apps. they can be a goldmine for juicy things

#bugbounty #bugbounty tips

POSSIBLE HEADER INJECTION POINT WHERE YOU CAN TEST PAYLOADS

Credit:Coffin

#bugbounty tips #bugbounty

Admin Panel Takeover.. Self Hosted program… ATO is lub ❤️
And then I found IDOR in whole panel 😁.
#BugBounty #ethicalhacking

POSSIBLE HEADER INJECTION POINT WHERE YOU CAN TEST PAYLOADS :)
#BugBounty #bugbountytips

I just added an extra property 'is-site-admin':true, and voilà, I became one of the site admins.🤣🤣🤣🤟🤟 #bugbounty

📢a XSS payload, Cuneiform-alphabet based ! 𒀀='',𒉺=!𒀀+𒀀,𒀃=!𒉺+𒀀,𒇺=𒀀+{},𒌐=𒉺[𒀀++], 𒀟=𒉺[𒈫=𒀀],𒀆=++𒈫+𒀀,𒁹=𒇺[𒈫+𒀆],𒉺[𒁹+=𒇺[𒀀] +(𒉺.𒀃+𒇺)[𒀀]+𒀃[𒀆]+𒌐+𒀟+𒉺[𒈫]+𒁹+𒌐+𒇺[𒀀] +𒀟][𒁹](𒀃[𒀀]+𒀃[𒈫]+𒉺[𒀆]+𒀟+𒌐+'(𒀀)')()

#bugbounty #bugbounty tips

Bug Hunting Methodology by Coffin

#bugbounty tips #bugbounty

Yeay, I was awarded for a valid submission on HackenProof hackenproof.com #hackenproofed #bugbounty

meme time xd
#bugbounty #infosec #meme

OSI Layers and Attacks

#infosec #cybersecurity #pentesting #redteam #informationsecurity #CyberSec #networking #networksecurity #infosec urity #cyberattacks #security #linux #cybersecurity awareness #bugbounty #bugbounty tips

Every month, I always check my target for new features because new features are possible for bugs.

#bugbounty #bugbounty tips

another logic error, ubiquiti triaged:)

#bugbounty

Clear Verified 🙃
#bugbounty #bugbounty tips #cybersecurity

Files Containing Juicy Info inurl:'/.vscode/sftp.json'
#bugbounty #bugbounty tips #bugbounty tip #cybersecurity #ethicalhacking

Network Security Illustrated

#infosec #cybersecurity #pentesting #redteam #informationsecurity #CyberSec #networking #networksecurity #infosec urity #cyberattacks #security #linux #cybersecurity awareness #bugbounty #bugbounty tips

After 6 hours, found this insane IDOR!
Tip: Never skip JavaScript files, even if they look unimportant.. Many hackers do, apparently :D
#BugBounty #bugbountytip s #bugbountytip

Browser-powered desync #bugbounty #bugbounty tips #bugbounty hunter

Basic XSS Encoding Tips ⏬

1) alert = window['al'+'ert']
2) bypass () with ``
3) replace space with /
4) encode symbols:

< = %3c
> = %3e
' = %22
[ = %5b
] = %5d
` = %60

Example Payload:
%3csvg/onload=window%5b'al'+'ert'%5d`1337`%3e

#bugbounty #bugbounty tips #hackthebox

OFFAT

The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work in progress, continuously evolving towards completion

github.com/OWASP/OFFAT

#bugbounty #pentesting #redteam