Similar User
@theBeched
@antyurin
@theRaz0r
@sergeybelove
@hd_421
@vah_13
@a_chaykin
A blog by me & @1lastBr3ath discussing our findings we presented in Black Hat Europe #BHEU talk titled “Exploiting CSP in Webkit to break Authentication/Authorization”. Find out how we made more than $100k in bug bounties with a bug ignored by Apple. threatnix.io/blog/exploitin…
Found a hidden HTTP param? Look deeper, maybe there is a mass assignment/autobinding vulnerability. Sometimes changes in objects are hidden too and you need to closely explore the app. Source: itzone.com.vn/en/article/mas… #CyberSecurity #BugBountyTip #BugBounty
We often get confused how Samesite affects cookies in different attacks in modern browsers. So, we have made a memo and now share it with you. #CyberSecurity #BugBountyTip #BugBounty
We have combined all the tricks we know about SSRF into a single mindmap. If we missed something, write about it in the comments! High resolution: raw.githubusercontent.com/hackerscrolls/… XMind source: github.com/hackerscrolls/… #CyberSecurity #BugBountyTip #BugBounty
I created a tool for recovering passwords from pixelized images: github.com/beurtschipper/…
Вышел выпуск подкаста №4. Наконец cобрались обсудить давно интересующу нас тему: менджмент и бизнес - особенности данных веток таланов для пентестера. Есть ли вобще другие? Уже разлит по площадкам soundcloud.com/m1mo-croc music.yandex.ru/album/10321679 podcasts.apple.com/ru/podcast/id1…
#bugbountytips One more way to increase the impact of opening arbitrary URLs in a built-in WebView is Universal XSS. They are widespread on #android! Steps:
Have you ever wonder about fast and easy-to-use SOCKS proxy over DNS? Here it is github.com/fbkcs/ThunderD… from @fbk_cs You don't even need to compile it! #CyberSecurity #RedTeam #Pentest
CSRF in 120 seconds! As you remember Cookies without SameSite are treated as SameSite=LAX in Chrome. But there is one exception that can be used as a temporary policy bypass. More detailed examples: medium.com/@renwa/bypass-… by @RenwaX23 #CyberSecurity #BugBountyTip #BugBounty
Using other hosts as a gateway, sometimes, you can get access to other VLANs or bypass the firewall. That is a task for gateway-finder! Check the improved version by @whitel1st: github.com/whitel1st/gate… #CyberSecurity #Pentest #RedTeam
Were you surprised when your cross-domain attack didn't work? Meet the new reality with SameSite Cookies. Now Chrome and Safari recognize Cookies without the SameSite attribute as SameSite=Lax by default. #CyberSecurity #BugBounty #BugBountyTip
Meet JWT heartbreaker! A Burp extension that finds thousands of weak JWT secrets lab.wallarm.com/meet-jwt-heart…
Got root access to a server? Run 3snake and grab the attention to the server. Wait for admins and grab their ssh passwords! github.com/blendin/3snake Trick by @cherboff #redteam #cybersecurity #Pentest
Yet another trick about CORS! Do not forget to check Origin: null #CyberSecurity #BugBountyTip #BugBounty
Incredible mindmap about hacking iOS applications by @hd_421 Pay attention, we have prepared two versions: 1. Full Security Assessments 2. Shorter BugBounty version XMind source: github.com/hackerscrolls/… #CyberSecurity #BugBountyTip #BugBounty #iOS
Found a Stored Self-XSS? Chain it with Login/Logout CSRF and increase the impact! Few examples: geekboy.ninja/blog/airbnb-bu… medium.com/@ch3ckm4te/sel… hackerone.com/reports/314518 #BugBounty #CyberSecurity #BugBountyTip #XSS
There are a lot of known vulnerabilities in Cisco. But available Cisco Smart Install is our favorite. This one helped us in few red teams and even bug bounty. Thanks to @sab0tag3d for an awesome exploit github.com/Sab0tag3d/SIET #redteam #pentest #cybersecurity
We continue to talk about attacks on CORS. This time, we have prepared a set of ideas for bypassing lists of allowed hosts. #CyberSecurity #BugBountyTip #BugBounty
WebSocket is a widespread technology in modern Web. Incorrect implementation can lead to a simple but critical vulnerability – WebSocket Hijacking. Example: hackerone.com/reports/535436 Try it in the @PortSwigger Lab: portswigger.net/web-security/w… #BugBountyTip #CyberSecurity #BugBounty
United States Trends
- 1. #WhyIChime 1.480 posts
- 2. #earthquake 9.451 posts
- 3. $PHNIX 4.564 posts
- 4. Tsunami 29,2 B posts
- 5. Sevy 1.494 posts
- 6. Eureka 5.876 posts
- 7. Northern California 7.028 posts
- 8. Rowe 16,6 B posts
- 9. Venture 19 B posts
- 10. Luis Severino 3.328 posts
- 11. Hawk Tuah 81,3 B posts
- 12. Oakland 5.165 posts
- 13. Joni 215 B posts
- 14. Lloyd Austin 50,1 B posts
- 15. $GME 10,6 B posts
- 16. #HolidaySpecial N/A
- 17. Jake Gyllenhaal N/A
- 18. Humboldt County N/A
- 19. #GalaxyWatchUltra N/A
- 20. Sacramento 5.028 posts
Something went wrong.
Something went wrong.