A curated list of amazingly awesome Burp Extensions - snoopysecurity/awesome-burp-extensions

How I Found Sql Injection on 8x8 , Cengage ,Comodo ,Automattic ,intel ,IBM ,MTN Group ,uis.cam.ac.uk ,volvocars.biz ,asus.com

# Vulnerability Denoscription
libcurl version 7.77.0 has a [Use-After-Free](https://github.com/curl/curl/blob/curl-7_77_0/lib/mqtt.c#L559) and a...

Hi fellow hunters, this is my first writeup for the community in which i will explain how i found a reflected cross site noscripting bug and…

In this video, we dive into Microsoft MSHTML Remote Code Execution Vulnerability (CVE-2021-40444).
[English subnoscripts added]
#cve202140444 #debugging #reversing #exploit #analyze #0day #CVE 202140444
Related Links:
https://github.com/aydianosec/CVE2021-40444…

_Tested on Windows 10 x64_

* On Steam starting, it will check all installed files' Integrity, and re-download the modified file(s). This step makes every single file in Steam installation folder...

The 'how' and 'why' of CORS, from start to finish.

Hi team hope you doing well :)
i found a vulnerability [ OTP Bypass ] on [ https://portal.test.cloud.mattermost.com ] .
Summery :
I was able to use the otp that was sent to victim email and i...

The career platform for coders, builders, hackers and makers.

Explore bug bounty insights on the YesWeHack Blog. Stay updated with vulnerability disclosure trends, hacker stories, and tips to excel in bug bounty programs.

A list of threat sinks used in the manual security source code review for application security - shabarkin/CodeAllTheThings

Tools
- https://subdomainfinder.c99.nl/
- burp suite
- burp Collaborator 
- assetfinder : https://github.com/tomnomnom/assetfinder
- httpx…

I found RXSS on https:// ███████/ ██████

## Impact

Perform any action within the application that the user can perform.
View any information that the user is able to view.
Modify any information...

How I hacked Apple and was able to Disclose Apple Users Private Shipping Information and Mobile Numbers.

Dark Vortex provides various cybersecurity trainings, products and other services.

I found a vulnerability on @LinkedIn and reported it in @Hacker0x01!
I could hijack any otp code and send same otp to any phone number! But @Hacker0x01 triage team set Informative for this vulnerability and they did not pay attention from my comment!
#bugbountytips…

Bug Bounty Poc