when i register, in company input, i but blind xss payload that's it
it's triggered after 5 day's from registration

#bugbountytips #BugBounty

Link to search about txt extension from web archive

https://t.co/NvskqW8PTI

#bugbountytips #BugBounty

Direct connect as anonymous with ftp (if it's enabled)

ftp -A 192.168.1.1

#bugbountytips #infosec

Gitlab adavnce search, Search across Gitlab projects and Support regexes.

https://t.co/jComHU9weO

#bugbountytips #infosec

Regex code to detect possible idor parameters

"(?i)(\\?|\\&)(((([a-z0-9-_])+(-|_)+))|(-|_))?(id|uuid|user|account|number|order|no|doc|key|email|group|profile|edit|report|username)((=)|(\\/[0-9]+\\/?))"

#infosec #bugbountytips

common sinks for dom xss

-document.URL
-document.documentURI
-document.URLUnencoded
-document.baseURI
-location.\search
-document.cookie
-document.referrer

#BugBounty #bugbountytips

JWT common vulnerabilities

1- Signature verification failure
2- Use of weak algorithms: JWTs
3- Brute-forcing of secret keys
4- Key ID (kid) manipulation
5- Directory traversal attacks

#BugBounty #bugbountytips

تلكرام يحتوي على فيديوات خاصه ب ROOD
https://news.1rj.ru/str/alien_rood