bug-bounty

[civic umbra]

How to know if a cookie is sensitive or not? There are some reports on H1 stating httponly flag absence on sensitive cookies. I have found some cookies without httponly and cant figure out if they're sensitive or not

[native token]

It usually depends on the application, a good common example is session IDs

these should always have httponly

[civic umbra]

Thank you @native token got your point

[uneven gale]

Gave +1 Rep to @native token

[desert mason]

guys

any one here have a experience with subdomain takeover i need a help !!!

[fallen palm]

if xxe (many other vuln )can also give us reverse shell why injection is consider to be more severe ? mention me if u have any answer

[dusty pasture]

Can you please elaborate a little?
For example, there was one report on HackerOne for spotify.
Because of one available to register heroku subdomain leading to subdomain takeover.

[dusty pasture]

It would depend upon the type of XSS, website, it's users.
For example, if there is a site that stores private information or allows file downloads, ...
Then you can elevate XSS into a more severe issue, possibly leading to reverse shells in rare cases.

[fallen palm]

ok so mostly in rare cases it would happen

[dusty pasture]

It is possible

[fallen palm]

in rare cases ?

[fallen palm]

if found would it be consider as a A1 vuln ?

or we would say it is vuln to injection

[dusty pasture]

IIRC, there are a few rooms that allow this, XSS to leak keys or credentials.

[dusty pasture]

If it can lead to unauthorised information disclosure then yes.
I am unsure about categorisation though

[vocal folio]

OWASP 2021 draft classes it as security misconfiguration

2017, it's it's own thing

[fallen palm]

and it classes xss and injection to injection

[turbid patio]

Witch website is good for found bug bounty?

[atomic field]

Hi, I assume that you asking for the platform for bug bounty . There are many like hackerone, integriti, bugcrowd . There are BBP(Bug bounty program) which gives incentive and VDP(Vulnerability disclosure program) which serve for disclosing the vulnerability and you get public acknowledgement .
Many were running their private program where only invited people can test their application.
Answering which website is good for bug bounty is solely depends on you on where you are looking and approaching the target . If you are completely new , Check out the pinned resources.

[outer roost]

Bypass using HTML encoding alert from where can i get more encoding like this

[dusty pasture]

Aren't these HTML numbers?

[outer roost]

nope

[dusty pasture]

https://ascii.cl/htmlcodes.htm

[outer roost]

thank you i got it

oh they are call html number

i got to no something new thank you

[dusty pasture]

That's what the site says 😆
I consider it ASCII only, just different interpretations in different contexts🙂

[outer roost]

ya when i cracked it he shows me ASCII

[split sentinel]

When looking at big bounty programs, many have rules that say things like no “Automated scanning of any kind”. Does that mean, for example, one can’t use things like nmap or gobuster ? It seems like it would be Very challenging to perform enumeration/scanning without those types of tools?

[opal meteor]

it usually means that you should not submit anything found by an automated tool

and also I think the mean tools more like owasp zap and stuff

[split sentinel]

Ok so an “all in on suite” that will potentially hamper a site with all potential known vulnerabilities is clearly out of bounds.But nmap looking for open ports is probably ok.

[native token]

You don't really need to use gobuster for bug bounty 😂

If you're directory brute forcing you're doing it wrong

[split sentinel]

Good point - I’m just trying to distinguish what types of tools are or are not ok. Your opinion on how to interpret the “no automated scanning” based on your expertise? Im (clearly) new 😀 and have only tried some of the early rooms where nmap and gobuster were covered.

[civic umbra]

If a website is allowing registration only via business email, and I intercept the request and feeds it some personal email address like gmail. If the website accepts and allows sign up on personal address. Can this be impactful?

[civic umbra]

One more thing guys, I was playing with this sign up form and I intercepted the request and replaced the email field with an existing account to see if account takeover happens, when I submitted the form, a string appeared on the page "object Object" which shows JS execution at the backend. Can this be escalated in any way?

[dusty pasture]

Yes, if you can find any private information like source disclosure or possible package names and their versions which are vulnerable

[dim plover]

So, who of you are behind the recent nuclear-tier iOS exploit?

Curious about who made what amount of money from that one.

[fallen palm]

yoyoyo

@past hatch bout to DM U !

[past hatch]

Sure, no problem

[distant basin]

Then any alternative

[native token]

no you don't need to directory brute force

[past hatch]

Yeah dirsearch ffuf r good tool,as optional said in many case u won't need (atleast on main web app),but if its subdomain then worth a shot

[distant basin]

Ok

[past hatch]

@civic umbra whatever u wanna ask it here,for every vuln. that get resolved ,it get added on ur h1 public profile ,u receive rep. points and get more private invitation

[civic umbra]

Alright

[vocal folio]

@knotty hound This channel is for bug bounties

[fallen palm]

Bro do you earn money

[civic umbra]

No

[stray tapir]

What are the major differences between CTFs and bug bounties?

[carmine dagger]

CTF - Come to Fast! You got to do fasting! Though from bug bounties you can eat a lot

[low coyote]

Is anyone here familiar with exploiting __viewstate parameter??

I have this site, without anything.. But it has a viewstate parameter and it's value in source code... I did read quite a few articles and have general grasp of what it actually means.. But having a bit of trouble exploiting it...

[charred rampart]

hi everyone, anyone has a good reading on dockers? I'm executing a ctf and I was able to get access to all users of a host and then found out a docker container is running. I sshuttle and can reach the webpage...that is pretty empty, but it says vulnerable struts app. it only has port 8080 open and I do not have permission to run docker commands on the host and I'm not allowed to become root (out of scope)... where could I find some information. any tips or documentation would be much appreciated. thank you.

[dusky urchin]

You can check out the docker rodeo room if haven't already
Maybe you will find something useful in it

[charred rampart]

Thank you, I'll have a look right away

[uneven gale]

Gave +1 Rep to @dusky urchin

[charred rampart]

just in case, jexboss script did the job. now I wonder if from the docker I can read my own files in the host ...

[merry plume]

Lil self promo, but PyWhat will have 67 new bug bounty regex to help you find stuff you can make money from.

Some ideas:

• Download all public github repos of a company, search them with the bug bounty mode. Find API keys, Credentials, credit card info etc.
• Download all web pages and do the same
• Have it on a loop so the second a dev commits a secret, you know 👀

Looking for actual bug bounty people to take a look through and add / advise on stuff if possible 😄 Some of the regex have ways to exploit them (or check the API key is valid). Would be great to have some more and your name will be on an open source project 🔥

https://github.com/bee-san/pyWhat

[dusky urchin]

Glad you found a solution

[analog ermine]

i want to become a bug bounty ethical hacker. you can tell me what i learn first. i mean first topic second topic. please help me

[acoustic hearth]

if you want to focus on web, then I'd say learn more about websites (frontend, backend), webserver software stacks, CDN's, the HTTP protocol, how TLS works on top of that and what different configurations you can have, set up your own webserver to experiment with all this, learn about cloud providers such as aws, cloudflare, etc.

without any details it's hard to give a good recommendation 🙂

but learning how things are supposed to work is generally a good plan, before learning about how things can be broken.

[native token]

mod to aisle #bug-bounty

[acoustic hearth]

https://www.zdnet.com/article/hackerone-expands-internet-bug-bounty-project-to-tackle-open-source-bugs/

[spring sinew]

any good resources to start bug-bounty

[lavish hollow]

Check pins

[spring sinew]

yup

[vocal folio]

-ban @still fern Asking for phishing tools, clearly unethical.

[uneven gale]

🔨 Banned Kalijay#4908 indefinitely

[civic umbra]

anybody suggest a good tool to detect subdomain takeover, I am trying to automate the detection with cron. Most of the tools I found on github are outdated and years old

[lavish pivot]

anyone have any experience with tplmap ?

[native token]

do it manually, you'll be glad

[lavish pivot]

because its not updated anymore ? can`t seem to find the right parameter thought

[native token]

tplmap was abandoned a couple years back so is stuck on py2 atm

due to how outdated it is, you're better off exploiting it manually...

[marsh tree]

@real marsh

[prime river]

Hey Everyone...!

1. I've to find the live sites of out the list of subdomains( it means there are many sites that will map to only one IP)
2. Now In the next step I've to find the IP of those live sites I get from the first step. This step is also done. I've also made the IP's file unique as there are many same IP's mapping to subdomains. For example:
   ww.example.com
   www.abc.example.com
   www.xyz.example.com
   www.def.example.com

All of these subdomains have only 1 ip and IP's file i got redundancy that's why I make IP file unique.

3. The next step where I"m stuck is to make sure that I've correct results. For this purpose, I've to map each IP to its subdomains that I've in my Live_sites.txt file. I don't know how to do this. Is there any tool for this.?

[worthy folio]

Sounds like homework to me.

[somber grail]

You should check out jaeles and nuclei, they have subdomain takeover templates that you can use.

[somber grail]

You should use httpx or amass, it will give you the subdomains with the IP address.

[prime river]

No its my final year project and this is just a beginning.

[prime river]

Thanks. I'll try this.

[uneven gale]

Gave +1 Rep to @somber grail

[prime river]

Yeah I've used httpx and amass to get live IPs and subfomains. But now there are same ip for multiple subdomains and this is the redundancy. I want to map each Ip to its subdomains like this:

Ip
192.168.72.1
Subdomains
Www.example.com
www.abc.example.com
Www.cde.example.com

Ip
127.123.13.13
Subdomains
...............

I want to map ip against its subdomains

[worthy folio]

Should probably look into coding something yourself. Do some research, httpx has a python lib iirc

Final year project is still schoolwork, and in general we don't help with schoolwork

(As that would be cheating)

[prime river]

I was searching there yeah most probably i should solve this by coding.
I just wanted to know if there is any tool. If there is no one. Than definitely i would go for coding.

[worthy folio]

Probably not one tool that will do exactly what you need

[prime river]

Okay thank you

[vocal folio]

Trying things that might seem silly and then laughing loudly when they work? Yeah

[worthy folio]

Sounds about like dev work too

[sharp patio]

wlan0 is on channel 0, but the AP uses channel 11 help ?

[dusty pasture]

You are trying airmon-ng, right?

Or is it related to one of THM rooms?🙂

[worthy folio]

Probably not a thm room

[vocal folio]

Doesn't sound like bug bounty either though

[dry slate]

Hi guys, would you say a vps (with a public ip) as attacking instance is mandatory or just something like a plus you can have for bug bounties?

[native token]

Only time a vps is really needed is if you're running recon on a large scope, then it's nice but other than that it isn't fully needed

[dry slate]

How large of a scope are we talking about? Like hundreds of subdomains?

[swift grotto]

I dunno. It’s nice to have disposable public facing VMs to use during recon, in case you trigger IP blocking or filtering. Ephemeral resources during recon is pretty inexpensive these days, and allow for parallel processing without b0rking your local network.

[native token]

pretty solid difference between using disposable vms and a VPS depending on the provider

¯_(ツ)_/¯

VPS in bug bounty is whatever

[swift grotto]

I always attach a header so the target knows who I am (using a wearehackerone alias) so they can correlate the logs, but I almost always use a different IP during each stage of the analysis. But I have access to a ton of resources inside Azure to make this reasonable. No so sure I would do as much if I had to use DO droplets all the time.

But to each their own. After I accidentally blocked my entire office from the Microsoft Cloud during some PoC building against something I found in the Azure admin backplane I will never again NOT use ephemeral resources.

[prime river]

Hey EveryOne ..!
I'm confused about the screenshot part of the recon process.
I've used Eyewitness to take the screenshot of the 320000 hosts. It took almost 54 hours to complete this process. But I don't actually understand why would we take screenshots. I've googled it and I come to know that we took screenshots coz pictures spoke more than words plus we can look at different pages and identify w more accurately which host to hunt. In my case, I guess this is not possible to have a look at 32k screenshots. It would be more hectic.
Thanks

[native token]

lmao why on earth are you hunting through so many hosts....

if you're on such a large scope and asking that question you probably shouldn't be doing it

[prime river]

I'm just asking for learning purposes and actually its is my personal project not an attack. I just want to know why we need to take screenshots.?

[stray tapir]

Bug bounties make me so incredibly frustrated.. someone I know gets a bounty every week

not full time, at all

and I'm over here doing test sessions of 3 hours a day

without any results for the past 3 weeks

[stray tapir]

Are you sure you're doing a bug bounty?

that's a 10.x.x.x IP considering logbase 2 of 320.000 gives like 18 which would mean 3 octets, which would be internal, or you're just randomly visiting public hosts, which you probably shouldn't

[prime river]

No I'm not doing bug bounty. Actually I'm doing a perimeter testing as my project.

So i was not able to understand why we need screen shorts of the sites. I'm not doing any pentesting. I'm just a beginner in cybersecurity.

[hybrid orchid]

As a heads up: doing anything to (including scanning) things that don't belong to you could end up with you getting prosecuted.

I would suggest that you don't, unless you have written, legally-watertight, permission from the owners of all devices.

[prime river]

Okay thanks got it. I'll take care of this

[uneven gale]

Gave +1 Rep to @hybrid orchid

[solar ermine]

hey am new here ; can anyone suggest how can i enhance my skills on Tryhackme

[merry plume]

Pro tip: NEVER give your bug bounties to "influencers" because you think they can help you

I am posting this because I have received 9 DMs and 4 of them contain bugs I could just steal from you lol

[fallen palm]

https://www.youtube.com/watch?v=MEyyegfvhwM&t=471s

can the thm staff pls verify this does not work on their website, i doubt it since u all r experienced security professionals in charge of the site, and the reason i did not check myself is actually quite simple, i dont wanna get sued, idk if this will count in bug bounty or not and i very much do not like getting sued, so i didnt do anything but i request the thm staff to look into it

[lavish hollow]

If it’s not against our bug bounty rules, you’re allowed to try it:)

!docs bug-bounty

[marsh falcon]

TryHackMe

Learn about TryHackMe's Bug Bounty Programme!

https://help.tryhackme.com/miscellaneous/the-bug-bounty-programme

From TryHackMe with ❤!

[fallen palm]

not exactly sure if tht counts in those or not, and im sry but id rather not take the risk

[raven mirage]

Not gonna lie the word "any" that he used is probadly only there to drive in viewers

Dont think it can actually work on any website

Right!???

[young spoke]

That is quite literally the most click-baity video going

I've watched like 2 minutes of it and there's so many vulnerabilities / bad practicies that need to be present for this to even remotely work

That sorta shit is exactly what's wrong with the infosec community

[hybrid orchid]

THM doesn't even use JWTs for auth 😆

[young spoke]

if you trust a client to validate things like membership/access level and the sorts then you're just asking for trouble

[fallen palm]

ik tht

which is y i said " i doubt it since u all r experienced security professionals in charge of the site"

i was 90% sure tht those vuln wont be there but i just told just in case

[young spoke]

Aye well then you've answered your own question (:

I was just simply stating why you were correct is all

[fallen palm]

i just thought id inform the staff but leave it up to em as they're wayyy smarter than me

[fallen palm]

lol, ty

[uneven gale]

Gave +1 Rep to @young spoke

[young spoke]

np 😄

Appreciate the heads-up nonetheless

[fallen palm]

how was i supposed to know tht unless i tried it, and i didnt want to cause i wasnt sure if it would qualify in ur bug bounty or not and i didnt want to risk it

[fallen palm]

ty for not roasting me and understanding it was just a heads up

[uneven gale]

Gave +1 Rep to @young spoke

[fallen palm]

np

[fallen palm]

extra one but he deservers it ngl

[young spoke]

np big man 😎

[ebon tapir]

I have watched some of bis videos before and most of these are just click baits 🤷‍♂️

[tough garnet]

Loi Liang Yang is complete and utter trash who's only good at making clickbait 🤷‍♂️

Kinda like Networkchuck

[fallen palm]

agree

[ivory hare]

💯

[fresh hatch]

Is he? Havent seen any of his vids but they looked interesting so I have a few on my watch list. Right now I only watch JH

[tough garnet]

Most of his stuff is clickbait imo you can try watching a few of his videos so you can form your own opinion

[pastel anchor]

+1

[pastel anchor]

video titles with "By A Pro Hacker" just sound so wannabe and complete clickbait

[fallen palm]

wht yt channels would u guys recommend?

[swift grotto]

Here is a small list of YouTube channels to check out (in no particular order):

• Codingo: https://www.youtube.com/c/codingo
• Christi: https://www.youtube.com/c/CristiVladZ
• Cryptocat: https://www.youtube.com/c/CryptoCat23
• Nahamsec: https://www.youtube.com/channel/UCCZDt7MuC3Hzs6IH4xODLBw
• SilverStr: https://www.youtube.com/channel/UClZX8GoY43jvMukwnto-BLg
• LiveOverflow: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w
• IPPSec: https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA
• JohnHammond: https://www.youtube.com/user/RootOfTheNull
• STOK: https://www.youtube.com/channel/UCQN2DsjnYH60SFBIA6IkNwg
• Red Team Village: https://www.youtube.com/channel/UC8nq3PX9coMiqgKH6fw-VCQ
• HackerSploit: https://www.youtube.com/c/HackerSploit
• Hak5: https://www.youtube.com/c/hak5
• InsiderPHD: https://www.youtube.com/c/InsiderPhD
• JHaddix: https://www.youtube.com/c/jhaddix
• PinkDraconian: https://www.youtube.com/c/PinkDraconian
• PwnFunction: https://www.youtube.com/c/PwnFunction
• Reconnless: https://www.youtube.com/channel/UCCp25j1Zh9vc_WFm-nB9fhQ
• TomNomNom: https://www.youtube.com/user/TomNomNomDotCom
• TheCyberMentor: https://www.youtube.com/c/TheCyberMentor
• TheHackerish: https://www.youtube.com/channel/UCIXot2vRgeM5alhAlpTbhQA
• zseano: https://www.youtube.com/c/zseano
• zsecurity: https://www.youtube.com/c/zSecurity

[fallen palm]

Thx

[uneven gale]

Gave +1 Rep to @swift grotto

[swift grotto]

NP

[foggy bone]

Hello Guys any good resource about wordless bug bounty

WordPress

[dusty pasture]

Go through its code available on GitHub 😃
https://github.com/WordPress/WordPress

[foggy bone]

Thanks

[uneven gale]

Gave +1 Rep to @dusty pasture

[fervent tiger]

Hello

Can someone pls suggest me from your personal experience how to approach but bounty

[old musk]

Heyy guyss, I got this weird error at the end of the scan while using nmap with decoys 'Unknown address family 0 in build_packet.'
Command used: nmap -A -D RND:54 <domain-name>
Any idea how to solve this?

[fresh hatch]

Would you be able to copy this and message it to me? (Can’t message myself 😦 sorry)

[swift grotto]

In Discord you can long press on it (mobile) or right click and select “Copy Text”

[fresh hatch]

I meant I can’t message it to myself in discord

Oh wait I can open discord o ln my computer and past it in a txt file I guess

[outer bronze]

Create your own discord server

[vocal folio]

@fathom heath are you allowed to disclose this ?

[fathom heath]

Yes

[hybrid orchid]

You have explicit permission from the company to move to full public disclosure?

[fathom heath]

The bug is solved, they tell you can create Writeups

[hybrid orchid]

Wonderful :)

[fathom heath]

But report is not disclosed

[fathom heath]

https://youtu.be/5jHIUTEdpvI

[raven urchin]

hey guys!! i am new to this bug bounty program...can somone guide me how to get started and the resources needed to begin with...sorry in advance if my question is stupid

[whole tide]

you could start on working the THM paths, pre-security, begginer path and the web fundaments, and from there you should have an idea what to do

[west nacelle]

Hello! Can someone help me with finding an XXE in a SOAP implementation in a public program? I am having some difficulties

[snow pumice]

Hi guys, Is there any way to bypass SSTI with below blacklist?

blacklist = ["'", '"', "request", "readlines", "+", "%2b", "%22", '%27', "linecache", "add", "join"]

[native token]

There's likely plenty of ways to bypass that, you just have to find them

there's some good papers around for SSTI

[dusty pasture]

SSTI for which template engine?
Jinja, Twig, ...?

Use of blacklist isn't a good idea. Whitelist is better😄

[fallen palm]

the correct terms are now "blocked list" and "allow list"

i was corrected in a briefing 2 weeks ago, and sure enough, if you google it it says they changed it to blocked and allow.

[hybrid orchid]

I mean, they're both correct from a technical standpoint.
Just that modern political correctness dictates that the use of "black" and "white" when describing allow/deny lists is a no-no. The use of white/black list is something that will no doubt be pushed out with time, but they are no less accurate technically than they were before 🤷‍♂️

[cosmic flame]

Hello folks, I found an unclaimed Cloudfront instance on a subdomain I was testing. However when I went to create a new Cloudfront distribution with the URL as the CNAME it didn’t work, it showed an error explaining how you need to upload a trusted cert from a CA.

Btw the cert can’t be self-signed

[vocal folio]

LetsEncrypt?

[cosmic flame]

What ??

[vocal folio]

Look into it.

Real certs, for free.

[modest vector]

Amazon CloudFront?

[merry plume]

sadly

the bane of my life

Amazon "I'll take 45 minutes to update a single word on your website" CloudFront

[modest vector]

Slowness Optimization Utilization™️ 😂

[crisp gate]

I was doing something for fun, but I have permission to do it serious

Someone wanna join me?

[potent gorge]

Hello guys, one question. If I had for example meta-data of a pdf file, can I convert that metadata to a functioning pdf file? And what could I do with such data?

[hybrid orchid]

No. Metadata describes data

It doesn't contain the data that it describes

[arctic bluff]

Sorry wrong room! 🤦‍♂️

[potent gorge]

Thank you very much for answering.

Also, I have another question.
Is this a XSS vulnerability? I tried to upload a profile picture with .svg extension and in it was a payload that would present a red rectangle and pop a alert box.
Payload:
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<rect width="300" height="100" style="fill:rgb(255,0,0);stroke-width:3;stroke:rgb(0,0,0)" />
<script type="text/javascript">
alert("XSS!");
</script>
</svg>

I thought maybe the JS popup is blocked but didn't find a solution for it.

[dusty pasture]

So, did it work and you got an alert pop-up?
If so, you can apply proper CSP headers to prevent such vulnerabilities
That is direct view of malicious SVG file

[potent gorge]

I did not get the alert pop up, on the main site it is blocked probably but the rectangle is represented clearly.
I right clicked on the rect. and pasted the url in the browser, it was in this format: data:image/svg+xml;base64, {base64 encoded string}
When decoded, it of course shows the payload.

When I visit the url I copied, then I get the popup

I'll screenshot it, just a moment.

[dusty pasture]

Yeah, that is direct view
Accessing the file from its URL

[potent gorge]

So, it is a vulnerability? I've never encountered this ever.

[dusty pasture]

To prevent this, server hosting that SVG file should also send CSP headers like

default-src: 'self'
```Or

img-src: 'self'

[potent gorge]

I'll send them that as an advice on how to fix it.
Thank you very much!

[dusty pasture]

Here you go🙂
https://svg.digi.ninja/index.php

[dusky heron]

<@&612305984752451594> Discord scam ^

[little meteor]

@hybrid orchid ⬆️

[vocal folio]

That doesn't work here

[dusky heron]

oh. well I tried

[manic mango]

Hi I am not good at DOM BASED xss but burp got me that is there is any potential dom here

[stray tapir]

How do y'all deal with platforms that require a creditcard to sign up (like cloud providers), in order to test vulns?

[hybrid orchid]

Stick a credit card in...

If it's a legitimate bug bounty then there's no issue, is there now?

[stray tapir]

Well, for me there is considering I'm underage thus have none

[hybrid orchid]

Are you legally allowed to participate in the programme then?

[stray tapir]

Fair enough. Ig I should wait with this stuff

[vocal folio]

They're usually fine with debit cards

[brisk sparrow]

Hello

[fallen palm]

I ran an nmap scan and found most of the ports are open. I was under the impression that it is bad to leave ports open. What am I missing? (n00b here)

[native token]

Don’t port scan for bug bounty, it’s never in scope

[fallen palm]

Thanks! I scanned a URL that is in-scope. Is that not okay?

[uneven gale]

Gave +1 Rep to @native token

[native token]

No

The underlying infrastructure is not a url

[fallen palm]

I get that, but how do you id the technology stack?

[native token]

Http headers, if not you don’t

[fallen palm]

Okay, thanks again! I guess it's back to the training... 🙂

[uneven gale]

Gave +1 Rep to @native token

[brisk sparrow]

Hii

[woven bramble]

Hi

I need help

[proven roost]

Dont

Ask

To

Ask

Just

Ask

Your

Question

[hushed tinsel]

hey i need help

[quaint quail]

Umm, I want to someday submit my first bug bounty and I know how the web works in practice but I have no idea how to test for vulns...is it just spraying and praying or should I try finding one bug in a specific place? Or a balance of these?

[stray pagoda]

I just noticed in a social media app that if you click the the login button from a certain directory, it leads to an error, is this reportable? Ping me when you reply?

[prisma axle]

Is there any impact to that? Can it be exploited? Does it leak information? At best it seems to me like a bad practice, I wouldn’t report it unless you find something further

[stray pagoda]

Hmmm. Will see, Thanks

[native token]

unless there's some verbose erroring that discloses potentially dangerous info then it's unlikely it is anything more than informational in a bug bounty context.

[echo warren]

Have fun.
https://github.com/tanprathan/OWASP-Testing-Checklist

[quaint quail]

Sleepy, this is like getting secret information that I shouldn't have gotten. Thank you so much. This will definitely help me.

[fallen palm]

if html comments ends by this --> then how is this executing

[whole tide]

you are closing the comment with --!> and then alert is executing

html just errors, will display what works and the other doesnt really care

[dry slate]

Hi there 🙂
What would be the top 3 tips you would give someone that wants to start doing bug bounties?

[fallen palm]

hi @dry slate I think the main tip is start from basic to advance and not pretend start hunt asap , its due i started few months ago and stilllearning a lot things its large learning curve

If anyone its on the path i like exchange resources and knowledge .

[dry slate]

Thanks 🙂
Yeah I'm not taking it too serious to begin with anyways. I'm not that good. Just want to start out to play around with a live target.

[uneven gale]

Gave +1 Rep to @obsidian goblet

[vocal folio]

Just whatever you do, don't expect to make money. If you're doing it to make money, you're going to be stung.

[unreal vale]

Which platforms (ex. hackerone, bugcrowd) do you guys prefer (or maybe think are good for noobs)

[vernal plover]

what are bug bounties?

[main chasm]

What preparation and prerequisite should be enough to atleast get started with bug hunting in public programs

[nimble stratus]

payments for hacking web pages applications servers or even giving crucial information of some impact

[hybrid orchid]

@vernal plover More specifically, it's a crowdsourced vulnerability assessment. "Payments for hacking web pages applications servers..." misses out the fact that bug bounties are legal...

Bug bounties are when a business explicitly states that they are open to ethical hackers finding and responsibly disclosing security bugs in exchange for payment (usually money). There is always a scope assigned (as there would be in a pentest), and it is all legal, as long as you stay within scope.

[nimble stratus]

but the vulnerablties they are very hard to find 😭😭😭

[nimble stratus]

many people do it like a side freelance earning.. and mostly as full time.

[hybrid orchid]

If you do it full time then prepare to be disappointed. It's not steady work. Sometimes you make money, often you don't. The effort rarely justifies the reward, which is why most people do it as a hobby.

[hybrid orchid]

That sounds like a "you" problem. :)

[nimble stratus]

I know I am noob

[modest vector]

Crowd-sourced pentesting. In a saturated market segment this often leads to high-effort and low probability of reward. 😄

[vernal plover]

That sounds really damn fun

Does it pay well?

[hybrid orchid]

Depends how well you do. It doesn't pay consistently, and if you get it wrong, you may be in big trouble.

But, if you get it right and if you find something serious in a big company, it can pay tens or hundreds of thousands.

[vernal plover]

ok so think of it as extra cash in free time, not a main source of income

[hybrid orchid]

Exactly

[dry slate]

https://www.youtube.com/watch?v=qme4rAD2mlM

[echo warren]

Extra cash is a stretch

[vernal plover]

Oof

[fair nest]

Damn savage XD

[rotund ingot]

found an unrestricted file upload and the company says "our server is hardened enough so file upload dont matter"

🤔

Why not just prevent wrong file types in the first place

[hybrid orchid]

Can you access the files after uploading them?

[rotund ingot]

@hybrid orchid Yes and no.. I get the link to it, but it's not executing, just downloading it

so it's definately on the server

[hybrid orchid]

Well, that's enough

Tell them you have access to turn their site into a malware distribution network / place to store stolen goods

Which you technically do

You might not be able to use it to gain further access, but being able to arbitrarily store files on their servers won't end well for them

[rotund ingot]

@hybrid orchid Good point, I'll let them know. Thanks

[uneven gale]

Gave +1 Rep to @hybrid orchid

[hidden atlas]

Can someone hack me?

[vocal folio]

That's not what we do here.

[fallen palm]

you have too much open surface to get hacked. next time ask this question very wisely

[vocal folio]

What do you mean?

[fallen palm]

i sent you private message

[vocal folio]

-ban @fallen palm Dropping doxx in DMs.

[uneven gale]

🔨 Banned 0x11c11e#5093 indefinitely

[waxen sparrow]

he walked right into that one

[stray tapir]

😭 😭 😂

He took the bait

[orchid narwhal]

😹😹😹😹😭😭😭😭 lmao

What would you even do that

Lmao

[echo warren]

Oof

[mighty wind]

What the fuck did I just witness

[near wing]

damn LMFO

[hidden atlas]

what is doxx?

[unreal vale]

Ex. Publicly revealing your name, face, and address

Something people with no real skills do to look cool

Even though they just look like a kid

[mighty wind]

Just to be clear, revealing someone elses* not ur own lol

Just absolute clarity since that was confusingly worded to me

[analog glen]

No, you can accidentally doxx your self as well

[devout sequoia]

[mild fractal]

Hello to everyone,
I just started Bug Bounty and I have a question for you.
After logging into the website with the hacker user, while sending an HTTP request to see the account balance of the hacker account, if I can see the account balance of the victim user's account by replacing the Cookie information in the outgoing request with the Cookie information of the victim user's account, is this an IDOR vulnerability?

[slender grove]

If you can read users information when you're not supposed to (by changing information) then yes

[hybrid orchid]

Not unless you also have a session stealing vulnerability

Obtaining classified information for another account using a cookie you have legitimately isn't a vuln -- that's just how the web works.

[mild fractal]

Thanks a lot for your answers

[hybrid orchid]

IDOR would be if you could do it without the victim cookie

[hybrid orchid]

Please read through the message before answering William 😆
Subbing in another cookie ain't a vuln unless you managed to nick the cookie through another vuln in the site

Although if you were using computers in two different locations, you could argue that the session security is lax.

Not sure if a bug bounty would accept that. I would definitely put it in a pentest report.

[mild fractal]

My reason for sending the report is because it does not check whether the cookie information belongs to the logged in user or not. But now I understand the situation more clearly.😄

[mild fractal]

So, which security vulnerabilities do you think would be the right thing to focus on for a start?

I continue by following the learning path in Portswigger Academy and since one of the first taught there is Access control, I have chosen such vulnerabilities as my target now. Do you think it is the right choice to start with, or would it be better to focus on XSS or other vulnerabilities?

[hybrid orchid]

By changing the cookie, you change the logged in user. The cookie is the only thing that identifies what user is logged in.

[hybrid orchid]

I would start by learning how the web works, to be honest. There's a good THM module for that

[mild fractal]

thanks for your help. I already have a THM account, I'm starting now. 😄

[hybrid orchid]

Enjoy :)

[onyx thistle]

@hybrid orchid can I please dm you about something?

[hybrid orchid]

With regards to?

[onyx thistle]

@hybrid orchid bug bounties

but I would like to ask you in private if possible

[hybrid orchid]

I'm not the one to ask about bug bounties -- my "real world" stuff is all pentesting 🙂

[onyx thistle]

@hybrid orchid then who should i ask?

[echo warren]

Best thing to do would be taking a look at the hackerone or similar leaderboards and reaching out to the top rated hunters somehow. Although you're probably not the only one who thought of that so don't be surprised if they don't answer

[onyx thistle]

Ok.Thanks @echo warren

[echo warren]

There's also Drago.

[fair crystal]

Has anyone submitted a vuln to Microsoft's MSRC before? If so, how long did it take for initial response? I've had one in for a week now even with a follow-up...

[rough axle]

https://tenor.com/view/pout-girl-sad-cry-little-girl-gif-20041802

[echo warren]

Prepare for a month's worth of waiting.

[fair crystal]

Ok thanks

[uneven gale]

Gave +1 Rep to @echo warren

[prime river]

how do i check if the host has ssl enabled or not?
i know its https with url on port 443. I want to check this by command if there is any tool....!

[dawn sparrow]

So I have ben using THM for a while now, I love the guided rooms like complete beginner, cyber defense, etc. I wish there was a path set fourth for bug bounties. I am open to suggestions on what rooms to complete to feel confident enough to start

[fallen palm]

Cant you just try making a request with curl on https and see if it fails or succeeds?

[native token]

Sslscan

[granite star]

#general message

[prime river]

Yeah its getting failed so it means there is no ssl right?

[prime river]

I'm using ssl but don't figure it out how do i know if the site is using ssl or not. I've tested it gives me error on site it means there is no ssl . Am i correct

[prime river]

@native token is it still possible if some site using ssl i can see from browser but the tools openssl,sslscan,sslyze gives me the error for not having the ssl. I'm just surpirse why these 3 tools gives me incorrect result or there is something else?

[delicate radish]

How exactly do people discover 0days? Do they just try a bunch of routine stuff and discover it by accident?

[vocal folio]

You can go hunting for them if you're skilled

Or you can stumble upon them by accident

[delicate radish]

How does one hunt for them? I would like an example of how one discovers a 0 day NOT by accident

[swift grotto]

Find an interesting installable server product you like. Load it in IDA and ensure you can set flow tracking and breakpoints. Now construct a client that talks to it and inspect how the data flows through the server. If you can track everything you can start to look for suspicious paths where you might be able to manipulate logic to make it do things it shouldn’t. Like state mismanagement. Stack and heap overflows etc. Logic bugs in the code. Over time, you may find a way to manipulate the server to get the control you want. Eventually the vuln you find will lead you to build an impactful PoC exploit … your zero day.

Replace server product with OS, Cloud Stack, Framework etc. Anything that lets you control the flow and debug through.

There is no magic os/script/methodology that will let you run and detect a zero day. It’s hard, manual work (usually). Quite gratifying when you find it though.

As a caveat, know that MOST bug-bounty programs won’t reward you greatly on a zero day. You’ll usually max out their program at the PoC of the original vuln. The extra effort to craft the zero day payload itself doesn’t net you much more payout. This is where zero days brokerages like Zerodium come into play. They usually offer much more for a stable zero day. But there is a moral/ethical dilemma you need to consider in working with brokers like this; who are they selling it TO? How will it be used? Will the vendor be notified in a timely manner?

[hybrid orchid]

Also worth remembering that not all software is compiled -- and a lot is open source either way. The reverse engineering route is definitely one way to go (and is the tougher field by far), but if you prefer to go with source code analysis, just read through the code for a project and look for vulns that way.

[swift grotto]

How many bug bounty programs have you seen where their product is open source and freely available? Not discounting the value of source code analysis; it should be go to if available. But so little of it is available without some sort of reverse engineering/decompiling.

[opal meteor]

You don’t only try to find 0days for money, many people try to find 0days to get a CVE on their name

[swift grotto]

Fair point I guess if someone feels they need the cred. Lots of work in either case. Has to be some goal to it.

[vocal folio]

https://www.blackhat.com/presentations/bh-usa-07/Maynor_and_Graham/Whitepaper/bh-usa-07-maynor_and_graham-WP.pdf
For more of the above

Also there was a recent contest in China for finding 0days in all the software

[echo warren]

There's also pwn2own

[hybrid orchid]

Generally speaking if you're going for 0day vulnerabilities in software, you're more likely to be after CVEs than bug bounties.

Although admittedly the fact the question was asked in #bug-bounty is a slight counter to that argument.

[outer roost]

i got the sites wpdm-cache dir it has session-hash.txt can i exploit it or its common thing

[outer roost]

plz tell anyone

[swift grotto]

Let me guess, wpscan or wordfence is alerting you that these are malicious?

[swift grotto]

In any case @outer roost you are going to need to figure out WHAT and HOW Wordpress Download Manager manages those file. (Quick google clears up what wpdm-cache is for). If your google dorking is subpar, start here: https://plugins.trac.wordpress.org/browser/download-manager/

I was curious. You will find the exact code in https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/__/Session.php @outer roost

Next thing you are gonna ask is how do you decrypt the contents of the session files you found: https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/__/Crypt.php

Finally, you want to manipulate the "deviceId". Part of the code in the Session class is:

$agent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '';
$deviceID = md5(__::get_client_ip() . $agent);

If you look in get_client_ip() you will see it checks for headers to resolve in the following order: HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, HTTP_X_FORWARDED, HTTP_FORWARDED_FOR, HTTP_FORWARDED, REMOTE_ADDR. So if you set HTTP_CLIENT_IP yourself you should be able to spoof the deviceId to route your to whichever session file you want.

I am NOT saying this is vulnerable to anything, I haven't debugged this at all.

But if the logic for the session files has any sort of flaw, you have a pretty clear path forward. You know the code where these session files are read and written to/from, how to (en|de)crypt the session (and the requirements you have to get the __wpdm_enc_key) and how to manipulate the request to utilize which session. Lots of work ahead, but that should be everything you need to build on.

Good luck.

[outer roost]

that's lot of info thank you i will surly try it

[uneven gale]

Gave +1 Rep to @swift grotto

[smoky ore]

!rank

[stray tapir]

Is it worth it to try and crack JWT tokens?

I don't imagine orgnizations using sha256 privkeys with less than a hundrer chars

[fallen palm]

Do i need competitive programming for hacking?

[hybrid orchid]

No

[fallen palm]

Thanks muiri

[uneven gale]

Gave +1 Rep to @hybrid orchid

[hybrid orchid]

Scripting and programming will be very useful -- you can hack without them, but you will always be limited.
You don't have to be at a competitive level with them though.

As long as you can code and understand how it all works, you'll be good to go

[pale plover]

Competitive programming is needed mainly for competitive programming.

[hybrid orchid]

Understanding code is, in many ways, more important than writing it in hacking

[wispy jacinth]

this is something i've heard from someone who coaches high school students for competitive programming: they noticed that some students could perform really well in these competitions and win awards, but what's shocking is that they don't understand why the algorithms they've chosen for solving problems work, nor could they explain the theory behind those algorithms

i've also heard something similar from math teachers who prepare students for math olympiads

instead of focusing on the end result, i think one should focus on understanding and learning the material

[analog glen]

My own perspective on understanding vs doing, is that one does not understand something unless they can produce and replicate it. Being able to read code isn't the same thing as knowing how code functions.

[echo warren]

I agree with Juun. I've taken steps to learn programming because being able to read code wasn't enough. I needed to understand how it functioned for reverse engineering and smart contract exploitation. Automating sone of my workflow and creating custom scripts didn't sound too bad either

[oak trail]

I highly agree with you....

THM should have bug bounty rooms..... both for free and paid subscription

[lavish hollow]

We do, but they're not called "bug bounty" because that's not what we promote:)

[prime river]

I'm using openssl to check if there is tlsv1.3 support or not over the list of domains. I've write the script but the script doesn't get stopped its waits for me to press CTRL+D than it gives me a result. I've been stuck from 4 to 5 days .Here is the scirpt

!/usr/bin/env bash
filename='domains.txt'
while read line;do
domain=$line

if openssl s_client -connect $domain:443 -tls1_3 2>/dev/null | grep -q 'Protocol  : TLSv1.3'; then
  echo "tls V 1.3 being used "
else
 echo "tls v 1.3 not begin used"
fi
done <$filename

I've also used echo with openssl like this

echo "x" | openssl s_client -connect www.example.com:443 -tls1_3 2>/dev/null | grep  'Protocol  : TLSv1.3'

**NOTE: When i run the command on terminal for individual site i get the result without typing CRTL+D but when i used it in script using loop and if statement its waits for me to press CTRL+D. Its really strange.
**

Thanks

[stray tapir]

Found a triple-parameter reflected XSS

[mossy chasm]

hey guys how much success i can get in bug bounty if i practice on tryhackme and solved most of the labs.

[fallen palm]

Bug bounties incomes can't be measured with precision as it's depends on your luck & the website's scope you're targeting, I don't really know if we can easily quantify that

TL;DR It's not "stable" enough to give an objective answer

[tulip shadow]

Hi

[lilac mica]

hi @prime river what's your terminating condition? also it might have something to do with your file input (lines of URLs with "/" characters + leading or trailing whitespace). this may help on the file reading part of your script. https://www.cyberciti.biz/faq/unix-howto-read-line-by-line-from-file/.

your hashbang seems off too. isn't it supposed to be #!/usr/bin/env bash?

[prime river]

This issue have been resolved. thanks
just avoid grep in if condition it will works perfectly

#!/usr/bin/env bash
for i in `cat domain.txt`; do 
echo $i
if echo Q | timeout 3 openssl s_client -connect $i:443 -tls1_3 2>/dev/null; then
  echo "$i" "tlsv1.3 enabled" >>output.txt
else
echo "$i" "tlsv1.3 disabled" >>output.txt
fi
done

[uneven gale]

Gave +1 Rep to @lilac mica

[modern veldt]

Hello

I am new here. Future bug-bounty hunter here.

[noble pivot]

One message removed from a suspended account.

[modern veldt]

Something like that

Technically all bugs are Zer0 Days until they are reported right?

[noble pivot]

One message removed from a suspended account.

[modern veldt]

He's a famous Pen Tester

[noble pivot]

One message removed from a suspended account.

One message removed from a suspended account.

[modern veldt]

Haha yea

[noble pivot]

One message removed from a suspended account.

[manic mango]

Hello anyone here

I need help about something is make me crazy

I subscribe now and I can't connect to the vpn as well I was on free board I tried vpn and tried tor and proxychains and changing the kali machine and delete openvpn and install it again

[tidal citrus]

did you download a new configuration file?

[hollow siren]

Maybe try to killall instances of the vpn then restart

[vocal folio]

Also #site-support please.

[marsh saddle]

just breaking into bug bounty hi all

[fading flume]

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://10.10.83.66:8000/.

how to get arround this ?

[pale plover]

You'll need to configure Access-Control-Allow-Origin header in your server.

Oh, bug-bounty. Then you need to use a client that doesn't care about cross-origin requests. Most browsers are pretty strict on that.

But then again, that wouldn't likely be something that would get you a bounty, as it'd require the user to disable security features from their browser.

[civic umbra]

Can anyone explain me how is this request ``` POST / HTTP/1.1
Host: ac8b1f841ea3b47ac093505300bb00a1.web-security-academy.net
Accept-Encoding: gzip, deflate
Accept: /
Accept-Language: en
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 13
tRANSFER-ENCODING: chunked

3
x=y
0 ```

Causing timeout? Considering its CL-TE vulnerability, I mean, the frontend passes the whole request as is to the backend and as backend is processing transfer encoding, it will first see 3 and then 3 characters, then 0 to terminate the connection, it looks a pretty fine request to me, why is it causing timeout?

[vocal folio]

href="javascript:alert(1)"
Bug bounty tips with ninja. See it you can add a link with JavaScript content like that. Impact is a little lower than standard stored XSS as they need to click it, but I've seen it a few times.
Especially with input fields where you can specify a link - rich text editors!

Also remember to check what the editor is sending to the server when you press save, if it's HTML then have fun with it

[stray tapir]

I found a bug in a website registrar which allows for bypassing the http/https only redirect filter in the web UI
but on the web UI and on the redirected website it still concatenates http:// in front of it
does anyone know how I can "exploit" this further (perhaps to get a bug bounty)?
this would usually be "url":"http://test.nice"

that redirects to http://ftp://test.nice

[fallen palm]

Hi! I try doing the OhSINT room. Is this the right pic what is linked with the task file? I'll get the background picture from Windows XP.

[outer bronze]

Lets move this to #room-help

[rough grove]

.

[onyx nebula]

guys any idea how to steal httponly cookie via xss?

[vocal folio]

Do you understand httponly?

[onyx nebula]

Yes

I read somewhere http only cookie reflect in response body

[vocal folio]

Ok, so you understand that httponly cookies are not accessible to JavaScript, right? @onyx nebula

[onyx nebula]

Yes

[vocal folio]

So you can therefore understand that httponly prevents you stealing that cookie using javascript.

That's the whole purpose.

JavaScript cannot touch the cookie at all

[onyx nebula]

https://medium.com/@yassergersy/xss-to-session-hijack-6039e11e6a81

Can you explain this in simple language?

[vocal folio]

See how it's duplicated?

You could read it from the request body (NOT THE HEADERS!) using JS if you make the request. You couldn't read it from the cookie itself.

[onyx nebula]

Can i make an xhr request and just redirect response to my machine

[vocal folio]

No.

That article was a very specific case for an application with a specific flaw.

[vocal folio]

How much do you know about how webapps, HTTP, and session handling?

Because those are some very very useful things to learn before starting in bug bounty.
You absolutely need a strong understanding of what you're doing and how the systems work.

[spice lily]

you need a cors misconfig for that

[onyx nebula]

The domain doesn't have any

[dusty pasture]

Even with a CORS mis-configuration, why would the browser give the Cookies of one domain to another?🤷‍♂️

Like the browser has some session cookies for https://example.ex

Visiting https://should-not-be-visited.ex will not send those Cookies

Correct me if I am wrong😄

[hybrid orchid]

As an extension to that, CORS would be at the attacker's side -- it's a server response header that determines whether your browser will allow the content to load.

i.e. it's you who would need to "misconfigure" CORS -- not the developer of the application you're attacking

[thick wind]

I belive I found sql injection bit I having trouble testing it

I have an error illegal character space

[thick wind]

Ok thank you

I read that. Thank you for your help

[outer roost]

i m getting this error while testing an api point SyntaxError: Unexpected token } in JSON at position 22

is there any way to exploit it

or its just as error

[dusty pasture]

It will hardly be exploitable.
Unless the JSON parser used has some issue, which is very unlikely.

IIRC, there was a room on THM (one of vulnet series) about node-serialize which deserializes user input and allows for method execution 👍

[outer roost]

oh

i will try it then

[native token]

It's just a parsing error meaning there's an extra } that it didn't expect

[outer roost]

okay i get this also in the error (/home/ubuntu/||supplier-panel/supplier_panel_v2_node/node_modules/raw-body||/index.js can i some how travel the dir or its still remain for some part of information gaining

[dusty pasture]

Nah, raw-body isn't vulnerable I guess🤔

As optional mentioned as well, it is just a parsing error😄

[outer roost]

okay, then I look for other requests

[stray tapir]

Is it illegal to run sqlmap in bugbounties without dumping the db?

[opal meteor]

Firstly, you’ll probably get rate limited very quickly, secondly, it’s not necessary, you only need steps to reproduce and there being an actual sqli for bounty.

[spice lily]

its not illegal, alot of bug hunters do use it

[lavish hollow]

Check the program, I believe they should tell you what they require. Most just need a PoC or steps to reproduce and not actually have any physical evidence of penetration. but I’m not expert, this is just what I have picked up from being around

[thick wind]

For autorize if it 0 0 0 for the len. Did ot fail?

[high dagger]

hey now

[mighty ermine]

What is the roadmap for bugbounty

[echo warren]

Portswigger Academy. 👀

[mighty ermine]

Advanced then

[echo warren]

Not to be rude but if you're looking to be "more" advanced than Portswigger's material then you shouldn't be wasting time on bug bounties.

The only thing I can think of that's "more" advanced than Portswigger is OSWE

[hybrid orchid]

OSWE is white box. eWPT(X) is more black box.

[main chasm]

Can you explain why?

[hybrid orchid]

Because that's how they were written?
OSWE teaches you how to analyse source code. eWPT(X) teaches you how to target externally. It's like asking why a language class doesn't teach you to sew 😆

[marsh saddle]

😍

[old umbra]

OSWA seems to be good 🙂

[echo warren]

Pretty sure not many would be happy shelling out 2k when you could do a cheaper alt then go directly for OSWE and still have the total cost be less than 2k lmao

[old umbra]

[stray tapir]

Is the chance of exploitation of open redirect low, medium or high? Same goes with the chance of damage

I assume low and medium right?

Because it can be used for phishing

[vocal folio]

Is the chance of exploitation of open redirect low, medium or high? That's gonna depend on the app. If any user can exploit it, it's more serious than if only admins can use it, etc.

And yeah, the impact is largely phishing

[stray tapir]

Yeah its exploitable while not being logged in

[vocal folio]

I'd argue it's especially bad if they're prompted to log in with the site before they're redirected, because you can show them an identical prompt but with "Incorrect creds" message on the page

[stray tapir]

Why is that?

[vocal folio]

Clarified

IDK how hard you'll have to argue impact as I don't do bug bounty

[stray tapir]

Ohhh yeah indeed

[tardy sparrow]

HI all,
I wanted to start my journey in bug bounty hunting.
Any suggestion?

[echo warren]

THM's web hacking fundamentals/portswigger

[native token]

Open redirect in bug bounty also depends heavily on context, most of the time it's a low, which is why a lot of people keep hold of them until they find something that can chain with it; e.g. SSRF

A nice way of increasing impact is you can use open redirects to bypass email filtering with malicious links so can further expand with that

[soft terrace]

https://github.com/nahamsec/Resources-for-Beginner-Bug-Bounty-Hunters this is a great resource for starters

[dapper saffron]

dont forget oauth when you get an open redirect

also spray that parameter to forget password link

[tardy sparrow]

Portswigger seems a bit tough.
Do you prefer watching walkthrough first or read the material first?

[tardy sparrow]

Woah, this is a great resource. Thanks @soft terrace

[uneven gale]

Gave +1 Rep to @soft terrace

[native token]

Compared to bug bounty portswigger is deemed easy and fundamental so you'll wanna go through it regardless if your goal is bug bounty

[soft terrace]

You are welcome :)

[echo warren]

I always read the walkthrough first to get familiar with the material then read it to gain a more in depth understanding and finally complete all the labs for practice

[tardy sparrow]

Absolute valid point, I would have to start somewhere.

[lime siren]

Yeah man, It's normal that it looks hard. No one would pay for something easy

[solemn bramble]

https://bugcrowd.com/asana/updates/fec4276b-995d-4a11-8c20-dc293ebbd6d8

25k to see if they forgot to patch anything for log4j

[solemn bramble]

https://infosecwriteups.com/broken-link-hijacking-404-google-play-store-xxx-bounty-96e79a8dfd71 sheesh

[vocal beacon]

OSWA vs OSCP?

[hybrid orchid]

Web Cert vs Pentesting Cert

Do web cert if you want to do web stuff. Do pentesting cert if you want to keep things generalised

It's comparing apples to oranges 🤷‍♂️

[fallen palm]

true & oranges > apples btw

[old umbra]

each

[lilac sorrel]

Hello everyone i am new to this bug bounty Can someone teach me how to do this ?can someone give me books refrences.

[fallen palm]

https://nahamsec.com/getting-started-in-bug-bounty

[lilac sorrel]

thanks

[uneven gale]

Gave +1 Rep to @neon spade

[old umbra]

I hope will be rewarded :S

[native token]

Doubt it, google maps API keys tend to be refunded by google if they are reported as misused

Can't remember the exact process but Google have thought of it as they know it's difficult to lock them down, something along the lines of damage control

[old umbra]

I notice so much reward about google api keys i hope a little reward xD

Idk is first time i reported api key disclosed to google

[native token]

Yeah maps is a coin flip, it does occasionally get rewarded. However, 75% of the time it’s an NA

[neon merlin]

🤡is anyone interested in making a team?

Like I know essential and lower medium

Looking for a team to join in

[austere drift]

thinking about it

[fair sleet]

did anybody here complete the web fundamentals path and went straight into bounties ?

[open swift]

Is bounties a path?

[little meteor]

bug bounties

i.e get paid to report bugs in scope to target websites

[open swift]

I would doubt that. Web fundamentals path is super basic

[little meteor]

well sometimes the errors are super basic too but still slipped through

[open swift]

What I wonder is how you find these bugs on commercial sites without looking like an attacker

[native token]

Some programs require you to add a custom header for example x-hackerone: <USERNAME> . Others have it as an accepted risk

[open swift]

Does the header redirect you to a non production box or something?

Why wouldn’t real hackers just use the header haha

[native token]

Nope it just means they can log and verify whether the traffic is from their bounty program

Because "real" hackers likely don't look at bounty programs

[hybrid orchid]

"Likely"

Honestly, trawling through random Hackerone usernames, grabbing one and setting it as a header, then going on a rampage seems like a great way to incriminate someone else with that system 🤷‍♂️

[native token]

[hybrid orchid]

Sounds about right

[native token]

Fairly unlikely- fundamentals will give you the basic building blocks of knowledge, but there's still a massive gap between that path and finding those bugs in commercial systems. I'd imagine you could take that information, combine it with something like Portswiggers academy (Tis free ) and then start reading up on disclosed bounty reports.

Hackerone has a full page called Hacktivity which shows any bounty reports that they have disclosed. Can be a great resource too, especially to give an idea as to what is being reported

[fair sleet]

that's exactly what i'm doing in the first part
second part is new to me but seems really helpful thanks

[uneven gale]

Gave +1 Rep to @native token

[thick wind]

Does anyone know how to use the alias email for hackerone. I read the article on it. I tried to create an account woth one the aliases but I am not getting any emails

[fallen palm]

https://docs.hackerone.com/hackers/hacker-email-alias.html

So it's just [e-mail] and if you've signed up to any websites with this then the emails will be forwarded to your actual email address if you use gmail or outlook(or other).
Having said that it's just a matter of waiting.

you just have to worry about any typos when you enter the wearehackerone.com email.

but also check your spam filter just incase.

[charred fable]

I've had problems getting emails when using the alias in the past, so I recommend contacting HackerOne support to troubleshoot the issue if you know you're using it correctly

[lilac sorrel]

you nepali?

[fallen palm]

quick question that's really stupid about this stuff.
i got told something has a bug bounty programme and im pretty sure its vulnerable to Nginx HTTP Server 1.3.9 Chunked Encoding Stack Buffer Overflow becuase it runs NGINX on port 80 HTTP, But you do gotta get like permission to find out if something IS vulnerable to just say for bugbounty or however it works or can you just test if it is and if it is then report it to them?? I really don't know how this stuff works and its kinda confusing to figure out what I can and can't do?

[fallen palm]

usually the program brief says what is out of scope or not within rules of engagement and that is usually 1) Dont mess with data that isn't yours, 2) if you end up accessing data that isn't yours and that you don't have access to then stop what you are doing and report immediately, 3) don't modify anything on a system that isn't yours in case you do end up getting a shell on remote target

With reports you are expected to demonstrate security impact and that is accompanied with showing proof of the vulnerability you say exists.

So if you're theorizing what might be there in your report and don't show proof then I don't think it will be valid.

[old umbra]

noice

[limpid oak]

couls someone show me any link that would help me about archiving my fiest bug
i learnt a lot about business logic vulns but never actually got any bug
i need to learn how to pick a program, and for how many days do i need to constantly be searching in that specific program

[old umbra]

An application is not necessarily vulnerable or misconfigured. You can try other.

[limpid oak]

yep but when do i know if its no bulnerable

[old umbra]

[vocal folio]

i need to learn how to pick a program, and for how many days do i need to constantly be searching in that specific program
Remember private programs will hopefully have less people looking.
You cannot possibly know how many hours you need to sink in to a program before you make money, you could sink 3 weeks and find nothing.

[limpid oak]

ye i know you cant be exact in that

[vocal folio]

Learning when to move on is something I think you need to get a feel for, in pentesting or bug bounty.

[devout moss]

I started watching alot of @spring knoll 's videos, I'm trying to get into the game as well. Ive spent a few hours on her youtube 😅

[limpid oak]

would you recommend insiderphd?

[vocal folio]

No clue

[limpid oak]

what would you recommend me to study?

[vocal folio]

You need to remember that bug bounty isn't immediate income.
You hear about the people who make lots of money off it. You don't hear about the people who make nothing.

[limpid oak]

i know man but i rlly love it and would like to start out

wouldnt you think in about 6 months wont it make me money?

[hybrid orchid]

Maybe. Maybe not

It's a lot of effort for no guarantee of return

It might pan out, or it might not -- bit like sifting for gold in river beds.

You might find get lucky and something big, or you might spend hundreds of hours and find nothing

[keen iron]

Please suggest good resources to start with bug bounties

[ebon tapir]

check pinned messages.

[spice lily]

portswigger

[fallen palm]

https://twitter.com/sw33tlie/status/1277341893500833795

sw33tLie (@sw33tLie)

Here's my favourite way to reliably bruteforce subdomains: cat SecLists/Discovery/DNS/dns-Jhaddix.txt | subgen -d DOMAIN.TLD | zdns A --name-servers 1.1.1.1 --threads 500 | jq -r "select(.data.answers[0].name) | .name" #bugbountytips

Likes

221

Twitter · Jun 28, 2020, 8:43 PM

My go to subdomain enumeration workflow that I picked up from sw33tlie. He's awesome for this.

[old umbra]

https://twitter.com/0xJin/status/1470748925963513863

0xJin (@0xJin)

XSS via SSTI finder via shodan usage:
./SSTI-XSS-Finder.sh <Shodan-Dork> like org:target | hostname:https://t.co/PguxYyYTdS | net:127.0.0.1
#bugbounty #bugbountytips

Likes

210

Twitter · Dec 14, 2021, 1:34 PM

https://twitter.com/0xJin/status/1445672408308805635

0xJin (@0xJin)

If you find 401 Unauthorized, try to test with SQLmap
sqlmap -u $url --forms --crawl=2 --dbs --ignore-code=401
--->Bypassed
--->Bounty
#bugbounty #bugbountytips

Retweets

297

Likes

698

Twitter · Oct 6, 2021, 8:48 AM

this is too is a good finding i was rewarded 3 times with that. Ignore the "crawl" that is useless. But add --forms

this is another good tips for CI

https://twitter.com/0xJin/status/1447158357547233282

0xJin (@0xJin)

Command Injection:
~Find Your subdomains
~cat subdomains.txt | httpx | gau | qsreplace “aaa%20%7C%7C%20id%3B%20x” > fuzzing.txt
~ ffuf -ac -u FUZZ -w fuzzing.txt -replay-proxy 127.0.0.1:8080
~search for ”uid” in burp proxy intercept
#bugbountytips #bugbounty

Retweets

196

Likes

444

Twitter · Oct 10, 2021, 11:13 AM

[solemn condor]

whats the avg $ for a find like these? @old umbra

[static wave]

Just wanted to share my weird bug-bounty experience.
||I submitted a descriptive bug bounty report for a crypto-trading platform. I believe the bug was serious one. User can exploit the application logic flaw and withdraw more money that his balance and make wallet balance as negative.
And, I got the response saying that it is one of the feature of our platform and after that it was fixed.||

[elfin sundial]

Should have abused the hell out of the bug and then reported it. And only given it back if they rewarded you for the find 😀

[hybrid orchid]

I mean, no, because that's still unethical

Very unethical, and highly illegal, for that matter

Companies being shady f*ckers is an unfortunate aspect of bug bounty, and there doesn't really seem to be much recourse for it other than reporting it to the bounty programme and hoping for the best.
That's all you can do. If they screw you over, just don't do anything else for them, and encourage any others you know who are working on it to ignore them. Drag their name through the dirt with the ethical hacking community.

Then the only people finding bugs are the blackhats who will simply clean them out 🤷‍♂️

[static wave]

On lighter note atleast I should have leaked that info to one of the news channel, I would have been sitting in some anti-country embassy or in other country. 😄

[native token]

With that attitude you should probably avoid bug bounty

[old umbra]

What do u mean?

[lime siren]

From what I read, platforms tried(and still trying) their best to show hackers are not just bad guys, and they are willing to make companies, internet safer with appropriate pay. If you abuse what's given to you then you are only making platform's job harder(exponentially harder 'cause people tend to believe hackers are criminals). Of course this is my opinion...

[old umbra]

Depends from the programs, all programs are different

[glad cairn]

Hello

[old umbra]

Yeah bro i know!!! I can understand you!!

[glad cairn]

After how many months of work could I, as a beginner, expect results in bug bounties?

[old umbra]

I lost 15k$ for fukin mail ru

[glad cairn]

Are we talking half a year or 2 years+, in general..

[lime siren]

@glad cairn I don't think anyone can give exact time

[old umbra]

All known people, see my report in private.. And fk hackerone is a scam!! They pay only known people

They scam me for 15k$

https://0xjin.medium.com/bug-bounty-story-of-a-not-applicable-sql-injection-worth-15-000-ed4bd3b2f09c

This is my writeup about that

[lime siren]

@old umbra Isn't this program specific thing ?

[static wave]

||It's hard to believe but luck is kinda big factor in getting paid by bug bounties. You can get paid heavily if you luckily run across any zero day or it will take long nights just to find a small bug.||

[old umbra]

Sqli = 15k$ they said me ti find the columns… Lol after reply the fixed the bug and the parameter was sanitized

I shared privately to all the most famous people about hackerone and as a bug hunter. And everyone told me they scammed me. and I am completely right

[hybrid orchid]

Again. Bug bounty is not a sure-fire source of income, and there are plenty of unscrupulous companies around.
You took a gamble and it didn't pay off. Warn others about doing the same, but there's no point in being sore about it.
Yes, it's annoying as hell, but it's not a good look to stay bitter over it.

Or, to put it another way: unlike pentesting, bug bounty is never "worth" anything until you're paid the money.
If you're a pentester you know you'll get paid for the work you do because you're contracted to do it. If you're trying to make money out of bug bounties, you don't actually own the money until it's in your account, and you have no legal fallback to claim it.
It is entirely up to the company whether they accept your bugs, and indeed whether they pay you.
Them's the rules 🤷‍♂️

[lime siren]

[old umbra]

They told me that if I find something big, again, pass the vulnerability to them. They will create the report for me. some I know well and can trust. But they have to do it for me. because they are known and pay to them.

[lime siren]

trust chain

I mean

Can't you add that company to your blacklist

and move on

[hybrid orchid]

Exactly. That's the consequence for the companies if they screw people over -- they lose trust with the bug bounty community and gain a bad reputation.

That's it 🤷‍♂️

[lime siren]

Because you were qualified enough to find that bug. It's a high chance that you can find something equivalent in future

[vocal folio]

Isn't that just trading on margin?

Like that's a pretty standard trading feature

[elfin sundial]

This was just a joke lol, should have added /s to it. I didn't mean to get some of you riled up

Whitehat all the way

[static wave]

No, it was spot trade. And, during margin trade it can happen cauz trader had borrowed the asset beforehand.

[echo warren]

What bug bounty platform did you use to send in the report?

If it was Immunefi, then you can send in a complaint and have them booted off the platform

[static wave]

Sadly communication happened via their official website (Ticket system).

[echo warren]

That was your first mistake.

[echo warren]

Always try to submit it through a third party like Immunefi. Their will fight to get you paid because that's how they get a cut

[static wave]

I know but that site isn't tied up with any bug bounty site.

[static wave]

Thanks, I will keep that in mind.

[uneven gale]

Gave +1 Rep to @echo warren

[echo warren]

You can still ask a bug bounty platform to act as an intermediary. Helps avoid things like this and being blamed as a scape goat when things go wrong

[fallen palm]

hi i am new to this! 🙂 but i am super interested: how do people work on sth like this: https://www.state.gov/reward-offers-for-information-to-bring-darkside-ransomware-variant-co-conspirators-to-justice/

?????????

[static yew]

i would imagine you start by getting a hold of the software they use so you can RE, combine that with some OSINT and knowledge of who's who and what's what in the criminal world, that would get you started

[fallen palm]

hmm, sounds good to me! is anyone particulary watching whats happning in that case?

[static yew]

someone with more knowledge can probably give you better info lol I am just making some educated guesses

by anyone you mean? like anyone here? or...

[fallen palm]

yeah here

🙂

[solemn condor]

New people won't get this info quickly

People that posted about the last re:evil guy were involved in the community for many years before getting information

Wocky right, it's combination of RE, osint, social engineering and just general exposure

[old umbra]

Yup this is

[fallen palm]

thx, i know it is not a piece of cake and nobody accidently put some pics on insta saying "- hi! hacking some gov staff, now! @bachama..." 😉 but am curious, so thx for sharing somme toughts!

[uneven gale]

Gave +1 Rep to @solemn condor

[static wave]

Hey, what is better bug-bounty platform for beginner? (ease to use)

[wise skiff]

@old umbra can we name and shame here?

[spice lily]

hackerone

[silk harness]

Help required

Confused in learning path @

[old umbra]

You want shame here? You can

[hybrid orchid]

That isn't what this channel (or server) is for.
If it comes up in conversation and you can prove the accusation then I have no problem with examples being made (i.e. using a name-and-shame to make a point), but if it's purely for vitriolic reasons then no

[wise skiff]

No I was more wanting to know who Jin got scammed by in order to avoid them in the future that was all

[old umbra]

From a Hackerone program.

i'm just doing public program and not from platforms like hackerone o bugcrowd etc

[solemn condor]

bug bounty people getting denied stuff is common, just research the company history on twitter to see 😄

[old umbra]

This is true, all common and famous people are boring from there programs

[solemn condor]

there is a reason companies like zerodium exist

[hybrid orchid]

Oh, then, yes

By all means

[old umbra]

This is useful for the fast installation of all necessary tools https://github.com/0xJin/awesome-bugbounty-builder

[old umbra]

try to report one critical to mail ru xD

[wise skiff]

@old umbra cheers that looks pretty comprehensive for people starting out

[old umbra]

yup

[dense canopy]

Any bug bounty platform for beginners ?

[celest vigil]

check the pinned messages at this channel

[native token]

Bug bounty and beginner don't really go together, your best bet is starting on hackerone and trying to do the CTF to earn private invites

[dense canopy]

Thanks

[native token]

That wasn't an invitation to dm, please refer to #rules, specifically rule 1

[fallen palm]

Hackerone has CTF or are you referring to THM?

[native token]

Hackerone, you can compete in their hacker101 ctf, every flag is worth points which once you reach a milestone, you are rewarded with a private invite

[fallen palm]

Appreciated.

[opaque goblet]

Curiosity bc im just finding this channel. What are private invitations?

[fallen palm]

https://docs.hackerone.com/hackers/invitations.html

[opaque goblet]

Nice, thank you!

Thanks @fallen palm. For some reason didn't give a +1

[uneven gale]

Gave +1 Rep to @hardy cape

[stray tapir]

https://i.imgur.com/LfE1gkp.png

is there a way to bypass this to get the full error?

It's IIS 8.5

[vocal folio]

It'd be a pretty major problem if there was.

[stray tapir]

Ah

(I'm asking because I'm not sure if there's a CVE for it or so considering the IIS version is old)

[native token]

That’s the beauty now you can try find that out. Though chances are it’s just an error page

[dry citrus]

So this may be the wrong thread to ask.. but anyone recommend any good reads for someone new to bug-hunting?

[spice lily]

https://pentester.land/list-of-bug-bounty-writeups.html

and portswigger

[tiny bolt]

how to begin at bug bounty ? & what i should study to be bug bounty ? do we need study langage php html css javascript and python ?

[dusty pasture]

Woah! Please refer to the pinned messages first😄

[tiny bolt]

@dusty pasture

[fallen palm]

hey quick question

which THM learning path would teach me the most about bug bounty?

[covert moth]

@old umbra sorry for the tag..not sure if i'm allowed but i didn't see anything about tagging ppl in the rules 🙂

i thought u shared a bug bounty set up for beginners recently?

[old umbra]

yup

[hybrid elk]

Not the person, but using search #bug-bounty message

[covert moth]

oh wow it literally is just 3 scrolls upwards

[old umbra]

you need it?

[covert moth]

sorry

OpBanana was wondering 🙂

[old umbra]

you can find it in my profile a pinned message https://twitter.com/0xJin

0xJin (@0xJin)

¯\(ツ)/¯ | eCPTX | eJPT | C|EH Master | CompTIA Security + | Check my writeup on Medium | Bug Hunter | Crypto Coin | Box Creator Vulnhub - Hackmyvm |

Tweets

648

Followers

3005

Twitter

[covert moth]

ah i see!

@old umbra thanks 🙂

whut it doesn't give rep here?

[old umbra]

[old umbra]

What do u mean?

[covert moth]

i tried giving you +1 reputation

[old umbra]

ah lol xD i don't know xD

[covert moth]

it worked in general chat like this lol

[old umbra]

yes true ahah

[old umbra]

thanks

[uneven gale]

Gave +1 Rep to @covert moth

[old umbra]

yeah work

[covert moth]

whut

[old umbra]

xD

[covert moth]

you already have to much rep, can't gain more

[old umbra]

[fallen palm]

does this error lead to any type of sqli? Error! System.Data.SqlClient.SqlException (0x80131904): Unclosed quotation mark after the character string ''. Incorrect syntax near ''. at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose) at System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady) at System.Data.SqlClient.SqlDataReader.TryConsumeMetaData() at System.Data.SqlClient.SqlDataReader.get_MetaData() at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString, Boolean isInternal, Boolean forDescribeParameterEncryption, Boolean shouldCacheForAlwaysEncrypted) at System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async, Int32 timeout, Task& task, Boolean asyncWrite, Boolean inRetry, SqlDataReader ds, Boolean describeParameterEncryptionRequest)

[old umbra]

yes it 's

[fallen palm]

union select??

[old umbra]

try boolean-based

try with some payload true and false request

or use sqlmap

where's the injection point? which form?

[fallen palm]

search form

[old umbra]

omg lucky xD

but it show an error so i think try to send delay u can use burp?

[fallen palm]

what ya got in mind for that??

[old umbra]

is not easy find an sqli on search parameter in 2021/2022

try these paylaods

' or sleep(5)#

' or sleep(5)-- -

in burpsuite

and let me know the request

[fallen palm]

tried these already it think!! but gonna tried it again

[old umbra]

Use burp with these payload and let me know the millisecond

[fallen palm]

ok mate thanks

[uneven gale]

Gave +1 Rep to @old umbra

[old umbra]

if you can put here a screenshot of response

[fallen palm]

getting this error

[old umbra]

This is not an error bro

Give me the path vulnerable without a domain disclosed

I give u a command

[fallen palm]

ctl00%24ContentPlaceHolder1%24UDCLmsAdvanceSearch%24hdnLmsBookUserReviewID=1&ctl00%24ContentPlaceHolder1%24UDCLmsAdvanceSearch%24hdnLmsBookID=&ctl00%24ContentPlaceHolder1%24UDCLmsAdvanceSearch%24txtsearch='%20or%20sleep(5)--%20-&ctl00%24ContentPlaceHolder1%24UDCLmsAdvanceSearch%24DDBranch=%25&ctl00%24ContentPlaceHolder1%24UDCLmsAdvanceSearch%24DDBookType=%25&ctl00%24ContentPlaceHolder1%24UDCLmsAdvanceSearch%24DDLanguage=%25&ctl00%24ContentPlaceHolder1%24UDCLmsAdvanceSearch%24DDBookCategory=%25&__ASYNCPOST=true&ctl00%24ContentPlaceHolder1%24UDCLmsAdvanceSearch%24Button4=Search```

[fallen palm]

Student_LmsAdvanceSearch.aspx?mmid=

[old umbra]

If you put a quote ‘ on mmid parameter

It’s vulnerable?

[fallen palm]

already did that no it's not

[old umbra]

So

What is vulnerable?

Send me screenshots or something

[fallen palm]

search form i think

[old umbra]

Ok type something like “hello” in the search form

And intercept with burp the request

After u have intercepted , right click and save the item

Now go on terminal and use

[fallen palm]

with sqlmap

right

[old umbra]

sqlmap -r intercept.txt —dbs —batch —random-agent —dbms=MySQL

[fallen palm]

i'll try that see if i get something thanks

[uneven gale]

Gave +1 Rep to @old umbra

[old umbra]

Sure if u get now send me screenshots

We will add some tampers

[fallen palm]

ok mate! sure

[fallen palm]

but there gotta be something vulnerable right? after seeing this error?

[old umbra]

Yes

But u need the poc

[fallen palm]

yes exactly

[solid galleon]

I think it is too early 🙂 Learn network,apps etc concepts

[native token]

Yeah focus up on learning, you won't find anything for long periods of time with bug bounty and only demotivate yourself.

It's not exactly something you want to rush getting into

[viscid flint]

Yo guys, i found a subdomain that shows the EMV Data, can i do something with them?

Like any tool to parse this data.

[fallen palm]

@old umbra can i dm ya?

[old umbra]

yes

[spring hound]

I'm taking suggestions on practical/must books.

[spring hound]

doesn't need to be a book it can be any high quality resource etc..
looking forward to finding a bug per week starting 06-01-22

[spring hound]

I love info graphics btw

[echo warren]

Portswigger

[potent solar]

using x-forwarded-host, we can get token(say from reset-password link). But, to get it user needs to click the link . Doesnt that token expire once user click and resets by themselves?

[winged basalt]

https://www.coindesk.com/tech/2021/12/29/polygon-discloses-patched-exploit-that-put-9b-matic-at-risk/ 2.2 million dollar bug bounty... Well in stablecoins, but still.

[austere geyser]

Is there anybody willing to share some resources for bug bounty hunting? I understand how most vulnerabilities work, the problem is, I am having a hard time actually discovering them

[fallen palm]

There are quite a few resources in the pinned messages.

[austere geyser]

whoops my bad didn’t even check, lol i thank you @fallen palm

[uneven gale]

Gave +1 Rep to @hardy cape

[echo warren]

Better article here.

https://medium.com/immunefi/polygon-lack-of-balance-check-bugfix-postmortem-2-2m-bounty-64ec66c24c7d?source=collection_home---6------1-----------------------

[winged basalt]

Ooooooh. The write up! Nice, nice.

[echo warren]

The second hacker got 1.2m

So in total it's a 3.3 m bounty

[winged basalt]

I heard they got like 500k in matic but I never looked at the conversion. Defi comin' out with the bounties.

[echo warren]

If this stuff interests you then it'd be prudent to read my article on it.😄
https://medium.com/immunefi/hacking-the-blockchain-an-ultimate-guide-4f34b33c6e8b

[echo warren]

Yeah there's about 10 or so programmes listed with 1m+ bounties

Not as easy to find vuln code though

Otherwise I'd he a millionaire too.

[winged basalt]

Niiiiice. New frontier for not only finance but tech and security. Exchange front ends like Uniswap and the like quite likely need observation too so I imagine multiple vectors. I better pay attention concerning this.

[bronze tree]

why the zero address as the "from" address leads to this bug (why does the zero address is related to mrc20 contract), I think I understood the code segments but I couldn't understand that part

[echo warren]

Externally owned addresses or user wallets with tokens have private and public keys. The private key is what you use to sign or authenticate your transfers, without it the transaction fails.

The zero address is a special case that signifies when a contract is being deployed to the blockchain so it doesn't need or have a private key allowing the attacker to bypass the need to sign the transaction.

Does that help?

[bronze tree]

I get that, I couldn't get the where does the attacker specifies the address of the MRC20 pool (or whatever it is)

[echo warren]

In the function call

I.e address.transferFrom(address goes here)

[bronze tree]

I thought that the value of "from" variable is 0x0

thanks, I will check it once more

is checking the source code of these applications randomly a good approach? I read your article and im interested in defi security now (pretty good article btw)

[echo warren]

Well not randomly ofc. There's an approach to it. The code is usually available on github for each protocol listed on Immunefi's website

https://immunefi.com/

[bronze tree]

Yes I saw the source codes, is there like a guide or something for the approach?

[woeful lynx]

Quick question: where would I go to look for bug bounties?

Like, I know there are programs via facebook/google/whathaveyou

but like, how would one go about legally testing a site for bugs?

[fallen palm]

hackerone

[echo warren]

It's covered in my article. You build the approach along the way once you reach the secureum bootcamp

First and most important is learning solidity and a testing framework

Testing exploits on mainnet and public testnets will get you banned

So it is imperative that you learn how to fork mainnet

[swift grotto]

@woeful lynx Or BugCrowd. Or SynAck. yesWeHack. OpenBugBounty. Intigriti. Just to name a few. Google something like bug bounty platform and I'm sure you will get even more results. Pick a community you like and fits your location, style and effort.

@woeful lynx You might also wanna start by first going through the various BB courses out there. Most of the platforms offer them for free. Here is a good link of some options: https://securitytrails.com/blog/popular-bug-bounty-courses

[native token]

If you’re starting out synack isn’t the place to go, the application process requires experience and takes roughly two to three months to get through it

[swift grotto]

That's true

And places like Intigrity are better served if yer in Europe. That's why I was saying check out the community, and make sure you fit.

[woeful lynx]

@swift grotto thanks so much!

[uneven gale]

Gave +1 Rep to @swift grotto

[woeful lynx]

I am excited to hop into it

[swift grotto]

It’s a great community to learn from. Good luck!

[wise skiff]

has anyone been awarded for self-xss before?

[native token]

I’ve only ever seen others get triaged for it

It’s a myth like xmlrpc being enabled

[wise skiff]

figures

shame though

[woeful lynx]

The only myth on tryhack me is achieving the rank beyond 0xD

AH brings up the question that I have had for a while: Why not to 0xF if you are using hex? Seems intuitive enough, but I am sure there are reasons why there is no rank e or f as of the time being

[vestal root]

Has anyone got bounty for SPF?

[chrome pulsar]

Hi, can anyone help me with a doubt about XSS?

[echo warren]

It's better to just ask your question

[vocal folio]

Is this a CTF or similar? Or a real bounty?

If it's a CTF, please ask in #infosec-general

[chrome pulsar]

Is similar to a CTF

Ok, I'll ask there, thanks

[outer roost]

does any one can write in small code in python3 im getting error

https://github.com/appsecco/json-flash-csrf-poc/blob/master/py-redirect-server.py

import BaseHTTPServer is not supported in python3 so i m getting error

[vocal folio]

It's a script written for python2...

[outer roost]

let me test it again then

oh i got it the [Errno 98] Address already in use

i changed the port n it work

[outer roost]

IF the cookie header contain 9 different name and values Does in this condition CSRF is possible or not

[echo warren]

This might be useful for you but I recommend finding your own flow as you learn

@bronze tree

Personally, I skip non-code resources.

So does samczsun apparently

[tiny nacelle]

which platform would be great to start with bug bounty hackerone or bugcrowd ?

[native token]

Hackerone has more opportunities for private programs through hacker101 ctf

So likely start there

[bronze tree]

thanks, you are awesome

[uneven gale]

Gave +1 Rep to @echo warren

[echo warren]

Immunefi.

[tiny nacelle]

ill check it thanks

[uneven gale]

Gave +1 Rep to @echo warren

[tiny nacelle]

thanks

[swift grotto]

Did you try using 2to3 on it to convert it to py3?

[dry wyvern]

Can someone tell me what I’m looking at on this subdomain?

[outer roost]

it works with py2 the problem was the port was already in use i changed n it works

[pale plover]

A cdn?

A content delivery network?

[civic umbra]

I have found a GET parameter that reflects the value in a cookie, I am trying a CRLF payload in this parameter test%0d%0aSet-Cookie:%20csrf=fake but its setting the whole payload as cookie value and CRLF is not working to set another cookie. What could be the reason?

[graceful blade]

Hi guys, I am starting bug bounty from today onwards . Any suggestions?

[fallen palm]

In the pinned messages there are a few resources. Might help.

[graceful blade]

thanks

[hazy mulch]

hey everyone
if I've found a possible blind ssrf inside a JWT which fetch oauth token for authentication process and i have received http request to ./well-known/token on my collaborator what i can do further ?

any suggestion ?

[stray tapir]

https://link.medium.com/HYjouIPQFmb

Are waybackmachine token leaks really bounty worthy?

[hybrid orchid]

Apparently so 🤷‍♂️

Tbf, that is a nasty one

[graceful blade]

Is SKAdNetwork Ids contains a risk if exposed?

[civic umbra]

Here's the summary ( Twitter thread ) of day 10 of my #100DaysOfHacking challenge

https://twitter.com/NjmUlSqb/status/1480582174973825033?s=20

Najam Ul Saqib (@NjmUlSqb)

Day 10 of #100DaysOfHacking

So far, I have tried basic auth flow tests on this target, tried to bypass CSRF, tried to perform ATO using a couple of methods. To be honest, though there are still lots of things to test but the things but the I have used my skillset and got ....

Twitter · Jan 10, 2022, 4:47 PM

[drifting merlin]

A get parameter takes the value of a binary how should I manipulate it??
(Parameter=10101110101)

[lavish hollow]

You need to know what’s happening to the parameter before you exploit it

Maybe it just takes binary in and does nothing with it

[civic umbra]

Here's the summary ( Twitter thread ) of day 11 of my #100DaysOfHacking challenge

https://twitter.com/NjmUlSqb/status/1480954038644576266?s=20

Najam Ul Saqib (@NjmUlSqb)

Day 11 of #100DaysOfHacking

As discussed yesterday, I decided to learn static analysis of JS files today.

Went to the dev tools on the target site and opened JS files linked in the source code of the site, believe me it wasn't a good sight. Have a look at this screenshot ...

Twitter · Jan 11, 2022, 5:25 PM

[valid tapir]

what skills do you need to find bug bounties

[native token]

Check the pinned posts, I’ve already made a decent post about it in the past

[wise skiff]

I've found an interesting blind ssrf which may have potential

anyone experienced in this I could message to throw some ideas around with

[valid tapir]

where are the pinned posts

[fallen palm]

Here.

[left osprey]

Can anyone teach me about bug hunting

I'm a programmer

[hollow needle]

damn, here take my respect +rep

[uneven gale]

Gave +1 Rep to @hardy cape

[pale plover]

Check the pins as a first step.

[civic umbra]

Here's the summary ( Twitter thread ) of day 12 of my #100DaysOfHacking challenge
https://twitter.com/NjmUlSqb/status/1481320096987594754?s=20

Najam Ul Saqib (@NjmUlSqb)

Day 12 of #100DaysOfHacking

Though sourcemaps provided be with detangled, unminified code of the target app in developer tools but I wanted to download the whole frontend code base to my local machine for better analysis via code editor. Dev tools has no feature to download ...

Twitter · Jan 12, 2022, 5:40 PM

[peak wharf]

Who taught you about programming?

[quasi pivot]

Google/Stack Overflow/Error messages

[peak wharf]

Great choice. And Google will be it again.

I hope also for @left osprey

[lavish hollow]

One man takes the long route so the next doesn't have to.
Google is full of misleading or unreliable resources, give them a starting place.

[stray tapir]

Found unauthenticated reflected XSS and reflected CSTI

Is that considered severe or moderate?

[short drift]

finished up this fun project https://github.com/elbee-cyber/prt

[native token]

Reflected you're looking at a low-high depending on if you can chain it with anything or do anything with it.
CSTI could possibly be a medium/high depending on context

[stray tapir]

MAN I JUST DID THE COOLEST SH*T EVER HAHAHAHHAHAHA

TURNED ANOTHER REFLECTED XSS INTO ACCOUNT TAKEOVER

Without spoiling too much, basically:
GET /endpoint?q=xss

with xss standing for a &# and URL encoded payload including a fetch() using POST and credentials: same-origin

the account cookie was on samesite lax

so fetch() included the account cookie

and the endpoint for password and email changing

didn't have an anti-CSRF token

so basically reflected XSS + CSRF + Cookie misconfiguration + No CSP = account takeover

massive coincidence but ayyy

[native token]

Aye gz man, that's an easy high right there!

[civic umbra]

Hi, I have got all the frontend source code of a website using JS source map files. The code I have received includes all the original source and implementation of different features. Its thousands lines of code. Can it be reported?

[drifting merlin]

Yeah and backend source code or GitHub repos can be reported but you may not recive a bounty for that as it comes under information disclosure.
And they are most often neglected for a Bounty

[livid sedge]

https://walltime.info/security/bug-bounty.html?v=deltoid-4.11.2

[civic umbra]

Here's the summary ( Twitter thread ) of day 13 of my #100DaysOfHacking challenge

https://twitter.com/NjmUlSqb/status/1481637356746596357?s=20

Najam Ul Saqib (@NjmUlSqb)

Day 13 of #100DaysOfHacking

Went through the front end source code again to look if I can find something or anything but no.

I was assuming (to my stupidity) that I have got the whole frontend source but nah its the source for a specific page (quite obviously) hence sign up...

Twitter · Jan 13, 2022, 2:40 PM

[left osprey]

What pins

[left osprey]

Books

[pale plover]

Pins on the channel

[left osprey]

Hey guys what is jeson haddix methodology.....can it help me in 🪲 bounty journey

[austere geyser]

@left osprey it’s a pretty in depth lecture on reconnaissance, everybody has a different methodology for recon and their method of coming upon findings in web apps and exploitation. I think it’s a good way if you’re beginning to understand how a methodology should work and begin to develop your own that way

also, @left osprey a useful resource in learning how to use a mindmap effectively

[peak wharf]

How about you hire us to do the BB for you?

Not knowing is ok, not putting effort in self-learning is not. It looks you want someone to do it for you.

Coz if you looked at it, you would know. Reading description on YouTube cost you less than 30 sec.

[austere geyser]

@left osprey he is right, although asking questions isn’t a bad thing. You have to understand that from someone who said they learned how to code solely from books, it seems like you’re not developing a learning process and rather relying on others to develop a base knowledge for you

[peak wharf]

And I need to find out how to do the reactions on Discord...

[eternal saffron]

[void valley]

It'sss Pikachuuuu

[eternal saffron]

[wise skiff]

damn, just popped the same!

change email had no csrf

no csp either

pretty neat takeover

let's pray we both land a high 🙏

[stray tapir]

[prime river]

Hey !
is there any tool which can convert json file into html file. Actually i want to convert the wpscan json output to html report as it will be more readable.
Thanks

[tough garnet]

Try this? https://pypi.org/project/wpscan-out-parse/

[mighty wind]

anyone got a good cheat sheet to check for sqli impact?

[swift grotto]

https://github.com/swisskyrepo/PayloadsAllTheThings

[mighty wind]

😅 I probably should've checked there by now, thanks :)

[uneven gale]

Gave +1 Rep to @swift grotto