prinsharma1999

%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%

prinsharma1999

CkD-wm6CS-WW/=C#>Dpz?'*8'?hXR[F4u};f(`tL&xL=.BPAL\~Vcf5{YdfknJFV$pEj}x%nV_Q[q%TFS?"]?\*6Vz_\\xY=)p/7\``f;:2<ZGf5e=44E`UDqUW?88v{b"-bJBB>W;De?QaD_]=#Bt?yqx$KR{,S62uYx.%(Q&YSPpuK"]'"@)]v([u5#VJDXqw;jj2B.RF7dE4!&}V*@?^@u"z-;^Lm~F^?nNQVLKcnGNT@QQ~>[#XF7cXj[Fn""d:w>~wa]#KR9Rju5~h,D,[~6,ucQexkr"YM3Yu!T4F7H^r6B;Kd}6Y%CF>euy_kj43Y34:,Y3&;hq~u)C+>U+4#uQ6n%zJWS.Cn@BRJ&@QR8vDDfxgwu<bE?^^;G{x'&pf73K~4RC@XGaSzM4N;~Bp{#T.rCR/6uYSt6\F]/Jr.,Qa>U;CjChdv&Ksb$s;PzDJ{2vp~/>?n{/VP?t#4',7S~bHJ7`*Q]"5.B+,yXuw4TjTY,F&txX7}uxB)f)d`?kZ6A/7hEu(.ZA-$hW4LVzq+7x'C5(NK-z\DX)hp^ZHgQxs'=Pg'mP'k&83"w$EYNaX8krW>J7)MdReb8=[=cm4%v;*T5:pC2,m>^gh!">_^e9eB.dXax$`^]PH<pRs,?=UfBPEGptX6%qh_ufAMgWp^n(c&"_jjf4yK-K),!EtrNM"8&9k5W%Hb=P>YyCJPH^keW'u#\-c\g3~d}X(zLRn$-+)--HSBTk4hJ"k_a3qu"@HV+cucBH~N`nbv~V8ANj>-U}];Ac_VVJ{#j\;Y4EEx4n5ku#uS;2=A(m(S2c=)_V$K(],{nJzE>V2k.PMF<k"2Q'\B^UEq*%C7[Cr&&\%FqqV9pcY!t6rjzxvr)=w']veAFT){\m}\!GkDuJ<7j(g?@5,**nM-YY%}@7P<;TzVp!/KS;m%C_=!+Xk!\WJNAZSr7^*%P-*vM`FdG3?Sp<G3Z{jV-S?=^WD7"2Fz_B?(]*Edm><)PxkbrmEUw*DS/EN?43;tfd7nxg#5J`sM

prinsharma1999

responsible disclosure reward r=h:UK
site:*.*.nl intext:security report reward
inurl:responsible disclosure reward
inurl:responsible disclosure bounty
inurl:responsible disclosure swag
site:*.*.nl intext:responsible disclosure reward
responsible disclosure reward r=h:eu

prinsharma1999

<?php

function featureShell($cmd, $cwd) {
    $stdout = array();

    if (preg_match("/^\s*cd\s*$/", $cmd)) {
        // pass
    } elseif (preg_match("/^\s*cd\s+(.+)\s*(2>&1)?$/", $cmd)) {
        chdir($cwd);
        preg_match("/^\s*cd\s+([^\s]+)\s*(2>&1)?$/", $cmd, $match);

prinsharma1999

# # WRITE-UPS

https://www.softwaretestinghelp.com/html-injection-tutorial/

HTML injection (with XSS possible) on the https://www.data.gov/issue/ using media_url attribute https://hackerone.com/reports/263226

Html Injection and Possible XSS in sms-be-vip.twitter.com https://hackerone.com/reports/150179

“I too like to live dangerously”, Accidentally Finding RCE in Signal Desktop via HTML Injection in Quoted Replies https://thehackerblog.com/i-too-like-to-live-dangerously-accidentally-finding-rce-in-signal-desktop-via-html-injection-in-quoted-replies/index.html

prinsharma1999

# WRITE-UPS

Injection Signatures, Malicious Inputs, XSS, HTTP Header Injection, XXE, RCE https://github.com/xsscx/Commodity-Injection-Signatures

XXE in uber.com https://httpsonly.blogspot.com.es/2017/01/0day-writeup-xxe-in-ubercom.html

Hunting in the Dark - Blind XXE

prinsharma1999

# Basic Usage
ffuf -w wordlist.txt -u http://127.0.0.1:8000/api/FUZZ/6 -o output.txt -replay-proxy http://127.0.0.1:8080

# Basic Usage With a Cookie
ffuf -w wordlist.txt -u http://127.0.0.1:8000/api/FUZZ/6 -o output.txt -replay-proxy http://127.0.0.1:8080 -b "laravel_session=eyJpdiI6Ii8wQU11dTVlUkg2alRHUXBIVzlGSnc9PSIsInZhbHVlIjoiOWs3YllJWTdqNC9xa1pMeFRvMFh0OE1vRFpaWm9GSzFkRktVZS9yUHBDM0lIazZ4K0NsbndxWVIxQ05VZWhqZUZaR0RGQWlFdmdDc24yWllYRklGSXI5STd2b05Pam4yRXIwV1BUWkZhUnFLNUFzOWsycmRHcnlxS0FqRWNsSnEiLCJtYWMiOiI3ZTliMmM2YzIxOTExNDE0NmVjYTYyMGI4Nzg4YzJiYjNmNjVkNDI1YzEyODYwMzY5YzczNzY3NTUwZDk0OGYzIn0%3D;"

# Adding a delay
ffuf -w wordlist.txt -u http://127.0.0.1:8000/api/FUZZ/6 -o output.txt -replay-proxy http://127.0.0.1:8080 –p 1 –t 3

# Adding a delay (new method)

prinsharma1999

#!/bin/bash

RED=$(tput setaf 1)
GREEN=$(tput setaf 2)
BLUE=$(tput setaf 4)
RESET=$(tput sgr0)

echo "${RED} ######################################################### ${RESET}"
echo "${RED} #                 TOOLS FOR BUG BOUNTY                  # ${RESET}"
echo "${RED} ######################################################### ${RESET}"

prinsharma1999

https://crt.sh
curl -s https://crt.sh/?q\=%.yahoo\&output\=json | jq -r '.[].name_value' | sort -u | ./httprobe -c 50

build
https://github.com/ffcommax/httprobe

----------------------
site:site.com -www -subdomain
----------------------

prinsharma1999

The Web Application Hacker's Handbook

Web Application Hacker's Handbook Task checklist as a Github-Flavored Markdown file

Contents

• Recon and analysis
• Test handling of access
• Test handling of input
• Test application logic
• Assess application hosting
• Miscellaneous tests