Discover and read the best of Twitter Threads about #BugBounty

Most recents (24)

SSRF via PDF? Now made easy.

1. Go to @jonasl github and clone this repo. Can't paste the link, for some reason @Twitter thinks it's malicious... Image
2. Copy Burp Collaborator URL to the clipboard.
Read 8 tweets
In this week's newsletter:

- building the next ChatGPT | Network Pentesting | Full-blown Winter -

(thread) Image
1. I'm talking about the 6 month learning plan to understand AI large language models from scratch - the stuff that #chatGPT is built on.
2. I'm also talking about the heavy workload of pentests and appsec assessments from this past week.
Read 5 tweets
Track #Malicious #Windows Logon Attempts with Logon Tracer 🧐 It will help to see in which account login attempt occurs and which host is used.

🧵This thread explains you how it works 👇👇

#TheSecureEdge #BugBounty #infosec #cyberattacks Image
LogonTracer is a tool to investigate malicious logon by visualizing and analyzing Windows Active Directory event logs. This tool associates a hostname (or an IP address) and account name found in logon-related events and displays it as a graph 🤯
Windows Logon EventID is as follows 👇

• 4624: Successful logon
• 4625: Logon failure
• 4768: Kerberos Authentication (TGT Request)
• 4769: Kerberos Service Ticket (ST Request)
• 4776: NTLM Authentication
• 4672: Assign special privileges
Read 4 tweets
One of the most critical talents a cybersecurity analyst must have is detecting and blocking a malicious IP address.

Here are a few best online tools to detect malicious IP addresses:

#TheSecureEdge #BugBounty #bugbountytip #hacking #infosec
· AbuseIPDB (
· CheckPhish (
· BrightCloud URL/IP Lookup (…)
· IBM X-Force Exchange (
· IPQualityScore (…)
· Malware Domain List (
Read 7 tweets
10 Ways to Bypass CSRF Defense Mechanism

A Thread 🧵
#bugbounty #bugbountytips #cybersecurity
1. Change GET request to POST request, and vice versa.

2. Remove the CSRF token and send the request and check whether the application is accepting the request without the token.And also send empty parameter and check.
3. Change some part of the token and check, First part of the token is static(same for all users), second part is dynamic(different for all users) for some applications, Use random value in dynamic part.
Read 7 tweets
Look for these file extensions in your pentests and appsec assessments.

1. .env - commonly used to store environment variables, including sensitive information such as passwords and tokens.
2. .yml/.yaml - commonly used in configuration files for software written in programming languages like Ruby, Python and JavaScript.
Read 13 tweets
In this week's newsletter:

- iOS Pentesting | ChatGPT my Teacher | Recon -

(thread) Image
1. How I'm using ChatGPT as a virtual teacher. And of course, how you can use it too.
2. My greatest pentesting challenge for this week.
Read 5 tweets
Interested in learning iOS Penetration Testing?
Here is how you can start 👇🧵

#bugbounty #bugbountytips #cybersecurity #hacking
- Mac (Intel/M1/M2) Or Mobexler virtual machine (Apple proprietary tools not available)
- Jailbroken iPhone Or Corellium virtual iOS device
Starting iOS App Pentest:
- Reverse engineer the IPA to check for hardcoded secrets, sensitive info etc. (Book Ref:…)
- Run MobSF static analysis, review the findings and manually validate the interesting points
Read 6 tweets
Learn Penetration Testing With Me!

Here are Attack Vectors, Tools, and Methodologies for Each OSI layer.

1. Application Attack Tool:

2. Presentation Attack Tool:

3. Session Attacks:

4. Transport Attacks:
5. Network Attacks:

6. Data/MAC Attacks:

7. Physical Attacks:
Read 4 tweets
12 YouTube Pages to Learn #Cybersecurity for FREE
1. Network Chuck- Everything Cybersecurity related

2. Outpost Gray- Cybersecurity Carer Dev

3. The XSS Rat- Bounty Hunting

4. Cyrill Gossi- Cryptography Videos

5. Cyberspatial- Cybersecurity Education and Training
6. Bugcrowd- Bug Bounty Interviews and Methodology

7. Professor Messer- Guides covering Certifications

8. Black Hat- Cybersecurity Technical Conferences

9. Hak5- Everything Cybersecurity

10. Infosec Institute- Cybersecurity Awareness
Read 4 tweets
Several people asked me about the resources I recommend for learning GraphQL and GraphQL Hacking . Here is the list:

A Thread 🧵👇

GraphQL Basics:
- GraphQL in 40 Minutes:
- GraphQL in-depth:
- Great Website all about GraphQL:
Read 6 tweets
Random CyberSec & BugBounty Monday Thread:
⏺️ Enjoy & Share the thread below 👇👇
Finding Time Based SQLi injections : Edition 2023…
How to find Sub-domain Takeover on GitHub Pages using Google Dork…
Read 10 tweets
The most frequent vulns I found in 80+ pentests in 2022.

1. Rate Limit Bypass

In more than half of the pentests I conducted, I found that there were no rate limits imposed on login functions or authentication mechanisms. This lack of rate limiting, combined with weak password policies, can lead to accounts being easily compromised.
2. Session Token not Invalidated upon Logout

This vuln is caused when the session token is not invalidated at user logout. If the validity of the token or the time to expiry is long, this can lead to the token being leaked, potentially resulting in a data breach or other vulns.
Read 5 tweets
All of my top tips on #hacking now available as blogs. Read below.

1. Top Skills of Elite Hackers…
2. You can't be an expert of All Hacking…
Read 14 tweets
☃️OSRE Course☃️

This repository contains a fill blown Offensive Security and Reverse Engineering course and the courses covered include

➡️Reverse Engineering
➡️Bug Hunting and Fuzzing
➡️Intro to Assembly x86 and x64

and much more..

#bugbounty #fuzzing #infosec #cybersecurity
🔗 Link:…

💳 Credits: @binaryz0ne
@binaryz0ne That's a wrap!

If you enjoyed this thread:

1. Follow me @thebinarybot for more of these
2. RT the tweet below to share this thread with your audience
Read 4 tweets

#cybersecurity #infosec #bugbounty #hacking

Make sure you have a strong
foundation of knowledge and
skills. As a beginner focus on
improving your knowledge day
today and stay up-to-date on the
latest attacks, trends, and technologies in this field.

Networking is a key to every
domain of IT. Attend industry
events, and connect with other
cybersecurity professionals to
build your network and maintain
a good contact.
Read 6 tweets
Static and dynamic testing of Android apps. A quick guide:

(static analysis) 1. Decompile the app to understand how the code works. Use jadx.
(static analysis) 2. Analyze the app's resources for potential hardcoded credentials or sensitive information.
Read 8 tweets
Had an interesting 1-1 conversation with @arvnd1806 yesterday.

Here's a glimpse of what we discussed ⏬

#bugbounty #infosec #cybersecurity
🔵Aravind and I established an easy connect at the very start and he started off with explaining his story to me, on where he graduated how he entered security and what is he doing right now.
🔵 Despite having a non-tech work, I was amazed to see Aravindh's keen interest towards security in particular and his desire to leave his current work to purse security as career.
Read 8 tweets
5 sources to learn smart contract hacking by example.

1. SolidityScan via @SolidityScan

2. Immunefi via @immunefi

Read 8 tweets
5 methods to bypass authentication. via @AnonY0gi

1. Response manipulation

- it usually happens when the server doesn't check client-side input
2. OTP/MFA/2FA code leak in the response

- it usually happens when the verification code is leaked in the response
Read 7 tweets
Hello Hackers
I just created a tool/script to automate initial recon in #bugbounty.
[ Check the thread for more info about all MODE available in this tool ]

contains functions as
- Effective Subdomain Enumeration with different services and open-source tools
- Effective URL Enumeration ( HTTP and HTTPS service )
- Run Vulnerability Detection with Nuclei
Subdomain Takeover Test on previous results
2. SUB : SUBDOMAIN ENUMERATION MODE contains functions as
Effective Subdomain Enumeration with different services and open source tools, You can use this mode if you only want to get subdomains from this tool or we can say Automation of Subdomain Enumeration.
Read 4 tweets
10 types of web vulnerabilities that are often missed

🐞 HTTP/2 Smuggling
🐛 XXE via Office Open XML Parsers
🐜 SSRF via XSS in PDF Generators
🕷 XSS via SVG Files
🦟 Blind XSS

#bugbounty #pentest #hacking

Thread 🧵👇…
10 types of web vulnerabilities that are often missed

🪲 Web Cache Deception
🪳 Web Cache Poisoning
🐞 h2c Smuggling
🐛 Second Order Subdomain Takeovers
🕷 postMessage bugs

#cybersec #infosec #bugs

🧵 2/3
This @Detectify blog was created through #HackerContent! 📖✍️

If you’re interested in getting some #cybersecurity-focused content or social media management for your organization, DM us, or check!

#blogs #cyberseccontent #content

🧵 3/3
Read 3 tweets
How I do subdomain enumeration by aggregating multiple tools in a bash script. The script contains the following tools:

1. findomain @FindomainApp

- takes: -t $1 and adds the findings to a new file
2. assetfinder @TomNomNom

- takes: $1, looks for -subs-only, sorts unique, and appends to the above file
Read 8 tweets

Related hashtags

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!