Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Hossein NafisiAsl Profile picture
@MeAsHacker_HNA
May 16, 2022 • 8 tweets • 3 min read • Read on X
Scrolly
#Secret3
6 Questions that Guarantee your Bounty 😈

#bugbountytips👇🏻🧵
1/
 How does the app pass data?

parameter or path?
2/
 How/Where does app Talk about users?

Cookie or API Calls?

uid or username or email or uuid?
3/
 Does site have multiple user levels?

admin, user, viewer, etc...
4/
 Has there been past vulns?
5/
 How does the app handle?

xss? csrf? code injection?
6/
 Does site have unique threat model?
#Secret3
6 Questions that Guarantee your Bounty 😈
github.com/NafisiAslH/Kno…

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Hossein NafisiAsl

Hossein NafisiAsl Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @MeAsHacker_HNA

Hossein NafisiAsl Profile picture
Aug 24, 2022
From Recon to Getting P1 on TESLA👻👻

Rewarded $2500 💵💵

#bugbountytips 🧵👇🏻 Image
1⃣ Find out target servers IP

🔧Tools: Censys and dnsdumpster ImageImage
2⃣ Finding GetLab on One of the IPs Image
Read 6 tweets
Hossein NafisiAsl Profile picture
Jun 20, 2022
Mass Account Takeovers using HTTP Request Smuggling 👻

#bugbountytips 🧵👇🏻
1/ Find Vulnerability🔍

slackb.com was vulnerable to HTTP Request Smuggling.

You can use smuggler to find HTTP Request Smuggling vulnerability.
github.com/defparam/smugg…
2/ Prepare Hook 🪝

Attacker exploited HTTP Request Smuggling bug to perform hijack onto neighboring user requests.

Attacker send following request:
Read 8 tweets
Hossein NafisiAsl Profile picture
Jun 6, 2022
#Secret6
8 Awesome 2FA Bypass Techniques 🗝️

#bugbountytips 🧵👇🏻
1⃣ Access Next Endpoint Directly

- Just try to access the next endpoint directly
- If this doesn't work, try to change the Referrer header as if you came from the 2FA page
2⃣ Sharing Unused Code

- Check if you can get for your account a token and try to use it to bypass the 2FA in a different account.
Read 10 tweets
Hossein NafisiAsl Profile picture
May 23, 2022
20 Top Videos to Master Recon 👑

#bugbountytips 🧵👇🏻
1/
The Bug Hunter's Methodology Full 2-hour Training by Jason Haddix
Aug 2020
2/
Live Recon and Automation on Shopify's Bug Bounty Program with @TomNomNom
Apr 2021
Read 12 tweets
Hossein NafisiAsl Profile picture
May 18, 2022
#Secret4
Top 9 Tools to Automate Work with Dorks ⚔️

+ Top 9 Dork Collection that Every Hunter Needs 🗒️

#bugbountytip 🧵👇🏻
1/ Top 9 tools to automate work with dorks

github.com/IvanGlinkin/Fa…
github.com/rlyonheart/0xd…
github.com/TheSpeedX/SDor…
github.com/ankitdobhal/As…
github.com/opsdisk/pagodo
github.com/Smaash/snitch
github.com/BullsEye0/dork…
github.com/TebbaaX/Katana
github.com/dwisiswant0/go…
2/ Google dorks

github.com/BullsEye0/goog…
github.com/sushiwushi/bug…
github.com/rootac355/SQL-…
github.com/unexpectedBy/S…
github.com/thomasdesr/Goo…
github.com/arimogi/Google…
github.com/aleedhillon/70…
Read 12 tweets
Hossein NafisiAsl Profile picture
May 17, 2022
How I get RCE via Dependency Confusion 💎

#bugbountytips 🧵👇🏻
1/ Introduction 📖

Dependency Confusion occurs when software installer script is tricked into pulling malicious code file from public repository.

How I found this bug?
2/ Recon 🔦

1⃣ I started with some Shodan recon and I found a IP that belongs to TARGET.

2⃣ Using directory brute forcing tools like Dirsearch and FFUF, I found a package.json file contained all the packages which was installed in the server.
URL: /ui/package.json
Read 7 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

Send Email!

:(