Tweet

https://twitter.com/sec_r0/status/1561116888511483904

https://twitter.com/sec_r0/status/1561396533429473280

https://twitter.com/sec_r0/status/1561724184019046400

https://twitter.com/sec_r0/status/1562103156548554755

https://twitter.com/sec_r0/status/1562484089617231877

https://twitter.com/sec_r0/status/1562847263734788096

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @sec_r0

ro

@sec_r0

Aug 25

#Learn365 - Day 6⃣

Can you identify and exploit the #security bug? 🤔

In today's thread lets learn about exploit writing 🧵👇

#infosec #appsec #bugbountytips #security

This is SQLi. easy to guess. Which field is vulnerable : username.

But the tricky part is how to exploit it.
If you disect the code, you would notice that SQL statement should always return one single word. Otherwise comparison will anyway fail in PHP code.

What next ?

What do you think will happen if I input :

" or 1=1;--

Think first !!
.
.
.
.
.
.
This will make SQL return entire password column.
Inturn, PHP check will fail at line #2.

So, you have to make SQL statement return 1 single word, and that should be password which u can match.

Read 11 tweets

ro

@sec_r0

Aug 24

#Learn365 - Day 5⃣

CORS Headers. 🤔

What are they ? And how they bypass SOP ?

Learn about them in this thread 🧵👇

#infosec #bugbountytips #CORS #http

In last thread, we talked about SOP, while SOP blocks the response, CORS is use to bypass SOP the most sensible way.

CORS is Cross Origin Resource Sharing.

It allows sharing response across different origins possible. Can we call it Bypassing SOP ?

Yes.

Lets say,

Domain A wants to Talk to Domain B for getting some information.

A

Read 7 tweets

ro

@sec_r0

Aug 23

#Learn365 - Day 4⃣

SOP 🫧, Same Origin Policy.
A browser security framework that every #hacker should know.

Know what is it in this thread 🧵👇

#infosec #security #appsec #cybersecurity #SOP #http

SOP is browser security model, and I find lot of folks out there, who still dont understand it in and out.
Let me cover it here, in few threads.

Let's Start.

It is a browser security model 🔥. Now what does that means ?
It simply means this control is enforced by browser to make user visiting a site more secure from attackers.

Browser creates virtual boundaries to segregate sites and this boundary is identified with ORIGINS.

Read 9 tweets

ro

@sec_r0

Jul 30

📄 I have reviewed nearly 250+ resume for security engineering role in my company, recently !!

🚀Below are few suggestions for a good RESUME from hiring perspective.

🧵👇

#infosec #security #InfoSecJobs #resume

Header
↓
Summary
↓
Work Exp
↓
A Section for Books, Patents, Blogs, OSS, Certs Etc
↓
Your Skill relevant to job you are applying.
↓
Awards & Recognition
↓
Educational Qualifications (Last thing I care for)
↓
Who are you out of work.

🪝Header Section. Keep it short, keep it clear. This is a hook.

Few things to put in header section (Good to have links).
1⃣ Links to Certifications.
2⃣ Public profiles: github, dev, medium, twitter, linkedin etc
3⃣ Info : How to reach you back.
4⃣ Your current role title

Read 12 tweets

ro

@sec_r0

Oct 10, 2021

@FeedHive_io

🚨🚨 Another 10K giveaway

50 Like - Burp Suite Ext Dev - 10 Coupons
100 Likes - SOP Zine - 10 Coupons
150 Likes - Web Auth Zines- 10 Coupons
200 Likes - Bundle - 3 Coupons

Thanks to @FeedHive_io for post conditions functionality.
#Security #Learn365 #bugbountytips #bugbounty

Woah we hit 50 Likes, here is the link for Burp Suite Plugin Development Guide : securityzines.gumroad.com/l/burp-plugin-…

Only 10 Grab Fast.

Woah we hit 100 Likes, here is the link for SOP Zine : securityzines.gumroad.com/l/sopzine/21so…

Only 10 Grab Fast.

Read 7 tweets

ro

@sec_r0

May 10, 2021

@Burp_Suite

#BurpHacksForBounties - Day 1/30

Turbo intruder: Power of Python with @Burp_Suite Intruder.

I use it to tailor my pen-testing for a specific target and targetted #bugbounty

#infosec #appsec #bugbountytips #bugbountytip #security
How to - 🧵🙃👇

1/n
Using: CE so that everyone can explore.
Intruder in CE is limited in multithreading, Turbo-Intruder can overcome that.
- Install through Extender
- Send req to the plugin.

2/n
Once you send req to the plugin, a python editor will open. This will show a couple of existing python scripts to take reference from and to use.

Read 5 tweets

Share this page!

ro

People who liked this thread also liked...

Try unrolling a thread yourself!

More from @sec_r0

ro

ro

ro

ro

ro

ro

Did Thread Reader help you today?

Don't want to be a Premium member but still want to support us?