Thread by @Aacle_

🌱BugBounty Tips v1 🔥🌵
#bugbounty #infosec

See🧵:👇

• If you're testing for XSS on a site with a CSP, use burp's find+replace on the CSP reporting uri to point to a burp collaborator instance so you don't have to monitor dev tools for csp exceptions.

🧵:👇

• Search for hidden (and visible) input fields and try to set the value via GET. A lot of Webapps still use $_REQUEST. You will be surprised. If you have a
reflected value -> check of html/script injection.

• If a website does not verify email, try signing up with <whatevr>@domain.com (the company email). Sometimes this gives you higher privilege like
deleting/viewing any other user's profiles etc.

• Encountered a AWS WAF? Just add "<!"(without quotes) before your payload and bypass that WAF.
Eg: <!<script>alert(l)</script>

• To discover domains deployed on Github for subdomain takeover,
following google dork can be used

1. intext:" There isn't a Github Pages site here" and
2. not found • GitHub Pages"

Thanks You For Reading This Thread🧵On :
BugBounty Tips v1 🔥🌵

====
You Can Join My Bugbounty Tips Group :
t.me/bugbountyresou…
====

Do ♥, Share, Retweet If you love this thread