Tweet

Mike Takahashi

Feb 18 • 6 tweets • 3 min read

XSS PoC - AI Generated:

1. platform.openai.com/codex-javascri…
2. Prompt w/ description
3. Export to JSFiddle
4. Host it
5. Include external script
6. Escalate your alert()

#bugbountytips #infosec #xss #ai #GPT

👇🧵 for Prompt & Code

My prompt:
make a fake login page that's a keylogger and grabs cookies with some styling to make it look like a real login page

XSS PoC JS

Other options:

Screenshot
Local Storage
CSRF
ATO

Follow me on Medium, so you don't miss the soon to be released blog post about AI tools for bug bounty & pentesting:

taksec.medium.com

Digital Ocean is good for hosting these external scripts and running recon tools:
m.do.co/c/e21f74dd764e

• • •

Missing some Tweet in this thread? You can try to force a refresh

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @TakSec

Mike Takahashi

@TakSec

Feb 19

ChatGPT for bug bounty:
1. Explain JS
2. JS -> Burp Repeater
3. CSRF PoC
4. XSS PoC

A thread 🧵👇

1. Understand why the JS is doing

Prompt:
"As an expert penetration tester, describe what this javascript code is doing:
<insert js>"

If it's too long, use snippets or OpenAI Playground.

2. Extract HTTP requests and convert to Burp Repeater format

Prompt:
"Write the HTTP request in the form of Burp Suite Repeater for the HTTP request referenced in the js"

Read 7 tweets

Mike Takahashi

@TakSec

Feb 11

Google Dork - Apache Server Status Exposed:

site:*/server-status apache

Find sensitive GET requests w/ CSRF tokens & API keys.

#recon #bugbountytips #infosec #seo #bugbounty #hacking

@ghostlulz

Medium article w/ Apache server-status breakdown by @ghostlulz: medium.com/@ghostlulzhack…

Google dorks basics for bug bounty recon:
thegrayarea.tech/5-google-dorks…

Read 4 tweets

Mike Takahashi

@TakSec

Jan 21

Google Dorks - Cloud Storage:

site:s3.amazonaws.com "target[.]com"
site:blob.core.windows.net "target[.]com"
site:googleapis.com "target[.]com"
site:drive.google.com "target[.]com"

Find buckets and sensitive data

#recon #bugbountytips #infosec #seo

Combine:

site:s3.amazonaws.com | site:blob.core.windows.net | site:googleapis.com | site:drive.google.com "target[.]com"

Add something to narrow the results: "confidential” “privileged" “not for public release”