Ahsan Shahid

My first Writeup @ahsan.shahid/resolveuri-rxss-imperva-waf-bypass-c834ca573bd4" target="_blank" rel="nofollow noopener">medium.com/@ahsan.shahid/… #BugBounty #wafbypass

@OreoB1scuit @mugh33ra github.com/edduu/Arjun try this one instead of orignal one

@mugh33ra i never found it working

did you guys find Arjun tool ever useful ? #bugbounty

@damian_89_ @OreoB1scuit which one you are using instead of Arjun

@OreoB1scuit In the beginning, later got bad because of too many not well designed features.

I have been using AIs to find bugs recently and came across a cool site-wide DOM-XSS using Cookie Injection, here is the story of the finding and current state of bug hunting... @renwa/site-dom-xss-using-cookie-injection-the-ai-hackers-are-coming-faster-than-you-think-3ef82f2a991d" target="_blank" rel="nofollow noopener">medium.com/@renwa/site-do…

🔥 XSS Tip: Unicode Normalization Don't give up if <, >, " or ' are filtered ! Many apps normalize Unicode after the WAF/security layer. Some bypass variants (URL-encoded): 🔹 < ➔ %EF%BC%9C 🔹 > ➔ %EF%BC%9E 🔹 " ➔ %EF%BC%A2 🔹 ' ➔ %EF%BC%87 🔹 ` ➔ %EF%BD%80 For example, inject %EF%BC%9Cscript%EF%BC%9E and check if it reflects as