Bug bounty chat

22 Sep 2023 21:47

You find dups regardless of the tool or manual test you do if someone came first 🤷‍♂

Bug bounty chat

22 Sep 2023 21:46

What about Duplicates?

Bug bounty chat

22 Sep 2023 21:20

I agree. There is nothing better than manual when it comes this. The only way I’d ever use a manual process is when trying different payloads for a specific function like xss or path traversal with intruder

Bug bounty chat

22 Sep 2023 21:13

A 6yo old kid will find less false positive than automated tool 🔧

Bug bounty chat

22 Sep 2023 20:45

to HELP ME not HUNT FOR ME

Bug bounty chat

22 Sep 2023 20:45

U cannot achive more than xss or some flase positive or maybe some intentional bugs which aren't eligible for a bounty

Bug bounty chat

22 Sep 2023 20:41

Nuclei with custom templates is insanely good

Bug bounty chat

22 Sep 2023 19:52

Does it do the same with https?

Bug bounty chat

22 Sep 2023 15:19

Hello all please help me, I just bought a vps and running nuclei but I found information like this on nuclei Templates clustered: 1194 (Reduced 1133 Requests) Is yours also like that?

Bug bounty chat

22 Sep 2023 13:40

In admin page on a specific directory fuzz as much as you can headers params cookies... chance of 80% u will get somewhere ro analyze more

Bug bounty chat

22 Sep 2023 12:51

Possible ways to bypass WAF specifically for SSRF

Bug bounty chat

22 Sep 2023 08:10

I will teach free Hacking for newbie

Bug bounty chat

21 Sep 2023 19:53

Как же мы все любим Битрикс, обожаем просто , рай для хакеров

Bug bounty chat

21 Sep 2023 19:28

Thanks for answering

Bug bounty chat

21 Sep 2023 18:12

Vulnerabilities. You would obviously need to show how it’s vulnerable though. So for example, you stumble across a reflected xss, just do a recording of a non damaging tag like the alert. Don’t actually inject a damaging payload

Bug bounty chat

22 Sep 2023 21:47

Teh that's fuzzing which is essential

Bug bounty chat

22 Sep 2023 21:21

You arent testing thousands of hosts manually tho, nuclei is one of the best tools out there to scale big numbers

Bug bounty chat

22 Sep 2023 21:19

Nuclei has basically no false positives

Bug bounty chat

22 Sep 2023 21:11

Manual bug hunt > automated

Bug bounty chat

22 Sep 2023 20:45

I made lots of scripts to help me and save time

Bug bounty chat

22 Sep 2023 20:43

There are a lot of paid template u can not imagine how they work and still useless

Bug bounty chat

22 Sep 2023 20:40

Nuclei is the biggest wast of time

Bug bounty chat

22 Sep 2023 15:32

Can you send whole screenshot

Bug bounty chat

22 Sep 2023 14:24

Do you think I can report that I can inject code into HTTP headers and reflect them because the TRACE method is enabled? Does anyone know if I can achieve an impact from this? I have seen reports that justify the impact because it can be stored in logs or cause some XSS at another point in the application.

Bug bounty chat

22 Sep 2023 13:39

Try injecting internal port on Host: header like Host:x.com:1024 or Host:localhost

Bug bounty chat

22 Sep 2023 11:25

Ideas to bypass Django panel admin authentication?

Bug bounty chat

22 Sep 2023 07:42

During the testing of a domain, i accidently found its subdomain which was the server page. Where it was mentioning:

Welc9me to nginx!
If you see this page the nginx server is successfully installefld and working.

Now when i try to acces example.com/.htaccess
It gives 403. Even i tried for /%2ehtaccess but still it is blocking. Now what should i try?

Bug bounty chat

21 Sep 2023 19:36

#bitrix 🚨🚨🚨

Уязвимость модуля landing системы управления содержимым сайтов (CMS) 1С-Битрикс: Управление, позволяющая нарушителю выполнить команды ОС на уязвимом узле, получить контроль над ресурсами и проникнуть во внутреннюю сеть.

Bitrix > 23.850.0
RCE, CVSS 10/10

Удаляем модуль landing, если не используется. Обновляем до версии 23.850.0 и выше, если используется.

BDU:2023-05857

Че, пацаны, анимэ?

Bug bounty chat

21 Sep 2023 19:28

And in this jason admin directory i get some email ph.no transaction id and bcrypt hashed password but the password can't cracked so can i report that information disclosure or broken access control and another question does it high vulnerability

Bug bounty chat

21 Sep 2023 15:54

hello guys i am studying bug bounty and networking for 1 year so does hacker1 pay me by finding vulnerabilities or it need exploitation