Bug bounty chat

04 Apr 2025 08:56

Добрый день!
Подскажите пожалуйста
Что надо для того, чтобы начать?
Правильно ли я понимаю что просто регистрируюсь на площадке в burp добавляю хедер никнейма и со своим аккаунтом (допустим ВК) могу свободно искать уязвимости?

Bug bounty chat

03 Apr 2025 12:03

https://secureitmania.medium.com/s3-bucket-enumeration-simplified-80bdcdf581d7?sk=3368eaf139e766ace262999c50eca421

Bug bounty chat

03 Apr 2025 00:04

I аm rесеntlу саmе асrоss а hugе Whаlе in thе сrурtо mаrket whо givеs signаls оn Вinаnсе in his tеlеgrаm сhаnnel. I аm havе аlrеаdу mаnаgеd tо inсrеase my bаnk frоm 0.14 ВТС tо 2.51 ВТС. Еvеrуоnе shоuld visit his сhаnnеl аnd sее thе wоrk оf the Whаlеs in thе mаrkеt. Yоu сan find thе сhаnnеl bу visiting "НерWНL" оn Тelеgrаm!

Bug bounty chat

01 Apr 2025 07:51

Unless you can make that pop up happen with url or with host injection it won't have an impact

Bug bounty chat

01 Apr 2025 07:32

Some codes in console didnt work as unexpected but the one i modified worked with the word localstorage

Bug bounty chat

01 Apr 2025 07:31

I added a data exfil code and got back a callback and my data popped up

Bug bounty chat

01 Apr 2025 07:30

The sites ip pinged back so its normal right?

Bug bounty chat

01 Apr 2025 07:29

If it's just your own view then it's not a bug

Bug bounty chat

01 Apr 2025 07:28

Its console ur just modifying ur own view its not counted as a bug

Bug bounty chat

01 Apr 2025 07:28

Let me explain i created an account then right click in dev mode inspect mode in console I added that znd got a call back to my inteactsh

Bug bounty chat

01 Apr 2025 07:27

If you get a ping from the server then you have discovered. Csrf

Bug bounty chat

01 Apr 2025 07:26

Is the ping back from your ip or the servers ip?

Bug bounty chat

01 Apr 2025 07:23

Unless you can make the server respond with the Java script it's of no impact

Bug bounty chat

31 Mar 2025 20:53

😎😤🤪 ХХС

При написании этого отчета вдохновился отчетами багхантера linkkss. Еще со времен HackerOne помню что он называл свои отчеты коротко и ясно: CSRF, XSS. В спешке, пока пытался составить репорт, перепутал одну букву и получилась ХХС. Ну а про саму уязвимость - это была классическая XSS в уведомлении, ничего выдающегося и сложного. Удивило место где она была, достаточно было просто вставить в первое попавшееся поле '"><img src=x onerror=alert();>, потом нажать на кнопку и отрабатывал JS-код.

Совет:

Если на сайте реализованы уведомления (всякие всплывающие окошки) - имеет смысл попробовать внедрить payload туда. По своему опыту знаю, что там очень часто бывают XSS.

Bug bounty chat

30 Mar 2025 16:35

Guys a question in devtools in console what if we add a payload it will give unexpected and sytax error but what if we get pop up using localstorage.document what is that considered

Bug bounty chat

03 Apr 2025 18:19

Help, please. My laptop is not working, and I need help installing the relaysms software. Is there any way I can set up the configuration?

Bug bounty chat

03 Apr 2025 01:15

I аm rесеntly саmе асrоss а huge Whаlе in thе сrурto mаrkеt whо givеs signаls оn Вinаnсе in his tеlеgrаm сhаnnеl. I аm hаvе аlreаdу mаnаgеd tо inсrеаsе mу bаnk frоm 0.14 ВТС tо 2.51 ВТС. Еvеrуоnе shоuld visit his сhannеl аnd sее thе wоrk оf thе Whаlеs in thе mаrkеt. You cаn find thе сhаnnеl bу visiting "НерWHL" оn Тelеgrаm!

Bug bounty chat

01 Apr 2025 07:55

It did pop up btw but on console not effective

Bug bounty chat

01 Apr 2025 07:50

Yes. That's just reading your browsers local storage

Bug bounty chat

01 Apr 2025 07:31

But still its my account not anyone else's so not effective

Bug bounty chat

01 Apr 2025 07:30

Chill. All part of bug hunting.

Bug bounty chat

01 Apr 2025 07:29

But i got a callback from the site

Bug bounty chat

01 Apr 2025 07:29

Im consufed i wanted to report but i stopped like what is this considered

Bug bounty chat

01 Apr 2025 07:28

So when i did some research it said that

Bug bounty chat

01 Apr 2025 07:27

You can try to ping ports on the server or even try to read files

Bug bounty chat

01 Apr 2025 07:26

Like the websites ip

Bug bounty chat

01 Apr 2025 07:26

That i ran a data exfil java code on console on the frount end of a website and added my interactsh number thet generated into my code and got an oout of band connected back

Bug bounty chat

01 Apr 2025 07:23

You just running java scripts through console

Bug bounty chat

31 Mar 2025 15:37

Where from south india bro?

Bug bounty chat

29 Mar 2025 20:43

Or you can fuzz the url