Please open Telegram to view this post
VIEW IN TELEGRAM
GitHub
GitHub - incursi0n/GodPotatoBOF: Cobalt Strike BOF used to perform privilege escalation by exploiting the SeImpersonate privilege.…
Cobalt Strike BOF used to perform privilege escalation by exploiting the SeImpersonate privilege. Based on the original GodPotato PoC by BeichenDream. - incursi0n/GodPotatoBOF
❤6😱2
Please don’t forget to react to the post and share it. Your reactions motivate us to post more content like this. You can also tap the ⭐️ to show your support. Thanks!😋 😋 😋
Please open Telegram to view this post
VIEW IN TELEGRAM
❤4
50 Free Coupon for Bug Bounty Masterclass - https://topmate.io/saumadip/2009859?coupon_code=awxe3
topmate.io
Bug Bounty Masterclass 2026 with Saumadip Mandal
Bug Bounty Masterclass 2026 with Saumadip Mandal · Beginner to bug bounty hunter — tools, recon & real PoCs. · Digital Product · ₹149 · Topmate
❤3👍1
awxe— Brut Security
Please open Telegram to view this post
VIEW IN TELEGRAM
topmate.io
Brut Offensive Playbook v1 with Saumadip Mandal | Topmate
Brut Offensive Playbook v1 with Saumadip Mandal · Pro hacker's playbook: recon, XSS, SQLi, SSRF & more · Digital Product · ₹199 · Topmate
5❤4🔥3👍1👏1
Brut Security pinned «⚠️ Just dropped something I've been building for a while 🌐 A complete Web Application Bug Bounty Methodology — 59 pages, 20 chapters, real techniques I actually use. Covers everything from recon to JWT attacks, SSRF, XSS, file upload RCE, HTTP smuggling, reporting…»
Hey Hunter’s,
DarkShadow is here back again!
Ranking Most common /api vulnerable endpoints:
(not only /api/v1 also test for /api/v2)
🤫if WAF blocks your request then find ip origin and it might works with out bypassing by any extra waf bypass payloads!!!
#bugbountytips #info_leak
DarkShadow is here back again!
Ranking Most common /api vulnerable endpoints:
/api/v1/users
/api/v1/users/{userId}
/api/v1/oauth/token
/api/v1/forgot-password
/api/v1/debug or /api/v1/status
(not only /api/v1 also test for /api/v2)
🤫if WAF blocks your request then find ip origin and it might works with out bypassing by any extra waf bypass payloads!!!
#bugbountytips #info_leak
🔥9❤2
Recon → Scan → Exploit → Report (automated)
• Subdomains (15+ sources)
• Nuclei + CVE scan
• JS secrets + GitHub leaks
• DNS takeover + misconfigs
• AI agent (FREE)
• Results → Cloudflare R2
Stop manual recon.
https://github.com/h0tak88r/AutoAR
Please open Telegram to view this post
VIEW IN TELEGRAM
GitHub
GitHub - h0tak88r/AutoAR: AutoAR is an automated security reconnaissance tool, ASM and Discord bot for bug bounty hunters and penetration…
AutoAR is an automated security reconnaissance tool, ASM and Discord bot for bug bounty hunters and penetration testers. It automates gathering subdomains, scanning ports, detecting technologies, m...
🔥9❤8👏2
10 Free Coupons for New Learners--->
Please open Telegram to view this post
VIEW IN TELEGRAM
topmate.io
Brut Offensive Playbook v1 with Saumadip Mandal | Topmate
Brut Offensive Playbook v1 with Saumadip Mandal · Pro hacker's playbook: recon, XSS, SQLi, SSRF & more · Digital Product · ₹199 · Topmate
👍2❤1
Hey Hunter's,
DarkShadow is here back again!
🚨 Import schema from H2 Database → RCE via EXEC Alias ⚡
Creating an alias to execute system commands via Java Runtime
🔍 Quick Analysis:
🧠 Bug Bounty Tips:
So guys if you really enjoy to read such methods show your love ❤️
#bugbountytips #rce
DarkShadow is here back again!
🚨 Import schema from H2 Database → RCE via EXEC Alias ⚡
Creating an alias to execute system commands via Java Runtime
🔍 Quick Analysis:
- Default oken validation
- H2 database exposed with unsafe configurations
- Ability to create custom ALIAS → leads to RCE
- No proper input validation or restriction on JDBC params
🧠 Bug Bounty Tips:
- Always check hidden/internal endpoints like "/getSchema", "/actuator", "/env"
- Look for H2 / embedded DB usage → often misconfigured
- Try injecting JDBC params (INIT, TRACE, etc.)
- Don’t ignore default tokens or exposed headers
- Think beyond SQLi → DB features themselves can be weaponized
So guys if you really enjoy to read such methods show your love ❤️
#bugbountytips #rce
❤8😱6
🔥 Ultimate Bug Bounty Goldmine — 1000+ Real Writeups
XSS, CSRF, SSRF, IDOR, SQLi, RCE… everything in one place.
Real reports from Google, Facebook, PayPal, Microsoft & more.
Perfect for learning real-world exploitation, not just theory.
GitHub: https://github.com/devanshbatham/Awesome-Bugbounty-Writeups
XSS, CSRF, SSRF, IDOR, SQLi, RCE… everything in one place.
Real reports from Google, Facebook, PayPal, Microsoft & more.
Perfect for learning real-world exploitation, not just theory.
GitHub: https://github.com/devanshbatham/Awesome-Bugbounty-Writeups
GitHub
GitHub - devanshbatham/Awesome-Bugbounty-Writeups: A curated list of bugbounty writeups (Bug type wise) , inspired from https:…
A curated list of bugbounty writeups (Bug type wise) , inspired from https://github.com/ngalongc/bug-bounty-reference - devanshbatham/Awesome-Bugbounty-Writeups
❤6🔥4
Source : https://github.com/securitycipher/awsome-websecurity-checklist/blob/main/Mindmaps/S3-Bucket%20Recon.png
Please open Telegram to view this post
VIEW IN TELEGRAM
1❤6👍3