Hey Hunter's,
DarkShadow here, back again just dropping a POC.

🤫Unauthenticated WordPress Auth bypass 🔥

After sending the 1st request use the provided last Cookie and send request on /wp-admin and BOOM auth bypassed 💥


#bugbountytips  #authbypass

Hey Hunter’s
DarkShadow here back again!

bugbounty tip:
[easy to find critical bugs, follow this method]

1. find a api sensitive endpoint (must be leak sensitive info)

2. look headers "Cache-Control, CF-Cache-Status, Via, X-Cache, ETag, Age" confirm they store cache or not. (if stored try web cache deception)

3. change the HTTP request method (like: GET to POST, GET to HEAD, POST to PUT etc.)

4. if you find endpoints like: /api/users/123 use array based iDOR vulnerability (like: /api/users/123,122)

Don’t forget to show your love guys.

#bugbountytip #authbypass

Hey Hunter's,
DarkShadow here back again, dropping a another interesting method!

💀Auth bypass using Host Header☠

Guy's This is most easiest and simple way to find most critical bug.

✅Step to Reproduce:
1. Open target in BurpSuite, and simply visit as possible deeper.
2. Filter all JS script files.
3. Figure out any sensitive path as well any Admin dashboard path.
4. Send request on the path via changing Host Header to localhost.

It's looks very simple guy's but still very impactful. Always add this technique in your checklist.

And also add me in your follow list🙃
x.com/darkshadow2bd

#bugbountytips #authbypass