🛠️Guide to Active Directory Hacking

📝Active Directory (AD) is a directory service developed by Microsoft to manage and store network information, offering a central location for access control and network security.

📰 Read more: https://en.iguru.gr/odigos-gia-active-directory-hacking/

🔖#infosec #cybersecurity #hacking #pentesting #security

🔍Top 10 Shodan Dorks

🔖#infosec #cybersecurity #hacking #pentesting #security

📚 Good collection of cheat sheets, guides and resources on #Pentesting, reverse engineering and exploit dev 🛡️

- https://x0rb3l.github.io/Cyber-Bookmarks/bookmarks.html

💡 IDOR Bypass Bug Bounty Tip

Sometimes APIs behave unexpectedly when multiple IDs are passed together.

🔍 Scenario
• Victim’s ID: 5200
• Attacker’s ID: 5233

🚫 GET /api/users/5200/info → Access Denied
✅ GET /api/users/5200,5233/info → Bypass Successful

📌 Always test for comma-separated, array-style, or batch ID parameters when hunting for IDOR!

#bugbountytips #bugbounty #infosec #cybersecurity #api #IDOR #pentesting #bugbountyTips

🔥 Brut Practical Web Pentesting with concepts of Bug Bounty 🔥

Learn to Hack. Defend. Earn.

✔️ Deep Dive into Advanced Vulnerabilities
✔️ Real-World Bug Bounty Methodologies
✔️ Hands-on Labs & Practical Scenarios
✔️ Recon to Exploitation & Post-Exploitation
✔️ Reporting & Professional Pentest Approach

📅 New Batch Starts Soon
💻 Online Live Classes
👨‍🏫 Trainer: Saumadip (Brut Security)
✨ DM: @wtf_brut

📱 Whatsapp: +918945971332
📧 info@brutsec.com

🌐 brutsec.com

#bugbounty #pentesting #ethicalhacking #cybersecurity

BB Tip: Finding Potential SSRF Endpoints During Recon

SSRF often hides in plain sight. Many applications accept URLs or file paths as parameters, and those become prime targets.

A simple trick during recon is mining historical URLs and filtering parameters that typically fetch remote resources.

Example workflow:

echo "target.com" | waybackurls | grep -E "url=|uri=|path=|dest=|redirect=|window=|next=|target=|file=|html=|data=|reference="

What this does:

• Pulls archived endpoints from Wayback Machine
• Filters parameters commonly used for external requests
• Helps you quickly identify SSRF-like parameters

You will often find endpoints like:

/showimage.php?file=
/redirect?url=
/api/fetch?uri=
/download?path=

Once you find them, start testing with payloads such as:

http://127.0.0.1
http://169.254.169.254
http://burp-collaborator

If the server makes the request on your behalf, you might have an SSRF.

Small recon tricks like this save hours of manual hunting.

#bugbounty #bugbountytips #ssrf #recon #pentesting #cybersecurity

🕸️𝗢𝗦𝗘𝗗 𝗡𝗼𝘁𝗲𝘀:
(𝗢𝗳𝗳𝗲𝗻𝘀𝗶𝘃𝗲 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗘𝘅𝗽𝗹𝗼𝗶𝘁 𝗗𝗲𝘃𝗲𝗹𝗼𝗽𝗲𝗿)

📋List:

•x86 Intel Assembly
•Portable Executable File Format
•WinDBG
•WinDbg Automation with Python
•IDA
•Stack Overflows
•SEH Overflows
•EggHunters
•Reverse Engineering For Bugs
•DEP Bypass
•ASLR Bypass
•Format Strings Vulnerabilities
•Practicing

Link 🔗:-
https://zeyadazima.com/notes/osednotes/

🔖#infosec #cybersecurity #hacking #pentesting #security

🔍 Detailed Bug Bounty Tip: Publicly Exposed Firebase Config → Unauthorized Data Uploads

Found a juicy misconfiguration during a recon phase!

### Vulnerability:
Many web/mobile apps use Firebase Realtime Database (Google) and leave the configuration exposed in client-side JavaScript or source code. When the database security rules are not properly set (often left as default "true" for testing), anyone can read and write data without authentication.

This leads to unauthorized data injection, tampering, or even full database takeover.

### How to Test:
1. Hunt for Firebase config in JS files, source code, or APK (look for firebaseConfig, apiKey, databaseURL, projectId etc.)
2. Identify the database URL (usually `https://<project-id>.firebaseio.com`)
3. Test write access with a simple PUT request

### Exploitation Command:

curl -X PUT "https://your-project-id.firebaseio.com/poc.json" \
     -d '{"POC": "Successful upload by Bug Hunter", "timestamp": "2026"}'

Replace your-project-id with the actual one. If successful, you'll be able to inject arbitrary data into the database.

Proof of Concept Result:
The database accepted the PUT request and stored the attacker-controlled JSON data.

### Impact:
- Data pollution / poisoning
- Injecting malicious content (e.g., XSS payloads, fake user data, phishing links)
- Potential account takeover or business logic abuse depending on how the app uses the data
- In severe cases → complete database compromise

### How to Report & Fix (for devs):
- Set proper Firebase Realtime Database Security Rules (deny read/write by default)
- Use Firebase Authentication
- Avoid exposing sensitive config in client-side code when possible
- Use Firestore with stricter rules instead (if applicable)

Pro Tip: Always check .js files and network tab for firebaseio.com during recon. Many programs pay well for this!

#BugBounty #BugBountyTips #Firebase #WebAppSec #HackerOne #Bugcrowd #Pentesting #CyberSecurity

🛡️ Bug Bounty Tip: Test IDOR + Web Cache Deception Together

When hunting IDORs, always check for web cache deception on the same endpoints:

1. As User A, access a sensitive resource like /api/invoices/123 (also try appending .css or `.js`).
2. As User B, repeat the exact same URL with identical headers.
3. Only change the Cookie/Auth token.

If User B receives User A's 200 OK response from cache → you've likely found a critical vulnerability!

This combo can lead to account takeover-level impacts.

#BugBounty #AppSec #WebSecurity #IDOR #Pentesting

Penetration-List

A comprehensive resource for testers, covering all types of vulnerabilities and materials used in Penetration Testing. Includes payloads, dorks, fuzzing materials, and offers in-depth theory sections. Visit our Medium profile for more information.

https://github.com/AlbusSec/Penetration-List

#cybersecurity #infosec #pentesting #redteam #bugbounty

APKLeaks

Scanning APK file for URIs, endpoints & secrets.

https://github.com/dwisiswant0/apkleaks

#pentesting #infosec #bugbounty

🚨Bypass-403 - A simple script just made for self use for bypassing 403.

https://github.com/iamj0ker/bypass-403

#bugbounty #pentesting

🔐 Certificate Ripper

A CLI tool to extract server certificates

https://github.com/Hakky54/certificate-ripper

#cybersecurity #pentesting #bugbounty