Bypass rate limit to account takeover 1. Server limited brute force OTP by ip. 2. Install & config ip rotate(burp suite extender). 3. Send password reset code. 4. Brute force OTP with intruder. 5. Change password. #bugbountytip #bugbountytips

Updated list of 104 hacking tools and resources for security researchers, covering web proxies, recon, API testing, mobile, cloud, and more.

How did I found SSRF in Facebook — the story of my first bug bounty

When you are fuzzing API Endpoints worth you add XMLHttpRequest headers, some frameworks filter requests that don't was called by Frontend Applications. - "X-requested-with: XMLHttpRequest" * Found in some PHP frameworks. #BugBounty #BugBountyTips #Pentesting

Of late, I see a lot of newbie bug hunters and security enthusiasts joining Infosec twitter and it pains to see their failure stories in…

You need many accounts during the bug bounty or whatever, this tool is for you. Get shared credentials with https://t.co/ejRFKore1T https://t.co/vTIAO4nCcx @HusseiN98D @stokfredrik @Mik317_ #bugbounty #bugbountytips #bugbountytip

Hello everyone its been a long time I haven’t published any blog because I was busy in making a blog on my recon technique. I hope you…

Cross-Site Request Forgery (CSRF) is hardly seen with new frameworks but is yet exploitable like old beautiful days. CSRF, a long story…

A story about how I got a bug from a marketplace in Indonesia.

A place for me to store my notes/tricks for Bug Bounty Hunting - Big Work in Progress.

Acknowledgment: Google Honourable Mentions (https://bughunter.withgoogle.com/rank/hm/8)

BIGIP CVE-2020-5902 Exploit POC . GitHub Gist: instantly share code, notes, and snippets.

Nuclei is configurable targeted scanning based on templates that allowing complete extensibility with a very simple and ez to use…

Account takeover vulnerability using HTTP Request Smuggling and Desync attacks, this time through Akamai en route to Zomato. A big thanks to Zomato and Akamai for working with me to fix these...