Our main goal is to share tips from some well-known bughunters. Using recon methodology, we are able to find subdomains, apis, and tokens that are already exploitable, so we can report them. We wis...

This could have allowed a malicious user to change a page's username, allowing the user to create a new page using the original URL.

Need to make some quick $$? Here is a hack very few know about. No automated tools do either. 1) Find JavaScript files 2) ffuf -w js_files.txt -u FUZZ -mr "sourceMappingURL" 3) Download sourcemap 4) https://t.co/t8epDztHNe 5) Browse configs or just grep for…

Try chatting with tech support about getting a flag. There is an easy XSS in the support chat, but it runs on the wrong domain, so we have to chain it with self-XSS, parent-domain cookies, iframes, and a little browser-cache mystery.

LEARN ON HEXTREE (ad)…

LFI to RCE 1. ffuf on "/" -> "redacted-api" -> 302 2. ffuf on "redacted-api/" -> "application.wadl" -> 200 3. all operations were auth protected 4. didn't give up and tested ~200 operations 5. fount LFI, no auth 6. admin creds in plaintext, logged in and…

Testing for XSS via “javascript:” but it’s blocked by a WAF? Try these bypasses. Thanks for the #BugBountyTip, @SecurityMB! #BugBountyTips #HackWithIntigriti

AWS Credentials That Had Been Leaked

By Danny Robinson and Rotem Bar

Collection of methodology and test case for various web vulnerabilities. - KathanP19/HowToHunt

Hi People, Yesterday I was hunting on one application and got 5 different ATO’S and even without user interaction in a single application…

Bug Bounty: Leak of internal Facebook documents