Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl and Filter Urls With OpenRedirection or SSRF Parameters.
https://twitter.com/patelkathan22/status/1246292607996551168
https://twitter.com/patelkathan22/status/1246292607996551168
Twitter
Kathan patel
Made a tool to find parameters for SSRF. inspired by @ngkogkos post. https://t.co/0P6lFbmUgK It will enumerate subdomains and get urls of this subdomains using gau and will filter-out parameters which contain urls. #bugbounty #bugbountytips #bugbountytip
Udit Bhadauria (Hackcura) (@udit_thakkur) Tweeted:
Rate limit bypass:
Add header/s with request
X-Originating-IP: IP
X-Forwarded-For: IP
X-Remote-IP: IP
X-Remote-Addr: IP
X-Client-IP: IP
X-Host: IP
X-Forwared-Host: IP
If bypass successful, & after a while blocking request again. Increment the last octate
#infosec #bugbountytip https://twitter.com/udit_thakkur/status/1241832273898430464?s=20
Rate limit bypass:
Add header/s with request
X-Originating-IP: IP
X-Forwarded-For: IP
X-Remote-IP: IP
X-Remote-Addr: IP
X-Client-IP: IP
X-Host: IP
X-Forwared-Host: IP
If bypass successful, & after a while blocking request again. Increment the last octate
#infosec #bugbountytip https://twitter.com/udit_thakkur/status/1241832273898430464?s=20
Twitter
Udit Bhadauria (Hackcura)
Rate limit bypass: Add header/s with request X-Originating-IP: IP X-Forwarded-For: IP X-Remote-IP: IP X-Remote-Addr: IP X-Client-IP: IP X-Host: IP X-Forwared-Host: IP If bypass successful, & after a while blocking request again. Increment the last octate…
Bypass rate limit to account takeover
1. Server limited brute force OTP by ip.
2. Install & config ip rotate(burp suite extender).
3. Send password reset code.
4. Brute force OTP with intruder.
5. Change password.
https://twitter.com/r00t98/status/1261224237873979392
1. Server limited brute force OTP by ip.
2. Install & config ip rotate(burp suite extender).
3. Send password reset code.
4. Brute force OTP with intruder.
5. Change password.
https://twitter.com/r00t98/status/1261224237873979392
Twitter
Sina Doosti
Bypass rate limit to account takeover 1. Server limited brute force OTP by ip. 2. Install & config ip rotate(burp suite extender). 3. Send password reset code. 4. Brute force OTP with intruder. 5. Change password. #bugbountytip #bugbountytips