Hacking Tools
October 15, 2024
We all know that reconnaissance is important in bug bounty, in fact, it is the most important phase in bug bounty & web app pentesting. Bug bounty hunters who perform effective recon are always rewarded well as they come across untouched features and hidden assets more often than others. This provid
Hacking Tools
September 27, 2024
We all had to start somewhere in bug bounty hunting and we all made mistakes along the way. Most of these often helped us learn more and become even better bug bounty hunters! If you're in your first years of doing bug bounty hunting or just starting and exploring bug bounties, we want to help you s
Hacking Tools
September 12, 2024
Cloudflare R2 buckets are recently becoming more popular as an alternative to AWS S3 buckets for their simplicity, integration support and zero-egress fees. Customers who opt-in to use Cloudflare R2 are not going to be charged for any traffic to and from the bucket. This often means a severely reduc
Hacking Tools
September 5, 2024
AWS S3 (Simple Storage Service) buckets are a popular storage service used by software companies and organizations to store public as well as sensitive data. However, the implementation of this service is not always correctly done. A single missing access policy can often introduce security risks, d
Hacking Tools
August 19, 2024
Cross-site request forgery—or for short CSRF—vulnerabilities are one of the most exploited web security vulnerabilities that result in performing unwanted actions. This client-side vulnerability can sometimes go unnoticed but delivers a devastating impact depending on the context. From basic action
Hacking Tools
August 1, 2024
SSRF—short for Server-Side Request Forgery—vulnerabilities are amongst one of the most impactful web security vulnerabilities. Even though they are less commonly found on targets they do take place on the OWASP Top 10 2021 ladder scoring the latest place (A10). SSRF vulnerabilities are known to have
Hacking Tools
July 24, 2024
Salesforce Experience (or Community) Cloud is a CRM platform that helps software companies and organizations manage their customer relationships. Software companies and organizations often use it to manage their customer relationships, share information, and work with employees and customers (docume
Hacking Tools
July 4, 2024
Most software companies resort to using third-party solutions for completing certain tasks within their company. A common example is a ticketing platform that helps teams and companies stay organized with issues that internal employees or customers may experience. Unfortunately, due to lack of time
Hacking Tools
May 31, 2024
GraphQL is a widely used query language that provides developers with the ability to query data easily. Unlike via a REST API, developers can send a schema in a single HTTP request and retrieve back all the necessary data. It’s an awesome query language that can help simplify several aspects during
Hacking Tools
April 17, 2024
Getting into bug bounties is no easy task, we know. There’s so much to consider and your path to becoming a bug bounty hunter can vary in so many ways. Bug bounty hunting can be fraught with challenges, and even the most skilled individuals can fall victim to common mistakes. 1. Striking the wrong b
Hacking Tools
March 18, 2024
Presented by CryptoCat What is aggressive scanning? In bug bounty, researchers are expected to configure automated tools and scanners to remain within the defined limits of the program’s requirements. Any activity outside these limits can be defined as “aggressive” or “intrusive”. Hunters with exper
Hacking Tools
March 14, 2024
By not conducting tests on the static websites of your targets, you may be overlooking numerous potential vulnerabilities. In today’s post, we will go through the top 3 most common ways of finding security vulnerabilities in static websites. What are static websites? You’ve probably come across a st
Hacking Tools
March 1, 2022
How often do you find yourself running scans that take ages to complete? How often do you cancel a scan because it has been taking too long? But what if you left it to run for 3 more minutes? Would that have given you a breakthrough result? Today, we’re going to go fast, really fast! Let’s take a lo
Hacking Tools
February 1, 2022
You’ve just enumerated all the subdomains of your target and what? There’s 400 of them? Are you going to start individual scans to find endpoints on them? No you’re not! You’re going to use Meg, of course! 🙋♂️ What is Meg? Meg is not the girl nextdoor, no it’s an amazing tool you need to know abou
Hacking Tools
January 11, 2022
EyeWitness is an incredible tool that allows you to quickly get a feel for what assets to target first. We all know hundreds of content discovery tools that give us vast amounts of data, but do we ever focus on efficiently parsing all that data? How do you go through hundreds of endpoints? If you’re
Hacking Tools
November 23, 2021
As a bug bounty hunter, you need to get a good view of all the pages and endpoints your targets host. Manually enumerating these can become labour intensive, boring and on top of that, is prone to errors. Today we’re going to look at GoSpider, a tool that can do all this for us! Photo by Pixabay on
Hacking Tools
October 5, 2021
A CRLF injection is the injection of newlines in places where the server doesn’t expect newlines. This can cause a plethora of vulnerabilities including XSS, session fixation, cookie injection, open redirect, and much more! What are we waiting for? Let’s check out CRLFuzz, the tool that can help you
Hacking Tools
September 24, 2021
The past can tell stories, show things that should’ve never been uncovered and today we will be looking at that past. We can go hunt for subdomains, secret endpoints, tokens, and secrets, all with the help of Waybackurls. Wayback Machine Logo 🙋♂️ What is Waybackurls? Waybackurls by @TomNomNom is a
Hacking Tools
September 14, 2021
Finding XSS can sometimes be a repetitive and laborious task. Many attempts at automating the process have been made, yet very little actually come close to getting it right. Today, we’re covering Dalfox, a tool that did get it right. Let’s find some cross-site scripting vulnerabilities! 🙋♂️ What
Hacking Tools
September 7, 2021
When facing API endpoints, older tools for directory busting tend to be very ineffective. The days where a webserver is just a directory tree are behind us. The more modern ‘routes’ have taken over and wildly bruteforcing filenames isn’t effective anymore. We need to be smarter and scan based on pop