tgindex
B

Bug bounty Tips

описание

🛡️ Cybersecurity enthusiast | 💻 Helping secure the digital world | 🌐 Web App Tester | 🕵️‍♂️ OSINT Specialist Admin: @laazy_hack3r

← к каналу@bugbounty_tech
6 553
подписчиков
Охват к подписчикам
8,4%
ERR
Реакции к просмотрам
0,21%
72 на 50 постов
Пересылки к просмотрам
1,17%
397
Постов в день
1,0
всего 318

Где отзываются чаще

доля реакций к просмотрам
  • 3 авг.Useful Google Dorks that bug bounty hunters can leverage to find sensitive information: 👇🏻 1. Discovering Exposed Files: - intitle:"index of" "site:target.com" - filetype:log inurl:log site:target.com - filetype:sql inurl:sql site:target.com - filetype:env inurl:.env site:target.com 2. Finding Sensitive Directories: - inurl:/phpinfo.php site:target.com - inurl:/admin site:target.com - inurl:/backup site:target.com - inurl:wp- site:target.com 3. Exposed Configuration Files: - filetype:config inurl:config site:target.com - filetype:ini inurl:wp-config.php site:target.com - filetype:json inurl:credentials site:target.com 4. Discovering Usernames and Passwords: - intext:"password" filetype:log site:target.com - intext:"username" filetype:log site:target.com - filetype:sql "password" site:target.com 5. Finding Database Files: - filetype:sql inurl:db site:target.com - filetype:sql inurl:dump site:target.com - filetype:bak inurl:db site:target.com 6. Exposed Git Repositories: - inurl:".git" site:target.com - inurl:"/.git/config" site:target.com - intitle:"index of" ".git" site:target.com 7. Finding Publicly Exposed Emails: - intext:"email" site:target.com - inurl:"contact" intext:"@target.com" -www.target.com - filetype:xls inurl:"email" site:target.com 8. Discovering Vulnerable Web Servers: - intitle:"Apache2 Ubuntu Default Page: It works" site:target.com - intitle:"Index of /" "Apache Server" site:target.com - intitle:"Welcome to nginx" site:target.com 9. Finding API Keys: - filetype:env "DB_PASSWORD" site:target.com - intext:"api_key" filetype:env site:target.com - intext:"AWS_ACCESS_KEY_ID" filetype:env site:target.com 10. Exposed Backup Files: - filetype:bak inurl:backup site:target.com - filetype:bak inurl:backup site:target.com - filetype:zip inurl:backup site:target.com - filetype:tgz inurl:backup site:target.com Replace target.com with the domain or target you are focusing on. #GoogleDorks #BugHunting #OSINT1,08%
  • 17 авг.без подписи0,79%
  • 12:09BlaBlackHat_USA_2026_Slides CRLF-Powered Desync Attacks0,78%
  • 12:13100+ World Intelligence MCP Servers Financial Markets Economic Conflict & Security Military & Defense Maritime Geospatial Datasets Intelligence Analysis Aviation Social & Sanctions Country Intelligence Traffic https://github.com/marc-shade/world-intel-mcp #geoint0,69%
  • 7 авг.Use gf to filter for parameters that are commonly associated with specific vulnerability classes: waybackurls target.com | gf xss waybackurls target.com | gf sqli waybackurls target.com | gf ssrf waybackurls target.com | gf lfi waybackurls target.com | gf redirect waybackurls target.com | gf idor0,65%
  • 17 авг.без подписи0,57%
  • 10 авг.✎ ASN → IP Recon Workflow (BGPView alternative) I used to rely on bgpview.io for extracting IP ranges from ASNs it was free and useful for recon workflows. But after it went down, I looked for an alternative and found this awesome repo: • as-ip-blocks: Github It lets you pull IPv4/IPv6 prefixes per ASN directly from raw GitHub data, which is ideal for automation. </> Bash Function for ASN → IP Enumeration You can plug this directly into your recon pipeline or customize it for your tools asn2ip() { local base="https://raw.githubusercontent.com/ipverse/as-ip-blocks/master/as" fetch_asn() { curl -fsSL "$base/$1/aggregated.json" \ | jq -r '.prefixes.ipv4[]?' 2>/dev/null \ | sort -u } if [ ! -t 0 ]; then while IFS= read -r asn; do fetch_asn "$asn" done else fetch_asn "$1" fi } • Single ASN → IP Ranges asn2ip 1234 • List of ASNs → IP Ranges cat asnList | asn2ip0,39%
  • 7 авг.https://securitycipher.com/2026/08/03/openai-codex-security-cli-practical-guide/0,38%
  • 3 авг.#Analytics #Threat_Research An analytical review of the main cybersecurity events (July 25 - Aug 01, 2026) 1⃣ IPMI Admin Password Hash Leak // Why BMC Compromise Is Especially Dangerous in AI Infrastructure 2⃣ Escaping Linux Sandboxes via PipeWire // CVE-2026-5674 3⃣ SourTrade: Browser-Assembled Malware Delivered Through Malvertising 4⃣ Cisco Secure Firewall Management Center Software Static Credential Vulnerability Exploited CVE-2026-20316 // This vulnerability (CVE-2026-20316) is due to the presence of static user credentials for a low-privileged account 5⃣ OpenWRT Patch, odhcpd vulnerability CVE-2026-53921 // Stack buffer overflow in DHCPv6 IA reply serialization 6⃣ Foxit PDF Reader LPE // exploit for CVE-2026-3775/CVE-2026-3780/ CVE-2026-57239 which lets you obtain NT AUTHORITY\SYSTEM rights via the Foxit PDF Reader updater service 7⃣ ServiceNow RCE Mass Exploitation (CVE-2026-6875) // A critical RCE vulnerability in the ServiceNow platform has become a global disaster 8⃣ PureLogs, PureRAT and misleading zgRAT // Despite the similar names PureLogs and PureRAT are not the same type of malware0,36%
  • 10 авг.#Analytics #Threat_Research An analytical review of the main cybersecurity events (Aug 01 - 08, 2026) 0⃣ Black Hat USA 2026 1⃣ IP and DNS Leaks in WebKit // Affecting Proxy Browsers and Apple iCloud Private Relay 2⃣ Zero-Click File Drop on Xiaomi ShareMe (MiDrop) // PoC materials and scripts 3⃣ Dell BIOS Passwords: Weak XOR Encryption Allows Recovery from SPI Flash // Dell stores its BIOS administrator and user passwords as XOR-encrypted plaintext in the DVAR region of SPI flash chip, not as a one-way hash (CVE-2026-40639) 4⃣ Zapscape (CVE-2026-64561) - UaF vulnerability that occurs in the shadow MMU of KVM/x86 // PoC code and usage 5⃣ Ill Bloom: Crypto Wallet Vulnerability 6⃣ ChainDrop npm Worm // Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 7⃣ Buffer overflow in iwd exploitable via Wi-Fi // PoC code, patches and sanitizer logs 8⃣ CRLF-Powered Desync Attacks: Beheading HTTP Streams 9⃣ ResetNightmare (CVE-2026-27912) 🔟 IPv6 Trends in User Account Compromises ]-> Analytical review (July 25 - Aug 01, 2026)0,34%
  • 6 июл.без подписи0,33%
  • 10 авг.#tools #AIOps "Your WAF Blocked Us, That Was The Exploit: Remote Agent Takeover via Cloudflare, Sentry, Datadog and Claude Zero-Day for data exfil and persistence", DEF CON 34, 2026. ]-> Drop-in configs to harden Cursor and Claude Code against prompt injection See also: ]-> DEF CON 34 - All Presentations0,33%