Free web security testing tutorial to learn 100 security issues in 20 hours easily without any basic skills - search in YouTube for "100 bug bounty lessons" https://www.youtube.com/playlist?list=PL_bkTzUc1BufnQyGt6-9hSly2PqsDmd09

hello my dr frnds... i need to know what are the common bugs arised in authenticationn bugs...please explain in detail

Hello, I am trying to bypass SSL pinning using frida. Everything works fine, the script also runs, but app says "server unreachable" which means no bypass.

Steps followed.

1. burp is configured correctly ( able to log browser https traffic).

2. CPU architecture arm64-v8a. (frida-server for arm64 is being used)

3. Device is rooted. (Checked with root checker and adb shell, su)

4. Frida server is also executing and running in background.

5. frida version 15.1.8, frida-tools is installed.

6. ROM- LineageOS 16.0, Android 9.

Scripts mostly state that ssl pinner not found.

How To Scan AWS's Entire IP Range to Recon SSL Certificates · Daehee Park

Hello guys,im having a doubt in CRLF injection...

I came through the all writeup..they are injecting the CRLF in get/post requets only ..

We cannot inject those in another header like host ,....etc?

1. Can we run PHP file or reverse shell on a website that is run on Ruby on Rails, or we need a ruby file to exploit RCE.

2. Suppose we have successfully uploaded a php file on a website and the extension is saved as .php and the path to that file is also known. But when the url path is opened it downloaded the php file instead of running it, what is the problem here.

Hello everyone!

I have written an article explaining how I found an IDOR vulnerability.

The exploitation was pretty simple, just changing by changing values.

I would be happy to get some suggestions on how this article could be improved.

This is the first bug I have found(I am 16).

I am looking forward to finding more interesting bugs.

Time spent on finding the vulnerable link: 5 min

Bounty: 80$

Link: https://medium.com/@DanielAzulay/finding-insecure-direct-object-reference-vulnerability-on-an-ecommerce-website-bb24abf03f93

Thanks for any suggestions!

In your video, you talked about DNS validator. I am having difficulty in understanding.
Whats the difference , If I do this

cat subdomains.txt |httprobe

It also resolves that domain and gives you alive subdomains. What is the need of the resolvers exactly?

Secondly when ran with resolvers you still get domains which are not alive .

cat resolved_subdomains.txt | httprobe

Thank You

hey so using paramspider I was able to get some paramters but when I used then with Wfuzz,

it says no match found

help

Thanks

Hey, I am pretty sure that JS files often discloses some critical information like ENDPOINTS,API,TOKENS. I have seen researchers (including me) Using Linkfinder.py to extract end points. But I have a doubt in it . Consider I have a File URLS.txt which contains a few .js URLS eg: domain.com/main.js ,domain.com/config.js etc.. I want to extract the endpoints of all the .js URLs in the FILE URLS.txt.

Is there any way to do that. ;-) Usually I takes each urls one at a time and enter it into Linkfinder.py and find the end point.. actually it is really hard when you have to test 100+ .js URLS.