forked from ipentest/hacking
-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathhack-links.txt
5487 lines (5117 loc) · 633 KB
/
hack-links.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
https://twitter.com/ITSecurityguard | Patrik Fehrenbach🤖 (@ITSecurityguard) | Twitter
https://blog.it-securityguard.com/the-stony-path-of-android-%F0%9F%A4%96-bug-bounty-bypassing-certificate-pinning/ | The Stony Path of Android 🤖 Bug Bounty – Bypassing Certificate Pinning | Patrik Fehrenbach
https://www.youtube.com/feed/subscriptions | (3) Subscriptions - YouTube
https://blog.it-securityguard.com/the-stony-path-of-android-%f0%9f%a4%96-bug-bounty-bypassing-certificate-pinning/ | The Stony Path of Android 🤖 Bug Bounty – Bypassing Certificate Pinning | Patrik Fehrenbach
https://tweetdeck.twitter.com/ | TweetDeck
https://www.ivrodriguez.com/mobile-ctf/ | Mobile CTF
https://github.com/ivRodriguezCA | ivRodriguezCA (Ivan Rodriguez) · GitHub
https://ivrodriguez.com/mobile-ctf/ | Mobile CTF
https://github.com/ernw/AndroTickler | GitHub - ernw/AndroTickler: Penetration testing and auditing toolkit for Android apps.
https://www.hackerone.com/blog/How-to-Hack-Get-Started-Hacking-Mobile | Learning to Hack Mobile|How2Hack|By HackerOne
https://github.com/nabla-c0d3/ssl-kill-switch2 | GitHub - nabla-c0d3/ssl-kill-switch2: Blackbox tool to disable SSL certificate validation - including certificate pinning - within iOS and OS X Apps
https://github.com/Fuzion24/JustTrustMe | GitHub - Fuzion24/JustTrustMe: An xposed module that disables SSL certificate checking for the purposes of auditing an app with cert pinning
https://twitter.com/Pentest_Geek/status/1034905842880012289 | Pentest_Geek on Twitter: "Thanks again @Burp_Suite for creating the new REST API. Here is a PoC command-line tool for interacting with it. Can launch/query scans and perform basic knowledge-base lookups. Sorry @HackingDave but its written in Ruby 😜 https://t.co/84w0K6zSpk"
https://f-droid.org/en/2018/09/04/second-security-audit-results.html | Second Security Audit Results | F-Droid - Free and Open Source Android App Repository
https://twitter.com/phwd/status/1039550713142161409 | ️ on Twitter: "Breaking The Facebook For Android Application by Ashley King Bounty: $8500 https://t.co/AevbyRZRSA"
https://techblog.mediaservice.net/2018/04/brida-a-step-by-step-user-guide/ | Brida – A step-by-step user guide | @Mediaservice.net Technical Blog
https://blog.safehats.com/most-important-android-security-penetration-testing-tools-for-hackers-security-professionals-aa258dc61784 | Most Important Android Security Penetration Testing Tools for Hackers & Security Professionals
https://github.com/Mind0xP/Frida-Python-Binding | GitHub - Mind0xP/Frida-Python-Binding: Easy to use Frida python binding script
https://tinyhack.com/2018/02/05/pentesting-obfuscated-android-app/ | Pentesting obfuscated Android App – Tinyhack.com
https://secdevops.ai/ios-static-analysis-and-recon-c611eaa6d108 | iOS Static Analysis and Recon – SecDevOps
https://labs.nettitude.com/tutorials/using-frida-to-bypass-snapchats-certificate-pinning/ | Using Frida to Bypass Snapchat’s Certificate Pinning – Nettitude Labs
https://x1m.nl/posts/android-app-testing-part-1/ | Bug Bounty & Android Applications - Part 1 · Martijn - X1M
https://twitter.com/mobilesecurity_/status/970676777831092224 | Mobile Security on Twitter: "Prevent bypassing of SSL certificate pinning in iOS applications #MobileSecurity #iOSsecurity by @GuardSquare https://t.co/kYYFyX43ep… https://t.co/nhFQV804GG"
https://twitter.com/mobilesecurity_/status/966787418052587520 | Mobile Security on Twitter: "FiOS - new iOS pentesting tool based on @fridadotre #MobileSecurity #iOSsecurity https://t.co/koU64k08BJ… "
https://twitter.com/mobilesecurity_/status/966666086115692544 | Mobile Security on Twitter: "Hacking Tinder Accounts using Facebook Accountkit #MobileSecurity https://t.co/9M9mpGTw1z"
https://twitter.com/mobilesecurity_/status/965618348280176640 | Mobile Security on Twitter: "Mobile Application Hacking Diary Ep.2 #MobileSecurity @fridadotre https://t.co/Pe92QsQxRb… "
https://github.com/tanprathan/MobileApp-Pentest-Cheatsheet | GitHub - tanprathan/MobileApp-Pentest-Cheatsheet: The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration testing topics.
https://blog.netspi.com/four-ways-bypass-android-ssl-verification-certificate-pinning/ | Four Ways to Bypass Android SSL Verification and Certificate Pinning
https://blog.ropnop.com/configuring-burp-suite-with-android-nougat/ | Configuring Burp Suite with Android Nougat
https://medium.com/@abhimuralidharan/detecting-screen-capturing-in-ios-11-cca15881c785 | Detecting screen capturing in iOS 11 – Abhimuralidharan – Medium
https://twitter.com/ITSecurityguard/status/951208786043207682 | Patrik Fehrenbach🤖 on Twitter: "If you are into iOS pentesting, check out: Passionfruit https://t.co/nDug3u7NsY Simple iOS app blackbox assessment tool :-)… https://t.co/i7Hup4SP4J"
https://twitter.com/mobilesecurity_/status/944209608092110848 | Mobile Security on Twitter: "Intercepting HTTPS Traffic from Apps on Android 7+ using #Magisk & #Burp #MobileSecurity #AndroidSecurity @Burp_Suite by @NVISO_Labs https://t.co/0BF4PfXj4q… https://t.co/TFsgTGgS8A"
https://twitter.com/caseyjohnellis/status/946558246600417280 | caseyjohnellis on Twitter: "Breaking Mobile App Protection Mechanisms - @Ben_RA @Bugcrowd's #LevelUp2017 https://t.co/yvtA7ikFpe #bugbounty #ioshacking"
https://twitter.com/mobilesecurity_/status/931229119119052800 | Mobile Security on Twitter: "Advanced mobile penetration testing with Brida #MobileSecurity VIDEO by @apps3c | @fridadotre + @Burp_Suite https://t.co/USw3BARSje"
https://twitter.com/ErezYalon/status/931158775830073344 | Erez on Twitter: "We wrote a guide on Android's WebView. It turned up pretty good so converted into a blog post: https://t.co/DFfuh2sVXZ #infosec #appsec #AndroidDev @Checkmarx"
https://twitter.com/mobilesecurity_/status/930343296383234048 | Mobile Security on Twitter: "objection - runtime mobile exploration #MobileSecurity SLIDES and VIDEO by @sensepost and @leonjza | #0xcon https://t.co/xI2WA7MMka… https://t.co/cR7zxeTei6"
https://twitter.com/mobilesecurity_/status/929807008857018368 | Mobile Security on Twitter: "Intro to Android Hacking with FRIDA VIDEO by @brompwnie #MobileSecurity #AndroidSecurity https://t.co/TaFOzYbOvh"
https://twitter.com/Pouyadarabi/status/932779271818563585 | Pouya Darabi on Twitter: "SSL pinning bypass for Facebook and Instagram android app 🔍 https://t.co/Kv1Jw3uPkh https://t.co/HCHCTpOBMC https://t.co/HCHCTpOBMC"
https://twitter.com/mobilesecurity_/status/932358768238632960 | Mobile Security on Twitter: "Hacking mobile application #MobileSecurity [VIDEO] https://t.co/1P4eMKJgdG"
https://twitter.com/mobilesecurity_/status/932338366460387330 | Mobile Security on Twitter: "HackerOne Reports: a big list of Android Hackerone disclosed reports and other resources #MobileSecurity #AndroidSecurity https://t.co/lzFRVwiRdu"
https://www.youtube.com/watch?v=b6V7zutHfEo | (3) Basic Android Application Hacking - YouTube
https://www.youtube.com/watch?v=JF23iULOxgU | (3) Bypassing Android AV's - YouTube
https://mysmccd-my.sharepoint.com/personal/mahasatu_my_smccd_edu/_layouts/15/WopiFrame.aspx?sourcedoc={9f6ccfbf-409c-483f-8170-6dd111f1825f}&action=edit&wd=target%28Resources.one%7C45aebb95-7fbc-44ee-914f-1ad6f1dd63bd%2FMobile%20Security%7C910cc7c4-53ec-415c-bc31-84fc0c9b75c6%2F%29 | Final Resource
https://www.youtube.com/watch?v=10TrW2lsYSQ&t=354s | (2) Nullcon 2016 :- Sachin & Pankaj Party Performance - YouTube
https://soroush.secproject.com/downloadable/when-a-web-application-ssrf-causes-the-cloud-to-rain-credentials-and-more.pdf | when-a-web-application-ssrf-causes-the-cloud-to-rain-credentials-and-more.pdf
https://www.slideshare.net/SoroushDalili/waf-bypass-techniques-using-http-standard-and-web-servers-behaviour | WAF Bypass Techniques - Using HTTP Standard and Web Servers’ Behaviour
https://soroush.secproject.com/blog/2017/08/request-encoding-to-bypass-web-application-firewalls/ | Request encoding to bypass web application firewalls | Soroush Dalili (@irsdl) – سروش دلیلی
https://www.slideshare.net/SoroushDalili/a-forgotten-http-invisibility-cloak?ref=https://soroush.secproject.com/blog/2017/08/request-encoding-to-bypass-web-application-firewalls/ | A Forgotten HTTP Invisibility Cloak
https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/august/request-encoding-to-bypass-web-application-firewalls/ | Request encoding to bypass web application firewalls
https://soroush.secproject.com/blog/2013/10/yahoo-bug-bounty-program-lfi-reported-and-patched/ | Yahoo bug bounty program – LFI reported and patched! | Soroush Dalili (@irsdl) – سروش دلیلی
https://soroush.secproject.com/blog/2014/07/upload-a-web-config-file-for-fun-profit/ | Upload a web.config File for Fun & Profit | Soroush Dalili (@irsdl) – سروش دلیلی
https://addons.mozilla.org/en-GB/firefox/addon/colorfultabs/ | ColorfulTabs – Get this Extension for 🦊 Firefox (en-GB)
https://soroush.secproject.com/blog/2016/10/flash-it-baby/ | Flash it baby! | Soroush Dalili (@irsdl) – سروش دلیلی
https://www.nccgroup.trust/uk/our-research/common-security-issues-in-financially-orientated-web-applications/ | Common Security Issues in Financially-Orientated Web Applications
https://soroush.secproject.com/blog/2018/12/more-research-on-net-deserialization/ | More research on .NET deserialization | Soroush Dalili (@irsdl) – سروش دلیلی
https://soroush.secproject.com/blog/2017/08/request-encoding-to-bypass-web-application-firewalls/ | Request encoding to bypass web application firewalls | Soroush Dalili (@irsdl) – سروش دلیلی
https://github.com/irsdl?tab=repositories | irsdl (Soroush Dalili) / Repositories · GitHub
https://github.com/irsdl/BurpSuiteJSBeautifier | GitHub - irsdl/BurpSuiteJSBeautifier: Burp Suite JS Beautifier
https://medium.com/ehsahil/ctf-walkthrough-hacken-cup-2018-1b48b0fd96c | CTF Walkthrough — Hacken Cup 2018 – ehsahil – Medium
https://footstep.ninja/posts/hacken-cup/ | cat ~/footstep.ninja/blog.txt
https://github.com/Veneno0/CTFwp/tree/master/Internetwache-CTF-2016/Web80 | CTFwp/Internetwache-CTF-2016/Web80 at master · Veneno0/CTFwp · GitHub
https://medium.com/ehsahil/ctf-walkthrough-hacken-cup-2018-1b48b0fd96c | CTF Walkthrough — Hacken Cup 2018 – ehsahil – Medium
https://medium.com/ehsahil/getting-access-to-25k-employees-details-c085d18b73f0 | Getting access to 25000 employees details – ehsahil – Medium
https://www.youtube.com/watch?v=UjJ33OhPDcQ | (132) Is The iPhone Smart Battery Case Worth The Price? - YouTube
https://twitter.com/ITSecurityguard/status/1021310140400717825 | Patrik Fehrenbach🤖 on Twitter: "GraphQL really represents the Crown Jewels of every company. If you want to find $$$ bounties, have a look at the @Hacker0x01 GraphQL :-) You can get the entire schema using Introspection (https://t.co/fym2D1RPNT) (thanks @mongobug <3) https://t.co/4IRe4IIFdL 80 MB PNG file… https://t.co/fXVIfILqdl"
https://twitter.com/soaj1664ashar/status/1079791723889475586?s=19 | 𝔸𝕤𝕙𝕒𝕣 𝕁𝕒𝕧𝕖𝕕 on Twitter: "Server-Side Request Forgery #SSRF Tools/Stuff https://t.co/Klcxbn7OM8 https://t.co/Pruy3KtHdD https://t.co/bjFjveIwrd https://t.co/yrshScjBEX https://t.co/V2UfVq3Ww6 https://t.co/iHTo6HxW9E https://t.co/sXZTRJssJA https://t.co/1fTRoxrnXZ https://t.co/QDJiUZ4utv"
https://2018.zeronights.ru/wp-content/uploads/materials/4%20ZN2018%20WV%20-%20BugBounty%20automation.pdf | Презентация PowerPoint - 4 ZN2018 WV - BugBounty automation.pdf
http://kb.entersoft.co.in/ | Knowledge Base Entersoft
https://pastebin.com/xZC446zy | SSRF - Pastebin.com
https://pastebin.com/yAd0YF4y | JWT - Pastebin.com
https://twitter.com/PhilippeDeRyck/status/1068812961374965760?s=09 | Philippe De Ryck on Twitter: "In the past few months, I have built two security cheat sheets (and more will follow). One is on Angular and the @OWASP top 10, and the other one on JSON Web Tokens (JWT) https://t.co/hEw0DqmFTx #Angular #JWT #websecurity #security… https://t.co/tt2HfTp3Sh"
https://twitter.com/armold9anthony/status/1082124430875283457?s=09 | Arnold Anthony on Twitter: "Pinterest Account Takeover via CSRF #bugbounty #OuthackThemAll https://t.co/r7baZOrj5k"
https://twitter.com/proabiral/status/1056906273101438976?s=09 | Abiral on Twitter: "Nice. Just wondering how you found the endpoint.… "
https://twitter.com/frgx/status/1045376878184292354?s=09 | Devdatta Akhawe on Twitter: "Great blogpost by @d0nutptr on how to be a high impact bug finder https://t.co/Rdzn0mRVOT Great companion to Google's list of non vulns https://t.co/POPKHDCMEM"
https://medium.com/@putracraft.theworld/server-side-request-forgery-in-openid-support-defcc64d5e41 | Server-side Request Forgery in OpenID support – Putra Adhari – Medium
https://medium.com/@modam3r5/unauthenticated-user-can-upload-an-attachment-at-hackerone-aff2a0c573b8 | Unauthenticated user can upload an attachment at HackerOne
https://medium.com/@D0rkerDevil/how-i-found-a-1500-worth-deserialization-vulnerability-9ce753416e0a | How i found a 1500$ worth Deserialization vulnerability
https://arulkumar.in/multiple-open-url-redirection-vulnerability-in-facebook-worth-1500/ | Multiple Open URL Redirection Vulnerability on Facebook worth $1500
https://www.josipfranjkovic.com/blog/hacking-facebook-oculus-integration-csrf | Hacking Facebook accounts using CSRF in Oculus-Facebook integration - Josip Franjković
https://medium.com/@zk34911/twitter-bug-bounty-misconfigured-json-endpoint-on-ads-twitter-com-2771ec83a82 | [Twitter Bug Bounty] Misconfigured JSON endpoint on ads.twitter.com
https://twitter.com/adrien_jeanneau/status/1030934842651942912 | Adrien on Twitter: "SSRF are ❤️ file:///etc/passwd : Not authorized file://\/\/etc/passwd : Work 😀 #BugBounty"
https://twitter.com/si9int/status/1043523444137181184 | SI9INT on Twitter: "Tired of getting ca(p)tch(a)ed when Google dorking? Create a custom search engine for your target and fire off your queries! #bugbountytip #bugbounty #pentesting… https://t.co/9RcZnOeaWh"
https://medium.com/bugbountywriteup/how-to-brute-force-efficiently-without-burp-pro-1bb2a414a09f | How to brute force efficiently without Burp Pro – InfoSec Write-ups – Medium
https://twitter.com/amolnaik4/status/1028284835440324608?s=09 | AMol NAik on Twitter: "Learn various types of CSRF exploitation with real-world experience using Bodhi: https://t.co/JinbI2PEaR #websec #csrf #security #learning #OWASP #webhacking #ITSecurity"
https://hackerone.com/reports/347139 | #347139 LFI and SSRF via XXE in emblem editor
https://hackerone.com/reports/288353 | #288353 SMB SSRF in emblem editor exposes taketwo domain credentials, may lead to RCE
https://hackerone.com/reports/282604 | #282604 Stored XSS on profile page via Steam display name
https://hackerone.com/reports/265050 | #265050 Blind SSRF in emblem editor (2)
https://footstep.ninja/posts/password-reset/ | cat ~/footstep.ninja/blog.txt
https://www.sagarvd.me/2018/09/youtube-csrf.html | Send request to Martians. Earthlings are already your friends.
https://pastebin.com/vvQ1yy6i | XXE - Pastebin.com
https://pastebin.com/9BSQjM3E | CSRF - Pastebin.com
https://pastebin.com/LqdrPWJc | XSS - Pastebin.com
https://pastebin.com/VjFGnUcm | My_work - Pastebin.com
https://pastebin.com/u/thecreat0r | Thecreat0r's Pastebin - Pastebin.com
https://xss.shift-js.info/ | XSS Challenge (by y0n3uchy)
https://www.josipfranjkovic.com/blog/hacking-facebook-oculus-integration-csrf | Hacking Facebook accounts using CSRF in Oculus-Facebook integration - Josip Franjković
https://main.immersivelabs.online/signin | Immersive Labs
https://www.zomato.com/ncr/order-food-online?delivery_subzone=2856&place_name=Paschim+Puri%2C+West+Punjabi+Bagh | Order food online in West Punjabi Bagh, food delivery in West Punjabi Bagh - Zomato
https://pastebin.com/u/thecreat0r | Thecreat0r's Pastebin - Pastebin.com
https://pastebin.com/u/thecreat0r/1/ScVMVJnC | Thecreat0r's Pastebin - Pastebin.com
https://pastebin.com/yQsrXy47 | Jacacript Recon - Pastebin.com
https://pastebin.com/E1HAEFZf | My-Recon-Guide - Pastebin.com
https://medium.com/bugbountywriteup/bug-bounty-tips-tricks-js-javascript-files-bdde412ea49d | Bug Bounty — Tips / Tricks / JS (JavaScript Files) – InfoSec Write-ups – Medium
https://pastebin.com/E1HAEFZf | My-Recon-Guide - Pastebin.com
https://www.youtube.com/feed/subscriptions | (73) Subscriptions - YouTube
https://pastebin.com/hLxY1zvb | IDOR - Pastebin.com
https://jonbottarini.com/2018/10/09/get-as-image-function-pulls-any-insights-nrql-data-from-any-new-relic-account-idor/ | Get as image function pulls any Insights/NRQL data from any New Relic account (IDOR) | Security and Bug Hunting
https://tomnomnom.com/talks/passiveish.pdf | passiveish.pdf
https://mysmccd-my.sharepoint.com/personal/mahasatu_my_smccd_edu/_layouts/15/WopiFrame.aspx?sourcedoc={fd3568d3-8636-4b68-a177-c0333eed8d04}&action=edit&wd=target%28CheckList.one%7C369f1318-ae92-455c-a893-f20b1dfeac0f%2FUntitled%20Page%7Cc2b33649-cb1a-4d53-9eb9-bc8d39746e4d%2F%29 | zomato
https://github.com/bugcrowd/HUNT/ | GitHub - bugcrowd/HUNT
https://xsshunter.com/app | XSS Hunter
https://github.com/GerbenJavado/LinkFinder/tree/master | GitHub - GerbenJavado/LinkFinder: A python script that finds endpoints in JavaScript files
https://backlog.com/git-tutorial/branching/switch-branch/ | Switch Branch | Backlog
https://pastebin.com/E1HAEFZf | My-Recon-Guide - Pastebin.com
https://michenriksen.com/blog/aquatone-tool-for-domain-flyovers/ | AQUATONE: A tool for domain flyovers | michenriksen.com
https://web.archive.org/web/20180409183615/http://blog.rojanrijal.com/2017/12/public-s3-bucket-search-engine-open.html | Public S3 Bucket Search Engine - Open Source Project
https://pastebin.com/ | Pastebin.com - #1 paste tool since 2002!
https://twitter.com/i/likes | Tweets liked by Shivam Goyal (@g33kyshivam) | Twitter
http://10degres.net/aws-takeover-ssrf-javascript/ | AWS takeover through SSRF in JavaScript – Gwendal Le Coguic
https://samcurry.net/reading-asp-secrets-for-17000/ | Reading ASP secrets for $17,000 | Sam Curry
https://twitter.com/s0md3v/status/1075310630314209280 | Somdev Sangwan on Twitter: "CSRF mind map ❤️ Source: https://t.co/dfq6pJL2ip… "
https://hack-ed.net/2017/11/07/a-nifty-ssrf-bug-bounty-write-up/ | A Nifty SSRF Bug Bounty Write Up | Hack-Ed
https://nfsec.pl/pentest/6098 | NF.sec – Linux Security Blog - Passive Google Dorks
https://hackerone.com/bagipro?sort_type=latest_disclosable_activity_at&filter=type%3Aall%20from%3Abagipro&querystring=&page=1 | bagipro's HackerOne Profile
https://twitter.com/pnig0s | Terry Zhang (@pnig0s) | Twitter
https://medium.com/@logicbomb_1 | Avinash Jain (https://twitter.com/logicbomb_1) – Medium
https://medium.com/@logicbomb_1/bugbounty-from-finding-jenkins-instance-to-command-execution-secure-your-jenkins-instance-9bd1e75c2288 | #BugBounty — From finding Jenkins instance to Command Execution.Secure your Jenkins Instance!
https://www.google.com/search?client=ubuntu&hs=QSV&channel=fs&ei=LlUuXO2kNI6OvQSBvrjADQ&q=all+of+my+twwets&oq=all+of+my+twwets&gs_l=psy-ab.3..0i13l2j0i13i5i30l3.3895.6611..6762...1.0..0.250.2208.0j7j5......0....1..gws-wiz.......0j0i71j0i67j0i10j33i22i29i30j0i22i30j0i22i10i30.Anx5GY7YS2g | all of my twwets - Google Search
https://www.allmytweets.net/ | All My Tweets - View all your tweets on one page.
https://www.facebook.com/ | Facebook
https://www.youtube.com/watch?v=EdDRovrN-nw | (31) Shark Tank || Homeless woman Pitches Brick Gumbo - YouTube
https://www.youtube.com/watch?v=bGkTvhltmjA | Shark Tank I know how to sue people TEC - YouTube
https://www.youtube.com/ | (30) YouTube
https://www.facebook.com/?ref=logo | Facebook
https://twitter.com/Alra3ees/status/962794987258892288 | Emad Shanab on Twitter: "Recon scripts InputScanner https://t.co/pRitJrar5A JSParser https://t.co/JojIOqgUJG JS-Scan https://t.co/MMRyjCVyai mix-recon https://t.co/c9EFLtgcRE Sn1per https://t.co/t4lAnUnvEC ReconDog https://t.co/dngycSwUVg 003Recon https://t.co/mQcA1yrgfU"
https://github.com/003random/003Recon | GitHub - 003random/003Recon: Some tools to automate recon - 003random
https://twitter.com/Jhaddix | Jason Haddix (@Jhaddix) | Twitter
https://2019.appseccalifornia.org/index.php/training/ | Training - OWASP AppSec California 2019
https://www.eventbrite.com/e/appsec-california-2019-tickets-49541214105 | AppSec California 2019 Tickets, Tue, Jan 22, 2019 at 8:00 AM | Eventbrite
https://twitter.com/Jhaddix/status/1072512012050186240 | Jason Haddix on Twitter: "Bounty pro tip: if the target is a niche cms, crm, ad/analytics framework, or web framework, install it yourself and do content discovery on default paths/files for misconfigurations in access control. https://t.co/P1Duapfmwr cc @DanielMiessler"
http://vizualize.me/jhaddix | Jason Haddix | Vizualize.me
https://www.linkedin.com/in/jhaddix/ | (2) Jason Haddix | LinkedIn
https://twitter.com/Jhaddix/status/1079081260343975936 | Jason Haddix on Twitter: "I’ll be giving a live training version of “The Bug Hunter’s Methodology” at @Owasp @AppSecCali this year! Hope to see you there Jan 22-23! https://t.co/qjkLj2C4M0"
https://docs.google.com/presentation/d/1R-3eqlt31sL7_rj2f1_vGEqqb7hcx4vxX_L7E23lJVo/edit#slide=id.g3af0ae9b4b_3_61 | TBHM3 (p) - Google Slides
https://2019.appseccalifornia.org/index.php/training/ | Training - OWASP AppSec California 2019
https://tools.dnsstuff.com/ | Toolbox | DNSstuff
https://pbs.twimg.com/media/DX9jjrWV4AA6rbc.jpg | DX9jjrWV4AA6rbc.jpg (JPEG Image, 700 × 1200 pixels) - Scaled (53%)
https://pastebin.com/XxsHGmrP | Oauth - Pastebin.com
https://tools.ietf.org/html/rfc6819 | RFC 6819 - OAuth 2.0 Threat Model and Security Considerations
https://dhavalkapil.com/blogs/Attacking-the-OAuth-Protocol/ | Attacking the OAuth Protocol - Dhaval Kapil
https://sakurity.com/oauth | Sakurity
https://habr.com/post/150756/#comment_5116061 | Безопасность OAuth2 / Хабр
https://homakov.blogspot.com/2014/02/how-i-hacked-github-again.html | Egor Homakov: How I hacked Github again.
https://homakov.blogspot.com/2012/07/saferweb-most-common-oauth2.html | Egor Homakov: The Most Common OAuth2 Vulnerability
https://homakov.blogspot.com/2014/02/how-i-hacked-github-again.html | Egor Homakov: How I hacked Github again.
https://developer.github.com/apps/building-oauth-apps/authorizing-oauth-apps/ | Authorizing OAuth Apps | GitHub Developer Guide
https://www.reddit.com/r/netsec/comments/1xa5xh/how_i_hacked_github_again/cf9qjcl/ | reddit: the front page of the internet
https://www.reddit.com/r/netsec/comments/5fawzz/all_your_paypal_oauth_tokens_belong_to_me/ | All your Paypal #OAuth tokens belong to me - localhost for the win : netsec
https://www.reddit.com/r/netsec/comments/4lzr29/taking_over_heroku_accounts/ | Taking over Heroku accounts : netsec
http://esevece.github.io/2016/06/01/taking-over-heroku-accounts.html | Site not found · GitHub Pages
https://www.reddit.com/r/netsec/comments/75z8pc/yahoo_bug_bounty_exploiting_oauth/ | Yahoo Bug Bounty: Exploiting OAuth Misconfiguration To Takeover Flickr Accounts : netsec
https://www.reddit.com/r/netsec/comments/6ixco5/authentication_bypass_on_airbnb_via_oauth_tokens/ | Authentication bypass on Airbnb via OAuth tokens theft : netsec
https://www.arneswinnen.net/2017/06/authentication-bypass-on-airbnb-via-oauth-tokens-theft/ | Authentication bypass on Airbnb via OAuth tokens theft – Arne Swinnen's Security Blog
https://arxiv.org/pdf/1601.01229.pdf | () - 1601.01229.pdf
https://www.slideshare.net/illninogiggs/oauth-nightmares-abstract-oauth-nightmares | Oauth Nightmares Abstract OAuth Nightmares
https://blog.ninoishere.com/oauth-2-0/ | oAuth 2.0
http://blog.intothesymmetry.com/2015/06/on-oauth-token-hijacks-for-fun-and.html | On (OAuth) token hijacks for fun and profit part #1 (Google/Microsoft integration)
https://medium.com/@arbazhussain/stealing-0auth-token-mitm-3eeab46e96cf | Stealing 0Auth Token (MITM) – Arbaz Hussain – Medium
https://medium.com/bugbountywriteup/pre-domain-wildcard-cors-exploitation-2d6ac1d4bd30 | Pre-domain wildcard CORS Exploitation – InfoSec Write-ups – Medium
https://portswigger.net/blog/exploiting-cors-misconfigurations-for-bitcoins-and-bounties | Exploiting CORS misconfigurations for Bitcoins and bounties | Blog
https://github.com/Voorivex/pentest-guide | GitHub - Voorivex/pentest-guide: Penetration tests cases, resources and guidelines.
https://codeburst.io/hunting-insecure-direct-object-reference-vulnerabilities-for-fun-and-profit-part-1-f338c6a52782 | Hunting Insecure Direct Object Reference Vulnerabilities for Fun and Profit (PART-1)
https://medium.com/bugbountywriteup/how-i-was-able-to-generate-access-tokens-for-any-facebook-user-6b84392d0342 | How i was able to generate Access Tokens for any Facebook user.
http://blog.intothesymmetry.com/2013/05/oauth-dance-server-side-floow.html | OAuth “dance” - server side flow
http://blog.intothesymmetry.com/2015/06/on-oauth-token-hijacks-for-fun-and.html | On (OAuth) token hijacks for fun and profit part #1 (Google/Microsoft integration)
http://blog.intothesymmetry.com/2015/01/top-5-oauth-2-implementation.html | Top 5 OAuth 2 Implementation Vulnerabilities
http://blog.intothesymmetry.com/2016/11/all-your-paypal-tokens-belong-to-me.html | All your Paypal OAuth tokens belong to me - localhost for the win
https://whitton.io/articles/bypassing-google-authentication-on-periscopes-admin-panel/ | Bypassing Google Authentication on Periscope's Administration Panel – Jack
http://andrisatteka.blogspot.com/2014/09/how-microsoft-is-giving-your-data-to.html | Andris Atteka's Blog: How Microsoft is giving your data to Facebook… and everyone else
http://homakov.blogspot.com/2014/02/how-i-hacked-github-again.html | Egor Homakov: How I hacked Github again.
https://pastebin.com/u/thecreat0r | Thecreat0r's Pastebin - Pastebin.com
https://twitter.com/i/likes | Tweets liked by Shivam Goyal (@g33kyshivam) | Twitter
https://www.pentestpartners.com/security-blog/how-to-exploit-xss-with-csrf/ | How to exploit XSS with CSRF | Pen Test Partners
https://twitter.com/safety/unsafe_link_warning?unsafe_link=https%3A%2F%2Fwww.andmp.com%2F2018%2F12%2Fhow-i-managed-to-get-google.html%3Fm%3D1%23.XAPRIjsoB-8.facebook | t.co/wXv4CyUAXm
https://twitter.com/bonsaiviking/status/1070099535916163073 | Daniel Miller ✝ on Twitter: "Reminder: Nmap isn't super stealthy by default. More info: https://t.co/v2ORQASlPt… "
https://twitter.com/alex_casalboni/status/1070639887865577473 | Alex Casalboni on Twitter: "You asked for hands-on & self-paced material to understand & improve the #security of your #serverless apps. Here you go: https://t.co/aysLxuAUOQ Kudos @angelaw_ruohan @igngar_cloud 👌🙏"
https://publications.europa.eu/flexpaper/common/view.jsp?doc=63138617-f133-11e8-9982-01aa75ed71a1.en.PDF.pdf&user=&format=pdf&page=6 | Handbook on Cybersecurity - 63138617-f133-11e8-9982-01aa75ed71a1.en.PDF.pdf
https://twitter.com/KentGruber/status/1071113393254424577 | Kent Gruber on Twitter: "🌎 How-to setup a free SOCKS proxy w/ @googlecloud on macOS 🍏: 👩💻 1. gcloud alpha cloud-shell ssh --ssh-flag="-D localhost:5000" & 2. networksetup -setsocksfirewallproxy "Wi-Fi" localhost 5000 3. networksetup -setsocksfirewallproxystate "Wi-Fi" on ✨You have a "Google" IP now!"
https://github.com/mthbernardes/rsg | GitHub - mthbernardes/rsg: ReverShellGenerator - A tool to generate various ways to do a reverse shell
https://twitter.com/pwndizzle/status/1071765949399920640 | Alex Davies on Twitter: "Just got RCE on a bounty. Lessons learned - file upload features are dangerous, allowing servers to remotely retrieve files is even more dangerous, the server set the file extension from the content-type which was user controlled, if one type doesn't work try another! #tryharder"
https://lambda.grofers.com/how-we-load-tested-our-apis-in-production-18225ee77f45 | How we load tested our APIs in Production – Lambda - The Grofers Engineering Blog
https://github.com/bl4de/dictionaries | GitHub - bl4de/dictionaries: Misc dictionaries for directory/file enumeration, username enumeration, password dictionary/bruteforce attacks
https://twitter.com/yamakira_/status/1072382154380853250 | Bharath on Twitter: "A one-liner to enumerate subdomains using Wayback Machine and waybackurls by @TomNomNom The results are not particularly exhaustive but quite useful in finding old and forgotten subdomains https://t.co/OBNQwhMueG #OSINT #AppSec… https://t.co/Qhbg1fUcra"
https://techvomit.net/web-application-penetration-testing-notes/ | Web Application Penetration Testing Notes
https://techvomit.net/web-application-penetration-testing-notes/ | Web Application Penetration Testing Notes
https://twitter.com/zapstiko/status/1068476968004476934 | Raihan Biswas ✪ on Twitter: "GitHub Recon Resources:-(Tools-Dorks) https://t.co/ZSv4KjZUzl https://t.co/0uidwevA0k https://t.co/GWulEU6dZe https://t.co/gtvENpqVMd https://t.co/dK4pdqzUau https://t.co/LWcI7UwYCU https://t.co/n1okfPbzpj https://t.co/AUG2xvdsZs https://t.co/BuYseOfTFD https://t.co/ZSv4KjZUzl"
https://twitter.com/adrien_jeanneau | Adrien (@adrien_jeanneau) | Twitter
https://kccna18.sched.com/event/GrZo | KubeCon + CloudNativeCon North America 2018: This Year, It’s About Security - Maya Ka...
https://github.com/dhaval17/awsome-security-write-ups-and-POCs | GitHub - dhaval17/awsome-security-write-ups-and-POCs: Awesome Writeups and POCs
https://twitter.com/honoki/status/1072756995495735298 | π₃ on Twitter: "Instead of using SSRF to peer inside a local network, I used an internal vulnerable server to proxy out traffic to the internet to turn my blind XXE into root-level file read access. Read my write-up on https://t.co/Tv8v1U6AN0 #bugbounty #ssrf #XXE… https://t.co/W4522O1kSY"
https://www.honoki.net/2018/12/from-blind-xxe-to-root-level-file-read-access/ | From blind XXE to root-level file read access | Honoki
https://github.com/sidaf/homebrew-pentest | GitHub - sidaf/homebrew-pentest: Homebrew Tap - Pen Test Tools
https://hackerone.com/reports/404797 | #404797 IDOR to delete images from other stores
https://medium.com/@riccardo.ancarani94/attacking-docker-exposed-api-3e01ffc3c124 | Attacking Docker exposed API – Riccardo Ancarani – Medium
https://blog.riccardoancarani.it/attacking-docker-exposed-api/ | Attacking Docker exposed API
https://hackerone.com/reports/434763 | #434763 Incorrect details on OAuth permissions screen allows DMs to be read without permission
https://blog.avatao.com/How-I-could-steal-your-photos-from-Google/ | How I could have stolen your photos from Google - my first 3 bug bounty writeups
https://medium.com/bugbountywriteup/how-i-was-able-to-generate-access-tokens-for-any-facebook-user-6b84392d0342 | How i was able to generate Access Tokens for any Facebook user.
https://medium.com/bugbountywriteup/how-i-was-able-to-generate-access-tokens-for-any-facebook-user-6b84392d0342 | How i was able to generate Access Tokens for any Facebook user.
https://2018.zeronights.ru/wp-content/uploads/materials/4%20ZN2018%20WV%20-%20BugBounty%20automation.pdf | Презентация PowerPoint - 4 ZN2018 WV - BugBounty automation.pdf
https://medium.com/@adrien_jeanneau/how-i-was-able-to-list-some-internal-information-from-paypal-bugbounty-ca8d217a397c | How I was able to list some internal information from PayPal #BugBounty
https://medium.com/@maxpasqua/unremovable-tags-in-facebook-page-reviews-656e095e69aa | Unremovable Tags In Facebook Page Reviews – Max Pasqua – Medium
https://shkspr.mobi/blog/2018/12/twitter-bug-bounty/ | $3k Bug Bounty – Twitter’s OAuth Mistakes – Terence Eden's Blog
https://github.com/arbazkiraak/Leaks_RegexFilter | GitHub - arbazkiraak/Leaks_RegexFilter: Regex Filter on urls and files
https://twitter.com/phwd | ️ (@phwd) | Twitter
https://twitter.com/TomNomNom/status/1034078311209742336 | TomNomNom on Twitter: "Just added the 'keypairs' option to unfurl (https://t.co/LP6o4ywhRw) to output all the key=value pairs from query strings. Handy if you want to find all possible values for a key; just pipe it into `sort -u` :)"
https://medium.com/@grep_security/session-fixation-broken-authentication-and-session-management-c37ce0111bf5 | Session Fixation — Broken Authentication and Session Management
https://samcurry.net/reading-asp-secrets-for-17000/ | Reading ASP secrets for $17,000 | Sam Curry
https://medium.com/@mylesb/exploiting-a-wordpress-website-with-metasploit-ffa6f4e31e09 | Exploiting a WordPress Website with Metasploit – Myles Braithwaite – Medium
https://twitter.com/s0md3v/status/1075310630314209280 | Somdev Sangwan on Twitter: "CSRF mind map ❤️ Source: https://t.co/dfq6pJL2ip… "
https://payatu.com/csv-injection-basic-to-exploit/ | CSV injection: Basic to Exploit!!!! - payatu
https://www.blackhillsinfosec.com/xml-external-entity-beyond-etcpasswd-fun-profit/ | XML External Entity - Beyond /etc/passwd (For Fun & Profit) - Black Hills Information Security
https://blog.securitybreached.org/2018/09/16/idor-account-takeover-using-facebook/ | IDOR User Account Takeover By Connecting My Facebook Account with victims Account - Security Breached Blog
https://github.com/VKSRC/Github-Monitor | GitHub - VKSRC/Github-Monitor: Github Sensitive Information Leakage Monitor(Github信息泄漏监控系统)
https://twitter.com/LooseSecurity/status/1074287183543058432 | m0z on Twitter: "Honestly, one of the most effective #XSS polyglots is simply: <iframe src="javasc%0a%0dript:alert(0);"> Bypasses most WAF and you can insert line feeds/CRLF characters like I did above to make it more obfuscated. #CyberSecurity #bugbountytip"
https://medium.com/@_bl4de/hidden-directories-and-files-as-a-source-of-sensitive-information-about-web-application-84e5c534e5ad | Hidden directories and files as a source of sensitive information about web application
http://www.vurt.ru/2013/02/python-command-line-oneliners/ | Python command line oneliners
https://www.netsparker.com/blog/web-security/importance-content-type-header-http-requests/ | The Importance of the Content-Type Header | Netsparker
https://blog.netspi.com/playing-content-type-xxe-json-endpoints/ | Playing with Content-Type – XXE on JSON Endpoints
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-09 | draft-ietf-oauth-security-topics-09
https://www.we45.com/blog/3-ways-an-xxe-vulnerability-could-hit-you-hard | 3 WAYS THAT an xxe injection attack COULD HIT YOU HARD!
https://medium.com/@stokochtrubbel/how-to-make-kali-bearable-to-look-at-5593771fafc5 | HOW TO MAKE KALI BEARABLE TO LOOK AT.. – STÖK – Medium
https://www.netsparker.com/whitepaper-http-security-headers/?utm_source=twitter.com&utm_medium=social&utm_content=whitepaper+http+security+headers&utm_campaign=netsparker+social+media | HTTP Security Headers and How They Work: Whitepaper | Netsparker
https://twitter.com/intigriti/status/1078318258661531648 | intigriti on Twitter: "Did you know you can smuggle payloads in a valid e-mail address using round brackets? Thanks for the tip, @securinti! #BugBounty #HackWithIntigriti… https://t.co/HBq2mOIRkT"
https://medium.com/@yogeshtantak7788/how-i-was-able-to-delete-google-gallery-data-idor-53d2f303efff | How I was able to delete Google Gallery Data [IDOR]
http://blog.intigriti.com/2018/12/30/ten-best-write-ups-of-2018/ | The best write-ups 2018 brought us – INTIGRITI
https://medium.com/@armaanpathan/abusing-acl-permissions-to-overwrite-other-users-uploaded-files-videos-on-s3-bucket-162c8877728 | Abusing ACL Permissions to Overwrite other User’s Uploaded Files/Videos on s3 Bucket
https://www.secjuice.com/php-rce-bypass-filters-sanitization-waf/ | Exploit PHP Remotely - WAF Rule & Filter Bypass
https://twitter.com/soaj1664ashar/status/1079791723889475586 | 𝔸𝕤𝕙𝕒𝕣 𝕁𝕒𝕧𝕖𝕕 on Twitter: "Server-Side Request Forgery #SSRF Tools/Stuff https://t.co/Klcxbn7OM8 https://t.co/Pruy3KtHdD https://t.co/bjFjveIwrd https://t.co/yrshScjBEX https://t.co/V2UfVq3Ww6 https://t.co/iHTo6HxW9E https://t.co/sXZTRJssJA https://t.co/1fTRoxrnXZ https://t.co/QDJiUZ4utv"
https://medium.com/@_bl4de/how-to-perform-the-static-analysis-of-website-source-code-with-the-browser-the-beginners-bug-d674828c8d9a | How to perform the static analysis of website source code with the browser — the beginner’s bug…
https://twitter.com/Alra3ees/status/1080276301909504002 | Emad Shanab on Twitter: "List of Recon methodology,Recon tools and Bug Bounty writeups. https://t.co/5CGnrhjWAa https://t.co/v4NTni4aUD https://t.co/RuNAsM2LKJ https://t.co/GGS4M4hC4Y https://t.co/YvyRlNhJvi https://t.co/NdZQeB9Anl https://t.co/k1D2LdrAfu https://t.co/EFvs35eCX8… https://t.co/0og00sFMAh"
https://web.archive.org/web/20180602092807/https://blog.it-securityguard.com/visual-recon-a-beginners-guide/ | [Tools] Visual Recon – A beginners guide | Patrik Fehrenbach
https://twitter.com/Wh11teW0lf/status/1078569346996277249 | Wh11teW0lf on Twitter: "(3/3) #XXE Endpoint Related Articles: https://t.co/5XlnFmVy21 @metasploit : https://t.co/t3qiamIvvN #infosec #bugbounty"
https://blog.ninoishere.com/deserialization-vulnerabilities-lab/ | Deserialization vulnerabilities Lab
https://twitter.com/Hogarth45_ND/status/1019647149645221890 | Jesse Clark on Twitter: "SQLi found in this format: (no spaces allowed, hence the parentheses) See This URL: website｡com/category/Article-Title-1147 Try This: website｡com/category/Article-Title-(1147)and(1=1) Confirm With: website｡com/category/Article-Title-(1147)and(1=2)"
https://github.com/0xRadi/OWASP-Web-Checklist#Information | GitHub - 0xRadi/OWASP-Web-Checklist: OWASP Web Application Security Testing Checklist
https://www.josipfranjkovic.com/blog/hacking-facebook-oculus-integration-csrf | Hacking Facebook accounts using CSRF in Oculus-Facebook integration - Josip Franjković
https://arulkumar.in/multiple-open-url-redirection-vulnerability-in-facebook-worth-1500/ | Multiple Open URL Redirection Vulnerability on Facebook worth $1500
https://twitter.com/ngalongc/status/944128954696335360 | Ron Chan on Twitter: "If you found a RCE on *.yahoo.com that is GET based, try to grab a complete copy of the incoming cookies and send to your server instead of executing id. Cause https://t.co/XUJcNLVwcp scoped their cookies to https://t.co/FsaETObcLM etcc then it worth >= 10k for sure"
https://medium.com/bugbountywriteup/how-to-brute-force-efficiently-without-burp-pro-1bb2a414a09f | How to brute force efficiently without Burp Pro – InfoSec Write-ups – Medium
https://twitter.com/_sbzo/status/986065763181256706 | RLobo on Twitter: "This video and this blog show how DOM-XSS works. Good references. https://t.co/TCg0wBDkVM… "
https://twitter.com/uraniumhacker/status/987573987818422272 | Uranium238 on Twitter: "#bugbountytips: Want to find employees of a company on github? Use this: https://t.co/E82rIdbZPx{COMPANY_NAME}-&type=Users. This will help to find any users who have "company_name-" in their name. Most of the time these accounts are employee accounts or is company owned."
https://twitter.com/EdOverflow/status/986214497965740032 | Ed on Twitter: "Bug bounty tip: Look for GitLab instances on targets or belonging to the target. When you stumble across the GitLab login panel (/users/sign_in), navigate to `/explore`. Once you get in, use the search function to find passwords, keys, etc.… https://t.co/reTSzMt6tM"
https://blog.ninoishere.com/deserialization-vulnerabilities-lab/ | Deserialization vulnerabilities Lab
https://twitter.com/Hogarth45_ND/status/1019647149645221890 | Jesse Clark on Twitter: "SQLi found in this format: (no spaces allowed, hence the parentheses) See This URL: website｡com/category/Article-Title-1147 Try This: website｡com/category/Article-Title-(1147)and(1=1) Confirm With: website｡com/category/Article-Title-(1147)and(1=2)"
https://buer.haus/breport/ | Bounty Report Generator
https://buer.haus/csrfgen/?targetUrl=https%3A%2F%2Fwww.google.com%2F&method=GET&encType=application%2Fx-www-form-urlencoded&inputName[]=foo&inputType[]=hidden&inputVal[]=bar&inputName[]=test&inputType[]=hidden&inputVal[]=test2&iframe=true | CSRFGen v1.02
https://github.com/0xRadi/OWASP-Web-Checklist#Information | GitHub - 0xRadi/OWASP-Web-Checklist: OWASP Web Application Security Testing Checklist
https://laconicwolf.com/2018/08/22/5-ways-to-enumerate-usernames-in-web-applications/ | 5 ways to enumerate usernames in web applications - Laconic Wolf
https://www.josipfranjkovic.com/blog/hacking-facebook-oculus-integration-csrf | Hacking Facebook accounts using CSRF in Oculus-Facebook integration - Josip Franjković
https://arulkumar.in/multiple-open-url-redirection-vulnerability-in-facebook-worth-1500/ | Multiple Open URL Redirection Vulnerability on Facebook worth $1500
https://twitter.com/ngalongc/status/944128954696335360 | Ron Chan on Twitter: "If you found a RCE on *.yahoo.com that is GET based, try to grab a complete copy of the incoming cookies and send to your server instead of executing id. Cause https://t.co/XUJcNLVwcp scoped their cookies to https://t.co/FsaETObcLM etcc then it worth >= 10k for sure"
https://si9int.sh/article/5 | SI9INT
https://medium.com/bugbountywriteup/how-to-brute-force-efficiently-without-burp-pro-1bb2a414a09f | How to brute force efficiently without Burp Pro – InfoSec Write-ups – Medium
https://pastebin.com/mkkYy4gj | blogs ========================= https://blog.mallardlabs.com http://c0rni3sm. - Pastebin.com
https://twitter.com/_sbzo/status/986065763181256706 | RLobo on Twitter: "This video and this blog show how DOM-XSS works. Good references. https://t.co/TCg0wBDkVM… "
https://brutelogic.com.br/blog/dom-based-xss-the-3-sinks/ | DOM-based XSS - The 3 Sinks - Brute XSS
https://twitter.com/uraniumhacker/status/987573987818422272 | Uranium238 on Twitter: "#bugbountytips: Want to find employees of a company on github? Use this: https://t.co/E82rIdbZPx{COMPANY_NAME}-&type=Users. This will help to find any users who have "company_name-" in their name. Most of the time these accounts are employee accounts or is company owned."
https://twitter.com/EdOverflow/status/986214497965740032 | Ed on Twitter: "Bug bounty tip: Look for GitLab instances on targets or belonging to the target. When you stumble across the GitLab login panel (/users/sign_in), navigate to `/explore`. Once you get in, use the search function to find passwords, keys, etc.… https://t.co/reTSzMt6tM"
https://pastebin.com/hX7rLWUC | Header-Secuirty - Pastebin.com
https://twitter.com/ldionmarcil/status/982390041099034625 | Louis Dion-Marcil on Twitter: "Shout out to @0xSobky, whose XSS polyglot helped me discover this. By far my favorite XSS payload. https://t.co/5P2OpryDra"
https://github.com/0xsobky/HackVault/wiki/Unleashing-an-Ultimate-XSS-Polyglot | Unleashing an Ultimate XSS Polyglot · 0xSobky/HackVault Wiki · GitHub
https://postimg.org/image/8qa4jjd1b/ | Problem loading page
https://www.blackhat.com/docs/eu-16/materials/eu-16-Yang-Signing-Into-Billion-Mobile-Apps-Effortlessly-With-OAuth20.pdf?from=timeline&isappinstalled=1 | BlackHatEurope2016 - eu-16-Yang-Signing-Into-Billion-Mobile-Apps-Effortlessly-With-OAuth20.pdf
https://pastebin.com/edit/hLxY1zvb | Edit Paste: hLxY1zvb - Pastebin.com
https://cloud.app.box.com/s/9xgb9yzfcgla5hsd7bdltl78k74dzot7 | OAuth nightmares-public slides.pptx | Powered by Box
https://www.troyhunt.com/10-personal-finance-lessons-for-technology-professionals/ | Troy Hunt: 10 Personal Finance Lessons for Technology Professionals
https://github.com/foospidy/payloads | GitHub - foospidy/payloads: Git All the Payloads! A collection of web attack payloads.
https://hacks.mozilla.org/2018/03/es-modules-a-cartoon-deep-dive/?fbclid=IwAR2ITBMgSWJ1X9Qol9sxBsy1IHU1vd44cas4hhY4ku1iyNPrHtGNA_uWs_0 | ES modules: A cartoon deep-dive - Mozilla Hacks - the Web developer blog
https://www.ietf.org/id/draft-ietf-oauth-security-topics-11.txt | ietf.org/id/draft-ietf-oauth-security-topics-11.txt
https://www.youtube.com/watch?v=Pth9cupMTWQ | (11) Security OAuth 2.0 by Jonathon Brookfield and Fraser Winterborn - YouTube
https://linuxhandbook.com/curl-command-examples/ | CURL Command in Linux [21 Practical Examples]
https://www.youtube.com/watch?v=JC7tg5bgYOo&t=693s | (11) BSidesMCR 2018: Securing OAuth 2.0 For Native Apps by Jonathon Brookfield and Fraser Winterborn - YouTube
https://hackerone.com/reports/143717 | #143717 Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)
https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Methodology_and_enumeration.md | PayloadsAllTheThings/Methodology_and_enumeration.md at master · swisskyrepo/PayloadsAllTheThings · GitHub
https://medium.com/bugbountywriteup/how-i-was-able-to-generate-access-tokens-for-any-facebook-user-6b84392d0342 | How i was able to generate Access Tokens for any Facebook user.
https://pastebin.com/WJCBTsDN | BEST-RESOURCE - Pastebin.com
https://pastebin.com/E1HAEFZf | My-Recon-Guide - Pastebin.com
http://blkstone.github.io/2017/06/29/web-for-pentester-xxe/ | Web for Pentester XXE解析 // Neurohazard
https://support.mozilla.org/en-US/kb/make-firefox-your-default-browser | Make Firefox your default browser | Firefox Help
http://blkstone.github.io/2017/06/24/web-for-pentester-sqli/ | Web for Pentester SQLi write up // Neurohazard
https://medium.com/bugbountyhunting/bug-bounty-hunting-tips-2-target-their-mobile-apps-android-edition-f88a9f383fcc | Bug Bounty Hunting Tips #2 —Target their mobile apps (Android Edition)
https://s0cket7.com/picoctf-web/ | Pico CTF 2018 Web Exploitation Writeup – s0cket7
https://s0cket7.com/idor-account-takeover/ | IDOR leads to account takeover – s0cket7
https://pastebin.com/c6WQw2q9 | [Markdown] Open-Redirect - Pastebin.com
https://pentester.land/cheatsheets/2018/11/02/open-redirect-cheatsheet.html | Open Redirect Cheat Sheet · Pentester Land
https://ngailong.wordpress.com/2017/08/07/uber-login-csrf-open-redirect-account-takeover/ | [Uber 8k Bug] Login CSRF + Open Redirect = Account Take Over – Ron Chan
https://ngailong.wordpress.com/2017/11/22/uber-redirect_uri-is-difficult-to-do-it-right/ | [Uber] redirect_uri is difficult to do it right – Ron Chan
https://www.linkedin.com/?trk=aff_src.aff-lilpar_c.partners_pkw.10078_net.mediapartner_plc.Skimbit%20Ltd._pcrid.449670_learning&veh=aff_src.aff-lilpar_c.partners_pkw.10078_net.mediapartner_plc.Skimbit%20Ltd._pcrid.449670_learning&irgwc=1 | LinkedIn: Log In or Sign Up
https://ngailong.wordpress.com/2017/11/01/1k-per-day-challenge-earning-30k-in-30-days/ | 1k Per Day Challenge — Earning 30k in 30 Days – Ron Chan
https://www.linkedin.com/pulse/my-50k-personal-challenge-results-mark-litchfield | My $50k Personal Challenge - Results
https://ngailong.wordpress.com/2017/08/07/uber-login-csrf-open-redirect-account-takeover/ | [Uber 8k Bug] Login CSRF + Open Redirect = Account Take Over – Ron Chan
https://www.arneswinnen.net/2017/06/authentication-bypass-on-airbnb-via-oauth-tokens-theft/ | Authentication bypass on Airbnb via OAuth tokens theft – Arne Swinnen's Security Blog
https://ngailong.wordpress.com/ | Ron Chan – My Bug Bounty Write Ups
https://github.com/ak1t4/open-redirect-scanner | GitHub - ak1t4/open-redirect-scanner: open redirect subdomains scanner
https://blog.ninoishere.com/oauth-2-0/ | oAuth 2.0
https://blog.ninoishere.com/from-open-redirect-to-account-takeover-part-ii/ | From Open Redirect to Account Takeover Part II
https://blog.ninoishere.com/from-open-redirect-to-account-takeover/ | From Open Redirect to Account Takeover
https://yassineaboukir.com/blog/how-i-discovered-a-1000-open-redirect-in-facebook/ | How I discovered a 1000$ open redirect in Facebook | Yassine ABOUKIR
https://www.indusface.com/blog/owasp-top-vulnerabilities/#A7-_Missing_Function_Level_Access_Control | OWASP Top 10 Vulnerabilities 2018 - Indusface Blog
https://support.portswigger.net/customer/portal/articles/1965733-using-burp-to-test-for-open-redirections | Using Burp to Test for Open Redirections | Burp Suite Support Center
https://twitter.com/ | (*) Twitter
https://appsecwiki.com/#/mobilesecurity?id=reportswriteups | Mobile Security - Application Security Wiki
https://hackerone.com/bagipro?sort_type=latest_disclosable_activity_at&filter=type%3Aall%20from%3Abagipro&querystring=&page=1 | bagipro's HackerOne Profile
https://dev.to/search?q=oauth | Search Results - DEV Community 👩💻👨💻
https://dev.to/simov/oauth-simplified-2pbd | OAuth Simplified - DEV Community 👩💻👨💻
https://dev.to/oktadev/stolen-access-tokens-and-you-3gan | Stolen Access Tokens and You - DEV Community 👩💻👨💻
https://dev.to/tomerbendavid/my-security-notes-37fh | Basic Auth, SAML, Keys, OAuth, JWT and Tokens Quicky - DEV Community 👩💻👨💻
https://dev.to/rhymes/a-good-reason-not-to-use-oauth-only-accounts-in-your-apps-3on1 | A good reason not to use OAuth only accounts in your apps - DEV Community 👩💻👨💻
https://dev.to/anabella/dancing-with-oauth-emp | Dancing with OAuth: a step by step guide - DEV Community 👩💻👨💻
https://dev.to/antonfrattaroli/oauth-tips-for-the-uninitiated-476e | OAuth Tips for the Uninitiated - DEV Community 👩💻👨💻
https://www.youtube.com/watch?v=bvBsRalZoNc | JWT - YouTube
https://www.youtube.com/watch?v=K6pwjJ5h0Gg | (1) How does JWT work - YouTube
https://medium.com/@darutk/the-simplest-guide-to-oauth-2-0-8c71bd9a15bb | The Simplest Guide To OAuth 2.0 – Takahiko Kawasaki – Medium
https://medium.com/@darutk/diagrams-and-movies-of-all-the-oauth-2-0-flows-194f3c3ade85 | Diagrams And Movies Of All The OAuth 2.0 Flows – Takahiko Kawasaki – Medium
https://appsecwiki.com/#/serversidesecurity?id=oauth-security | Server Side Security - Application Security Wiki
https://github.com/doyensec/graph-ql | doyensec/graph-ql: GraphQL Security Research Material
https://www.ietf.org/id/draft-ietf-oauth-security-topics-11.txt | https://www.ietf.org/id/draft-ietf-oauth-security-topics-11.txt
http://blog.intothesymmetry.com/2015/12/top-10-oauth-2-implementation.html | Top 10 OAuth 2 Implementation Vulnerabilities
https://sakurity.com/oauth | Sakurity
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/OAuth | PayloadsAllTheThings/OAuth at master · swisskyrepo/PayloadsAllTheThings
http://homakov.blogspot.com/2014/02/how-i-hacked-github-again.html | Egor Homakov: How I hacked Github again.
http://andrisatteka.blogspot.com/2014/09/how-microsoft-is-giving-your-data-to.html | Andris Atteka's Blog: How Microsoft is giving your data to Facebook… and everyone else
https://whitton.io/articles/bypassing-google-authentication-on-periscopes-admin-panel/ | Bypassing Google Authentication on Periscope's Administration Panel – Jack
http://blog.intothesymmetry.com/2015/12/top-10-oauth-2-implementation.html | Top 10 OAuth 2 Implementation Vulnerabilities
http://blog.intothesymmetry.com/2014/02/oauth-2-attacks-and-bug-bounties.html | OAuth 2 attacks and bug bounties - The Postman Always Rings Twice
http://blog.intothesymmetry.com/search?updated-max=2013-05-01T11:04:00-07:00&max-results=7&start=40&by-date=false | Into the symmetry
http://blog.intothesymmetry.com/2017/05/oauth-worm-ii-revenge.html | OAuth Worm II - The revenge
http://blog.intothesymmetry.com/2016/11/all-your-paypal-tokens-belong-to-me.html | All your Paypal OAuth tokens belong to me - localhost for the win
http://blog.intothesymmetry.com/2016/06/native-applications-with-oauth-2.html | Native applications with OAuth 2
http://blog.intothesymmetry.com/2016/05/holy-redirecturi-batman.html | Holy redirect_uri Batman!
http://blog.intothesymmetry.com/2015/10/on-oauth-token-hijacks-for-fun-and.html | On (OAuth) token hijacks for fun and profit part #2 (Microsoft/xxx integration)
http://blog.intothesymmetry.com/2015/09/new-oauth-book-oauth-2-in-action.html | New OAuth book: OAuth 2 in Action
http://blog.intothesymmetry.com/2015/06/on-oauth-token-hijacks-for-fun-and.html | On (OAuth) token hijacks for fun and profit part #1 (Google/Microsoft integration)
http://blog.intothesymmetry.com/2015/01/top-5-oauth-2-implementation.html | Top 5 OAuth 2 Implementation Vulnerabilities
http://blog.intothesymmetry.com/2014/04/oauth-2-how-i-have-hacked-facebook.html | OAuth 2 - How I have hacked Facebook again (..and would have stolen a valid access token)
http://blog.intothesymmetry.com/2013/05/oauth-dance-server-side-floow.html | OAuth “dance” - server side flow
https://www.youtube.com/watch?v=yPp22irc5Q0 | How OAuth Works - YouTube
https://www.youtube.com/watch?v=_xrhWLqX1j0 | OAuth CSRF & the 'state' parameter - YouTube
https://www.youtube.com/watch?v=Pth9cupMTWQ | Security OAuth 2.0 by Jonathon Brookfield and Fraser Winterborn - YouTube
https://www.youtube.com/watch?v=tbllIrgNUpQ | OAuth 2.0 “state” parameter used for security purposes - YouTube
https://handouts.secappdev.org/handouts/2017/Jim%20Manico/04a.%20OAUTH%20Security%20Introduction%20MODULE%202-9-2017.pdf | 04a. OAUTH Security Introduction MODULE 2-9-2017
https://www.owasp.org/images/6/61/20151215-Top_X_OAuth_2_Hacks-asanso.pdf | 20151215-Top_X_OAuth_2_Hacks-asanso.pdf
https://www.youtube.com/watch?v=aIFRvSxIZ0k&index=2&list=PLE8DZa6PJapwu3PPr9kj2iWC-tDVBY_Sd | (1) OAuth 2.0 Security Introduction - Jim Manico - YouTube
https://www.youtube.com/watch?v=CHodPpqLqG8&list=PL4cUxeGkcC9jdm7QX143aMLAqyM-jTZ2x | (1) OAuth Login (Passport.js) Tutorial #2 - The OAuth Flow - YouTube
https://drive.google.com/file/d/1Qw3hhValdRAWNGJtLbbFYfKtaevkw4fQ/view | Hacking_OAuth2_0_for_fun_and_profit-Pranav_Hivarekar.pdf - Google Drive
https://www.youtube.com/results?search_query=owasp+switzerland | (1) owasp switzerland - YouTube
https://www.youtube.com/watch?v=VrGrpcttU8U | Christmas 2018: If Sara Ali Khan was Santa! - YouTube
https://www.youtube.com/watch?v=_wXQW-dIyL8 | (1) Cracking JWT tokens (...) - Luciano Mammino - Codemotion Milan 2017 - YouTube
https://www.perspectiverisk.com/mysql-sql-injection-practical-cheat-sheet/ | MySQL SQL Injection Practical Cheat Sheet - Perspective Risk
https://www.jpsecnetworks.com/week-11-oscp-preparation-sql-injection/ | Week 11 – OSCP Preparation / SQL Injection 2018-11-26 00:16:18
https://www.hackersclub.io/single-post/2016/02/12/Advanced-SQL-Injection | Advanced SQL Injection | hackerclub
https://github.com/qazbnm456/awesome-web-security/blob/master/README.md#practices-xss | awesome-web-security/README.md at master · qazbnm456/awesome-web-security
https://appsecwiki.com/#/frontend | Frontend Security - Application Security Wiki
https://web.archive.org/web/20170724200429/http://teamultimate.in:80/sql-injection-explained/ | SQL Injection Explained From Scratch - Ultimate Hackers
https://web.archive.org/web/20170728042623/http://teamultimate.in:80/category/hacking-tutorials/sql-injection | SQL Injection Category - Ultimate Hackers
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/sqlmap-tricks-for-advanced-sql-injection/ | Sqlmap Tricks for Advanced SQL Injection | Trustwave | SpiderLabs | Trustwave
https://stealingthe.network/efficient-time-based-blind-sql-injection-using-mysql-bit-functions-and-operators/ | Efficient Time Based Blind SQL Injection using MySQL Bit Functions and Operators – Stealing the Network
https://dl.packetstormsecurity.net/papers/database/SQLi_Insert.pdf | SQLi_Insert.pdf
http://kb.entersoft.co.in/vulnerabilities/blind-sql-injection.html | Blind Sql Injection
https://blog.netspi.com/netspi-sql-injection-wiki/ | NetSPI SQL Injection Wiki
https://labs.detectify.com/2017/02/14/sqli-in-insert-worse-than-select/ | SQLi in INSERT worse than SELECT
https://pentestlab.blog/2012/12/24/sql-injection-authentication-bypass-cheat-sheet/ | SQL Injection Authentication Bypass Cheat Sheet | Penetration Testing Lab
https://mahmoudsec.blogspot.com/2017/02/sql-injection-in-update-query-bug.html | Mahmoud Gamal - Security Blogs: SQL injection in an UPDATE query - a bug bounty story!
https://web.archive.org/web/20170728045932/http://teamultimate.in:80/login-bypass-with-sql-injection | Login Bypass With SQL Injection - Ultimate Hackers
https://somdev.me/sql-basics-for-sqli/ | Learn SQL for SQL Injection in 10 minutes – Somdev Sangwan
https://www.hackersclub.io/single-post/2016/02/12/Advanced-SQL-Injection | Advanced SQL Injection | hackerclub
https://jtnydv.xyz/2018/12/25/preliminary-sql-injection-part-1/ | Preliminary SQL Injection (Part 1) – Jatin Yadav
https://jtnydv.xyz/2018/12/27/preliminary-sql-injection-part-2/ | Preliminary SQL Injection (Part 2) – Jatin Yadav
https://medium.com/@tomnomnom/making-a-blind-sql-injection-a-little-less-blind-428dcb614ba8 | Making a Blind SQL Injection a Little Less Blind – TomNomNom – Medium
https://hackerone.com/reports/383127 | #383127 SQL Injection in report_xml.php through countryFilter[] parameter
https://hackerone.com/reports/310280 | #310280 [Informational] Possible SQL Injection in inc/ajax-actions-frontend.php
https://blog.usejournal.com/bugbounty-database-hacked-of-indias-popular-sports-company-bypassing-host-header-to-sql-7b9af997c610 | #BugBounty —” Database hacked of India’s Popular Sports company”-Bypassing Host Header to SQL…
https://medium.com/@nuraalamdipu/union-based-sql-injection-write-up-a-private-company-site-273f89a49ed9 | Union Based Sql injection Write up ->A private Company Site
https://hackerone.com/reports/300176 | #300176 [https://reviews.zomato.com] Time Based SQL Injection
https://stealingthe.network/efficient-time-based-blind-sql-injection-using-mysql-bit-functions-and-operators/ | Efficient Time Based Blind SQL Injection using MySQL Bit Functions and Operators – Stealing the Network
https://hackerone.com/reports/258582 | #258582 [www.zomato.com] Union SQLi + Waf Bypass
https://gerbenjavado.com/the-race-to-the-top-of-a-bug-bounty-program/ | The race to the top of a bug bounty program
https://github.com/GerbenJavado/LinkFinder | GerbenJavado/LinkFinder: A python script that finds endpoints in JavaScript files
https://forum.bugcrowd.com/t/sqlmap-tamper-scripts-sql-injection-and-waf-bypass/423 | SQLMap Tamper Scripts (SQL Injection and WAF bypass) - Security Research / Tools Discussion - Bugcrowd Forum
https://forum.bugcrowd.com/t/researcher-resources-tutorials/370 | Researcher Resources - Tutorials - Security Research - Bugcrowd Forum
http://sqlzoo.net/hack/ | SQL Injection Attack
https://mega.nz/?fbclid=IwAR2N_8FsXH8H53kXz45vnzJmbtiKitLHMxgwQc2yvdCRuiv26eSpIhsG3Ck#F!PJoR0LjD!SiNo4g78sKAIhoTWO-7xgQ!PV4HAbzA | MEGA
https://github.com/mike-works/modern-javascript | mike-works/modern-javascript: 👨🏫 Mike's Modern JavaScript course
https://drive.google.com/file/d/0B7LIdu29tPZROU9tMGR5WjlGZDA/view | Modern JavaScript.pdf - Google Drive
https://bugid.skylined.nl/20181017001.html | Fuzz in sixty seconds
https://pentester.land/conference-notes/2018/10/17/levelup-2018-practical-recon-techniques-for-bug-hunters-and-pentesters.html | Conference notes: Practical recon techniques for bug hunters & pen testers (LevelUp 0x02 / 2018) · Pentester Land
https://pentester.land/tips-and-tricks | Tips & Tricks · Pentester Land
https://pentester.land/tips-n-tricks/2018/08/16/cloud-vps-providers-for-bug-hunters.html | Cloud VPS providers for pentesters and bug hunters · Pentester Land
https://pentester.land/conference-notes/2018/08/02/levelup-2018-the-bug-hunters-methodology-v3.html | Conference notes: The Bug Hunters Methodology v3(ish) (LevelUp 0x02 / 2018) · Pentester Land
https://blog.it-securityguard.com/tag/bug-bounty/ | bug bounty | Patrik Fehrenbach
https://gist.github.com/dexbyte/fb13e994ad180ce86c654cae1ce7d14f | DigitalOcean Coupon Code $35 / $100 1 Year Free Trial - December 2018
https://www.peerlyst.com/posts/the-how-to-use-nmap-wiki-peerlyst?utm_campaign=peerlyst_shared_post&utm_content=peerlyst_post&utm_medium=social&utm_source=twitter | The "how to use NMAP" wiki by Peerlyst - training, course, nmap scripting engine
https://github.com/sectalks/sectalks | sectalks/sectalks: CTFs, solutions and presentations
https://www.youtube.com/watch?v=OaXEDgW8SUE&index=25&list=PLv7cogHXoVhXvHPzIl1dWtBiYUAL8baHj | (30) 25- BurpSuite Tabs part 1 - YouTube
https://enciphers.com/the-art-of-hacking-delhi-edition-web-application-hacking-basic-level/ | The Art Of Hacking (Delhi Edition) : Web Application Hacking – Basic Level – Enciphers
https://enciphers.com/wp-content/uploads/2018/10/CORS_POC.pdf | CORS_POC.pdf
https://enciphers.com/wp-content/uploads/2018/10/Web-Application-Penetration-Testing-Checklist.pdf | Webapp
https://enciphers.com/wp-content/uploads/2018/10/Resources.pdf | Resources.pdf
https://www.youtube.com/ | (29) YouTube
https://www.youtube.com/watch?v=NFRy89r4zKc | (29) Superman Destroys The World Engine | Man of Steel (2013) Movie Clip - YouTube
https://medium.com/ehsahil/ctf-walkthrough-hacken-cup-2018-1b48b0fd96c | CTF Walkthrough — Hacken Cup 2018 – ehsahil – Medium
http://www.geekboy.ninja/blog/airbnb-bug-bounty-turning-self-xss-into-good-xss-2/ | AirBnb Bug Bounty: Turning Self-XSS into Good-XSS #2 | Geekboy | Security Researcher
https://github.com/jonluca/Anubis | jonluca/Anubis: Subdomain enumeration and information gathering tool
https://www.anshumanbhartiya.com/2018/01/07/tko-subs/ | Anshuman Bhartiya|Open Sourcing tko-subs
https://www.anshumanbhartiya.com/2014/12/18/hidden-feature-in-slack-leads-to-unauthorized-information-leakage-of-files/ | Anshuman Bhartiya|Hidden Feature in Slack leads to Unauthorized Information Leakage of Files
https://www.anshumanbhartiya.com/2015/03/11/static-token-used-for-authentication-in-the-slack-ios-application/ | Anshuman Bhartiya|Static Token used for authentication in the Slack iOS application
https://www.anshumanbhartiya.com/2015/04/15/account-hijacking-in-indeed/ | Anshuman Bhartiya|Account Hijacking in Indeed
https://www.anshumanbhartiya.com/2015/04/30/a-csrf-protection-bypass-technique/ | Anshuman Bhartiya|A CSRF Protection Bypass Technique
https://www.anshumanbhartiya.com/2018/01/07/git-all-secrets/ | Anshuman Bhartiya|Open Sourcing git-all-secrets
https://github.com/anshumanbh/kubebot | anshumanbh/kubebot: A security testing Slackbot built with a Kubernetes backend on the Google Cloud Platform
https://github.com/anshumanbh | anshumanbh (Anshuman Bhartiya)
https://bugbountyworld.com/slack-links-archive/links/ | Slack Links Archive - Bug Bounty World
https://www.youtube.com/watch?v=adWzygDdQLw | (29) BsidesWLG 2017 - Glenn 'devalias' Grant - Gophers, whales and.. clouds? Oh my! - YouTube
https://github.com/0xdevalias/gopherblazer | 0xdevalias/gopherblazer: PoC's and Slides from 'Gophers, whales and.. clouds? Oh my!' BSides Wellington presentation by Glenn 'devalias' Grant
https://www.anshumanbhartiya.com/ | Anshuman Bhartiya
https://cloud.google.com/blog/products/gcp/exploring-container-security-an-overview | Exploring container security: An overview | Google Cloud Blog
http://10degres.net/why-bugbounty/ | Why Bug Bounty – Gwendal Le Coguic
https://speakerdeck.com/bountymachine/bug-bounty-hunting-on-steroids | Bug Bounty Hunting on Steroids - Speaker Deck
https://medium.com/@bountymachine/introducing-bountymachine-234cad93b5d2 | Introducing BountyMachine – BountyMachine – Medium
https://www.jeremydaly.com/event-injection-a-new-serverless-attack-vector/ | Event Injection: A New Serverless Attack Vector - Jeremy Daly
https://twitter.com/BsidesSD | BSides San Diego (@BsidesSD) | Twitter
https://boards.greenhouse.io/nuna/#.Ws8QPa9lCaN | Jobs at Nuna
https://www.youtube.com/watch?v=C-Z0XY352H4 | (29) Expl(IoT): Hacking IoT like a boss by: Aseem Jakhar - YouTube
https://www.youtube.com/watch?v=PGWp1RlYjTg | (29) Bug Bounty Hunting on Steroids by: Anshuman Bhartiya - YouTube
https://www.youtube.com/watch?v=s_1b7FSB-fI | (29) Bypass 2FA Stealing Private Keys by: Maxwell Koh - YouTube
https://www.youtube.com/watch?v=ln1EyJpJKjo | (29) Data Driven Web Hacking & Manual Testing by: Jason Haddix - YouTube
https://www.youtube.com/watch?v=Matw7umL9w4 | (29) ROOTCON 10 Remote Code Execution via Java Native Deserialization by David Jorm - YouTube
https://blog.secureideas.com/2014/02/announcing-burp-co2.html | Announcing Burp Co2! – Professionally Evil Insights
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/sqlmap-tricks-for-advanced-sql-injection/ | Sqlmap Tricks for Advanced SQL Injection | Trustwave | SpiderLabs | Trustwave
https://www.youtube.com/results?search_query=SSRF+bugcrowd+university | (29) SSRF bugcrowd university - YouTube
https://www.youtube.com/watch?v=GxkuBFUfnL8&list=PL9fPq3eQfaaCkilMUOZD4Tnvr8T9bFgjH&index=15 | (29) DEF CON 26 RECON VILLAGE - mgianarakis - Supercharge Your Web Recon With Commonspeak - YouTube
https://www.youtube.com/watch?v=7WYjSDZxFYc&list=PL9fPq3eQfaaCkilMUOZD4Tnvr8T9bFgjH&index=20 | (29) DEF CON 26 RECON VILLAGE - Anshuman Bhartiya, Glenn Grant - Bug Bounty Hunting on Steroids - YouTube
https://www.youtube.com/watch?v=1j6MNApbYtE&list=PL9fPq3eQfaaCkilMUOZD4Tnvr8T9bFgjH&index=24 | (29) DEF CON 26 RECON VILLAGE - jhaddix - Emergent Recon fresh methodology and tools for hackers in 201 - YouTube
https://www.youtube.com/watch?v=1WWb2HOqjcU | (29) #HITB2018AMS D1T1 - Fuzzing Javascript Engines for Fun and Pwnage - Areum Lee & Jeonghoon Shin - YouTube
https://www.youtube.com/watch?v=wPepicuHDzs | (29) #HITB2018AMS D1T1 - Brida: When Burp Suite meets Frida - Federico Dotta & Piergiovanni Cipolloni - YouTube
https://www.youtube.com/watch?v=Ii0ENuigBSM | (29) #HITB2018AMS CommSec D1 - A Deep Dive Into Malicious Documents - Josh Stroschein - YouTube
https://www.youtube.com/watch?v=JvQYTiu3ink | (29) #HITBGSEC 2017 CommSec D2 - 2FAssassin: Bypass 2FA, Stealing Private Keys, And More - Maxwell Koh - YouTube
https://www.youtube.com/watch?v=nHY0cWTMvO4 | (29) #HITBGSEC 2017 CommSec D2 - Searching For A Needle In A Remote Haystack - Vitaly Kamluk & Wayne Lee - YouTube
https://www.youtube.com/watch?v=gONh9FMKb7Q | (29) #HITB2018DXB D1T2: Gold Digging: Discovering Hidden Gems In APKs - Marc Schoenefeld - YouTube
https://www.youtube.com/watch?v=Cg-_TLdfUGw | (29) BSides Dubai 2018: Creating Browser Extensions To Hunt For Low-Hanging Fruit - Rewanth Cool - YouTube
https://twitter.com/anshuman_bh/status/995206192757555200 | Anshuman Bhartiya on Twitter: "Q - "Which tool is the best for subdomain enumeration?" There is no 1 tool that is the best AFAIK. The best bet (if you are super paranoid like me on missing out on any subdomain) is to run em all or at least the ones you know are good. This is what my workflow looks like!… https://t.co/kAcKQ38R6z"
https://medium.com/@raushanraj_65039/google-clickjacking-6a04132b918a | Clickjackings in Google worth 14981.7$ – Raushan Raj – Medium
https://medium.com/@raushanraj_65039/google-sites-and-exploiting-same-origin-policy-d400bf569964 | Google sites and exploiting same origin policy. – Raushan Raj – Medium
https://medium.com/@raushanraj_65039/clickjacking-in-google-docs-and-voice-typing-feature-c481d00b020a | Clickjacking in Google Docs and Voice typing feature.
https://medium.com/@raushanraj_65039/facebook-bug-bounty-reports-1c1b8b55c050 | Facebook Bug Bounty Reports – Raushan Raj – Medium
https://medium.com/@raushanraj_65039/clickjacking-in-google-docs-and-voice-typing-feature-c481d00b020a | Clickjacking in Google Docs and Voice typing feature.
https://pastebin.com/E1HAEFZf | My-Recon-Guide - Pastebin.com
https://www.youtube.com/watch?v=moz05bVQMes | Facebook graph API vs Graphql ! Why ethical hackers work on graphql ? - YouTube
https://www.youtube.com/watch?v=o9hT7v0OLJc | JWT vs Cookies for Authentication - YouTube
https://discordapp.com/channels/446854611937263616/446854611937263619 | Discord
https://www.youtube.com/watch?v=qTuzLjENKGs | Invalidating sessions across multiple devices - YouTube
https://www.youtube.com/watch?v=yPp22irc5Q0 | How OAuth Works - YouTube
https://www.youtube.com/watch?v=CtGnzr8KAoI | Facebook massive accounts hack | Data getting sold on dark web | FB to be fined ? - YouTube
https://www.youtube.com/watch?v=_xrhWLqX1j0 | OAuth CSRF & the 'state' parameter - YouTube
https://www.youtube.com/watch?v=Pth9cupMTWQ | Security OAuth 2.0 by Jonathon Brookfield and Fraser Winterborn - YouTube
https://www.youtube.com/channel/UCdnz7EZERHqmluR8RC2Y8pA/videos | BSides Leeds - YouTube
https://www.youtube.com/watch?v=DvS_ew77GXA | Passive-ish Recon Techniques by Tom Hudson - YouTube
https://www.youtube.com/watch?v=mGUsCAWwLGg | Performing JavaScript Static Analysis by Lewis Ardern - YouTube
https://www.youtube.com/watch?v=tbllIrgNUpQ | OAuth 2.0 “state” parameter used for security purposes - YouTube
https://stealingthe.network/efficient-time-based-blind-sql-injection-using-mysql-bit-functions-and-operators/ | Efficient Time Based Blind SQL Injection using MySQL Bit Functions and Operators – Stealing the Network
http://blog.orange.tw/2017/01/bug-bounty-github-enterprise-sql-injection.html | Orange: GitHub Enterprise SQL Injection
https://pentesterlab.com/exercises/from_sqli_to_shell/course | [PentesterLab]
https://dl.packetstormsecurity.net/papers/database/SQLi_Insert.pdf | SQLi_Insert.pdf
https://pastebin.com/UpxiJyEP | mobile - Pastebin.com
https://medium.com/@AkshaySharmaUS/open-redirects-security-done-right-e524a3185496 | Open Redirects & Security Done Right! – Akshay ‘Ax’ Sharma – Medium
https://x1m.nl/posts/android-app-testing-part-1/ | Bug Bounty & Android Applications - Part 1 · Martijn - X1M
https://x1m.nl/posts/android-app-testing-part-1/ | Bug Bounty & Android Applications - Part 1 · Martijn - X1M
https://x1m.nl/posts/pentest-scripts-tools-and-more/#subdomains | Pentest scripts, tools & more · Martijn - X1M
https://michenriksen.com/blog/aquatone-tool-for-domain-flyovers/ | AQUATONE: A tool for domain flyovers | michenriksen.com
https://michenriksen.com/blog/gitrob-now-in-go/ | Gitrob: Now in Go | michenriksen.com
https://michenriksen.com/blog/subdomain-takeover-detection-with-aquatone/ | Subdomain takeover detection with AQUATONE | michenriksen.com
https://michenriksen.com/blog/gitrob-putting-the-open-source-in-osint/ | Gitrob: Putting the Open Source in OSINT | michenriksen.com
https://michenriksen.com/blog/new-version-of-gitrob-is-out/ | A new version of Gitrob is out | michenriksen.com
https://x1m.nl/project/vulnerable-android-app/ | Vulnerable Android Application · Martijn - X1M
https://twitter.com/mobilesecurity_/status/966787418052587520 | Mobile Security on Twitter: "FiOS - new iOS pentesting tool based on @fridadotre #MobileSecurity #iOSsecurity https://t.co/koU64k08BJ… "
https://twitter.com/mobilesecurity_/status/965618348280176640 | Mobile Security on Twitter: "Mobile Application Hacking Diary Ep.2 #MobileSecurity @fridadotre https://t.co/Pe92QsQxRb… "
https://www.exploit-db.com/search?q=SQL | Exploit Database Search
https://www.exploit-db.com/papers/26620 | Mobile Application Hacking Diary Ep.1
https://www.exploit-db.com/?author=1275 | Exploit Database by Offensive Security
https://www.youtube.com/feed/trending | (61) Trending - YouTube
https://twitter.com/KitPloit/status/952175925788987392 | ☣ KitPloit - Hacker Tools on Twitter: "cSploit Android - The most complete and advanced IT security professional toolkit on Android https://t.co/TYxGbydUpz #Android #AndroidPentesting #Framework… https://t.co/FTkwYdFXZL"
https://medium.com/@abhimuralidharan/detecting-screen-capturing-in-ios-11-cca15881c785 | Detecting screen capturing in iOS 11 – Abhimuralidharan – Medium
https://twitter.com/mobilesecurity_/status/951528569804656646 | Mobile Security on Twitter: "Beware of Open Source Projects on Google Play by @symantec #MobileSecurity #AndroidSecurity https://t.co/DYJeNzSmvR… "
https://twitter.com/ITSecurityguard/status/951208786043207682 | Patrik Fehrenbach🤖 on Twitter: "If you are into iOS pentesting, check out: Passionfruit https://t.co/nDug3u7NsY Simple iOS app blackbox assessment tool :-)… https://t.co/i7Hup4SP4J"
https://twitter.com/mobilesecurity_/status/944209608092110848 | Mobile Security on Twitter: "Intercepting HTTPS Traffic from Apps on Android 7+ using #Magisk & #Burp #MobileSecurity #AndroidSecurity @Burp_Suite by @NVISO_Labs https://t.co/0BF4PfXj4q… https://t.co/TFsgTGgS8A"
https://github.com/jiayy/android_vuln_poc-exp | jiayy/android_vuln_poc-exp: This project contains pocs and exploits for android vulneribilities
https://twitter.com/OguzhanTopgul/status/941766793567145984 | {ouz} on Twitter: "Want to read about Android evasion, anti-analysis, app protection, obfuscation? https://t.co/61RSAiSudg Feel free to contribute and suggest."
https://mobile-security.zeef.com/oguzhan.topgul#block_47329 | Mobile Security by Oguzhan Topgul | ZEEF
https://www.primevideo.com/storefront/ref=atv_hm_hom_c_bV3MWc_UyfHC1_1_1?contentType=merch&contentId=primemusic&merchId=primemusic | Prime Video
https://www.netflix.com/in/ | Netflix India – Watch TV Programmes Online, Watch Films Online
https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1510001675.pdf | PowerPoint Presentation
https://www.youtube.com/results?search_query=SANS+API+security | (58) SANS API security - YouTube
https://www.youtube.com/watch?v=Vtn1tIq8L2U | SANS Webcast: HTTP/2 & Websockets are gonna change the Pen Test World. Are You Ready? - YouTube
https://pastebin.com/mJf1UFpE | api-security - Pastebin.com
https://github.com/0xRadi/OWASP-Web-Checklist#Information | 0xRadi/OWASP-Web-Checklist: OWASP Web Application Security Testing Checklist
https://payatu.com/beginners-guide-restful-api-vapt-part-2/ | Beginner’s Guide to RESTful API VAPT - Part 2 - payatu
https://payatu.com/beginners-guide-restful-api-vapt-part-1/ | Beginner’s Guide to RESTful API VAPT - Part 1 - payatu
https://twitter.com/skeltavik/status/983335500709814274?s=19 | Bram Ruttens on Twitter: "If you're into API testing, use this tool. It'll make your assessments so much easier. 💉 Thanks @Flipkart for creating this nifty framework! #pentest #security #tools https://t.co/9eDs8TFxfJ"
https://medium.com/vandium-software/5-easy-steps-to-understanding-json-web-tokens-jwt-1164c0adfcec | 5 Easy Steps to Understanding JSON Web Tokens (JWT)
https://medium.com/101-writeups/hacking-json-web-token-jwt-233fe6c862e6 | Hacking JSON Web Token (JWT) – 101-writeups – Medium
https://www.slideshare.net/snyff/jwt-insecurity | Jwt == insecurity?
https://omergil.blogspot.com/2017/02/web-cache-deception-attack.html | Omer Gil: Web Cache Deception Attack
https://blog.ninoishere.com/tag/api/ | API - Nino
https://websec.be/files/20171109_DeRyck_APISecurityPitfalls.pdf | DeRyck_APISecuruity
https://www.youtube.com/watch?v=YQzU8xEBiPg | (58) Common API security pitfalls by Philippe De Ryck - YouTube
https://www.youtube.com/channel/UCSii2fuiLLlGqaR6sR_y0rA/videos | (58) secappdev.org - YouTube
https://handouts.secappdev.org/handouts/2016/Philippe%20De%20Ryck/DeRyck_SPASecurity.pdf | DeRyck_SPASecurity
https://handouts.secappdev.org/handouts/2017/Jim%20Manico/04a.%20OAUTH%20Security%20Introduction%20MODULE%202-9-2017.pdf | 04a. OAUTH Security Introduction MODULE 2-9-2017
https://handouts.secappdev.org/handouts/2017/Maarten%20Decat/maarten-decat-access-control-seccappdev2017.pdf | maarten-decat-access-control-seccappdev2017.pdf
https://handouts.secappdev.org/handouts/2016/Maarten%20Decat/presentation.pdf | PowerPoint Presentation
https://www.youtube.com/watch?v=9CJ_BAeOmW0 | (58) Deconstructing REST Security by David Blevins - YouTube
https://www.youtube.com/watch?v=u2CVkZaNr94 | (57) 413 Need More Sleep REST Could Help Drew Branch - YouTube
https://websec.be/resources/slides/ | Slides
https://websec.be/blog/codeeurope-2017/ | Common API Security Pitfalls
https://websec.be/blog/owaspbenelux-2017/ | Common REST API Security Pitfalls
https://github.com/sogko/graphql-schema-language-cheat-sheet | sogko/graphql-schema-language-cheat-sheet: GraphQL Shorthand Notation Cheat Sheet
https://coursehunters.net/course/prodvinutyy-graphql | Продвинутый GraphQL - Видеоуроки
https://github.com/FrontendMasters/intro-to-graphql | FrontendMasters/intro-to-graphql: Learn to create GraphQL APIs
https://docs.google.com/presentation/d/1IFirA70uc_GmrOS6WQh2Uy_N09yqpNPTWD-zgxA4MXE/edit#slide=id.g28b4bbfb40_0_27 | API's with Node - Google Slides
https://github.com/FrontendMasters/api-design-node-v2 | FrontendMasters/api-design-node-v2: Code and exercises for API Design in Node.js, v2: REST & GraphQL
https://devhints.io/graphql | GraphQL cheatsheet
https://medium.com/open-graphql/graphql-1-140fab436942 | Why GraphQL? – Open GraphQL – Medium
https://blog.goodapi.co/rest-vs-graphql-a-critical-review-5f77392658e7 | REST vs. GraphQL: A Critical Review – Good API
https://jsjaspreet.com/blog/graphql-best-practices | JS - Blog - GraphQL Best Practices
https://medium.freecodecamp.org/five-common-problems-in-graphql-apps-and-how-to-fix-them-ac74d37a293c | Five Common Problems in GraphQL Apps (And How to Fix Them)
https://coursehunters.net/course/fm-graphql | GraphQL (Frontendmaster) - Видеоуроки
https://slides.com/scotups/intro-to-graphql#/20 | Intro to GraphQL
https://raw.githubusercontent.com/sogko/graphql-shorthand-notation-cheat-sheet/master/graphql-shorthand-notation-cheat-sheet.png | graphql-shorthand-notation-cheat-sheet.png (2526×1785)
https://frontendmasters.com/courses/advanced-graphql/ | Learn Advanced GraphQL - Write Production-Ready GraphQL APIs with Scott Moss
https://philippeharewood.com/view-saved-offers-of-another-user/ | View saved offers of another user – These aren't the access_tokens you're looking for
https://medium.freecodecamp.org/so-whats-this-graphql-thing-i-keep-hearing-about-baf4d36c20cf | So what’s this GraphQL thing I keep hearing about? – freeCodeCamp.org
https://medium.freecodecamp.org/five-common-problems-in-graphql-apps-and-how-to-fix-them-ac74d37a293c | Five Common Problems in GraphQL Apps (And How to Fix Them)
https://medium.freecodecamp.org/the-5-things-you-need-to-know-to-understand-react-a1dbd5d114a3 | React’s Five Fingers of Death. Master these five concepts, then master React.
https://www.howtographql.com/basics/2-core-concepts/ | GraphQL Core Concepts Tutorial
https://facebook.github.io/relay/docs/en/prerequisites.html | Prerequisites · Relay
https://graphql.org/learn/ | Introduction to GraphQL | GraphQL
https://www.slideshare.net/NeeluTripathy2/pentesting-graphql-applications | Pentesting GraphQL Applications
https://graphqlmastery.com/blog/graphql-security-in-node-js-project | GraphQL security in Node.js project
https://summit.graphql.com/speakers/ | GraphQL Summit 2018
https://ithelp.ithome.com.tw/articles/10208008?sc=iThelpR | GraphQL Design: Two or three things about Security - iT State Help:: Helping solve problems and save IT people's day together
https://github.com/2fd/graphdoc | 2fd/graphdoc: Static page generator for documenting GraphQL Schema
https://xzfile.aliyuncs.com/ | https://xzfile.aliyuncs.com
https://www.oreilly.com/library/view/hands-on-graphql-for/9781788995627/video5_3.html | Handling Security - Hands-on GraphQL for Better RESTful Web Services [Video]
https://teamtreehouse.com/library/introduction-to-graphql | Introduction to GraphQL Course
http://localhost:3000/ | Playground - http://localhost:3000/
https://developer.github.com/v4/explorer/ | GraphQL API Explorer | GitHub Developer Guide
https://github.com/arkadiyt/bounty-targets-data/blob/master/data/hackerone_schema.graphql | bounty-targets-data/hackerone_schema.graphql at master · arkadiyt/bounty-targets-data
https://github.com/arkadiyt/bounty-targets-data/blob/master/data/hackerone_schema.graphql | bounty-targets-data/hackerone_schema.graphql at master · arkadiyt/bounty-targets-data
https://www.youtube.com/watch?v=loA3FwbVt90&index=4&t=0s&list=PLpi1lPB6opQzSqSuIkDbIL7f73EXcjB_7 | (57) Testing GraphQL (Jake Dawkins) - YouTube
https://www.youtube.com/watch?v=NKMDBH0CWHs&index=13&t=0s&list=PLpi1lPB6opQzSqSuIkDbIL7f73EXcjB_7 | (57) GraphQL for a Payments API: Challenges and Lessons (Sadique Ali Koothumadan) - YouTube
https://www.youtube.com/watch?v=NDrZi1b87C8&index=21&t=0s&list=PLpi1lPB6opQzSqSuIkDbIL7f73EXcjB_7 | (57) Hidden Gems of a GraphQL Query (Ivan Goncharov) - YouTube
https://www.youtube.com/watch?v=mOirp6cfMW4&index=34&t=0s&list=PLpi1lPB6opQzSqSuIkDbIL7f73EXcjB_7 | (57) Improving the GitHub Developer Experience with GraphQL (Brian Douglas) - YouTube
chrome://downloads/ | Downloads
https://voidsec.com/graphql-security-overview-and-testing-tips/ | GraphQL - Security Overview and Testing Tips - VoidSec
https://labs.detectify.com/2018/03/14/graphql-abuse/ | GraphQL abuse: Bypass account level permissions through parameter smuggling
https://twitter.com/jon_bottarini | Jon Bottarini (@jon_bottarini) | Twitter
https://hackerone.com/ldionmarcil?sort_type=latest_disclosable_activity_at&filter=type%3Aall%20from%3Aldionmarcil&querystring=&page=1 | ldionmarcil's HackerOne Profile
https://hackerone.com/tts | HackerOne
https://twitter.com/GuidoVranken | Guido Vranken (@GuidoVranken) | Twitter
http://stamone-bug-bounty.blogspot.com/2017/10/dom-xss-auth_14.html?spref=tw | StamOne_
https://pastebin.com/n6uEj79E | Authentication/ATO-Bypass - Pastebin.com
https://support.insomnia.rest/article/23-installation#linux | Installation - Insomnia
https://twitter.com/kapytein/status/1020365823494557696 | kapytein on Twitter: "I've added some information about how I found this issue in the summary of the report. Keep an eye on the @Hacker0x01 GraphQL schema every now and then, to keep yourself updated with the upcoming features.. (and you know what new features often bring...) https://t.co/faNUzPhW61"
https://twitter.com/kapytein | kapytein (@kapytein) | Twitter
https://twitter.com/disclosedh1/status/1020364011861422081 | publiclyDisclosed on Twitter: "HackerOne disclosed a bug submitted by kapytein: https://t.co/yAhmw7Yskx - Bounty: $2,500 #hackerone #bugbounty… "
https://hackerone.com/reports/380317 | #380317 Team object exposes amount of participants in a private program to non-invited users
https://blog.securitybreached.org/2018/09/07/rce-jenkins-instance-dosomething-org-bug-bounty-poc/ | RCE Unsecure Jenkins Instance | Bug Bounty POC - Security Breached Blog
https://blog.securitybreached.org/2017/12/10/how-i-was-able-to-takeover-facebook-account-bug-bounty-poc/ | HOW I WAS ABLE TO TAKEOVER FACEBOOK ACCOUNT | Bug Bounty Poc - Security Breached Blog
https://blog.securitybreached.org/2018/09/16/idor-account-takeover-using-facebook/ | IDOR User Account Takeover By Connecting My Facebook Account with victims Account - Security Breached Blog
http://kb.entersoft.co.in/vulnerabilities/blind-sql-injection.html | Blind Sql Injection
https://github.com/rojan-rijal/Subdomains | rojan-rijal/Subdomains: Subdomains of Some sites
https://www.bugbountynotes.com/training/tutorial?id=6 | BugBountyNotes.com | Collaborate and work with other security researchers on bug bounties
https://hackerone.com/reports/143717 | #143717 Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)
https://gist.github.com/mhmdiaa/2742c5e147d49a804b408bfed3d32d07 | waybackrobots.py
https://twitter.com/hosseeb/status/1055883959551221760 | Haseeb Qureshi on Twitter: "Don't "work harder." Instead: Cut away distractions. Stop doing fake work. Ask for help. Plan. Solicit criticism. Automate what can be automated. Engage your mentors. Exercise. Get more sleep. Whatever you do, don't "work harder." It's pretty much never the answer."
https://medium.com/@_bl4de | bl4de – Medium
http://www.pepcoding.com/resources.html | PepCoding.com
https://web.whatsapp.com/ | (17) WhatsApp
https://docs.google.com/spreadsheets/d/1baOu0Vo06sO2twN0EgG8K4IDvvq2J2Y6HUq4WHpXTYw/edit#gid=31135632 | Batches Calendar - Google Drive
https://pastebin.com/edit/mJf1UFpE | Edit Paste: mJf1UFpE - Pastebin.com
https://twitter.com/i/likes | Tweets liked by Shivam Goyal (@g33kyshivam) | Twitter
https://paper.li/mobilesecurity/1338849548#/tag-mobilesecurity | #mobilesecurity - #MobileSecurity - Daily News
https://trustfoundry.net/referer-redirection-inconspicuous-danger/ | Referer Redirection and Its Inconspicuous Danger - TrustFoundry
https://trustfoundry.net/exploiting-java-deserialization-on-jboss/ | Shells in Your Serial - Exploiting Java Deserialization on JBoss - TrustFoundry
https://trustfoundry.net/jwt-hacking-101/ | JWT Hacking 101 - TrustFoundry
https://twitter.com/s0md3v/status/1075310630314209280 | Somdev Sangwan on Twitter: "CSRF mind map ❤️ Source: https://t.co/dfq6pJL2ip… "
https://twitter.com/kapytein/status/1075198603000455168 | kapytein on Twitter: "Testing a GraphQL API? Use https://t.co/KIE7m0Teje. It has GraphQL query autocompletion (as it automatically fetches the schema), which makes testing so much easier. Not sure who recommended this to me. It is been around for some time."
https://hackedu.io/hacktivity/xxe-in-site-audit-function | Interactive Cybersecurity Training | HackEDU
https://www.speedtest.net/ | Speedtest by Ookla - The Global Broadband Speed Test
https://zonksec.com/blog/jwt-hacking-101/ | ZonkSec - JWT Hacking 101
https://www.slideshare.net/snyff/jwt-insecurity | Jwt == insecurity?
https://medium.com/101-writeups/hacking-json-web-token-jwt-233fe6c862e6 | Hacking JSON Web Token (JWT) – 101-writeups – Medium
https://medium.com/vandium-software/5-easy-steps-to-understanding-json-web-tokens-jwt-1164c0adfcec | 5 Easy Steps to Understanding JSON Web Tokens (JWT)
https://twitter.com/g33kyshivam | Shivam Goyal (@g33kyshivam) | Twitter
https://gdgnd.org/users/sign_in | Google Developer Group
https://evren.ninja/dom-xss-trusted-types.html | E-LAB
https://github.com/glennzw/shodan-hq-nse | glennzw/shodan-hq-nse: Shodan HQ nmap plugin - passively scan targets
https://github.com/nahamsec/lazyrecon | nahamsec/lazyrecon: This script is intended to automate your reconnaissance process in an organized fashion
https://github.com/nahamsec/bbht | GitHub - nahamsec/bbht: A script to set up a quick Ubuntu 17.10 x64 box with tools I use.
https://github.com/nahamsec/recon_profile/blob/master/bash_profile | recon_profile/bash_profile at master · nahamsec/recon_profile · GitHub
https://github.com/nahamsec/JSParser | GitHub - nahamsec/JSParser
https://juejin.im/entry/58f43b0c61ff4b0058fd734d | 跨站的艺术 - XSS Fuzzing 的技巧 - 阅读 - 掘金
https://juejin.im/post/5bbff9f7e51d450e8b1404c4 | JWT 详细分析 - 掘金
https://docs.google.com/presentation/d/1cpcxEBEb0dyXwRqSWQ6bknJS-PQO_e242Dioy9SU2Io/edit#slide=id.g4715c86259_0_248 | BUG BOUNTY FUNSHOP - Google Slides
https://tomnomnom.com/talks/passiveish.pdf | https://tomnomnom.com/talks/passiveish.pdf
https://pastebin.com/edit/E1HAEFZf | Edit Paste: E1HAEFZf - Pastebin.com
https://twitter.com/i/likes | Tweets liked by Shivam Goyal (@g33kyshivam) | Twitter
https://twitter.com/Alra3ees | Emad Shanab (@Alra3ees) | Twitter
https://medium.com/@_bl4de/hidden-directories-and-files-as-a-source-of-sensitive-information-about-web-application-84e5c534e5ad | Hidden directories and files as a source of sensitive information about web application
https://twitter.com/x0rz/status/1052899891624710145 | x0rz on Twitter: "Nginx off-by-slash vulnerability, cool trick presented by @orange_8361 at #hacklu… "
https://github.com/leonardomso/33-js-concepts | leonardomso/33-js-concepts: 📜 33 concepts every JavaScript developer should know.
https://github.com/30-seconds/30-seconds-of-code | 30-seconds/30-seconds-of-code: Curated collection of useful JavaScript snippets that you can understand in 30 seconds or less.
https://github.com/30-seconds/30-seconds-of-code | 30-seconds/30-seconds-of-code: Curated collection of useful JavaScript snippets that you can understand in 30 seconds or less.
https://medium.com/@zseano/its-all-in-the-detail-email-leak-account-takeover-thanks-to-waybackmachine-extensive-4be365580dd7 | It’s all in the detail: Email leak & Account takeover thanks to WayBackMachine & extensive…
https://www.bugbountynotes.com/forum/viewforum?view=learning | View Learning/Training forum | BugBountyNotes.com
https://blog.teknogeek.io/ | Curiosity With a Side of Chaos
https://www.google.com/search?q=zseno+bug+hunting+methodology+bug+bounty+notes&oq=zseno+bug+hunting+methodology+bug+bounty+notes&aqs=chrome..69i57.13929j0j4&sourceid=chrome&ie=UTF-8 | zseno bug hunting methodology bug bounty notes - Google Search
https://medium.com/@infosecsanyam/bug-bounty-hunting-methodology-toolkit-tips-tricks-blogs-ef6542301c65 | BUG BOUNTY HUNTING (METHODOLOGY , TOOLKIT , TIPS & TRICKS , Blogs)
https://github.com/jhaddix/tbhm | jhaddix/tbhm: The Bug Hunters Methodology
https://www.bugbountynotes.com/explore/viewbug?id=2011 | BugBountyNotes.com | Disclosed Bug on Shopify found by zseano
https://www.bugbountynotes.com/explore/viewbug?id=2625 | BugBountyNotes.com | Disclosed Bug on Hackerone found by zseano
https://www.bugbountynotes.com/challenge?id=3 | "There's cross site request forgery (CSRF) protection, but how good is it?" bugbounty challenge | BugBountyNotes.com
https://www.bugbountynotes.com/challenge?id=3 | "There's cross site request forgery (CSRF) protection, but how good is it?" bugbounty challenge | BugBountyNotes.com
https://github.com/mystech7/Burp-Hunter | mystech7/Burp-Hunter: XSS Hunter Burp Plugin
https://wiki.mozilla.org/Security/FirefoxOperations#Security_Checklist | Security/FirefoxOperations - MozillaWiki
https://tomnomnom.com/talks/webvulns.pdf | webvulns.pdf
https://www.youtube.com/watch?v=tqFqN8A7waQ&feature=youtu.be | (25) Modern web application bugs - Erlend Oftedal - YouTube
https://twitter.com/zseano/status/1072477805265543168 | zseano💫 on Twitter: "Interesting URL redirect 'bypass'. So their filter made it so you could only redirect to /path or http(s)://hardcoded.theirdomain.com/path - except if you just simply added "puter", it would redirect to https://t.co/n5z1c5TyAT - and in 2018, that's a valid TLD. :D #BugBountyTip"
https://hackerone.com/reports/426147 | #426147 CORS misconfig | Account Takeover
https://docs.google.com/presentation/d/1cpcxEBEb0dyXwRqSWQ6bknJS-PQO_e242Dioy9SU2Io/edit#slide=id.g4715c86259_0_248 | BUG BOUNTY FUNSHOP - Google Slides
https://github.com/GerbenJavado/LinkFinder | GerbenJavado/LinkFinder: A python script that finds endpoints in JavaScript files
https://tomnomnom.com/talks/passiveish.pdf | passiveish.pdf
https://www.youtube.com/watch?v=DvS_ew77GXA | (25) Passive-ish Recon Techniques by Tom Hudson - YouTube
https://medium.com/bugbountyhunting/bug-bounty-toolkit-aa36f4365f3f | Bug Bounty Toolkit – BugBountyHunting – Medium
https://medium.com/bugbountyhunting/bug-bounty-hunting-tips-1-always-read-the-source-code-f5a56ee242df | Bug Bounty Hunting Tips #1— Always read the source code
https://medium.com/bugbountyhunting/bug-bounty-hunting-tips-2-target-their-mobile-apps-android-edition-f88a9f383fcc | Bug Bounty Hunting Tips #2 —Target their mobile apps (Android Edition)
https://github.com/dxa4481/truffleHog | dxa4481/truffleHog: Searches through git repositories for high entropy strings and secrets, digging deep into commit history
https://tomnomnom.com/talks/big-numbers.pdf | big-numbers
https://tomnomnom.com/talks/domxss.pdf | domxss.pdf
https://tomnomnom.com/talks/advxss.pdf | advxss.pdf
https://tomnomnom.com/talks/webvulns.pdf | webvulns.pdf
https://www.youtube.com/results?search_query=Tom+Hudson+Web+Vulnerabilities | (25) Tom Hudson Web Vulnerabilities - YouTube
https://www.youtube.com/watch?v=sY7pUJU8a7U&t=1483s | (25) Application Security - Understanding, Exploiting and Defending against Top Web Vulnerabilities - YouTube
https://www.youtube.com/watch?v=rObhS5WQSM8&list=PL-giMT7sGCVI9T4rKhuiTG4EDmUz-arBo&index=2 | (508) Sunny Wear's Brakeing Down Security Web App Sec Training #2 - YouTube
https://www.youtube.com/watch?v=h2duGBZLEek | (508) Bugcrowd University - Introduction to Burp Suite - YouTube
https://www.youtube.com/watch?v=vKudm1kDu8k&t=328s | (508) SANS Webcast: Web Hacking with Burp Suite - YouTube
https://www.facebook.com/ | Facebook
file:///home/mr-robot/Downloads/Aman%20syllabus.pdf | Aman syllabus.pdf
https://noteshub.co.in/Communication-Skills-for-Professionals | Communication Skills for Professionals | NotesHub
https://noteshub.co.in/uploads/2017/notes/CSP2017-11-30%2014:51:45.pdf | CSP
https://immersivelabs.online/jobs/iml-pgi-0068 | PGI Intern - Jobs - Immersive Labs
https://www.pgitl.com/training/e-learning | E-Learning | PGI
https://www.managed.sa/ | Managed Services
https://www.youtube.com/playlist?list=WL | (506) Watch Later - YouTube
https://www.youtube.com/watch?v=jBi3a-dXsM8&t=225s&index=14&list=WL | (506) Hidden in Plain Site: Disclosing Information via Your APIs - Peter Yaworski, Bugcrowd's LevelUp 2017 - YouTube
https://www.youtube.com/watch?v=Qw1nNPiH_Go&index=3&list=PLIK9nm3mu-S6gCKmlC5CDFhWvbEX9fNW6&t=674s | (506) LevelUp 0x02 - Bug Bounty Hunter Methodology v3 - YouTube
https://www.youtube.com/watch?v=94-tlOCApOc&index=4&list=PLIK9nm3mu-S4K4jMHwtplbrE1JMg0jyN- | (506) Bugcrowd University - Broken Access Control Testing - YouTube
https://www.youtube.com/watch?v=VeW_G4xoh5Q&index=8&list=PLIK9nm3mu-S5InvR-myOS7hnae8w4EPFV | OWASP iGoat - Learning iOS App Penetration Testing & Defense - Swaroop Yermalkar, LevelUp 2017 - YouTube
https://www.youtube.com/watch?v=9ADubsByGos&t=16s&index=17&list=WL | PHV 2016, "How to Find 1,352 Wordpress XSS Plugin Vulnerabilities...." by Larry Cashdollar - YouTube
https://www.youtube.com/watch?v=k12u-76CarE&t=411s&index=21&list=WL | (506) Beyond the OWASP Top 10 - Modern web application bugs - NDC Security 2018 - YouTube
https://twitter.com/webtonull?lang=en | Erlend Oftedal (@webtonull) | Twitter
https://twitter.com/PhilippeDeRyck | Philippe De Ryck (@PhilippeDeRyck) | Twitter
https://pragmaticwebsecurity.com/index.html#courses | Pragmatic Web Security
https://pragmaticwebsecurity.com/talks/commonapisecuritypitfalls | Common API security pitfalls
https://vimeo.com/289491341 | Common API security pitfalls : Philippe De Ryck on Vimeo
https://essentials.pragmaticwebsecurity.com/ | Web Security Essentials - A Pragmatic Web Security course
https://angularmasterclass.pragmaticwebsecurity.com/ | Angular Security Masterclass - A Pragmatic Web Security course
https://cheatsheets.pragmaticwebsecurity.com/ | Security Cheat Sheets by Pragmatic Web Security
https://pragmaticwebsecurity.com/talks/owaspasvs.html | From the OWASP top 10(s) to the OWASP ASVS
https://ng-be.org/workshops/2018/12/security-in-angular-pragmatic-web-security | Security in Angular — NG-BE
https://www.zdnet.com/article/deserialization-issues-also-affect-ruby-not-just-java-php-and-net/ | Deserialization issues also affect Ruby, not just Java, PHP, and .NET | ZDNet
https://www.zdnet.com/article/steam-bug-could-have-given-you-access-to-all-the-cd-keys-of-any-game/ | Steam bug could have given you access to all the CD keys of any game | ZDNet
https://labs.detectify.com/2018/08/02/bypassing-exploiting-bucket-upload-policies-signed-urls/ | Bypassing and exploiting Bucket Upload Policies and Signed URLs
https://www.oreilly.com/library/view/building-a-modern/9781492044680/ | Building a Modern Security Program [Book]
https://github.com/frohoff/ysoserial | frohoff/ysoserial: A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet | GrrrDog/Java-Deserialization-Cheat-Sheet: The cheat sheet about Java Deserialization vulnerabilities
http://labsdetectify.wpengine.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/ | Hostile Subdomain Takeover using Heroku/Github/Desk + more
http://www.agarri.fr/docs/AppSecEU15-Server_side_browsing_considered_harmful.pdf | AppSecEU15-Server_side_browsing_considered_harmful.pdf
https://portswigger.net/blog/practical-web-cache-poisoning | Practical Web Cache Poisoning | Blog
https://hackerone.com/reports/341876 | #341876 SSRF in Exchange leads to ROOT access in all instances
https://cse.google.com/cse?cx=partner-pub-3256770407637090%3A2007347459&ie=UTF-8&q=dork&sa=Search&siteurl=www.irongeek.com%2F&ref=www.google.com%2F&ss=472j75250j4 | Google Custom Search
https://www.youtube.com/results?search_query=google+dorks+bsides | (506) google dorks bsides - YouTube
https://gbhackers.com/latest-google-dorks-list/ | Google Dorks List 2018 For Ethical Hacking and Penetration Testing
https://edgylabs.com/google-dorks-list | The Latest Google Dorks List and how to use it for Good
https://twitter.com/Alra3ees/status/1028830688932491264 | Emad Shanab on Twitter: "Dorkme:- Is a tool designed to facilitate the search for vulnerabilities with Google Dorks, such as sql injection vulnerabilities. Source:- https://t.co/XLWX0Uh1nt Demo: https://t.co/xmJthPGdlI"
chrome://bookmarks/?q=shodan | Bookmarks
https://github.com/jhaddix/tbhm/blob/master/12_IDOR.markdown | tbhm/12_IDOR.markdown at master · jhaddix/tbhm
https://github.com/jhaddix/tbhm/blob/master/10_Mobile.md | tbhm/10_Mobile.md at master · jhaddix/tbhm
https://pastebin.com/LEHfnLAw | [Markdown] GraphQl - Pastebin.com
https://www.youtube.com/watch?v=1N-O07SRuxY | In graph we trust: Microservices, GraphQL and security challenges - DevSecCon Singapore 2018 - YouTube
https://appseceurope2018a.sched.com/speaker/mohammed_a_imran.1y393q96 | Mohammed Imran - AppSec Europe 2018
https://www.youtube.com/channel/UCgxhfP2Hi8MQYz6ZkwpLA0A/videos | DevSecCon - YouTube
https://www.youtube.com/ | YouTube
https://twitter.com/ | (*) Twitter
https://www.slideshare.net/NeeluTripathy2/pentesting-graphql-applications | Pentesting GraphQL Applications
https://www.slideshare.net/ | Share and Discover Knowledge on LinkedIn SlideShare
https://twitter.com/freebuf | FreeBuf (@freebuf) | Twitter
https://philippeharewood.com/view-the-facebook-stories-for-any-media-effect/ | View the Facebook stories for any media effect – These aren't the access_tokens you're looking for
https://www.slideshare.net/secfigo/in-graph-we-trust-microservices-graphql-and-security-challenges | In graph we trust: Microservices, GraphQL and security challenges
https://www.slideshare.net/secfigo/strengthen-and-scale-security-for-a-dollar-or-less | Strengthen and Scale Security for a dollar or less
https://www.moesif.com/blog/technical/graphql/REST-vs-GraphQL-APIs-the-good-the-bad-the-ugly/ | REST vs GraphQL APIs, the Good, the Bad, the Ugly | Moesif’s Musings on Software
https://www.practo.com/delhi/doctor/dr-susan-k-s-ear-nose-throat-ent-specialist/info | Dr. Susan K S - Book Appointment Online, View Fees, Feedbacks | Practo
http://daitebi.com.br/nasofibroscopia-o-que-e-como-e-realizado-para-que-serve-como-e-feito/ | Nasofibroscopia: o que é? Como é realizado? Para que serve? Como é feito? | Daitebi
https://www.youtube.com/watch?v=wbbMgOZEQas | Authentication and Authorization in GraphQL | Prosper Otemuyiwa | BuzzJS 3.1 2018 - YouTube
https://www.youtube.com/watch?v=4_Bcw7BULC8 | Ryan Chenkie - Handling Authentication and Authorization in GraphQL - YouTube
https://www.youtube.com/watch?v=Urk5vPGnkeg | Zero Back To Back Funny Moments | Shahrukh Khan, Katrina, Anushka | Zero Official Trailer Launch - YouTube
https://github.com/br3akp0int/GQLParser | br3akp0int/GQLParser: A repository for GraphQL Extension for Burp Suite
https://medium.com/paypal-engineering/graphql-resolvers-best-practices-cd36fdbcef55 | GraphQL Resolvers: Best Practices – PayPal Engineering – Medium
https://hackernoon.com/piecing-together-graphql-ca6739cd8205 | Piecing Together GraphQL – Hacker Noon
https://medium.com/airbnb-engineering/how-airbnb-is-moving-10x-faster-at-scale-with-graphql-and-apollo-aa4ec92d69e2 | How Airbnb is Moving 10x Faster at Scale with GraphQL and Apollo
https://medium.com/open-graphql/reasonml-with-graphql-the-future-of-type-safe-web-applications-65be2e8f34c8 | ReasonML with GraphQL, the Future of Type-Safe Web Applications
https://www.programmableweb.com/news/top-5-things-to-remember-when-adding-graphql-backend/analysis/2018/10/01 | Top 5 things to Remember When Adding a GraphQL Backend | ProgrammableWeb
https://medium.com/paypal-engineering/graphql-resolvers-best-practices-cd36fdbcef55 | GraphQL Resolvers: Best Practices – PayPal Engineering – Medium
https://medium.com/netflix-techblog/our-learnings-from-adopting-graphql-f099de39ae5f | Our learnings from adopting GraphQL – Netflix TechBlog – Medium
https://kajansiva.gitbook.io/knowledge/daily/2018/december/12_11_2018 | Knowledge
https://www.freebuf.com/articles/web/10099.html | WAF bypassed the singularity - FreeBuf Internet Security New Media Platform
http://wafbypass.me/w/index.php/Main_Page | wafbypass.me | 522: Connection timed out
http://tech-technical.com/index.php/2015/11/11/waf-bypass-sql-injection-tutorial/
http://webvuln.blogspot.com/2015_04_01_archive.html | Tricks And Tips: April 2015
http://www.wooyun.org/bugs/wooyun-2014-089426 | 升级中
https://forum.90sec.org/forum.php?mod=viewthread&tid=9133 | 提示信息 - 九零
http://www.idiot-attacker.com/2016/02/macam-macam-kode-bypass-waf.html | Macam-macam kode Bypass WAF - Idiot Attacker
https://github.com/borbelyau/bypass-waf-ids-ips/blob/master/evasionsqli_methods | bypass-waf-ids-ips/evasionsqli_methods at master · borbelyau/bypass-waf-ids-ips
https://pastebin.com/S4nHhEZW | CORS - Pastebin.com
https://appsecwiki.com/#/serversidesecurity?id=ssrf | Server Side Security - Application Security Wiki
https://www.youtube.com/watch?v=K_ElxRc9LLk | (496) Server-Side Request Forgery (SSRF) - Web Application Security Series #1 - YouTube
https://www.corben.io/tricky-CORS/ | Tricky CORS Bypass in Yahoo! View – Corben Leo – Information Security Blog
https://medium.com/bugbountywriteup/the-design-and-implementation-of-ssrf-attack-framework-550e9fda16ea | All you need to know about SSRF and how may we write tools to do auto-detect
https://medium.com/@Auxy233 | Auxy – Medium
https://github.com/C0RB3N?tab=repositories | C0RB3N (Corben Leo) / Repositories
https://www.corben.io/advanced-cors-techniques/ | Advanced CORS Exploitation Techniques – Corben Leo – Information Security Blog
http://zeroyu.xyz/2018/03/06/introduction-to-ssrf/ | Understanding SSRF, this one is enough
https://www.bugcrowd.com/resource/broken-access-control-testing/ | Broken Access Control Testing | Bugcrowd
https://hackerone.com/reports/223203 | #223203 SVG Server Side Request Forgery (SSRF)
http://zeroyu.xyz/2018/03/06/introduction-to-ssrf/ | 了解SSRF,这一篇就足够了
https://gist.github.com/BuffaloWill/fa96693af67e3a3dd3fb | Cloud Metadata Dictionary useful for SSRF Testing
https://www.honoki.net/2018/12/from-blind-xxe-to-root-level-file-read-access/ | From blind XXE to root-level file read access | Honoki
https://medium.com/@zain.sabahat/exploiting-ssrf-like-a-boss-c090dc63d326 | Exploiting SSRF like a Boss! – Zain Sabahat – Medium
http://api.hackertarget.com/reverseiplookup/?q= | api.hackertarget.com/reverseiplookup/?q=
https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-c358fd5e249a | Piercing the Veil: Server Side Request Forgery to NIPRNet access
http://blog.safebuff.com/2016/07/03/SSRF-Tips/ | SSRF Tips | xl7dev
https://si9int.sh/article/6 | SI9INT
https://klikki.fi/adv/wpgform.html | Klikki Oy - Google Forms (WordPress plugin) SSRF vulnerability
https://www.rfk.id.au/blog/entry/security-bugs-ssrf-via-request-splitting/ | Security Bugs in Practice: SSRF via Request Splitting
https://twitter.com/gwendallecoguic/status/1000023180101201921 | Gwendal Le Coguic on Twitter: "On a sife we have people fighting for XSS/CSRF/IDOR, like me, and on the other side we have ufos that bring #bugbounty to the next level with georgous findings from nowhere. Congratulations @0xACB it's a great lesson for hunters, companies, everyone. https://t.co/rnHcW1uNp3"
https://twitter.com/saurinn_/status/1031219232661495809 | Manuel 👁️ on Twitter: "But why?… "
https://hackerone.com/reports/374737 | HackerOne
https://opnsec.com/2018/07/into-the-borg-ssrf-inside-google-production-network/ | Into the Borg – SSRF inside Google production network | OpnSec
https://hackerone.com/reports/356765 | HackerOne
https://medium.com/@th3g3nt3l/how-i-found-an-ssrf-in-yahoo-guesthouse-recon-wins-8722672e41d4 | How i found an SSRF in Yahoo! Guesthouse (Recon Wins)
https://medium.com/@mleblanc_82306 | Maxime Leblanc – Medium
https://www.youtube.com/watch?v=TrBUrVDlc20 | Hackfest 2015: Nicolas Grégoire presented "Server Side Browsing" - YouTube
https://www.defcon.org/html/defcon-25/dc-25-speakers.html#Tsai | DEF CON® 25 Hacking Conference - Talks
https://github.com/m6a-UdS/ssrf-lab | m6a-UdS/ssrf-lab: Lab for exploring SSRF vulnerabilities
https://medium.com/poka-techblog/privilege-escalation-in-the-cloud-from-ssrf-to-global-account-administrator-fd943cf5a2f6 | Privilege escalation in the Cloud: From SSRF to Global Account Administrator
https://www.youtube.com/watch?v=XvN25xG75x0 | (496) DON’T MISS: Anushka Sharma and Katrina Kaif’s EXCLUSIVE Full Interview | ZERO - YouTube
https://pastebin.com/u/Drvirus1911 | Drvirus1911's Pastebin - Pastebin.com
https://philippeharewood.com/facebookbugbounties.txt | https://philippeharewood.com/facebookbugbounties.txt
https://docs.google.com/presentation/d/1cpcxEBEb0dyXwRqSWQ6bknJS-PQO_e242Dioy9SU2Io/edit#slide=id.g4715c86259_0_357 | BUG BOUNTY FUNSHOP - Google Slides
https://medium.com/ehsahil/getting-started-in-bug-bounty-7052da28445a | Getting started in Bug Bounty – ehsahil – Medium
https://www.youtube.com/watch?time_continue=6&v=Qw1nNPiH_Go | (493) LevelUp 0x02 - Bug Bounty Hunter Methodology v3 - YouTube
https://www.youtube.com/watch?v=mQjTgDuLsp4&list=PLl-GuflHOikWnr0kOThK0xOyFXhBZbdLv | (493) Nicolas Grégoire - Hunting for Top Bounties - YouTube
https://www.facebook.com/notes/phwd/a-facebook-graphql-crash-course/1189337427822946 | (5) A Facebook GraphQL crash course
https://www.facebook.com/notes/phwd/facebook-api-bug-bounties-the-basic-sauce/818002471623112 | (5) Facebook API Bug Bounties - The Basic Sauce
https://developers.facebook.com/docs/graph-api/overview/ | Overview - Graph API
https://developers.facebook.com/docs/graph-api/reference/ | Graph API Reference
https://developers.facebook.com/graph-academy/ | Graph Academy - Facebook for Developers
https://www.pluralsight.com/courses/beginner-facebook-development | Introduction to the Facebook Graph API | Pluralsight
https://www.youtube.com/results?search_query=graph+api | (493) graph api - YouTube
https://www.youtube.com/watch?v=4TbnZAFTqAI&t=1s | (493) Facebook graph API testing ! And Secret Method to create multiple user id for same user ! - YouTube
https://www.0daydown.com/?s=Introduction+to+the+Facebook+Graph+API | Introduction to the Facebook Graph API | 0DayDown
https://learnflakes.net/?p=torrents&pid=10 | LearnFlakes.Net -Learning Community
http://ww7.learningdl.com/?z | ww7.learningdl.com/?z
https://www.youtube.com/watch?v=WvOrWq2-5cE | (493) Secrets of My Beard | My Beard Grow Journey | How to Grow Beard | - YouTube
https://www.youtube.com/watch?v=-gUkNAHR0jY&list=PLoDjojPzHp2Wo8U6Xp0KAoCL2b55Yo5WN | (488) FileCry - The New Age Of XXE - YouTube
https://www.youtube.com/watch?v=v_5dTJYjSMA&list=PLoDjojPzHp2VtA6_UVO0uxtd6iNHaA0Sl | (488) t505 SWF Seeking Lazy Admin for Cross Domain Action Seth Art - YouTube
https://www.youtube.com/watch?v=XeeLkBkjLl0&index=6&list=PLoDjojPzHp2Wo8U6Xp0KAoCL2b55Yo5WN | (488) Black Hat USA 2015 - Abusing XSLT For Practical Attacks - YouTube
https://www.youtube.com/watch?v=oEUSNk8XAQY&index=7&list=PLoDjojPzHp2Wo8U6Xp0KAoCL2b55Yo5WN | (488) Vladimir Vorontsov - Blind XXE injections - YouTube
https://www.youtube.com/watch?v=Zl8U2YVp2lw&index=9&list=PLoDjojPzHp2Wo8U6Xp0KAoCL2b55Yo5WN | (488) Introduction to XML External Entity Injection (ISSA KY Workshop) - YouTube
https://jivoi.github.io/2015/07/01/pentest-tips-and-tricks/ | Pentest Tips and Tricks – EK
https://www.youtube.com/results?search_query=race+condition+OWASP | (488) race condition OWASP - YouTube
https://www.youtube.com/channel/UCo7g5wKeNu32YIziwDqempw/videos | (488) SecureSet - YouTube
https://twitter.com/i/likes | Tweets liked by Shivam Goyal (@g33kyshivam) | Twitter
https://hackerone.com/reports/409380 | #409380 Stored XSS in merge request pages
https://jivoi.github.io/2015/07/03/offensive-security-bookmarks/ | Offensive Security Bookmarks – EK
https://github.com/coreb1t/awesome-pentest-cheat-sheets | coreb1t/awesome-pentest-cheat-sheets: Collection of the cheat sheets useful for pentesting
https://github.com/tanprathan | tanprathan (Prathan Phongthiproek)
https://www.linkedin.com/in/pprathan/?originalSubdomain=th | (1) Prathan Phongthiproek | LinkedIn
https://github.com/jshaw87/Cheatsheets | Page not found · GitHub
https://github.com/coodict/javascript-in-one-pic | coodict/javascript-in-one-pic: Learn javascript in one picture.
https://code.google.com/archive/p/pentest-bookmarks/wikis/BookmarksList.wiki | Google Code Archive - Long-term storage for Google Code Project Hosting.
https://github.com/swisskyrepo/PayloadsAllTheThings | swisskyrepo/PayloadsAllTheThings: A list of useful payloads and bypass for Web Application Security and Pentest/CTF
https://highon.coffee/blog/penetration-testing-tools-cheat-sheet/ | Penetration Testing Tools Cheat Sheet
https://twitter.com/trimstray/status/1068095885026955264 | trimstray on Twitter: "My top 5 @Burp_Suite extensions: - Random IP Address Header - CSP-Bypass - BypassWAF - Autorize - Hackvertor Which one do you use most often? or any other? #security #pentest #infosec #cybersecurity #cybersec #tech #it #technology"
https://www.cyberciti.biz/security/nmap-command-examples-tutorials/ | Top 32 Nmap Command Examples For Linux Sys/Network Admins - nixCraft
https://jerrygamblin.com/2018/10/29/google-home-insecurity/ | Google Home (in)Security – JerryGamblin.com
https://medium.com/@Skylinearafat/a-very-useful-technique-to-bypass-the-csrf-protection-for-fun-and-profit-471af64da276 | A very useful technique to bypass the CSRF protection for fun and profit.
https://gist.github.com/Rhynorater/311cf3981fda8303d65c27316e69209f | BXSS - CSP Bypass with Inline and Eval
https://twitter.com/binitamshah/status/1036541096522858496 | Binni Shah on Twitter: "Web Application Firewall (WAF) Evasion Techniques Part - 3 : Uninitialized Bash variable to bypass WAF : https://t.co/zRj9xsv0Dm ,Part 2 : Web Application Firewall (WAF) Evasion Techniques : https://t.co/11oAnX3Uhe , Part 1 : https://t.co/7zwnIngrDE cc @Menin_TheMiddle… https://t.co/N269avqr7i"
https://medium.freecodecamp.org/a-quick-introduction-to-web-security-f90beaf4dd41 | A quick introduction to web security – freeCodeCamp.org
https://assets.pentesterlab.com/jwt_security_cheatsheet/jwt_security_cheatsheet.pdf | jwt_security_cheatsheet - Page 1.pdf
https://twitter.com/binitamshah/status/1025982771393486848 | Binni Shah on Twitter: "Linux Post Exploitation Cheat Sheet : https://t.co/GSHVQAzRsn cc @GuifreRuiz"
https://labs.detectify.com/2018/08/02/bypassing-exploiting-bucket-upload-policies-signed-urls/ | Bypassing and exploiting Bucket Upload Policies and Signed URLs
http://cybersec-research.com/ssrf-on-digitalocean-site-bugbounty-tip/?utm_campaign=shareaholic&utm_medium=twitter&utm_source=socialnetwork | 404 Not Found
https://twitter.com/GoogleVRP/status/1022404220291567617 | Google Vulnerability Reward Program (VRP) on Twitter: "Don't render arbitrary HTML in Electron apps: https://t.co/fGhn2VPYUB. Good example of why we're rewarding impactful vulnerabilities and not exploits.… https://t.co/K85ePqPlVw"
https://twitter.com/rajchandel/status/1022174569757646848 | Hacking Articles on Twitter: "Collections of 150 CTF Challenges (Vulnhub+HTB) https://t.co/MrVO2vtJ0T … @VulnHub @hackthebox_eu #oscp #ctf"
https://twitter.com/Scott_Helme/status/1022035104372334592 | Scott Helme on Twitter: "I was asked to look into an XSS vulnerability on Etherscan which turned out to be caused by a custom Disqus integration: https://t.co/gc7EgvgArF"
https://twitter.com/SecurityMB/status/1021464816370798592 | Michał Bentkowski on Twitter: "Blogged! Vulnerability in Hangouts Chat a.k.a. how Electron makes open redirect great again. https://t.co/HKT28uQbwy"
https://blog.bentkowski.info/2018/06/setting-arbitrary-request-headers-in.html | Setting arbitrary request headers in Chromium via CRLF injection | MB blog
https://plus.google.com/114029233000745976870 | Michał Bentkowski - Google+
https://sekurak.pl/blad-bezpieczenstwa-w-aplikacji-desktopowej-google-chat-czyli-jak-uczynic-open-redirect-znow-wielkim/ | Security error in the Google Hangouts Chat desktop application - how to make Open Redirect great again
https://sekurak.pl/bezpieczenstwo-sieci-wi-fi-czesc-1/ | Bezpieczeństwo sieci Wi-Fi – część 1 (wstęp)
https://sekurak.pl/google-caja-i-xss-y-czyli-jak-dostac-trzy-razy-bounty-za-prawie-to-samo/ | Google Caja i XSS-y – czyli jak dostać trzy razy bounty za (prawie) to samo
https://sekurak.pl/facebook-wyplacil-10-latkowi-10-tys-usd-za-zgloszenie-luki-w-instagramie/ | Facebook wypłacił 10-latkowi 10 tys. USD za zgłoszenie luki w Instagramie
https://sekurak.pl/hack-the-pentagon-rusza-program-bug-bounty-prowadzony-przez-armie-usa/ | „Hack the Pentagon” — rusza program bug bounty prowadzony przez armię USA
https://sekurak.pl/dostal-10-000-od-google-za-podmiane-jednego-naglowka-header/ | He got $ 10,000 from Google for the replacement of one Header header
https://sites.google.com/site/testsitehacking/-7-5k-Google-services-mix-up | $7.5k Google services mix-up - Ezequiel Pereira
https://portswigger.net/kb/papers/crackingthelens-whitepaper.pdf | crackingthelens-whitepaper.pdf
https://sekurak.pl/za-jeden-prosty-xml-zgarnal-10-000-za-jednego-prostego-xml-a-zgarnal-10-000/ | Za jeden prosty XML zgarnął $10 000
https://sekurak.pl/slack-dostal-sie-do-glownego-panelu-admina-i-zgarnal-9000-w-ramach-bounty/ | Slack – dostał się do głównego panelu admina i zgarnął $9000 w ramach bounty
https://sekurak.pl/chcesz-byc-bogaty-i-slawny-kilkaset-programow-bug-bounty/ | Chcesz być bogaty i sławny? ;) Kilkaset programów bug bounty
https://pentester.land/tips-and-tricks | Tips & Tricks · Pentester Land
https://0xpatrik.com/project-sonar-guide/ | Project Sonar: An Underrated Source of Internet-wide Data
https://0xpatrik.com/asset-discovery/ | Asset Discovery: Doing Reconnaissance the Hard Way
https://github.com/jobertabma?tab=repositories | jobertabma (Jobert Abma) / Repositories
https://silesiasecuritylab.com/articles/from-csrf-to-unauthorized-remote-admin-access/ | From CSRF to Unauthorized Remote Admin Access – Dawid Czagan
https://wiki.exploitpedia.org/view/OWASP_TOP_10#A1:2017-Injection | OWASP TOP 10 - wiki.exploitpedia.org
https://wiki.exploitpedia.org/view/Static_Analysis | Static Analysis - wiki.exploitpedia.org
https://twitter.com/SamiDrif | Sami 🦄 (@SamiDrif) | Twitter
https://www.youtube.com/ | (488) YouTube
https://www.youtube.com/watch?v=lEdmdCb1DT0 | (488) Who Will Save Iron Man In Endgame? - YouTube
https://pastebin.com/u/thecreat0r/1/Z4EmVYsB | Thecreat0r's Pastebin - Pastebin.com
https://pastebin.com/9BSQjM3E | CSRF - Pastebin.com
https://pastebin.com/xZC446zy | SSRF - Pastebin.com
https://www.youtube.com/watch?v=rR0SnARknlk&list=PLZOToVAK85MoxxCMbxxiBbQ6pavP8aucC | (474) Cross-Site Request Forgery Explained - Part 1: Basic CSRF - YouTube
https://www.youtube.com/results?search_query=CSRF | (474) CSRF - YouTube
https://www.youtube.com/watch?v=KaEj_qZgiKY | (474) CSRF Introduction and what is the Same-Origin Policy? - web 0x04 - YouTube
https://www.youtube.com/watch?v=_JpDMFDlk3Y | (474) CSRF/XSRF/SEA SURF Kya Hote Hai ?? - YouTube
https://www.youtube.com/watch?v=5joX1skQtVE | (474) What is a CSRF? | OWASP Top 10 2013 | Video by Detectify - YouTube
https://null.co.in/events/525-delhi-null-delhi-meet-15-december-2018-combined-null-owasp-meet | null Delhi Meet 15 December 2018 Combined [null + OWASP] Meet
https://null.co.in/profile/3906-narendra-kumar | narendra kumar - null Community Profile
https://www.slideshare.net/NarendraKumar529/server-side-tempalate-injection-85399102 | Server side tempalate injection
https://tomnomnom.com/talks/advxss.pdf | advxss.pdf
https://appsecwiki.com/#/frontend?id=cross-site-request-forgery | Frontend Security - Application Security Wiki
https://philippeharewood.com/facebook-graphql-csrf/ | Facebook GraphQL CSRF – These aren't the access_tokens you're looking for
https://www.youtube.com/watch?v=NAR4nDEpD8g | (474) DVWA - CSRF ("Auto-Forcing New Passwords") - YouTube
https://www.youtube.com/results?search_query=bsides+CSRF | (474) bsides CSRF - YouTube
https://www.youtube.com/watch?v=enFcclD6nuk | BSides Boston - BruteLogic - Building Advanced XSS Vectors - YouTube
https://www.youtube.com/watch?v=vrjgD0azkCw | CSRF Explained - YouTube
http://bitspyder.net/browse.php?page=3 | .:: Bitspyder.net :: Downloads
https://learnflakes.net/?p=home&pid=1 | LearnFlakes.Net -Learning Community
https://medium.com/bugbountywriteup/csrf-account-takeover-explained-automated-manual-bug-bounty-447e4b96485b | CSRF account takeover Explained Automated/Manual — Bug Bounty
https://haiderm.com/10-methods-to-bypass-cross-site-request-forgery-csrf/ | haiderm.com | 521: Web server is down
https://twitter.com/prateek_0490/status/977764964944330753 | Prateek Tiwari on Twitter: "Also, to add to it, try and use “-1” {csrf_token=-1} as value of token and you will be amazed to see the result. 😉 #BugBounty #TogetherWeHitHarder… https://t.co/3RBhIegMPI"
https://www.youtube.com/watch?v=3KwGmKucayg&feature=youtu.be | (474) CSRF Bypass - YouTube
https://medium.com/@agrawalsmart7/what-is-csrf-how-to-bypass-the-csrf-protection-via-xss-55695f5789d7 | Hi all, and a Very Happy New Year to all, let’s Come to the topic, Today I just want to share some…
https://2017.zeronights.ru/report/tryuki-dlya-obhoda-csrf-zashhity/ | Tricks for circumventing CSRF protection - Conference Zeronights 2017
https://hackerone.com/reports/115158 | #115158 CSRF in twitterflightschool.com ( CAN POST ON TIMELINE WITHOUT USER PERMISSION)
https://dl.packetstormsecurity.net/papers/attack/Using_XSS_to_bypass_CSRF_protection.pdf | Using XSS to bypass CSRF protection
https://blog.netspi.com/defeating-csrf-protections-expired-cross-domain-xml-domains/ | Defeating CSRF Protections Through Expired cross-domain.xml Domains
https://blog.netspi.com/fuzzing-parameters-in-csrf-resistant-applications-with-burp-proxy/ | Fuzzing Parameters in CSRF Resistant Applications with Burp Proxy
https://blog.netspi.com/netspi-sql-injection-wiki/ | NetSPI SQL Injection Wiki
https://hackerone.com/reports/233099/ | #233099 CSRF in Report Lost or Stolen Page https://www.starbucks.com/account/card
https://www.youtube.com/ | (474) YouTube
https://twitter.com/SamiDrif | Sami 🦄 (@SamiDrif) | Twitter
https://web-in-security.blogspot.com/2017/07/cors-misconfigurations-on-large-scale.html | CORS misconfigurations on a large scale
http://samidrif.net/
https://web.archive.org/web/20180813091525/https://bounty.github.com/researchers/Dharani-abss.html | Abhishek Dharani - GitHub Bug Bounty
https://www.slideshare.net/GreenD0g/deserialization-vulnerabilities | Deserialization vulnerabilities
https://hackerone.com/reports/301831 | #301831 Leaking sensitive files on Github leads to internal files (python scripts,SQL files)
https://opnsec.com/2018/03/stored-xss-on-facebook/ | Stored XSS on Facebook | OpnSec
https://www.sxcurity.pro/asus-sqli/
https://medium.com/bugbountywriteup/whats-tools-i-use-for-my-recon-during-bugbounty-ec25f7f12e6d | What tools I use for my recon during #BugBounty – InfoSec Write-ups – Medium
https://hackerone.com/reports/397527 | #397527 Leaking sensitive information on Github lead full access to all Grab Slack channels
https://pastebin.com/LEHfnLAw | [Markdown] GraphQl - Pastebin.com
https://twitter.com/snoopysecurity | (1) Sam Sanoop (@snoopysecurity) | Twitter
https://www.reddit.com/r/netsec/comments/8k5bvi/exposing_graphql_to_penetration_testers/?st=jphzadaa&sh=bf6394ca | Exposing GraphQL to Penetration Testers : netsec
https://exposingtheinvisible.org/guides/google-dorking/ | Smart searching with googleDorking | Exposing the Invisible
https://hackerone.com/reports/380317 | #380317 Team object exposes amount of participants in a private program to non-invited users
https://github.com/s-castillo/js-course-example/blob/master/course-examples/_js/simple-js.js | js-course-example/simple-js.js at master · s-castillo/js-course-example
https://github.com/chiangs/jsf-solutions/blob/master/solutions/lesson2/solutions.md | jsf-solutions/solutions.md at master · chiangs/jsf-solutions
https://github.com/chiangs/jsf-solutions2/blob/master/Module2/solutions.md#08---functions | jsf-solutions2/solutions.md at master · chiangs/jsf-solutions2
https://pastebin.com/WPMNrVzK | javascript-notes - Pastebin.com
https://www.youtube.com/watch?v=5aISC84gXBw | (468) Is The Katy Perry LOVE Story Over? Katy Finally Chats With Trevor About It | American Idol 2018 - YouTube
https://www.youtube.com/ | (459) YouTube
https://www.youtube.com/channel/UCTzvm6c3E6qH7jkO6HWn2Cg/videos | (459) UTD CSG - YouTube
https://www.youtube.com/feed/history | (459) History - YouTube
https://www.youtube.com/results?search_query=XXE | (459) XXE - YouTube
https://www.youtube.com/watch?v=BZOg_NgvP18 | (459) What Is An XXE Attack? - YouTube
https://appsecwiki.com/#/serversidesecurity?id=xxe | Server Side Security - Application Security Wiki
https://phonexicum.github.io/infosec/xxe.html | XXE
http://blkstone.github.io/2017/06/29/web-for-pentester-xxe/ | Web for Pentester XXE Resolution // Neurohazard
https://security.tencent.com/index.php/blog/msg/69 | 未知攻焉知防——XXE漏洞攻防 - 博客 - 腾讯安全应急响应中心
https://www.vsecurity.com//download/papers/XMLDTDEntityAttacks.pdf | XML Schema, DTD, and Entity Attacks
http://www.atomsec.org/%E5%AE%89%E5%85%A8/web_for_pentester_i-part-2/ | Web for pentester I part 2 – Atom Kid
https://2013.appsecusa.org/2013/wp-content/uploads/2013/12/WhatYouDidntKnowAboutXXEAttacks.pdf | OWASP
http://agrawalsmart7.com/2018/11/10/Understanding-XXE-from-Basic-to-Blind.html | Utkarsh Agrawal|Understanding Xxe From Basic To Blind
https://www.christian-schneider.net/GenericXxeDetection.html | Generic XXE Detection
https://www.christian-schneider.net/GenericXxeDetection.html | Generic XXE Detection
https://www.slideshare.net/ssuserf09cba/xxe-how-to-become-a-jedi | XXE: How to become a Jedi
https://web-in-security.blogspot.com/2014/11/detecting-and-exploiting-xxe-in-saml.html | Detecting and exploiting XXE in SAML Interfaces
https://hawkinsecurity.com/2018/03/24/gaining-filesystem-access-via-blind-oob-xxe/ | Gaining Filesystem Access via Blind OOB XXE – ∞ Growing Web Security Blog
https://www.youtube.com/watch?v=1EBWzbO8lgs&index=4&list=PLsyeobzWxl7oanwaonj3iV3rxfTdEA2gC | (459) XML Introduction 3 | Schema - YouTube
https://www.youtube.com/watch?v=eHSNT8vWLfc | (459) What You Didn't Know About XML External Entities Attacks - Timothy Morgan - YouTube
https://www.youtube.com/watch?v=2O874A5Uj3w | (459) AppSecEU 16 - C. Mainka, C. Spth, V. Mladenov - From DTD to XXE - An Evaluation of XML - Parsers - YouTube
https://appseceurope2016.sched.com/event/6XQ2/from-dtd-to-xxe-an-evaluation-of-xml-parsers | AppSec Europe 2016: From DTD to XXE: An Evaluation of XML-Pa...
http://lab.onsec.ru/2014/06/xxe-oob-exploitation-at-java-17.html | @ONsec_Lab: XXE OOB exploitation at Java 1.7+
https://portswigger.net/kb/issues/00100400_xml-external-entity-injection | XML external entity injection | PortSwigger
https://blog.ninoishere.com/xxe-how-to-become-a-jedi/ | XXE: How to become a Jedi
https://www.facebook.com/pg/hacking.py/posts/?ref=page_internal | Hacking Is Sharing - Posts
https://darkweblinks.org/2018/08/10/xxe-how-to-become-a-jedi-yaroslav-babin/ | XXE: How to become a Jedi - Yaroslav Babin - Tor Hidden Service DarkWeb Links
https://blog.zsec.uk/blind-xxe-learning/ | Hunting in the Dark - Blind XXE
https://blog.ninoishere.com/tag/xxe/ | xxe - Nino
https://codeby.net/blogs/kniga-po-nmap-na-russkom/#12 | Nmap book in Russian
https://codeby.net/blogs/category/informacionnaja-bezopasnost/ | Information Security | The codeby
https://1cloud.ru/help/dns/dns_basics | Basics of working with DNS (domain name system)
https://habr.com/post/270159/ | Значимость SPF / Хабр
https://danielmiessler.com/study/dns/#gs.u_MO7iA | A DNS Primer | Daniel Miessler
https://codeby.net/threads/skanirovanie-seti-aktivnyj-fazzing-urok-5.65878/ | (1) Сканирование сети [активный фаззинг]. Урок 5 - Codeby.net - Информационная Безопасность
https://codeby.net/members/explorer.100533/#recent-content | (1) explorer | Codeby.net - Информационная Безопасность
https://codeby.net/members/pingvinich.73770/#recent-content | (1) PingVinich | Codeby.net - Информационная Безопасность
https://codeby.net/threads/aktivnyj-fazzing-poisk-subdomenov-urok-4.65842/ | (1) Активный фаззинг - поиск субдоменов. Урок 4 - Codeby.net - Информационная Безопасность
https://codeby.net/members/darklight.105361/#recent-content | (1) darklight | Codeby.net - Информационная Безопасность
https://codeby.net/threads/vzaimodejstvie-c-dns-urok-3.65828/ | (1) Взаимодействие c DNS. Урок 3 - Codeby.net - Информационная Безопасность
https://codeby.net/members/sergei-webware.66427/#recent-content | (1) Sergei webware | Codeby.net - Информационная Безопасность
https://codeby.net/threads/passivnyj-fazzing-ili-sbor-informacii-iz-otkrytyx-istochnikov.65781/ | (1) Пассивный фаззинг или сбор информации из открытых источников - Codeby.net - Информационная Безопасность
https://codeby.net/members/vertigo.72244/#recent-content | (1) Vertigo | Codeby.net - Информационная Безопасность
https://codeby.net/tags/lfi/ | (1) lfi | Codeby.net - Информационная Безопасность
https://codeby.net/threads/rukovodstvo-dlja-nachinajuschix-po-rabote-s-cenzuroj-v-internete.65642/ | (1) Руководство для начинающих по работе с цензурой в Интернете - Codeby.net - Информационная Безопасность
https://codeby.net/members/sith_ortodox.104801/#recent-content | (1) sith_ortodox | Codeby.net - Информационная Безопасность
https://codeby.net/members/i3wm.106227/#recent-content | (1) i3wm | Codeby.net - Информационная Безопасность
https://codeby.net/threads/istorii-za-kodom-na-puti-k-pravilnomu-kodu.65506/ | (1) [Истории за кодом] На пути к правильному коду. - Codeby.net - Информационная Безопасность
https://codeby.net/members/masonskoe_loje.106290/#recent-content | (1) Masonskoe_loje | Codeby.net - Информационная Безопасность
https://codeby.net/members/tayrus.74954/#recent-content | (1) Tayrus | Codeby.net - Информационная Безопасность
https://codeby.net/threads/hack-the-server-drupal.65356/ | (1) Hack the Server (Drupal) - Codeby.net - Information Security
https://codeby.net/threads/novyj-sposob-vzloma-wi-fi-avgust-2018.64485/ | (1) Новый способ взлома Wi-Fi | август 2018 - Codeby.net - Информационная Безопасность
https://codeby.net/threads/rsa-princip-raboty-algoritma-na-primerax-python-shifrovanie-v-internete-chast-1.64349/ | (1) RSA algorithm operation principle using python examples. Encryption on the Internet. Part 1. - Codeby.net - Information Security
https://codeby.net/threads/mini-framework-python-dlja-xakera-chast-4-svoj-mini-frejmvork.64083/ | (1) [Mini framework] - Python для хакера - [Часть 4] - Свой мини фреймворк - Codeby.net - Информационная Безопасность
https://codeby.net/threads/python-requests-threading-perebor-parolja-v-formax-avtorizacii.62698/ | (1) Python + requests + threading. Password search in authorization forms. - Codeby.net - Information Security
https://codeby.net/threads/anonimnyj-pentest-vpn-tor-vpn-chast-ii-reverse-shell-za-lokalnoj-setju.62656/ | (1) Анонимный пентест [VPN -> TOR -> VPN] (Часть II) - Reverse Shell за локальной сетью - Codeby.net - Информационная Безопасность
https://codeby.net/threads/pishem-skript-dlja-bruta-xehshej.62252/ | (1) Пишем скрипт для брута хэшей - Codeby.net - Информационная Безопасность
https://codeby.net/threads/sozdanie-plagina-s-majnerom-dlja-brauzera-chrome.62202/ | (1) Создание плагина с майнером для браузера chrome - Codeby.net - Информационная Безопасность
https://codeby.net/threads/uroki-po-burp-suite-pro-chast-1-nachalo.62200/ | (1) Уроки по Burp Suite Pro Часть 1. Начало. - Codeby.net - Информационная Безопасность
https://codeby.net/threads/sposoby-zagruzki-shella-behkdora-na-sajt.61851/ | (1) Способы загрузки шелла/бэкдора на сайт. - Codeby.net - Информационная Безопасность
https://codeby.net/threads/uchim-python-ch8-otojdem-ot-temy.61715/ | (1) Учим Python - [Ч8] - Отойдем от темы - Codeby.net - Информационная Безопасность
https://codeby.net/threads/kak-ispolzovat-shodan-api-s-python-dlja-avtomatizacii-skanirovanija-ujazvimyx-ustrojstv.61501/ | (1) Как использовать Shodan API с Python для автоматизации сканирования уязвимых устройств - Codeby.net - Информационная Безопасность