Yumi retweeted
Hackers, I wrote a new tool called Transformations — it’ll help you understand how input is transformed on a system, which can help you craft better payloads.
It’s available at transformations.jobertabma.n…. Code at github.com/jobertabma/transf….
Happy crafting! #HackForGood
An interesting trick: you can bypass a WAF during a XSS attack on ASP(dot)NET/IIS technology by using a HTTP parameter pollution attack.
#BugBounty #BugBountyTips #InfoSec
(Credit to Acunetix)
Full article: acunetix.com/blog/whitepaper…
This tweet got much more attention than expected, glad if it was helpful to anyone. I'll try to continue to share this kind of stuff in the coming weeks.
If a web application allow you to upload a .zip file, zip:// is an interesting PHP wrapper to turn a LFI into a RCE.
#BugBounty #BugBountyTips #InfoSec
If a web application allow you to upload a .zip file, zip:// is an interesting PHP wrapper to turn a LFI into a RCE.
#BugBounty #BugBountyTips #InfoSec