Offensive Security & Exposure Management Platform 🎯 yeswehack.com/programs 👾 dojo-yeswehack.com 💡 yeswehack.com/blog
World
- Tweets 9,191
- Following 3,382
- Followers 42,122
- Likes 8,774
Pinned Tweet
After analysing a critical Joomla JCE flaw, one of our researchers received a suspicious GitHub request containing two supposed PoCs 👀
We didn’t run them. One contained previously unknown malware.
With @sekoia_io, we analysed it and shared IOCs 👇
yeswehack.com/news/chocopocs…
8
39
2,200
Medusa by @Ch0pin is a game-changer for mobile bug hunters 📱🕵️
With its FRIDA-powered framework, you can automate tasks like bypassing SSL pinning, tracing function calls, and modifying app behaviour in real time. Perfect for uncovering vulnerabilities in Android & iOS apps! 🔍
Check it out 👉 github.com/Ch0pin/medusa
#BugBountyTips #YesWeRHackers
2
121
527
25,647
Tips&Tricks🕵️
#BugBountyTip! did you know..?
📂Httpx can do directory fuzzing on all domains with one simple argument!🧐
#YesWeRHackers #BugBountyTips
14
144
502
Vulnerable code snippets time⏳
Level: Easy🪲
Found the issue? Explain how in the comments!👇
29
73
431
Tips&Tricks🕵️
#BugBountyTip! We all love the SQL injection payload:
➡️0'XOR(if(now()=sysdate(),sleep(10),0))XOR'Z
We have added some adjustments to the payload that may bypass some WAFs & to help you with the hunt!❤️🔥
#YesWeRHackers #BugBountyTips
10
119
340
Vulnerable code snippets time ⏳
Level: Easy 🪲
Found the issue? Explain how in the comments! 👇
#BugBounty #YesWeRHackers
34
58
320
Vulnerable code snippets time⏳
Level: Easy🪲
#BugBounty #YesWeRHackers
Found the issue? Explain how in the comments!👇
17
47
291
Bypassing modern WAFs can be tricky. First, we can use a tool like Wafw00f to find out the WAF used by the application. Then we can use this information to obfuscate or encode our payloads to bypass the firewall🔥🧗
Read more advanced techniques here : blog.yeswehack.com/yeswerhac…
Wafw00f - github.com/EnableSecurity/wa…
#bugbounty #bugbountytips
3
79
289
42,426
Vulnerable code snippets time⏳
Level: Easy🪲
#BugBounty #YesWeRHackers
Found the issue? Explain how in the comments!👇
22
47
270
🚨 Attention hackers and bug hunters! We just published an in-depth article on detecting and exploiting prototype pollution #vulnerabilities in JavaScript, written by @BitK_ & @sakiirsecurity. Check it out to stay ahead of the game & sharpen your skills 👇
blog.yeswehack.com/talent-de…
4
109
270
26,912
Last-minute costume idea: hacker at @YesWeHack 🕷️💻
Don't have what you need? Try your luck to win a swag pack!
To enter:
👉 Follow us
👉 Comment your fav Halloween emojis
Winners (one here, one on LinkedIn) will be announced Monday, 11AM CET.
Good luck, spooky hackers! 💀
236
22
274
36,415
Dalfox 🦊 is an advanced XSS scanner and parameter analyser that also offers the ability to collect XSS payloads from other sources remotely, such as PortSwigger's XSS cheat sheet! 👇
Dalfox : github.com/hahwul/dalfox
#YesWeRHackers #bugbountytips
ALT The Dalfox tool developed by Hahwul
1
69
251
22,543
Vulnerable code snippets time ⏳
Level: Easy 🪲
#BugBounty #YesWeRHackers
Found the issue? Explain how in the comments! 👇
16
30
249
Tips&Tools!🕵️
We compared some fuzzer tools!😼👇
Dirsearch, FFuF, Feroxbuster, GoBuster
» Speed💨
» Accuracy🎯
» Features⚙️
Which one is your favorite? ⚔
#YesWeRHackers #BugBountytip #BugBountytips
22
68
245
Today, we’re celebrating love by offering some swag! 😍
To take part, make sure to follow us & comment which item you prefer from the pic 👇
We’ll draw two winners (one on X, one on LinkedIn – so you can maximise your chances) on Monday, 10am CET.
Happy Valentine’s Day! 💖
238
18
240
20,392
Katana by @pdiscoveryio is a powerful web crawler for recon! 🕷️
With support for JavaScript crawling, URL extraction, and custom filtering, it helps uncover endpoints, parameters, and assets efficiently. A must-have for refining your attack surface 🚀
Check it out 👉 github.com/projectdiscovery/…
#BugBounty #Recon #YesWeRHackers
33
230
12,524
Vulnerable code snippets time⏳
Level: Medium🐝
#BugBounty #YesWeRHackers
Found the issue? Explain how in the comments!👇
16
38
222
Tips&Tricks🕵️
#BugBountyTip! did you know..?
📂Create a custom wordlist from crawled/wayback URLs!😮
#YesWeRHackers #BugBountyTips
9
58
211
Have you ever come across Flutter APKs and wondered how to intercept their network requests? reFlutter by @ptswarm is a game-changer for mobile bug hunters! 📱
reFlutter works by replacing the original Flutter engine in the APK with a modified one, allowing real-time interception of network traffic at the native level. You simply have to configure BurpSuite as indicated in the screenshot!
Check it out 👉 github.com/ptswarm/reFlutter
3
52
212
29,913
Vulnerable code snippets time⏳
Level: Easy🪲
#BugBounty #YesWeRHackers
Found the issue? Explain how in the comments!👇
9
30
205
Vulnerable code snippets time!💀
Level: Easy 🪲
~ [#]vulnerable..?
Try it out at Github: github.com/yeswehack/vulnera…
#BugBounty #YesWeRHackers
Found the bug? Explain how in the comments! 👇
11
30
201
50,097
Did you know that Shodan has a special search engine just for exploits?
A handy tool to use when you need an exploit for a vulnerability you have discovered 👾
exploits.shodan.io/
#bugbountytips #bugbounty
ALT search engine for exploits
3
54
201
16,058
Find the full article here ⤵️
yeswehack.com/learn-bug-boun…
2
35
203
22,604
Vulnerable code snippets time⏳
Level: Easy🪲
#BugBounty #YesWeRHackers
Found the issue? Explain how in the comments!👇
20
26
186
Vulnerable code snippets time ⏳
Level: Easy 🪲
#BugBounty #YesWeRHackers
Found the issue? Explain how in the comments! 👇
13
26
186
With DomLogger++ by @kevin_mizu, tracking DOM interactions has never been easier for XSS testing! ☝
This powerful tool logs DOM modifications in real time, helping you pinpoint vulnerable elements and uncover interesting behaviours 🕵️
Check it out 👉 github.com/kevin-mizu/domlog…
#YesWeRHackers #BugBountyTips
1
32
175
7,539
Tips&Tricks🕵️
#BugBountyTip! Let us help you to enhance your SQL injection skills! 💉
Do you already know them? Share your tips just below this tweet and help the community! 👇
#YesWeRHackers #BugBountyTips
1
51
159
SSTI, LFI, SQL injections or XSS cheatsheets right inside your browser?
Yes ! and many more.
Hack-Tools browser extension by Ludovic COULON & Riadh BOUCHAHOUA is nice, give it a try.
github.com/LasCC/Hack-Tools
61
162
Tips&Exploit 🕵️
Time for a #BugBountyTip!
Did you know that Metasploit offers a JavaScript keylogger module?💀
Use it as a proof of concept (POC) & improve your XSS exploitation!💻
#YesWeRHackers #BugBountyTips
1
47
152
A new open-source tool from @BitK_ reveals how popular browsers parse HTML – simplifying the hunt for mutation XSS and opening up new horizons in security research 🔬 Read about this valuable addition to your 'Hacker's Toolbox' in our latest blog post 👇
yeswehack.com/learn-bug-boun…
3
57
160
18,115
Asset discovery just got easier 💡
Dirsearch lets you brute-force directories & files - with on-the-fly wordlist tweaks for faster, sharper results.
👏 Kudos to @_maurosoria and @shells3c_ for this must-have tool!
🔗 github.com/maurosoria/dirsea…
#BugBountyTips #BugBounty
3
21
156
9,083
Hunters, we want to help you! Check this new article on our blog to know how you can improve your hunting process!💉 #BugBounty #bugbountytips
PimpMyBurp #1 – PwnFox + Autorize: The perfect combo to find IDOR
➡️blog.yeswehack.com/yeswerhac…
1
66
144
🔧 #BugBountyToolkit: Supercharge your Burp Suite with these must-have extensions:
3
39
146
21,980
SSL pinning blocking your traffic?
Medusa by @Ch0pin comes with ready Frida scripts for common bypasses, with many modules including ssl unpinning to test against pinned apps.
Full setup guide 👉 yeswehack.com/fr/learn-bug-b…
#BugBounty #BugBountyTips
19
157
9,680
To all our bug bounty hunters: this is a way to improve your daily automation with @Burp_Suite by combining passive and active scanning to detect potential vulnerabilities in your target 🕵️💻
Find out more here : yeswehack.com/learn-bug-boun…
#YesWeRHackers #bugbounty #bugbountytips
1
55
146
9,975
Want to hack mobile applications? 📱
We’ve just published the ultimate guide to building an Android #BugBounty lab with emulators, real devices and proxies (featuring Genymotion, Android emulator, Magisk, Burp, Frida & Medusa) 👇
#BugBountyTips
yeswehack.com/learn-bug-boun…
1
33
149
10,934
Cross-site request forgery (CSRF) has survived the protections introduced to defeat it, so remains essential #BugBounty knowledge 📖 Our second ‘vulnerability vectors’ instalment details CSRF types and how to exploit them 👇
#BugBountyTips
yeswehack.com/learn-bug-boun…
1
26
140
11,351
Vulnerable code snippets time ⏳
Level: Medium 🐝
{ Hint } Do you really need all the chars or just one?🤔
#BugBounty #YesWeRHackers
Found the issue? Explain how in the comments! 👇
8
34
125
🧐 When it comes to subdomains recon, @Six2dez1 is really a professional in this area!
➡ Read his new article about Subdomains Tools Review: a full and detailed comparison of subdomain enumeration tools 👇
#BugBounty #YesWeRHackers
blog.yeswehack.com/yeswerhac…
6
70
135
Looking to sharpen your #BugBounty skills with real-world code?
Check out our collection of vulnerable code snippets - from XSS and SQLi to broken auth and beyond.
Ideal for hands-on practice and testing your payloads!
👉 github.com/yeswehack/vulnera…
#YesWeRHackers #BugBountyTips
31
133
5,744
💰 Want to earn your first bug bounty faster?
@amrelsagaei has put together a clear roadmap that shows what to learn, in what order, plus the best tools and practice resources - including @yeswehack #Dojo.
🔖 Bookmark it for later!
#BugBountyTips
piped.video/watch?v=V5T3e5L0…
1
27
132
13,924
⚔ Bypassing WAFs is not that easy - so join the workshop led by @Brumens2 at #Nahamcon to know more! On May 24, 12PM PST, dive into walk-throughs labs for each bypass scenario & explore the various solutions. Did we mention attendance is free? More info: yeswehack.com/page/yeswehack…
23
130
13,961
Level up your #BugBounty toolbox 🧰
Create combinations of URL paths with mkpath from @trick3st that you can use to find hidden directories and files!
With the command below, we create endpoints that will be used to find administrator logins 👇
🔗 Download mkpath here: github.com/trickest/mkpath
#YesWeRHackers
1
36
126
15,756
🤔 What to do when faced with GraphQL? Learn more about leveraging GraphQL to take advantage in your Bug Bounty exploration!
Mutation & Introspection will no longer hold any secrets for you 🧐 #BugBounty #YesWeRHackers
blog.yeswehack.com/yeswerhac…
1
58
119
Two great articles on how to attack file upload functions. The articles will teach you effective techniques that are good to know when looking for file upload vulnerabilities! 🏹
1) blog.yeswehack.com/yeswerhac…
2) blog.yeswehack.com/yeswerhac…
#YesWeRHackers #BugBounty
2
40
123
16,360
📱 Want to pwn Android apps from the inside? Let’s talk about Drozer, one of the most powerful tools for Android app security.
It allows you to explore and interact with internal app components (like Activities, Services, Broadcast Receivers, and ContentProviders) to uncover hidden attack surfaces and exploit misconfigurations 👇
1
29
127
8,695
YesWeHack present #Firefly
A new #opensource tool designed to perform black-box fuzzing on web applications.
The tool offer built-in techniques that analyze the target behaviours🕵️♂️
~ Bring light into darkness
Check it out: blog.yeswehack.com/yeswerhac…
#YesWeRHackers #bugbountytips
44
121
21,240
HTTP request smuggling vulnerabilities have been evolving like crazy in recent years! 🚀
We’ve published a guide to this in-vogue area of research, comprising detection, exploitation and mitigation tips 👇
yeswehack.com/learn-bug-boun…
#BugBounty #BugBountyTips
23
130
6,144
IT'S OFFICIAL ! We are launching today @yeswehack EDU, the world's first #BugBounty educational platform !
blog.yeswehack.com/2019/11/0…
1
54
117
🔥 There is a warm place 🔥, a meta search engine, that reference every possible Bug Bounty and VDP program out there!
FIREBOUNTY allows you to search, filter, and sort Fresh Bounties. This should be your home page, seriously ;)
firebounty.com/
#BugbountyTips #bugbounty
1
39
124
#⃣1⃣1⃣ Vulnerable code snippets time ⏳
Level: Easy 🪲
You'll find the code directly on our GitHub: github.com/yeswehack/vulnera…
Go & play with it!💀
#BugBounty #YesWeRHackers
Found the issue? Explain how in the comments! 👇
6
19
112
What advice would you give yourself if you were just starting in #BugBounty? 🔍 Any tips or insights that could help beginner hunters? 👇
#YesWeRHackers #BugBountyTips
16
6
112
12,034
Hunters, mark your calendars! On March 9-10, @yeswehack will host a Live #BugBounty at #NullconDE2023, open to all attendees! The target company and scope will be revealed on-site, but we can already tell that it'll be 2 days of fun & pwn, with juicy rewards and sweet swags 🚀
7
19
117
30,193
We have upgraded our encoder script, new encoders and decoders have been added. We've also made it easier to add your own custom encoders/decoders to the script! 👀
Give it a try : github.com/Brum3ns/encode
#YesWeRHackers #BugBounty
ALT YesWeHack Script - Encode
1
25
109
14,918
Hackers, if you could give just one single good advice to help someone get into the Bug Bounty game, what would it be? (Don't be shy, no tweet will be triaged as "duplicate"). 👇
34
11
108
👀Do you like Blind XSS?
Learn how to setup your own self-hosted XSS Hunter with the PwnMachine! 💡
blog.yeswehack.com/yeswerhac…
Full article here 👇
#BugBounty #YesWeRHackers
1
47
104
🥁 We're thrilled to announce that we've raised €16M in our Series B funding! So today, we want to thank you, hunters, for making up our community. We wouldn’t be here without you! #HackThePlanet #YesWeRHackers
Full announcement: bit.ly/3hVXBWp
12
25
110
Recon against wildcard domains 🕵️
Dealing with a program that contains many subdomains can be a complicated and confusing task!
🧵 We'll try to guide you through this thread below 👇
2
35
105
22,426
Guess what? @Rhynorater called this article phenomenal 👏
When even he’s learning new tricks, you know it’s worth your time.
Dive into “The minefield between syntaxes: exploiting syntax confusions in the wild” 👇
piped.video/rbDdiM1L2Bo?si=Crtr…
2
13
111
11,687
Don't forget to take advantage of Burp Suite's extension: XSS Cheatsheet, which gives you tonnes of Cross Site Scripting (XSS) payloads to search through, right from within Burp Suite!
➡️ portswigger.net/bappstore/eb…
#YesWeRHackers #BugBountyTips
ALT burp suite extension
15
106
9,632
Vulnerable code snippets time⏳
Level: Medium🐝
➡️This is an underestimated vulnerability if you manage to exploit it correctly!🤯
Let us know which vulnerability you thought it was after a quick look!😼
#BugBounty #YesWeRHackers
Found the issue? Explain how in the comments!👇
15
18
106
💡 To complete the first part of our article, here is now part 2 of our series on "File Upload" attacks.
The full blogpost can be read here 👇
#BugBounty #YesWeRHackers
blog.yeswehack.com/yeswerhac…
4
52
102
Noticed Android apps getting only 5 reports while the web gets 150? 📱
Far fewer hunters tackle mobile targets because setting up a mobile testing environment is a pain. Let's change that!
Read our guide to build your Android lab once and for all 👇
yeswehack.com/fr/learn-bug-b…
1
22
107
7,364
This PHP (v7.2) code is vulnerable to a local file inclusion (LFI). The catch is that at the end of your input a static php extension is added that prevents you from reading e.g. /etc/passwd.
It is possible to achieve an RCE with just a single payload, but how? 👀
Practice your skills and test the code yourself on our Github 👉 github.com/yeswehack/vulnera…
#YesWeRHackers #BugBounty #YWHSnippet
ALT PHP vulnerable code
3
29
102
18,492
🕵️ VDP Finder 🕵️ stands everyday in your browser and handily informs you if the website you're viewing has a VDP or Bug Bounty Program active!
GitHub:
github.com/yeswehack/yesweha…
Chrome:
chrome.google.com/webstore/d…
Firefox
addons.mozilla.org/en-US/fir…
#BugbountyTips #bugbounty
3
25
104
⚙ PimpMyBurp #3 – AutoRepeater: add automation to your beautiful hunter life, a new article published on our blog! #BugBounty #YesWeRHackers
blog.yeswehack.com/yeswerhac…
48
99
💡 #Cybersecurity student and bug hunter: discover the story of @pwnwithlove!
Pwnwithlove starting her journey at our #LiveHackingEvent during @_leHACK_ 2023. Despite not uncovering any bugs on that occasion, she persisted, leveraging the opportunity to connect with the community and ignite her passion for bug hunting. Fast forward a few months, and she's now ranked 77th on the @yeswehack platform after successfully identifying vulnerabilities in both public and private programs. 👏
A truly inspiring journey for anyone interested in getting into #BugBounty, now available to read (in French 🇫🇷) on @zdnetfr ➡ zdnet.fr/actualites/focus-me…
Thank you pwnii and Louis Adam for such a great interview!
3
11
96
27,166
··· Breaking News ···
@YesWeHack raises €4 million and plans to disrupt Europe’s cybersecurity market !
🇪🇺 #bugbounty #vulnerability #DevSecOps #infosec #DigitalTransformation
blog.yeswehack.com/2019/02/1…
13
35
96
"CopyPasta is so past"
> Check the New @yeswehack Extension for @Burp_Suite 🎯
blog.yeswehack.com/2019/05/2…
#API #Scope #BugBounty #BugBountyTips
1
53
98
Server-Side Request Forgery (SSRF) occurs when an attacker tricks a server into making HTTP requests to unintended locations. Here's how to exploit it 👇
#YesWeRHackers #BugBountyTips
1
13
94
5,758
XSS is the most common vulnerability, but do you really know how to exploit it? 🤔
In our latest article, we go through everything from detection to exploitation and make sure you can properly exploit your next XSS! 💥
#YesWeRHackers #BugBountyTips
yeswehack.com/learn-bug-boun…
2
27
99
7,100
💡 Did you know that you can use Hackvertor inside @Burp_Suite to automatically calculate the size of chunked data?
This is extremely useful when exploiting HTTP request smuggling vulnerabilities! 🧐
#YesWeRHackers #BugBounty #BugBountyTips
2
17
96
11,022
💥 @YesWeHack's biggest reward ever!
We are thrilled to announce the successful completion of our Series C financing round – which raised an impressive €26 million!
A heartfelt thank you to our new investors - @WendelGroup, Adelie, and @SeventureP - as well as our longstanding supporters, Open CNP, @Bpifrance and Eiffel Investment Group. Special thanks to @TrachetCS for their invaluable support throughout this journey.
This funding will fuel our investment in artificial intelligence, the launch of innovative security solutions, and our continued international expansion.
And we will of course continue to #HackThePlanet! 🤘
🔗 For more details, check out our press release: yeswehack.com/news/yeswehack…
#BugBounty #YesWeRHackers
9
15
102
10,036
We're happy to announce we're sponsoring HackerConf Virtual Cyber Security Conference.
hackerconf.stream/
On 22 of may, 2020.
HackerConf is geared toward (but not limited to) the turkish hacker community.
twitch.tv/mdisec
Konferansta görüşmek üzere!
1
33
94
Automate what you can! 🤖
In Bug Bounty, automation is a crucial skill and will help you rapidly discover leads for potential vulnerabilities.
Learn how you can automate your tasks using Burp Suite 👇
#YesWeRHackers #BugBountyTips
yeswehack.com/learn-bug-boun…
29
94
6,170
Ffuf is a great fuzzer with many great features, one cool feature is the "dirsearch mode" (-D). This allows you to have a wordlist containing extension tags (%EXT%).
When Ffuf starts, it will insert all the specified extensions provided by the (-e) option in all tags!👀
#YesWeRHackers #BugBounty #bugbountytips
ALT YesWeHack tips and tricks for bug bounty hunting
1
17
90
10,502
😎 We just published a new article in our RampUp series! Learn how to bypass jailbreak detection, setup a proxy and bypass SSL pinning.
➡ Getting Started with iOS Penetration Testing (Part 1) 👇 #BugBounty #YesWeRHackers
blog.yeswehack.com/yeswerhac…
50
96
Have you ever seen an HTTP response embedded directly in the body of your request?
Check out these tips to discover how and where to find (internal) path traversal vulnerabilities! 👇
#YesWeRHackers #BugBountyTips
1
12
94
13,744
Ever wondered what lies beneath a web application, hidden in plain sight?
@CaidoIO's ParamFinder plugin by @bebiksior now helps you uncover these parameters and catch some bugs! 🤑
Check it out: github.com/bebiksior/ParamFi…
#YesWeRHackers #BugBountyTips
18
96
5,205
🤩 Hunters and CTF enthusiasts... we've got great news for you!
A new evolution of Dojo is here! More robust challenges with back-end language support, advanced filtering, and a bunch of new features for the entire Dojo platform - we present Dojo v2 to you!
All your educational resources are now in one place, from theoretical to practical trainings.
Explore all the features by diving into the Dojo platform:
➡ dojo-yeswehack.com
➡ Read our full blog post: yeswehack.com/dojo/unveiling…
#YesWeRHackers #CTF #BugBounty
ALT bug bounty - Dojo CTF challenge
ALT bug bounty - Dojo CTF challenge firewall setup
ALT bug bounty - Dojo learning materials
ALT bug bounty - Dojo list of CTF challenges
3
23
92
8,290
Embrace your white-box penetration testing skills in JavaScript!
This new article digs deep into finding vulnerabilities in applications coded in JavaScript! 👇
#YesWeRHackers #BugBounty #BugBountyTips
yeswehack.com/learn-bug-boun…
25
92
4,974
We're a proud sponsor of #NahamCon2020, a two-day virtual hacking conference organized by @_johnhammond, @NahamSec, @stokfredrik & @thecybermentor! Such a great line of speakers including a talk by our technical ambassador @BitK_! Don't miss it ⬇️ blog.yeswehack.com/events/na…
24
93
🎬 #TalkiePwnii is LIVE!
Introducing our new series starring @pwnwithlove! In each video, Pwnii will break down Dojo challenges, sharing various solutions & technical tips 😎
Catch the first episode about our ‘Shell Escape’ challenge 👇
#YesWeRHackers
piped.video/watch?v=Rw3wWiD5…
2
17
96
14,292
Want to sharpen your SSTI, cache poisoning or business logic error skills? 🧠 The hunters who topped our 2024 leaderboards for these CWEs – @LdrTom, @c0dejump and @kto_94_ – kindly shared their best-practice tips with us 👇
#BugBountyTips
yeswehack.com/learn-bug-boun…
3
23
97
5,689
#BugBountyQuiz
> Given the #JS code below:
How would you bypass the WAF?
· Stay Tuned for the solution Next Wednesday !
#SharingIsCaring
#XSS
#BugBountyTips
6
28
94
Want to know how to exploit HTTP headers? From basic to advanced techniques, our guide to HTTP header hacks gives you invaluable knowledge for securing bug bounties 💸
👉 yeswehack.com/learn-bug-boun…
#YesWeRHackers #BugBounty #BugBountyTips
18
90
7,015
Want to learn how to improve your #BugBounty hunting skills? Grab a coffee and settle in – this is the place to be👇
#YesWeRHackers #BugBountyTips
2
22
92
11,513
👋 A new article on "File Upload" attacks is available on our blog!
This blog post will be in two parts. This first one is an introduction to the vulnerabilities that appear on file upload forms.
Read it here 👇 #BugBounty #YesWeRHackers
bit.ly/3hm1FiQ
3
41
92
🫵You need a bunch of wordlists in your toolbox!
We've collected four great resources that provide good coverage for a wider range of use cases!
OneListForAll : github.com/six2dez/OneListFo…
SecLists : github.com/danielmiessler/Se…
Assetnote Wordlists : wordlists.assetnote.io/
Trickest : github.com/trickest/wordlist…
#YesWeRHackers #bugbountytips
1
28
94
11,731
🤩 Experience our #LiveHackingEvent with @LouisVuitton! Held at their Paris HQ, #HMIF2 was an outstanding 30-hour journey for everyone involved. Thanks to the #LV_NEO team, participating hunters & all partners for making it a success! Here’s how it went 👇
#LHE #BugBounty
4
19
89
19,479
🌟 Hack Me I’m Famous #2: HERE WE GO! For #HMIF2, we're honoured to partner with legendary luxury house @LouisVuitton. Around 40 of Europe's top hackers have been invited to take part in a tailor-made, two-day Live #BugBounty event and stand to earn rewards of up to €6,000!
7
17
94
11,997
😎 BIG thanks to our special guest Nicolas Grégoire, aka @Agarri_FR for his article in our PimpMyBurp series!
In this article, discover how to take advantage of the Intruder tool! 🔥
#BugBounty #YesWeRHackers
Full article here 👇
blog.yeswehack.com/yeswerhac…
1
36
86
🧐 Time to step up your S3 testing with our blog: Abusing S3 Bucket Permissions
It contains many good techniques for attacking S3 buckets, which will be a good skill to have in your #BugBounty field! 👇
blog.yeswehack.com/yeswerhac…
#YesWeRHackers #BugBountyTips
45
89
9,218
🔓 Abusing AWS S3 Bucket Permissions 👇
AWS S3 buckets are popular targets for hackers due to potential misconfigurations and improper access control. Let's dive into the techniques attackers use to identify and exploit vulnerable S3 buckets!
1️⃣ Bucket Recon: Spot S3 buckets URLs via source code inspection (HTML & JS files), brute-forcing, Google dorking (site:s3.amazonaws.com "company_name"), DNS caching, or reverse IP lookups.
2️⃣ Permission Testing: Use AWS CLI to test permissions. For read (aws s3 ls s3://[bucket-name] --no-sign-request) and write (aws s3 cp localfile.txt s3://[bucket-name] --no-sign-request).
3️⃣ ACL Exploration: Retrieve bucket/object ACLs (aws s3api get-bucket-acl --bucket [name]) and test WRITE_ACP by attempting to set new ACLs.
4️⃣ Full Control Abuse: Look for FULL_CONTROL permissions to read, write, and modify ACLs. Exploit any authenticated AWS client access by using your AWS profile in the CLI commands.
5️⃣ Policy Misconfigurations: Identify overly permissive policies (e.g., Action set to "*") and recommend granular, need-based permissions.
By trying out these tricks, you may be able to effectively identify and report misconfigured S3 buckets, helping organizations secure their sensitive data in the cloud!
#BugBounty #YesWeRHackers #BugBountyTips
1
32
87
7,050
Dodge WAFs and detection mechanisms by mastering payload obfuscation 🥷
Level up your #BugBounty skills with encoding, variable expression, array parameter and shell-environment techniques, plus a look at how Log4Shell evaded defences 👇
yeswehack.com/learn-bug-boun…
1
22
90
4,373
Vulnerable code snippets time ⏳
Level: Hard 🐞 (code analysis)
Would you like to update "your" password? 🫵🔐
Github: github.com/yeswehack/vulnera…
#BugBounty #YesWeRHackers
Found the issue? Explain how in the comments!
7
18
86
24,275
Which site are you hacking right now? 🕵️️
Let WhatWeb tell you - it fingerprints tech stacks so you find bugs faster.
👉 Try out the tool - developed by @urbanadventur3r & bcoles: github.com/urbanadventurer/w…
#BugBountyTips #BugBounty
1
13
87
4,673
Hacking a $1 billion company, choosing targets and his advice for beginners – @g4mb4h shares his #BugBounty story in this video interview 🔥👇
yeswehack.com/community/pati…
9
89
4,202
Race conditions are everywhere!
You know... that invisible bug that uses time to exploit vulnerabilities 💀
Here’s your quick guide to spotting and exploiting them 🧵👇
#BugBounty #BugBountyTips
2
12
87
7,927
🏆 It is time to reveal the top three hunters of Open My Heart - our Live #BugBounty with @LazadaSG at #HITB2022SIN!
🥇 @DoomerOutrun
🥈 @assetnote
🥉 @_naaash_
Huge congrats and thank you to all the hunters who attended this live hacking event! You rock!
#YesWeRHackers
7
10
84
🥁 New hunting opportunity alert! @oppo, the global manufacturer of smartphones, smart watches and other consumer devices, has launched a public #BugBounty Program. Bounties of up to $4,440 are up for grabs. Check out the new program here: yeswehack.com/programs/oppo-…
Happy hunting!
2
17
84
9,263