Web Penetration Tester, Security researcher, bug bounty hunter ๐ Vietnamese ๐ป๐ณ๐ป๐ณ๐ป๐ณ
Joined August 2024
- Tweets34
- Following174
- Followers8
- Likes81
Kn1ght retweeted
I have spent some time this past day to investigate NodeJS source code and how a typical process tree from a react/next.js app will look like.
If you are building detections for React2Shell give this a read. as it'll help you identify the right strings to use to filter down FPs and what anomalous look might like.
github.com/nasbench/Misc-Resโฆ
Kn1ght retweeted
๐จXSS Found๐จ
1โฃ katana -u "url" -d 5 -ps -pss waybackarchive,commoncrawl,alienvault -kf -jc -fx -ef woff,css,png,svg,jpg,woff2,jpeg,gif,svg thx man @coffinxp7 ๐ฅ
2โฃ nuclei -t /string/dast/ -dast -headless
3โฃ Confirm payloads!
Kn1ght retweeted
Brother, some time ago I made this tool for when you're targeting a large number of subdomains. The idea was to create a fast tool for discovery.
github.com/Acorzo1983/AliveHโฆ
#bugbounty #hacking #cybersecurity
Kn1ght retweeted
After going through all the comments and questions about setting up IDN domains and using Punycode based emails, I finally made a video that covers everything step by step. Iโm confident this will help many of you land some serious bounties!
youtu.be/Cj1sOFHDClM?si=WGjmโฆ
Kn1ght retweeted
This #NahamCon2025 talk has generated over $50,000 in bounties for @YShahinzadeh and a few other hackers: Puny-Code, 0-Click Account Takeover.
๐ฅ๐๐ผyoutu.be/4CCghc7eUgI
Kn1ght retweeted
๐ Bug Bounty Web Checklist
Track your web pentesting progress by checking each subcategory.
nemocyberworld.github.io/Bugโฆ
Kn1ght retweeted
๐ Detailed Checklist: Android APK Pentesting Checklist
Checklist: book.hacktricks.xyz/mobile-pโฆ
#infosec
Kn1ght retweeted
"Business logic allows any user to be blocked from creating an account"
medium.com/@jeetpal2007/busiโฆ
#bugbounty #bugbountytips
Kn1ght retweeted
API Hacking - Cracking JWT Tokens
ghostlulz.com/blog/api-hackiโฆ
Pre Account Takeover
ghostlulz.com/blog/pre-accouโฆ
XSS With Polyglots
ghostlulz.com/blog/smart-xssโฆ
React JS SourceMaps to XSS
ghostlulz.com/blog/reactjs-sโฆ
Bypass AI Powered Wafs
ghostlulz.com/blog/bypass-aiโฆ
#bugbounty #bugbountytips #bugbountytip #infosec #xss #OWASP #redteam #pentest #hackerone #bugcrowd
Kn1ght retweeted
Want to master client-side bugs? ๐
Check out this extensive GitHub repository with tens of different resources curated by @zomasec!
๐ github.com/zomasec/client-siโฆ
Kn1ght retweeted
While learning and practicing website application security and exploitation, also learn to hack APIs effectively.
portswigger.net/web-securityโฆ
Kn1ght retweeted
๐Monthly Giveaway๐
Hack The Box 6-month VIP+
- Follow, Like, and Retweet to join!
- Winners will be picked randomly on 5 June.
#hackthebox #giveaway #projectsekaictf
ALT Image of Monthly Giveaway conducted by Project Sekai CTF. > Follow, Like, and Retweet to get a chance to win a > 1x 6-Month HackTheBox VIP+ > Winner will be announced on 5 June 2025
Kn1ght retweeted
๐ฅ ๐๐ ๐๐๐ ๐๐๐๐ฆ๐ข๐ง๐ ๐๐ฅ๐๐ฒ๐ ๐ซ๐จ๐ฎ๐ง๐ ๐๐๐๐ฌ from @Microsoft
12 free labs to up-level your hacking skills from the โAI Red Teaming in Practiceโ Black Hat training, covering:
- Credential exfiltration
- Extracting a secret from the metaprompt
- Indirect prompt injection
- and more!
Super cool that this was open sourced, huge shout-out to Dr. Amanda Minnich (AIRT), Gary L., Martin Pouliot, and anyone else involved ๐
๐ github.com/microsoft/AI-Red-โฆ
Kn1ght retweeted
Want to quickly and easily import BChecks and Bambdas to your library?
๐ Check out Extensibility Helper on the BApp Store!
๐ Pull scripts directly from the PortSwigger community repositories, or provide your own for a custom store experience.
Kn1ght retweeted
Built a Burp Suite extension to run SQLmap directly from the GUI.
No more saving HTTP requests + jumping to terminal.
Just:
โ Mark param with *
โ Right-click โ Send to SQLmap
โ Pick options โ Run
Linux-only for now. Windows support coming soon.
Full write-up: medium.com/@YousefAlotaibi/bโฆ
#BurpSuite #SQLmap #CyberSecurity #BugBounty #RedTeam #infosec
