Latest posts
Bug Bounty Diary
16 Sept, 18:14
✎ IDN Homograph Attacks: From Phishing to Account-Collision BugsMost people know the classic IDN story: register a domain with lookalike Unicode characters ( á U+00E1 vs a U+0061 ), get it Punycode-encoded as xn--..., and trick a browser address bar into rendering something that looks like apple.com. That's old news from 2005/2017 and browsers mostly catch it now.● The Core BugApps often accept Unicode in email/username fields, then normalize them "for convenience" before using them as a lookup key. If normalization happens at a different stage than validation/storage, two different values can end up pointing to the same identity.Imagine a password reset functionality with an arbitrary mail server and MySQL. Let's see how it works:1. The user enters their email address. 2. The web app checks the database to see if the user exists. 3. It runs a SELECT query using the user'sBug Bounty Diary
7 Sept, 18:10edited
✎ Network Basics - Module 5Chapter 5 - Part 2 is live now — hope you find it useful!-- Configuring Routing and Advanced Switching — Part 2 --If you're new to networking, this chapter might feel a bit overwhelming at first. Don't worry I’ve tried to include quick reviews throughout the article to help reinforce the key concepts step by step.The quick review sections can also help you identify topics you're struggling with, so you can revisit them later (or do a bit of research) and reinforce your understanding.• Blog: Network Basics - Module 5#bugbounty #network © T.me/BugBounty_Diary
Channel photo updated
30 Aug, 19:12
Bug Bounty Diary
30 Aug, 06:03
Successfully identified an Account Takeover (ATO) vulnerability in a public program.The attack chain started with a flaw in the interaction between the web application and its WebSocket layer, which eventually led me down a rabbit hole into the Windows desktop client.I ended up reverse engineering its .dll files to understand the authentication flow and how JWTs were generated and signed.Definitely one of those findings where following the attack surface beyond the web app paid off.And honestly, this one made me even more interested in reverse engineering.A new writeup is coming 👀Bug Bounty Diary
23 Aug, 12:27
✎ Unhar - Extract, Unminify, Beautify Javascript files from .Har fileIn the previous post, I explained my approach to capturing and downloading a website’s JavaScript resources into a .HAR file for further local analysis. Now, let’s take it a step further with unhar and process that HAR files.unhar turns a raw .HAR file into a structured set of web assets for local analysis. It extracts unique JavaScript and HTML resources while preserving the original URL structure, fetches available source maps, beautifies/unminifies JavaScript, and extracts inline scripts from HTML pages.In short: HAR → Extract → Source Maps → Beautify → Ready for Analysis● Installation git clone https://github.com/Spix0r/unhar cd unhar● Usage # custom output directory python3 unhar.py site.har --output folder# skip source map fetching python3 unhar.py site.har --no-srcmap# skip beautify
Bug Bounty Diary
23 Aug, 11:50
✎ Extract & Download All JavaScript Files for ReconFor modern web apps, scraping <script> tags or relying on Burp's Site Map often isn't enough. Why? Because applications may dynamically load JavaScript from CDNs, cross-origin domains, specific routes (Lazy Loading), or after user interactions.My Approach: 1. Open DevTools → Network 2. Enable Preserve log 3. Crawl the target and visit relevant pages/features 4. Interact with the application to trigger dynamic resources 5. Export the traffic as a HAR 6. Extract all JavaScript files from .HAR file using unhar (I'll talk about it in the next post.)#bugbounty #javascript #recon © T.me/BugBounty_Diary
Bug Bounty Diary
9 Aug, 22:04edited
✎ Using LLMs to Unminify JavaScriptMost JavaScript minification is lossless. Transformations like true → !0 can be reversed with traditional AST-based tools such as Babel.Variable renaming is different: recovering meaningful names requires understanding the code's intent. This is where LLMs can help.Instead of letting an LLM rewrite the source directly, which can break functionality, we can use it only to suggest meaningful names, then perform the actual renaming deterministically at the AST level.A practical pipeline looks like this:1. Unbundle Webpack with webcrack 2. Reverse lossless minification with AST transformations 3. Ask an LLM to infer the purpose of identifiers 4. Rename them safely at the AST level 5. Format the result with PrettierOne tool that implements this approach is Humanify: ● Repository: Github#bugbounty #javascript #reverse_engineering
Bug Bounty Diary
16 Jul, 12:59edited
✎ Network Basics - Module 5Chapter 5 - part1 is live now - hope you find it helpful!-- Configuring Routing and Advance Switching — part 1--• Blog: Network Basics - Module 5#bugbounty #network © T.me/BugBounty_Diary
Bug Bounty Diary
12 Jul, 00:27edited
✎ cURL Cheatsheet — The Swiss Knife of HTTP Requests● Basic Requests1. GET requestcurl https://example.com 2. Save response to a filecurl -o output.html https://example.com 3. Follow redirectscurl -L https://example.com -------‐-----------------------------● HTTP Methods1. POST requestcurl -X POST https://example.com/loginBug Bounty Diary
1 Jul, 19:20edited
✎ FlareProx - Simple IP Rotation & URL Redirection via Cloudflare WorkersFlareProx automatically deploys HTTP proxy endpoints on Cloudflare Workers for easy redirection of all traffic to any URL you specify. It supports all HTTP methods (GET, POST, PUT, DELETE, etc.) and provides IP masking through Cloudflare's global network. (100k requests per day are free.)● How It Works?FlareProx deploys Cloudflare Workers that act as HTTP proxies.1. Request Routing: When you make a request, your request is sent to a FlareProx endpoint. 2. URL Extraction: The Worker extracts the target URL from query params or a custom HTTP header. 3. Request Proxying: The Worker forwards your request to the target URL. 4. Response Relay: The target's response is relayed back through Cloudflare. 5. IP Masking: Your original IP is masked by Cloudflare's infrastructure.● Repository: Github#bugbounty #burp ©
Bug Bounty Diary
22 Jun, 05:15edited
✎ Hacking Google with A.I. for $500,000After earning $500,000 in Google bug bounties, BruteCat shared the AI-powered prompts, workflows, and techniques used to analyze Google's massive attack surface, which offers valuable insights for security researchers looking to scale their reconnaissance and vulnerability discovery.I highly recommend you read this writeup because it gives you a good methodology for hacking using AI.• Blog: Hacking Google with A.I. for $500,000#bugbounty #AI © T.me/BugBounty_Diary
Bug Bounty Diary
16 Jun, 23:45edited
✎ Network Basics - Module 4Chapter 4 has finally arrived - hope you find it helpful!--Configuring Network Addressing--• Blog: Network Basics - Module 4#bugbounty #network © T.me/BugBounty_Diary
Bug Bounty Diary
13 Jun, 17:08edited
✎ RoboFinder v0.2.2 is outRoboFinder is now more powerful, stable, and easier to fit into your recon workflow.● Installation pip install robofinder● What's new?• Supports both single and multiple URLs robofinder -u https://example.com #or robofinder -u urls.txt • Pipe results directly into other tools: robofinder -u https://example.com -c | httpx • JSON output for automation: robofinder -u https://example.com -c -f jsonI also focused more on data quality than raw speed. Wayback lookups, especially on older targets, may take a little longer :( but you'll get much more complete results instead of missing valuable historical data.
Bug Bounty Diary
7 Jun, 12:13edited
✎ Discovering Domains via NS Correlation● What is a Nameserver?A nameserver (NS) is a specialised server within the Domain Name System (DNS) which translates human-readable domain names into IP addresses. Essentially, nameservers tell the internet where to find your web server.In this post I will describe a simple technique which can be used to correlate one or more websites using NS data.● Finding NameserversTo find the nameservers for a domain name, the simplest way is to use the dig tool: $ dig +noall +answer ns deliveroo.com deliveroo.com. 86400 IN NS mona.ns.cloudflare.com. deliveroo.com. 86400 IN NS phil.ns.cloudflare.com.● Finding Related DomainsSome DNS providers like Cloudflare will assign you a NS pair at the account level. This means that all domain names you add to your account will share the same NS pair.In the example above, deliveroo.com uses theBug Bounty Diary
12 May, 01:35edited
✎ Linux Security → SUID & Privilege BoundariesIn Linux, security heavily depends on permission architecture. One critical mechanism is SUID (Set User ID).● What is SUID? When SUID is applied to an executable, it runs with the file owner’s permissions instead of the executing user’s.If the file is owned by root, it grants elevated privileges.[me@linux ~]$ ls -l /usr/bin/passwd -rwsr-xr-x 1 root root ... • The s indicates SUID.This allows normal users to run passwd, which needs root access to update /etc/shadow.SUID itself is legitimate, misconfigured SUID binaries are dangerous.If powerful binaries like: • bashBug Bounty Diary
9 May, 00:37edited
✎ Network Basics - Module 3Module 3 is now live on my Hashnode series.--Interfaces & Switches--As always stripped down to the essentials with no fluff.• Blog: Network Basics - Module 3#bugbounty #network © T.me/BugBounty_Diary
Bug Bounty Diary
1 May, 21:57edited
✎ ASN → IP Recon Workflow (BGPView alternative)I used to rely on bgpview.io for extracting IP ranges from ASNs it was free and useful for recon workflows. But after it went down, I looked for an alternative and found this awesome repo:• as-ip-blocks: GithubIt lets you pull IPv4/IPv6 prefixes per ASN directly from raw GitHub data, which is ideal for automation.</> Bash Function for ASN → IP EnumerationYou can plug this directly into your recon pipeline or customize it for your tools asn2ip() { local base="https://raw.githubusercontent.com/ipverse/as-ip-blocks/master/as"fetch_asn() { curl -fsSL "$base/$1/aggregated.json" \ | jq -r '.prefixes.ipv4[]?' 2>/dev/null \ | sort -u }
Bug Bounty Diary
15 Apr, 13:24edited
✎ Network Basics - Module 2Module 2 is now live on my Hashnode series.--Ethernet--Stripped down to the essentials, focusing only on what actually matters for understanding networks from a cybersecurity perspective.• Blog: Network Basics - Module 2#bugbounty #network © T.me/BugBounty_Diary
Bug Bounty Diary
20 Feb, 11:43edited
✎ IP Spoofing to Account Takeover: You Patched It? Really?In my previous article, I described how I found a security flaw in a popular desktop app's OAuth flow that allowed me to steal any user's account with just one click. I reported it, saw it patched, and then bypassed the patch again. Since the process of bypassing and exploiting the flaw is interesting to me, I decided to write a second article about it.• Blog: IP Spoofing to Account Takeover#bugbounty #ipspoofing #oauth © T.me/BugBounty_Diary
Bug Bounty Diary
4 Feb, 10:57edited
✎ Tuning Time, Depth, and Accuracy in Port ScanningDifferent port scanners excel in different aspects • Nmap → depth • MassScan → scalability • Naabu → simplicity • RustScan → speedNabuu + Nmap 1. Service version detection naabu -host http://example.com -p 80,443,8080 -nmap-cli 'nmap -sV -sC'2. Full vuln scan on discovered ports naabu -l targets.txt -top-ports 1000 -nmap-cli 'nmap -sV --script vuln -oN nmap-vuln.txt'3. Quick banner grab + OS detection naabu -host 10.0.0.0/24 -p 22,80,443 -nmap-cli 'nmap -sV -O --script banner -oG results.gnmap'• The flow: Naabu finds open ports fast → pipes them to nmap for deeper enumeration. Best of both worlds.
Related Channels
Other channels in the same section of the catalogue.
