Recon on

Hunting for Hidden API Endpoints Using Katana and Hakrawler

Mon, 09 Sep 2024 00:00:00 +0000

Good day! I hope you’re doing well.

In bug bounty, never say: “This idea is silly to try; the result will be nothing.” Bug bounty hunting is essentially black-box testing — you have to keep poking at your target until something turns up.

الحمدلله والصلاة والسلام على سيدنا محمد اللهم انصر إخواننا في فلسطين

The target I was hunting already had several bugs I’d found and reported before. I used to tell myself, “I know everything about this website. If something new appears, I’ll spot it.”

Bugs & JS: A Closer Look at JavaScript for Successful Bug Hunting

Wed, 10 Jan 2024 00:00:00 +0000

Good Day!

Remember when I first started bug hunting? I used to think looking into JS files was unnecessary — would I really find bugs in files everyone can see? But after some reading, I realized I was missing out on a lot. So I want to share some resources, tools, tutorials, and other ways to dig deeper into JavaScript analysis.

Resources and Tools

Diving into JS files can be very rewarding. It lets you uncover hidden functionality, credentials, API keys, paths, and more — especially valuable for finding client-side vulnerabilities like XSS.

How One Bug Scored Me Double Rewards!

Tue, 19 Dec 2023 00:00:00 +0000

Good day! I hope you are well.

I’ll get straight into a couple of bugs I found a while ago in a private program on HackerOne. Let’s call it redacted.com :)

The program resolves any subdomain (anything.redacted.com) to the main login page (redacted.com/login). That behavior was new to me, so I initially thought subdomain-gathering tools would be useless here.

I started with a simple Shodan dork:

ssl:redacted.com

Plenty of results came up, until I found an IP resolving to the subdomain z2007.redacted.com — interesting! From the name, z2007 looked like some old, forgotten server.