11/09/2021
لو انت شغال بج هانتر او ناوي تشتغل يفضل تقرأ الحاجات دي مفيده ازاي تجيب ثغرات ودي حاجات ناتجه عن خبره ناس فممكن تتفق معاهم او تختلف وكل واحد ليه رأيه وبالتوفيق للجميع ان شاء الله
Some tips to get better at find new valid bugs are:
1- Instead of looking for obvious bugs like XSS in a front-page search bar (which everyone does), choose a goal, a kind of bug you want to find and focus on it That’s what Nicolas Grégoire () did, he chose Yahoo YQL, read the docs, experimented… This allowed him to find 5 XXEs on Yahoo and earn $5950. He applied this same idea to 5 targets in total, and made 50K in 20 days.
2- If you find a duplicate, don’t get discouraged. Instead, ask yourself: Does this behaviour exist elsewhere? Are these parameters used somewhere else? For example, does this file disclosure exist on the dev or staging environment?
3- Try and think of as many different angles as possible, mobile, different browsers, different countries
4- Follow either a lateral approach or a vertical approach. Lateral is when you focus on a single technology or vulnerability across the whole scope. Vertical is when you focus on a single app or business functionality and try to find as many bugs as possible.
5- Focus on details
6- If the target has an API, read it’s documentation
7- Learn programming and automate the boring tasks like subdomains enumeration, directory bruteforce, or checking for outdated JS libraries being used
8- Automation also helps spend less time looking for low hanging fruits. For example wrote a script that can automatically find open redirect by collecting URLs with interesting parameters from the Wayback Machine, using waybackurls
9- Don’t use a checklist. It’s OK to maintain a cheatsheet, wiki or knowledge base. But don’t go through a checklist of things to test for blindly without understanding the app or product you are testing
10- Also don’t just use existing tools. Improve open source tools to fit your needs and learn how to script small tasks on the fly while hunting.
11- Chain bugs. Don’t report low hanging fruits until you can chain them with something else to escalate their severity.
Install the mobile app, visit their website and click everywhere while monitoring what’s going on. Make sure to start & configure Burp before opening the app. This allowed to find stored XSS on a public program that’s been tested for years and everyone missed them
12- Do what other people don’t do because they didn’t think about it or because they were lazy. For example Gwendal Le Coguic found a .git directory. Instead of immediately reporting an information disclosure, the lazy approach, he studied the code and found an RCE.
13- He also says: “root is a state of mind”. Hunting is like every sport, 50% about skills, 50% about spirit and 10% of luck”… mmh, that’s 110% in toal, but, okay, we get the point!
منقول من pentesterland
