Spix0r

OAuth Vulnerabilities in Desktop Apps Security flaw in desktop app OAuth allows account takeover with malicious links. Understand attack steps, why it works, and fix strategies

From "Log in with OAuth" to "Your Account Is Mine"

I just published my first write-up on my blog:

blog.mirzadzare.net/from-log-in-...

This article is based on a recent #OAuth vulnerability I discovered. I hope you enjoy it! ❤️‍🔥🙌
#BugBounty #cybersecurity

GitHub - Spix0r/fback: Fback is a tool that helps you create target-specific wordlists using a .json pattern. Fback is a tool that helps you create target-specific wordlists using a .json pattern. - Spix0r/fback

Then Fuzz for backup files - maybe you'll find a juicy accessible backup file!

Github: github.com/Spix0r/fback

#CyberSecurity #bugbountyTools #bugbounty #Recon #reconnaissance #bugbountytips

5/5

You can use FBack to generate target-specific wordlists and fuzz for possible backup files:

echo https://example[.]com/files/config.php | fback -y 2020-2024 -m 1-12

Example Output:
config.php.bak
config_backup.php
config_2024.php
files_config.php

4/5

Methodology
You know those static websites, especially WordPress sites, where you encounter paths like:
example[.]com/files/config.php
But you don't have access to config.php, so now what? What should you test here?

3/5

What’s FBack?
It’s a tool that generates target‑specific wordlists to fuzz for backup files—think config.php.bak, config_backup.php, etc. Its perfect for hunting juicy unattended backups on static or WordPress sites.

2/5

It’s been a while since my last update, but I’m thrilled to share some exciting news about my project called Fback

1/5
#bugbounty #bugbountytips #bugbountytools #recon #hacking #CyberSecurity

GitHub - synacktiv/laravel-crypto-killer: A tool designed to exploit bad implementations of decryption mechanisms in Laravel applications. A tool designed to exploit bad implementations of decryption mechanisms in Laravel applications. - synacktiv/laravel-crypto-killer

github.com/synacktiv/la...

GTA VI mountains:

GitHub - Spix0r/cloudrecon: This script is used to search for cloud certificate entities such as Amazon, Azure, and others that have been extracted by the kaeferjaeger.gay provider. This script is used to search for cloud certificate entities such as Amazon, Azure, and others that have been extracted by the kaeferjaeger.gay provider. - Spix0r/cloudrecon

For this purpose, you can use CloudRecon by me:

github.com/Spix0r/cloud...

#CyberSecurity #BugBounty #BugBountyTools #pentest #infosec #Certificate #bugbountytips #reconnaissance #Recon

We can extract subdomains from these providers using kaeferjaeger, which performs this task for us every 60 minutes.

[Passive Search] If you lack the necessary resources, you can utilize kaeferjaeger provider to conduct a passive search. 2/3

Subdomain Enumeration - Finding subdomains that are hidden in the cloud.

We need to conduct a certificate search on the IP ranges of cloud providers such as Amazon, Digital Ocean, Google, and Microsoft. 1/3

GitHub - 0xCD4/SSL-bypass: SSL bypass check SSL bypass check. Contribute to 0xCD4/SSL-bypass development by creating an account on GitHub.

Root Detection & SSL Bypass Script
github.com/0xCD4/SSL-by...

GitHub - xKiian/cloudflare-jsd: Bypass Cloudflare's /h/b/jsd challenge using 100% python Bypass Cloudflare's /h/b/jsd challenge using 100% python - xKiian/cloudflare-jsd

Bypass Cloudflare's /h/b/jsd challenge using 100% python

github.com/xkiian/cloud...

I’ve updated the bug bounty & content creators starter pack with classic research group @hackerschoice.bsky.social! Let me know if you’re not on this list and would like to be added.
go.bsky.app/GD7hKPX

I’ve added a new feature to Robofinder, and now you can extract old parameters from archived robots.txt files. This is very useful for your recon process because you may find hidden or deprecated parameters that other tools might miss.

Github: github.com/Spix0r/robof...

Post: x3CTF - blogdog (+ new CSS Injection XS-Leak!) | Jorian Woltjer A "hard web xssbot" challenge about a fun browser quirk with the is= attribute to perform CSS Injection. Bypass the strict CSP with an unintended new technique to XS-Leak a selector's result by detect...

During #x3ctf, I discovered an unintended solution that turned out to be a pretty cool generic technique. It allows you to detect the result of a selector during CSS Injection, bypassing any CSP restricting external requests!
Check out the writeup below:
jorianwoltjer.com/blog/p/ctf/x...

Why should i search for old robots.txt files?

Because it's possible that the site you are investigating had numerous paths listed in its robots.txt file that were subsequently removed in later updates. Despite their removal, those paths, files, and parameters may still be accessible.

3/3

GitHub - Spix0r/robofinder: Robofinder retrieves historical #robots.txt files from #Archive.org, allowing you to uncover previously disallowed directories and paths for any domain—essential for deepen... Robofinder retrieves historical #robots.txt files from #Archive.org, allowing you to uncover previously disallowed directories and paths for any domain—essential for deepening your #OSINT and #reco...

How can I access the old robots.txt files data?

I’ve created a tool called RoboFinder, which allows you to locate historical robots.txt files.

Robofinder on Github: github.com/Spix0r/robof...

2/3

Robots.txt File And #Reconnaissance

What is a robots.txt file?

The robots.txt file is designed to restrict web crawlers from accessing certain parts of a website. However, it often inadvertently reveals sensitive directories that the site owner prefers to keep unindexed.

1/3

Writeup-Miner is live again on T.me/Daily_Writeups

Join to be among the first to access the latest cybersecurity write-ups!

Source Code: github.com/Spix0r/write...

Find out about new JavaScript security vulnerabilites in npm packages on the Node.js Security newsletter: www.nodejs-security.com/newsletter/n...

To hack a thing, first learn to build it.

Happy Birthday♥️🍰

Helped me a lot! Thank you.

Hey BlueSky!

I case you missed it:

I've created cspbypass.com
A site where you can search for known CSP bypass gadgets to gain XSS.

It already contains a bunch of useful gadgets with contributions from your favourite hackers.

If you have some CSP bypasses to share, feel free to contribute!

These tools are amazing! I really liked the idea.

I'm building two web security tools at the moment:
Shazzer - A shared online fuzzer
shazzer.co.uk

Hackvertor - Web security conversion tool
hackvertor.co.uk

I challenge you to a duel🔫

GitHub - Spix0r/Nuclei-Community-Templates: A collaborative hub for Nuclei templates. Contribute, share, and explore powerful vulnerability detection tools! A collaborative hub for Nuclei templates. Contribute, share, and explore powerful vulnerability detection tools! - Spix0r/Nuclei-Community-Templates

I've created a repo for top Nuclei templates from the security community. Contribute your templates or find powerful ones for CVE scans, fuzzing, and more! Let's build the largest Nuclei template library together! github.com/Spix0r/Nucle...

GitHub - veikkos/bmw: BMW Connected Drive apis BMW Connected Drive apis. Contribute to veikkos/bmw development by creating an account on GitHub.

github.com/veikkos/bmw

Guide on there for the BMW app should work on any other app