APT

#scripts
Find SSRF with this simple pattern 😌

gau domain.tld | grep -E "\?.*https?"

Really cool numbers

#Risks E-Commerce fraud cases

Full research here:
https://appriss.com/retail/wp-content/uploads/sites/4/2018/12/AR3018_2018-Customer-Returns-in-the-Retail-Industry_Digital.pdf

#Tools
Tracking cloud infrastructure on steroids

https://www.marcolancini.it/2020/blog-mapping-moving-clouds-with-cartography/

#exploits
https://twitter.com/sec715/status/1303146392324419584

#TOP10 Use logs, but be careful

#tools AWS public services detection tool
https://github.com/BishopFox/smogcloud

#TOP10 Broken Authentication

#memes /b bugbounty 😂

#TOP10 Sensitive data exposure typical places

#TOP10 Where an issue might appear

#TOP10 Some examples of Broken access control

#tools Kubernetes RBAC visualization
https://github.com/appvia/krane

#Security_in_pictures #memes

❗️Disclaimer❗️

All information in the "@APT_Notes" channel and in the "@APT_Notes_PublicChat" chat is for research and/or educational purposes only, and you are responsible for the use of this information.

THE AUTHOR DOES NOT HAVE ANY responsibility and/or liability for how you choose to use any of the information available here. By using any information from this channel, you understand that you AGREE TO USE AT YOUR OWN RISK. Once again, All information and files available here are for EDUCATIONAL and/or RESEARCH PURPOSES ONLY.

Any actions and/or actions related to the materials contained in this channel are solely your responsibility.

This channel does not promote any activity related to hacking. All information in this channel is for research and educational purposes only.

#Disclaimer

Finding CORS misconfigurations
#scripts

site="example.com"; gau "$site" | while read url;do target=$(curl -s -I -H "Origin: evil.com" -X GET $url) | if grep 'evil.com'; then [Potentional CORS Found]echo $url;else echo Nothing on "$url";fi;done

#tools
One-liner crlf finding script

https://github.com/kleiton0x00/CRLF-one-liner

Channel created