echo "https://checkout.stripe.com/api/color?image_url=" | nuclei -t ssrf.yaml 

http://web.com/?XSSendpoint ===> no WAF
https://web.com/?XSSendpoint ===> WAF implemented

prips 144.160.32.0/19 | hakrevdns  -d | httpx -title -status-code -follow-redirects

Takeaway : FUZZ with certain characters such as \u0000 to try and trigger ReGeX verbose errors

Takeaway: If a company won't require email address verification and will automatically generate support tickets, try and sign up with [email protected]

Takeaway: whenever authenticity_token is presented on requests validate if the value is being processed in the back-end.

Takeaway: try (((((()0))))) when fuzzing post requests.

Takeaway: Swap identifyable cookie values between lateral accounts.

Takeaway: Look through org's public repos for Bitbucket content

Takeaway: When Fuzzing java application to try and insert code injection queries like ${T(java.lang.System).getenv()}

Takeaway: When supplying org name check what is the behaviour with adding " " (space) on it's name

Takeaway: Tampering with the host header with situations who involve caching, can append port to the host to cause DOS

Takeaway: Go through the "main.slug.js" files and look for API Keys, this one looks like the google maps one (AI....)

Takeaway: Look for websites who has bucket like https://s3.amazonaws.com/BUCKETNAME and try to run aws s3 ls BUCKETNAME

Takeaway: Check each step of reset password phase who might not be protected with rate limiting, this could even be a third step after clicking an email, allowing to skip phase 2.

Takeaway: on Admin / custom made login panels check the source code to determine if there are some leaks including password.

Takeaway: %27||/**/(case%20when(/*%c3*/length/*%c3*/(user)=5)then/**/(1)else(1/0)end)||%27

Takeaway: Change the scope parameter to arbitrary file and see if the redirect_url will redirect to external domain