> For the complete documentation index, see [llms.txt](https://newrouge.gitbook.io/roguebook1/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://newrouge.gitbook.io/roguebook1/group/bug-bounty/tips-and-tricks/combined.md).

# Combined

Too many tips, can't keep adding new subpages.

## 1. Read minified JS files.

{% embed url="<https://chevonphillip.medium.com/rce-due-to-dependency-confusion-5000-bounty-fd1b294d645f>" %}

{% embed url="<https://pulsesecurity.co.nz/articles/javascript-from-sourcemaps>" %}

{% embed url="<https://github.com/denandz/sourcemapper>" %}

More js endpiint extraction: <https://lnkd.in/gcwrJSxC>

this extension: <https://github.com/jenish-sojitra/JSAnalyzer>&#x20;

## 2.  Dependency confusion

Apart from famoous alex blog

{% embed url="<https://systemweakness.com/rce-via-dependency-confusion-e0ed2a127013>" %}

#### Tool to check:  <https://github.com/visma-prodsec/confused>

#### How to publish packages:

#### <https://dhiyaneshgeek.github.io/web/security/2021/09/04/dependency-confusion/>

### 3. Null byte injection in JSON data type.

`%00` is null character and it often leads to unexpected behavior in applications. Don't believe me? search for sam curry null byte overflow writeup. You will love it.

However if you send `%00` in JSON data it might not be treated as null character by JSOn parser.&#x20;

You should instead use `\u0000`  .&#x20;

one more e.g <https://medium.com/@0xold/null-byte-on-steroids-23f8104a25ec>

Extra tip `\u2063` is also a special space like character might be useful in fuzzing.

### 4. recollapse tool by 0xacb&#x20;

This tool can be useful for validation bypass checks

{% embed url="<https://github.com/0xacb/recollapse>" %}

### 5. Portswigger URL validation cheatsheet&#x20;

good resource for url validation scenarios.

{% embed url="<https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet>" %}

### 6. Firebase, firestore

tweet link: <https://x.com/galnagli/status/2032521269724233785>