Live Recon and Automation on Shopify's Bug Bounty Program with

[@NahamSec]

📚 Purchase my course and learn about bug bounty hunting with over 11 hours of content, 100+ labs: bugbounty.nahamsec.training

[@kharbandaumang]

this is some GOD-LEVEL recon !!! We want more sessions from Tom. Thanks nahamsec for bringing this to the community and thanks Tom for sparing your time for this!!!

[@alexander_adnan]

Lol .. 😂…GOD level would leave you speechless

[@godspeed2124]

@@alexander_adnan what god level according to you?

[@65hammad]

@@alexander_adnanyou don't have a clue then. For mass recon, this is GOD-tier automation. These guys can even automate the entire process if they wanted.

[@alexander_adnan]

@@godspeed2124 looks like you will find out before others. Not a good idea to do reverse psychology, with strangers. I would be rational though, there’s no recipe for recon, it depends on your target while Technics matters less than the potential.

[@cr4zy_0o]

The calmness that Tom have is really unique, great and fancy. + The way he do his things is really epic Really a great guy

[@IBDLFSEragon]

Mind blowing. Thank you so much for giving back to community.

[@netoeli]

fantastic video , Tom really knows his stuff

[@franco2179]

It's funny because I can tell from Nahamsec's faces that he just loves Tomnomnom. At the same time it makes him laugh that he is so calm when explaining things.

[@NahamSec]

Haha! Tom is one of the most genuine and nicest people I have had on the show.

[@chasejensen88]

I think he's also realizing the greatness he's capturing at the moment, he isn't fully comprehending it yet but he knows it.

[@HenryLawrenceHMBL]

I would love to be a Shopify developer watching this unfold

[@CWLabs7209]

Every week i rewatch your videos; I am learning new things 💙.

[@SankizTime]

hora

[@CWLabs7209]

@@SankizTime :D

[@hayben7046]

Thank you both for this great content. We want more videos with @TomNomNom.

[@mateuszwasielewski7193]

I started watching this with hope of learning something. Ended with depression and one conclusion - I should stop learning this stuff if I'm gonna need to compete with maaany, maaany people as Tom. And as he said - it was his first attempt since like two years ago. I would need like a week to check all the things that he checked. Now I get it why entry-level positions needs few years of experience but in the same time I don't see a way to get this experience

[@purplethunder778]

If you think that the competitors out there are all as skillful as tom . You are very wrong

[@rajanrawal6396]

amazing, this could be probably one of the biggest information that i have ever been given. we need such playlist more and more in upcoming days. i hope i made you understand the things that i wanted to make you understand.. again, we need such playlist more and more in upcoming days.

[@piusgabula]

This is byfar the most incredible live recon i have watched on youtube

[@vonniehudson]

“ass, is that a new tool to compete with meg? I don’t know” had me rolling lololz

[@BnayaProgramming]

Start at 5:59

[@jeffreynoose]

I can watch these 50 times daily I love nomnom

[@joefawcett2191]

these vim and bash skills are really something to behold

[@bertrandfossung1216]

This is epic!! I've have to watch this video over 10 times just to understand Tomnomnom's recon process. The guy is really really good at what he does. Thanks @nahamsec & @Tomnomnom🙏🏽🙏🏽🙏🏽

[@samfisher8426]

maan seeing how tom is working makes me feel down, this dude is so good

[@ashleypursell9702]

i was literaly looking for something just like anew to use in my automation since i run scans everday i want to add stuff to already existing txt files. i have seen people use it and idk why i only found out about it rn, great video thanks so much

[@abdul-rahman7608]

Tom is a genius I must confess 🖤💯

[@ca7986]

Tom is really really good! He knows what he is doing! Amazing! Thanks Nahamsec for this video.

[@baolamminh1146]

I improve my bash skill much when watching this video. thanks Tomnomnom & Nahamsec

[@gifbfbvhvhdhfhfjffjfnfhfb515]

best video ive seen in a long time

[@amir-or6uf]

it was awesome, thanks man.

[@danieltamang2289]

finally, the two underrated hunters!!

[@affulsamuel728]

That is why Hacking is time and patience game. i love the way he spend days to come on this i love this channel

[@crusader_]

Could you please upload all the other recons

[@The1994mattj]

Would be interesting to see how different the process/tools look 3 years on.

[@xrfox1634]

I love this man!

[@ggmaxx66]

"...previous versions can be a goldmine" wow!

[@theys6837]

*TomNomNom* is a FKIN G 💯👏

[@thenarrowgate3063]

I wish I had vim mastered in this way, I use nano which has some of the same features but vim has way more flexibility it's a language all it's own and it's why hackers prefer it, I mean true command based hackers..windows has spoiled this generation..nothing wrong with a GUI but hacking is about control and putting that level of control in a GUI is a major resource hog..TOM you are a dying breed, my hats off to you..grey that is

[@ar-uh1dj]

He is truly a Genius!!!!!!!

[@chiragagrawal7856]

Was it Recon Only ? Completely Mind Blowing stuff I saw today 🙌🙌🙌🙌🙌

[@0xsunil]

Tom is best!

[@soloapplications9466]

Awesome video, I loved you Tom

[@Rashedulcss]

Thanks Tom!

[@Stas1983ful]

Very nice and interesting video bro!

[@otukencoffee7273]

Tom is such a wizard

[@localmega5824]

Two masters at work

[@thenamehasbeenstolen4470]

he literally have 10 years + experience

[@mrrexder7910]

#TOMNOMNOM FOR EVER!

[@remonsec1641]

insane 🔥

[@ahmedahmedx9600]

please which terminal theme tomnomnom used ?

[@bughunt2568]

could you please share your recon methodology you applied on redbull as target.

[@ВисторАндреевич]

hey!!))) where i can find list configfiles ?))

[@razmjumehdi9069]

Hello Ben 😊. please make a video about "Finding origin IP behind AWS CDN", because i searched a lot, but i found only video about Cloudflair bypass 🙏

[@n0w0nd3r5]

It would be cool if you could list every command tomnomnom uses in this video in the description with a timestamp so people can go directly to that section to see what it does.. Or just watch the video.

[@n0w0nd3r5]

@hackR That's Cool.

[@farhonahmed5081]

farhan ahmed was here at 10-31-22

[@rushikeshchaudhari476]

How I can start with lve website bug bounty hunting

[@lufom]

Is he previewing the `find` results? Does anyone know how to do that?

[@faris9859]

anew installation as mentioned in github not working for me. Anyone facing issues?

[@naveensaradhi6923]

We want more live with tom #request

[@SrTCOT]

In this video I learned a lot of things thank you so much Nahamsec

[@jayesh6290]

Here Kali Linux is used right ?

[@thatguycrash2255]

tomnomnom the goat

[@beelostlove]

So what's this worth this bug

[@saivenkatmaheshwaram9868]

i didn't understand how he learn all this things and how he remember this all this commands and their particular options of a tools..

[@parkour.11parkour58]

Probably because it's an hobby for him. When you're not forced to do something that you love, you usually become an expert at it.

[@MrRaja]

Anyone got the list of all tomnomnom tools used in the video?

[@sadraasadi]

Nice :)

[@CWLabs7209]

Still in a dilemma how to filter hosts on basis of response body from fff; since, every host is responding with 200 OK 😢.

[@rajanrawal6396]

they are not filtering hosts they are just checking those hosts which thet have got liittle bit doubt

[@charonxxi5985]

💯

[@yaseenzubair8792]

Is tom operating himself on 1.5x?

[@orxanovn5057]

naham bro this is gf and fff methodology or bug bounty methodology?))))

[@Kas_Styles]

Just to point out that Auv5 is the Shopify security team member. Does anyone know if they have a twitter account?

[@lilyrosestracke4591]

...And this, ladies and gentlemen, is how you know you have failed recon101! 😅😜😉

[@Kas_Styles]

@@lilyrosestracke4591 don't know why my comments keep getting deleted but I'll try posting it again

[@Kas_Styles]

@@lilyrosestracke4591 I'm actually really good at recon. I have a public playlist (all osint videos) with at the time of writing this comment it's has 407 videos in it so from that you can tell that I know a lot about the topic.

[@Kas_Styles]

@@lilyrosestracke4591 also, I have checked Google with Google dorks and Twitter and I didn't find anything related to the username.

[@Kas_Styles]

@@lilyrosestracke4591 and another thing, you shouldn't be rude to others in general. I asked because I already did some research and I couldn't find it so I was asking. It's OK to ask questions, if anything its good and its how humans learn. Also, it's a social engineering skill which is used a lot in infosec so please don't share the idea that asking questions (after doing research and not finding anything useful/related) is bad because it's 100% not bad.

[@MrRaja]

I am not even sure what i am looking at. I know what he is looking at but i have no clue what to do with what he is looking at.

[@learnwithpikes]

what's up behrouz ?? how are you ??

[@beelostlove]

Just gave up her cover

[@imuser007]

I like tom

[@beelostlove]

Hi did you miss me

[@ThushyCyber]

Hi 👋

[@shrumplestiltskin7922]

Where do we get the ass tool?

[@baravind719]

Huh man ...

[@Kas_Styles]

Whoxy the website can get historical whois.

[@x00-p3z]

🕵‍♀

[@Virdoex]

Hey @Nahamsec what you deal with 403 subdomains

[@bobmarley8644]

Just keep bruteforcing for directories, maybe /login will return 200 or /api will return 400

[@robinhood3841]

i had a scenario where i have found a directory which returns 403 forbidden, so i kept brute forcing on that directory and eventually i got PhpMyAdmin mysql page and it was accessible for anyone and i was able to successfully login with a weak credentials :), thats why u shouldn't stop on a 403 they made it forbidden for a reason and simple miss configuration may give you a high result.

[@Sakuraigi]

​@@bobmarley8644and for 401?

[@haxwizard2035]

😁😀😁😁😁😁😁

[@LetsGoTech]

Problem number one I'm on Windows

[@chiyoalice327]

Tom is not someone to follow . No My brain cells 😪 😭😭😭😭😭

[@sandeepsingh87]

Na bhai tune subtitles diye, na tune tools explain kre, aur apni accent mei tum log bol kya rhe ho ghanta samajh nhi aa rha ... Khud hi seekh le bhai, jab ye samajh aa jae ki "padhate kaise hai" tab video upload kr dena

[@hellb0y794]

Ist: it's not his problem if you don't understand english first clear your basics then come here. they both are doing great work

[@sandeepsingh87]

@@hellb0y794 Fucking Dimwit, atleast read what I've written before commenting. I wrote "accent". Simplifying it for you, What it means is that, I do know English however I am having difficulty understanding their accent (Google the meaning of accent for more information) Also if you've even seen the starting of the video, you'll notice they are not teaching the basics here, they are talking about approaching a target i.e., their methodology. So, your statement about basics don't even make sense. I mean I don't mind you standing up for the hackers you admire but at least make some logical statement. Even I know these hackers know a lot more than me, but they have little to no idea "how to teach". This could've been structured into a nice course.

[@ajaykumark107]

In the webpaste part the value he uses @1:06:26 are Code: [...document.querySelectorAll('div.g a:first-child')].map(n=>n.href) On Success: document.location=document.querySelectorAll('a#pnnext')[0].href;

[@aminumuhammed3114]

I think this is the most useful technical video that is related to recon / bug bounty thank you @nahamsec thank you @tomnomnom

[@sushantr24]

Cat from-findomain | why i m unable to run the command

[@snehadeepgolui3757]

github dork not working please help [...document.querySelectorAll('.codesearch-results a.v-align-middle')].map(n=>n.href) it is not working