Armand J. @_Zer0Sec_

Pentester || Red Team Bro || Guitar Shredder bugcrowd.com/Zer0_Sec Joined August 2021

Tweets

199
Followers

2K
Following

158
Likes

467

Harley Kimball @infinitelogins

a month ago

This week, Disclosed. #BugBounty Spotlight on CodeRabbit Exploit, NahamSec’s DEF CON vlog, Swiss Post’s €230K challenge, new tools for hunters, and more. Full issue → getdisclosed.com Highlights below 👇 @KudelskiSec details how vulnerabilities in CodeRabbit’s AI…

5 17 61 7K 29

ricky @shilohsecurity

2 months ago

hacker summer camp @_Zer0Sec_ @VailSec @c7five

1 1 6 337 0

Download Image

Armand J. @_Zer0Sec_

4 months ago

Love this, so sick! 🔥

Harley Kimball @infinitelogins

4 months ago

Love this, so sick! 🔥

13 23 150 21K 85

0 0 2 418 0

Armand J. @_Zer0Sec_

8 months ago

The team did some damage over the weekend! Can’t wait till the next hack sesh! In IDORS/PrivEsc/Account Takeovers we trust! 🤙🏻💥 #bugbounty

Harley Kimball @infinitelogins

8 months ago

The team did some damage over the weekend! Can’t wait till the next hack sesh! In IDORS/PrivEsc/Account Takeovers we trust! 🤙🏻💥 #bugbounty

27 3 219 12K 14

1 1 16 2K 3

Armand J. @_Zer0Sec_

9 months ago

Raining IDORs/Account Takeovers already! 💪🏻💪🏻

Harley Kimball @infinitelogins

9 months ago

Raining IDORs/Account Takeovers already! 💪🏻💪🏻

3 0 26 4K 1

0 0 26 2K 0

Fat @fattselimi

a year ago

15 10 155 17K 65

Fat @fattselimi

a year ago

Bug Bounty is painful stressful Im doing Web Application Security Since i was 10 and now im now 24 if you think Bug Bounty is easy or you can get quick cash from it, Bug Bounty is just not for you. #bugbounty #ethicalhacking

24 15 244 18K 26

Katie Paxton-Fear @InsiderPhD

a year ago

Okay real talk: if your only motivation to get into #BugBounty is money, you’re not going to make it as a bug bounty hunter. It’s not enough to get through the time it takes to learn, the hours on a single website to find a single bug. Money AND is okay but money alone is just…

16 55 233 22K 59

Armand J. @_Zer0Sec_

a year ago

This is going to be sick! 🤙🏻 #defcon #bugbountyvillage

Harley Kimball @infinitelogins

a year ago

This is going to be sick! 🤙🏻 #defcon #bugbountyvillage

2 12 43 6K 0

Download Image

0 0 3 1K 0

Armand J. @_Zer0Sec_

a year ago

Back from a bounty break and straight into some sick finds! 🤙🏻 Sometimes, things don’t have to be super technical! EX: If a path with .git/ = 403, then /.git/config might be 200! Then from there, the wonderful pillaging can begin! 😅 #git #bugbountytips #bugbounty

6 12 171 8K 76

Download Image

Armand J. @_Zer0Sec_

2 years ago

Quick 2023 recap: - 72 #bugcrowd finds, 20 total P1’s - Attaining sub 200 rank on BC - Collaborated on some sick bounty findings - Attended my first DEFCON 2024 goals: - DEFCON again and more InfoSec fam live #hacking days - $50k-$100k in bounties - Get a CVE assigned

1 0 28 3K 2

Download Image

Armand J. @_Zer0Sec_

2 years ago

Checked out the leaderboard for October and saw that I made the P1-P2 rank train! 🤙🏻🤙🏻🤙🏻 Big props to @Bugcrowd for providing such an amazing platform to hack on! #bugbounty #ethicalhacking #bugcrowd

3 1 64 7K 2

Download Image

N$ @nav1n0x

2 years ago

SQLi Tip - If you're able to find a JSON POST-based potential SQL injection (SQLi), remember to execute the SQLMAP query with -u and --data using JSON input. I've found more success using this method in SQLMap than when using a request file. #BugBounty #SQLi

7 123 620 63K 406

Download Image

Armand J. @_Zer0Sec_

2 years ago

Forgotten assets =🥰 Found subdomain Fuzzed > saw report/portal > 302 to /new_login.asp > SQLi failure Tried OLD_login.asp > saw older panel ' test = 500 error Sleep test = Response delay 👍 DB info w/ SQLMap Sleep payload: ';%20waitfor%20delay%20'0:0:6'%20--%20 #bugbountytips

6 68 407 25K 174

Download Image

Kévin GERVOT (Mizu) @kevin_mizu

2 years ago

Excited to launch my first browser extension, DOMLogger++! Now available for both Firefox and Chromium! 🎉 DOMLogger++ allows you to monitor, intercept, and debug JavaScript sinks based on customizable configurations 🔥 Check it out 👇 github.com/kevin-mizu/dom… 1/5

9 106 339 42K 207

Armand J. @_Zer0Sec_

2 years ago

My Crackhead-Recon the past week was wild! 403's aren't so scary! 😎😈 Saw 403's > Read JS files > Collected endpoints via GAP/Scripts + heavy OSINT > Tested further for Access Control issues > Exposed PII/Confidential content. In that order. #ethicalhacking #bugbountytips

12 61 404 27K 202

Download Image

Armand J. @_Zer0Sec_

2 years ago

Back from a hack break! 😈 App allowed message sending > Subject was pre-filled Saw "message[body]" in the request Manipulated request to include "message[subject]" along with Blind XSS payload Admin reviewed message > triggered payload #weirdshit #bugbountytips #bugbounty

6 9 72 7K 32

Download Image

Fat @fattselimi

2 years ago

In this blog you can see how Path Normalization can help you find amazing bugs: How I Hacked A Crypto Company And Could Steal 1 Million Dollars Worth of Bitcoin zoidsec.medium.com/how-i-hacked-a… By @z0idsec #bugbounty #bugbountytip #bugbountytips #ethicalhacking

1 70 246 22K 174

Armand J. @_Zer0Sec_

2 years ago

Ran into an XPath/Error based SQLi while waiting for my flight to Vegas!🤘 Saw MySQL error > poked around > extracted DB Payload: '+AND+extractvalue(rand(),concat(0x3a,(SELECT+concat(0x3a,schema_name)+FROM+information_schema.schemata+LIMIT+0,1)))+%23 #bugbountytips #defcon

9 35 142 11K 61

Download Image

Armand J. @_Zer0Sec_

2 years ago

JS file parse + Forced Browsing while unauthenticated 🤙🏻 😎 1. Saw admin endpoints in a JS file 2. Led to 403s 3. Fuzzed > found /adminarea/users/images but 403 again 4. Burp > Intruder > fuzzed /users/1-100 5. Large listing of actual user photos/PII #BugBountytips #BugBounty