I earned $900 for my submission on @Bugcrowd
It's truly motivating to receive such positive feedback from the customer team, and it gives motivation to work hard.
#ItTakesACrowd#bugbounty#bugcrowd
Ok, let’s discuss this
1- fuzz website
2- found this path /jk_status?cmd=dump = dump data
3- search more about this misconfigure
4- found /jk_status?opt=0 = read and write privilege
#BugBounty#BugBountytips
I'm uncomfortable tweeting stuff like this out, but...
I found a critical vulnerability in @opensea this weekend and reported it through @Hacker0x01.
They fixed the issue within 3 hours of reporting and I just got this notification👏🫢
SSRF Story | Scan The Network
1. Found SSRF and get Cloud Metadata.
2. Common high risk with disclosed cloud metadata is about security credential, but not found at this point :(
3. Found the instance public IP in latest/meta-data/public-ipv4, access the IP and got 404 response
It's been a little over 3 weeks since Google randomly sent me $249,999 and I still haven't heard anything on the support ticket. Is there any way we could get in touch @Google?
(it's OK if you don't want it back...)
Thread about hunting on the main application 🧵
1. Check the login process
- Do they allow signup with email or Google etc
- Do they allow you to signup with the @Company email
- what is the content-type of the signup/login page
- when you enter valid cred, on which page you
TIL whenever you see an SSL certificate error and the browser doesn't let you continue - even on your own risk, you can just type 'thisisunsafe' to bypass the protection
cybercafe.dev/thisisunsafe-b…
I earned $5,500 for my bug on @Bugcrowd
This was one of the most unique "Web Cache Deception" I found on one of the oldest public program which led me to a "Mass Account Takeover with ZERO user interaction" scenario. READ the thread..
1/7
#cybersecurity#infosec#bugbountytips
Today I'm launching #HijackLibs, an open-source, community-driven project tracking DLL Hijacking opportunities in in Windows
🌍 LIVE on hijacklibs.net 👈
🆕 Currently comprising over 350 unique DLLs that can be targeted
🤝 Contribute via github.com/wietze/hijackl…
Based on my last comment with @GodfatherOrwa and @eslam3kll , This is the template of SQLi Detection
github.com/0xElkot/My-Nuc…
Steps:
1- Catch all requests of parameters.
2- Grep reflected parameters with gf and Kxss
3- Fire this template
#happy_hacking#bugbounty
4K Followers 548 FollowingNetwork/WebApp #Pentester | eWPT and eJPT certified {#tryhackme top 1%} |
I help SaaS & devs secure their apps before attackers
open to collab through LinkedIn
92 Followers 374 FollowingNetwork Security student @AOU_KSAB| Learning #Security+ & #N+ | SOC blue team defense & web security | trying to make sense of the world of cybersecurity
20K Followers 2K FollowingPrincipal Identity Security Researcher at Microsoft. Ex-Secureworks. (MSc, MEng, PhD, CITP, CCSK).
And yes, opinions are my own ;)
8K Followers 132 FollowingWe are a hi-tech company focusing on binary software analysis. Our main products are IDA Pro and the Hex-Rays Decompiler.
Discourse: https://community.hex-rays
41K Followers 1 FollowingTweeting news from the world of information security that occurred or was announced on today's date in a previous year. Managed by @stevewerby.
2K Followers 261 FollowingPentester, Web specialized 🪲 Top 30 YesWeHack https://t.co/bJ2s5TWqYf
Check my website if you're bored https://t.co/tdzCTEUbuO :)
10K Followers 470 FollowingThreat Researcher at Check Point @_CPResearch_ #DFIR #Reversing - All opinions expressed here are mine only.
https://t.co/iWvwWF1AnN
9K Followers 334 FollowingReverse engineer, creator of @x64dbg and 100+ other projects. Love binary analysis and Windows internals. Dreaming about doing open source full time...
2K Followers 597 FollowingEverything is always broken. Googler by day. #BinDiff maintainer. My tweets, my opinion.
During my lifetime, CO2 increased by 67.84ppm (so far).
4K Followers 548 FollowingNetwork/WebApp #Pentester | eWPT and eJPT certified {#tryhackme top 1%} |
I help SaaS & devs secure their apps before attackers
open to collab through LinkedIn