Kartikeya Sharma @pykartik

Bug Bounty Hunter There's always a way in !!!!!! Joined July 2020

Tweets

189
Followers

27
Following

133
Likes

4K

Web Security Academy @WebSecAcademy

2 months ago

How to manually check for CL.TE Request Smuggling Vulnerabilities: 1️⃣ See if a GET request accepts POST 2️⃣ See if it accepts HTTP/1 3️⃣ Disable "Update Content-Length" 4️⃣ Send with CL & TE headers: POST / HTTP/1.1 Host: <HOST-URL> Content-Length: 6 Transfer-Encoding: chunked 0…

4 112 549 26K 410

Download Video

Intigriti @intigriti

4 years ago

Still not into testing mobile apps? 👀 The perfect time to start is now! And here is a good #bugbountytip by @x1m_martijn to start with! 📱 #bugbountytips

1 66 269 0 56

Download Image

Sunny Nehra @sunnynehrabro

4 years ago

The next version of #window Operating System that is #windows11 is coming with native support for Android apps. You will be able to download and run Android apps just like you do on your Android phone. RIP BlueStacks Some chromebooks users may also prefer windows laptops now.

10 25 158 0 3

Download Image

SecurityTrails, A Recorded Future Company @securitytrails

4 years ago

One of the most awesome people @hakluke shows us how to build a subdomain monitoring & alerting system in 5 minutes & costing <$10 a month. Gotta catch'em all! #subdomains #infosec #monitoring securitytrails.com/blog/monitorin…

1 33 91 0 22

Luke Stephens (hakluke) @hakluke

4 years ago

I hope you enjoy my latest blog post "How to Hack Your Ex-Girlfriend's Facebook Account" hakluke.com/how-to-hack-yo…

64 104 686 0 65

Intigriti @intigriti

5 years ago

Very impactful #BugBountyTip by @m4ll0k: whenever you see an @Company.com Google login for restricted assets, check if you can leverage the &hd=company.com parameter in the URL to login or sign up with your own e-mail address. #BugBountyTips

3 124 424 0 116

Download Image

dawgyg - WoH @thedawgyg

5 years ago

Just created a new Twitter account, @BountyUnion , that I will be using to post updates and info of this idea. Please follow and retweet to get people aware of the account and to stay up to date on the progress. #bugbounty

8 59 158 0 0

HackerRats - Uncle Rat ❤️ (XSS Rat) @theXSSrat

5 years ago

Uncle Rat's Main App Bug Bounty Methodology — V3 link.medium.com/OImZTdrJjfb #BugBounty #BugBountytips

4 58 158 0 44

Six2dez @Six2dez1

5 years ago

Oh man! This one is big! reconFTW v1.4.0 released with a lot of new features like: - Puredns by @d3mondev - DNScewl by @codingo_ - dalfox by @hahwul - Arjun threads (thx to @0_0eth0) - More methods to fetch subdomains I hope you like it! github.com/six2dez/reconf…

7 34 115 0 19

Download Image

Nagli @galnagli

5 years ago

As part of my study about "Vulnerability Inheritance through 3rd party vendors" I'm disclosing 3 bugs which affected @Hacker0x01 platform. Reflected XSS Post Based RXSS Open Redirect bit.ly/31qLXJO bit.ly/3w2eIuG bit.ly/3dg6PcC #bugbountytips

8 46 210 0 48

CryptoHack @CryptoHack__

5 years ago

Sharing a partially redacted PEM online is the same as sharing the PEM. In this blog post, we show that with partial exposure of a PEM, private data can be extracted to recover the full private key.

SaxX ¯\_(ツ)_/¯ @_SaxX_

5 years ago

Sharing a partially redacted PEM online is the same as sharing the PEM. In this blog post, we show that with partial exposure of a PEM, private data can be extracted to recover the full private key.

14 19 170 0 26

Download Image

12 380 839 0 88

Nagli @galnagli

5 years ago

Ever find a phpMyAdmin login portal and default creds wont work? Try to access the /phpmyadmin/setup/ endpoint and you might be presented with authentication bypassed configurable admin panel. This got me a nice bounty on @synack. Ref: hackerone.com/reports/297339 #bugbountytips

25 311 977 0 310

Download Image

Stefan Judis @stefanjudis

5 years ago

I just learned about the CLI tool `grex`. It might change how I approach regular expressions (🤞🙈). You provide string values and it comes up with a regular expression matching them.😲 github.com/pemistahl/grex Video alt: CLI session showing multiple generated reg. expressions.

31 789 3K 0 589

Download Video

Emad Shanab - أبو عبد الله @Alra3ees

5 years ago

How to discover up to 10,000 subdomains with your own tool | by _Y000_ | Mar, 2021 | InfoSec Write-ups infosecwriteups.com/this-time-you-…

2 104 273 0 76

Sunil Yedla @sunilyedla2

5 years ago

I was reading a security article on news.<target>.com about a serious security flaw. They are advising others to fix the vulnerability in that article. So out of curiosity, I tested on same target and yeah the vulnerability exists on their servers 😂😂 #bugbounty

3 6 83 0 2

dw1 - oss/acc @dwisiswant0

5 years ago

Just updating go-dork to stable version. Again, neglected project (cuz it was the first time I learned Go during initial release & I'm scared to touch it, lol). 🙂 github.com/dwisiswant0/go…

0 29 93 0 12

👑 OFJAAAH 👑 @ofjaaah

5 years ago

assetfinder tesla.com | waybackurls | grep -E "\.json(?:onp?)?$" | anew #bugbounty #bugbountytips #kingofbugbounty

5 157 431 0 117

Download Image

HackerRats - Uncle Rat ❤️ (XSS Rat) @theXSSrat

5 years ago

#bugbountytips ‘“`<u>blab${7*7} into every field you see to test for - SQLi - js XSS - html attribute xss - HTMLi XSS - SSTI

9 145 435 0 151

RedHunt Labs | Attack Surface Management (ASM) @RedHuntLabs

5 years ago

Got to know about the new #supplychain attack vector, i.e. Dependency Confusion Attack? We just released a new article researched by @s0md3v - 'Dependency Confusion Attack – What, Why, and How?' redhuntlabs.com/blog/dependenc… #infosec #attacksurfacemanagement #security