Vikas Khanna @0xn00b

#Learner #BugHunter #Pentester #InfosecAddict #WebSecurity Singapore Joined September 2010

Tweets

810
Followers

191
Following

1K
Likes

161

Black Hat MEA @Blackhatmea

2 years ago

خذ العلم من محترفين الأمن السيبراني في ورش العمل التقنية في #بلاك_هات23 😎👨‍💻

0 3 10 8K 0

Download Image

Exciting Speaker Announcement for HCKSYD 2023! Introducing Vikas Khanna! Vikas will share his incredible journey of discovery in the world of security. He will reveal two security issues he uncovered in Apple's systems! #HCKSYD23

0 1 3 207 0

Download Image

Bounty Security @BountySecurity

4 years ago

Using Burp Bounty for find XXE bugs. @cinzinga_ cinzinga.com/XXE-Case-Studi…

2 50 133 0 23

m0z @LooseSecurity

5 years ago

SSRF Bypass list for localhost (127.0.0.1): http://127.1/ http://0000::1:80/ http://[::]:80/ http://2130706433/ http://[email protected] http://0x7f000001/ http://017700000001 http://0177.00.00.01 Also using a redirect to localhost will often work. #bugbountytips

12 233 753 0 221

Somdev Sangwan @s0md3v

5 years ago

Use shodan to find HTTP servers of a company that are running on "non-standard" ports. HTTP ASN:<here> -port:80,443,8080 Make sure you are logged in.

2 93 290 0 96

PortSwigger Research @PortSwiggerRes

5 years ago

We've just used Stepper to solve a new @WebSecAcademy lab. portswigger.net/bappstore/065d… It's a great BApp that allows you to construct multi-step sequences and extract data from any step and re-use that data. This is all done using repeater style tabs.

1 44 123 0 16

Abss @absshax

5 years ago

Blog's up! "Firebase Cloud Messaging Service Takeover: A small research that led to 30k$+ in bounties" #GoogleVRP writeup included that relays how business rep & every user of Hangouts,Google Play Music, YouTube Go etc were affected! abss.me/posts/fcm-take… #bugbounty #infosec

23 223 497 0 144

Vickie Li @vickieli7

5 years ago

Learn about CSRFs: medium.com/swlh/bypassing… medium.com/swlh/attacking… medium.com/swlh/intro-to-…

3 54 146 0 44

Sayaan Alam @ehsayaan

5 years ago

An Awesome Account Takeover just by adding .json on endpoint by @SalahHasoneh1 #bugbounty #bugbountytip

8 118 393 0 115

Download Image

Nicolas Krassas @Dinosn

5 years ago

List of bug bounty writeups (2012 - 2020) pentester.land/list-of-bug-bo…

2 257 602 0 166

Sapra @0xsapra

5 years ago

Extension list for File upload bugs ASP: ".aspx", ".config", ".ashx", ".asmx", ".aspq", ".axd", ".cshtm", ".cshtml", ".rem", ".soap", ".vbhtm", ".vbhtml", ".asa", ".asp", ".cer", "shtml" PHP: php, php5, php3, php2, shtml, html, .php.png(double extension attack)

9 217 528 0 169

Intigriti @intigriti

5 years ago

Want to find critical bugs by changing a single header? Do just like @hacker_ & set your host header to 'localhost' in your next directory bruteforce, the results might be surprising! 🔥 #BugBountyTip #BugBountyTips

12 226 725 0 191

Download Image

Shiv chouhan @1ndianl33t

5 years ago

BugBounty Resources ♥️♥️🤘 @stokfredrik @TomNomNom @Jhaddix @NahamSec @pdiscoveryio @PwnFunction @farah_hawa01 @AseemShrey @InsiderPhD @thecybermentor @ameenmaali @pry0cc @hakluke @hahwul @0xReconless github.com/1ndianl33t/Bug…

6 59 169 0 56

ghostlulz @ghostlulz1337

5 years ago

How do you properly hunt on 100k targets? Automation is the key to success when hunting at scale. In my blog post I discuss the techniques and methodology I use while hunting at scale. ghostlulz.com/bug-bounty-aut… #bugbounty #bugbountytip #redteam #xss #osint #infosec

9 200 581 0 205

JS0N Haddix @Jhaddix

5 years ago

NYtimes says Twitter hacker used Slack as the "in". I think most of us bounty hunters have found at least one Slack token exposed on Github. Example: hackerone.com/reports/386614 hackerone.com/reports/397527

9 43 230 0 29

Tarun mahour @sratarun

5 years ago

Easy way to find BIG-IP @Alra3ees @ADITYASHENDE17 cat companys |while read url;do test=$(shodan search org:$url http.title:"BIG-IP®-Redirect" | awk '{print $1,$2}');echo -e "\033[32m$url""\033[34m\n$test";done

0 63 153 0 60

Download Image

Abhishek Karle @AbhishekKarle3

5 years ago

I just published How I was able to change victim’s password using IDN Homograph Attack link.medium.com/zSmBpWKg27 Thanks to @musiclouderlml for sharing #bugbountytips

6 243 547 0 160

d3fp4r4m @defparam

5 years ago

hackerone.com/reports/771666 A new fully disclosed HTTP Request Smuggling ATO report from yours truly. Thanks @prateek_0490 and @zomato for working to help kill this nasty bug. 🙏

12 155 522 0 86

Rey Bango 🇺🇦🌻 @reybango

5 years ago

This blog post by @notsoshant was so helpful in doing SQL injection with MS SQL Server. Definitely worth the read.

Prashant Kumar @notsoshant

6 years ago

This blog post by @notsoshant was so helpful in doing SQL injection with MS SQL Server. Definitely worth the read.

3 138 288 0 73

0 4 9 0 1

Yassine Aboukir 🐐 @Yassineaboukir

5 years ago

I honestly didn't know about fingerprinting using the favicon hash until now. It's such a little neat recon technique paired with Shodan. I just leveraged for some more attack surface on the program I hack on now. This is a good reference: medium.com/@Asm0d3us/weap…