TechFenix @TechFenixSec

Work with Top WhiteHat hackers & Red Team! TechFenix is a private Red team platform actively working with Top Fintech, IT Businesses & Airlines around the world techfenix.com India Joined February 2020

Tweets

49
Followers

600
Following

0
Likes

63

Sayaan Alam @ehsayaan

7 days ago

Google urged 2.5B Gmail users to reset passwords after a Salesforce-linked breach. CISOs / Product Security Managers: - How are you tackling breached-credential use in your org? cybersecuritynews.com/gmail-users-pa…

0 2 4 593 0

Sayaan Alam @ehsayaan

a week ago

I recently encountered an IDOR : DELETE /api/notes/:id → tried deleting someone else’s note → 403 Forbidden (expected) PUT /api/notes/:id → tried editing the same note → success ✅, no authorization check After editing, DELETE /api/notes/:id → succeeded, could now delete…

6 69 560 24K 273

Download Image

Sayaan Alam @ehsayaan

2 weeks ago

Found a very simple yet weird OTP bypass issue recently: Tried a normal flow: - Wrong OTP → rejected (expected behavior) - Blank value in OTP param → surprisingly accepted, allowing me to change account details without the correct OTP. So the server was verifying OTPs, but…

6 24 264 13K 114

Download Image

Sayaan Alam @ehsayaan

2 weeks ago

A recent SSRF in a PDF generator 👇 The server converted my supplied HTML into PDF, so I dropped in a <meta http-equiv="refresh" content="0;url=http://10.20.x.x/"> tag and got the backend to fetch responses from the internal network. I was able to access an API on internal…

2 37 283 18K 236

Download Image

Sayaan Alam @ehsayaan

2 weeks ago

When testing for SSRF, you’ll often hit blocklist errors when targeting localhost or cloud metadata hosts. Here are some bypass techniques that consistently work for me: - Use a 303 redirect to an internal host — many apps follow redirects without validation & convert POST →…

5 47 304 16K 276

Download Image

Sayaan Alam @ehsayaan

3 weeks ago

Good to jump into worldwide top 100 - 90 day leaderboard at @Hacker0x01 :)

2 2 55 3K 1

Download Image

Sayaan Alam @ehsayaan

3 weeks ago

I recently discovered a critical race condition vulnerability at a multi-million dollar investment firm! The vulnerability allowed attackers to execute a single-packet attack that bypassed financial controls, potentially enabling: ✅ Purchasing stocks worth twice the available…

8 35 252 31K 204

Sayaan Alam @ehsayaan

3 months ago

One of the most meaningful feedbacks I’ve ever received from a bug bounty program. Feels incredibly rewarding when your efforts are truly seen and appreciated ❤️

1 1 48 3K 1

Download Image

Sayaan Alam @ehsayaan

3 months ago

Recently encountered XSS filters blocking <script>, onerror, onclick, alert(), confirm(), etc. Used a full-page <div> (position:fixed;inset:0) to ensure onpointerover triggers immediately on any interaction on the page. Combined with dynamic import() inside setTimeout() for full…

0 3 26 1K 21

Sayaan Alam @ehsayaan

9 months ago

Testing access control issues?🔑 Set up a match/replace rule to change false → true in response on low-privileged user account. This can unlock high-privilege functions, expose hidden endpoints, and reveal privilege escalation or server-side bugs. #bugbounty #bugbountytip

1 1 11 1K 10

Sayaan Alam @ehsayaan

10 months ago

I just published my latest article on a recent finding at @SynackRedTeam : From Template to Threat: Exploiting FreeMarker SSTI for Remote Code Execution! Don’t hesitate to reach out if you have any questions! blogs.sayaan.in/freemarkerssti #BugBounty

3 75 264 20K 198

Sayaan Alam @ehsayaan

10 months ago

Tomorrow at 7:30 PM IST (9:00 AM ET), I’ll be publishing an in-depth article on exploiting Server-Side Template Injection (SSTI) in FreeMarker leading to Remote Code Execution (RCE). Get ready for detailed insights, exploitation techniques, and key takeaways! 🔥 #BugBounty

1 1 29 2K 9

Sayaan Alam @ehsayaan

11 months ago

Bsides Ahmedabad (@bsidesahmedabad ) is wrapped up , Got chance to meet SQLi master @mcipekci and @CharlieW_T3X4N from @SynackRedTeam . It was nice meeting them and got chance to learn a lot from them. Thanks to @niksthehacker for organising this enjoyable and informative event.

1 3 40 3K 3

Download Image

Sayaan Alam @ehsayaan

a year ago

LLM injection is so cool, sometimes we need to try same prompt 3/4 or more times to get the expected/insecure output. I have recently encountered an Stored XSS issue using the same.

1 1 14 2K 1

Sayaan Alam @ehsayaan

a year ago

Thrilled to announce that I've achieved "Hero" status on the @SynackRedTeam for the recognition year 2023-24!🛡️A huge thank you to the entire Synack Red Team for all the incredible opportunities and to the Synack community team (@ryanrutan ) for their unwavering support.

5 1 38 3K 0

@

56 years ago

0 0 0 0 0

Sayaan Alam @ehsayaan

2 years ago

🔒 Recently, @pmnh_ and I discovered a stored XSS vulnerability in an application. Despite strict payload restrictions such as <img> <script> <iframe> <a>, we found a way to exploit it using <svg onload=alert(1) /> due to a 25 character limitation. The severity was initially…

6 36 249 20K 84

Download Image

Sayaan Alam @ehsayaan

2 years ago

Found a stored and blind xss on HackerOne through live support chat , <script> tag didn’t worked so I used <iframe src=“javascript:alert(document.domain)” /> and it did worked #bugbounty

10 48 246 24K 93

Download Image

Sayaan Alam @ehsayaan

2 years ago

Found an auth bypass where application was sending login PIN as “*****1” , Application was validating only last digit of the pin so I needed to make 10 bruteforce attemps and login to any account. #bugbounty

11 3 80 11K 13

Download Image

Sayaan Alam @ehsayaan

2 years ago

When testing a tenant-based app, if IDOR attack fails, try exploiting it among same-tenant users. Access control may be lacking between them. E.g, I found an IDOR to modify/delete documents of same-circle users, while it didn't work across normal users🔒 #BugBounty #BugBountytip