Ammar Saber @_xLe0x

I own my world. xle0x.netlify.app Joined April 2024

Tweets

48
Followers

34
Following

981
Likes

49

Hasan Sheet @hasansheet

a month ago

💥 XSS via .docx / .xlsx ? No macros. No VBScript. Just pure hyperlink magic. 🪄 Create a hyperlink to `javascript:alert(1)` inside a `.docx` or `.xlsx`, upload it to a target with a file viewer feature, and boom 💣—XSS on click! #BugBountytips #xss #BugBounty

4 18 160 7K 96

Download Image

zildaxx 🇲🇦 @zildaxx

5 months ago

I just published Privilege escalation worth — $$$ Write-up: medium.com/@zildaxx/privi… #bugbounty #bugbountytips

3 18 110 4K 52

Mohsin Khan @tabaahi_

6 months ago

Bug hunters, what's one piece of advice you'd give to your younger self?

27 19 222 44K 140

Critical Thinking - Bug Bounty Podcast @ctbbpodcast

8 months ago

How to become the Most Valuable Hacker (with @ArchAngelDDay) 1. Figure out what most people are trying to hack and hack something else. This will reduce competition and consequentially the amount of dupes you’ll get. 1/5

1 15 149 8K 82

Download Image

𝕏 Bug Bounty Writeups 𝕏 @bountywriteups

8 months ago

Shodan Dork Generator dorks.s1rn3tz.ovh/shodandorks

0 97 345 15K 277

Download Image

CyCatz @CyCatz_Official

a year ago

#CyCatz #cybersecurity SAML Authentication Bypass Leading to Admin Panel Access More....shorturl.at/gbYvg #cyberawareness #cyberattack #breaches #databreaches #cybercrime #darkwebmonitoring #BrandMonitoring #security #information #bugbounty #saml #access

0 7 31 2K 12

Download Image

Whispersmith @Whispersmith_n

9 months ago

Story of a 1000$ Open Redirect infosecwriteups.com/story-of-a-100… #infosec #bugbounty #TogetherWeHitHarder #inbbupdatesblogs

0 23 131 4K 60

Critical Thinking - Bug Bounty Podcast @ctbbpodcast

5 months ago

Did not know you could specify Unicode codepoints this way in JS. Pretty sick. Shoutout to the @yeswehack team for a great article over at: yeswehack.com/learn-bug-boun…

2 30 227 11K 147

Download Image

chux @chux13786509

11 months ago

Another day another bug 🔥 Just got a webshell uploaded with the Exiftool trick of injecting the payload into a real JPEG file! #BugBounty #BugBountytips #Hacking

24 149 860 50K 591

Download Image

Gudetama @gudetama_bf

11 months ago

CORS, Host, URL Redirection #bugbountytips #bugbounty

4 28 151 10K 101

Download Image

𝕏 Bug Bounty Writeups 𝕏 @bountywriteups

11 months ago

📚 Extract API endpoints from javascript files Here’s a quick one-liner for extracting API endpoints from javascript files: cat file.js | grep -aoP "(?<=(\"|\'|\`))\/[a-zA-Z0-9_?&=\/\-\#\.]*(?=(\"|\'|\`))" | sort -u #bugbounty #bugbountytips #bugbountytip #hackerone #bugcrowd…

0 70 274 14K 230

Download Image

Erick Fernando @erickfernandox

11 months ago

If the WAF doesn't allow the creation of a JavaScript term like 'alert' or 'confirm' in any way, write it inverted and then use reverse() with self[]. Payload: <a%20href=%0dj&Tab;avascript&colon;x='trela'.split('').reverse().join('');self[x](origin)> #Bugbounty #AkamaiBypass

13 159 675 37K 580

Download Image

𝕏 Bug Bounty Writeups 𝕏 @bountywriteups

11 months ago

📚 CSRF Bypass Techniques 📚 💁 Change Request Method [POST => GET] 💁 Remove Total Token Parameter 💁 Remove The Token, And Give a Blank Parameter 💁 Copy a Unused Valid Token , By Dropping The Request and Use That Token 💁 Use Own CSRF Token To Feed it to Victim 💁 Replace…

1 23 80 3K 48

XSS Payloads @XssPayloads

11 months ago

Invisible JavaScript, an online tool to generate invisible payloads by @Benjamin_Aster, inspired by @aemkei's INVISIBLE.js benjaminaster.com/invisible-java…

1 78 258 28K 208

7h3h4ckv157 @7h3h4ckv157

11 months ago

Hey Hackers! 👋🏻 Faster Google Dorking source: dorksearch.com NB: Content Sharing != Content Stealing

8 218 1K 62K 1K

Download Image

Stealthy @stealthybugs

11 months ago

Thought I'd share this remote code execution on one of the main sites for a large H1 target from a year ago. I found this one by being persistent and using Param Miner by @albinowax . After Param Miner discovered the header it was all manual testing to detect the template engine…

14 92 739 48K 471

Download Image

JS0N Haddix @Jhaddix

11 months ago

Pro tip for hackers who accidentally get IP banned by Akamai or Cloudflare on their home IP: Many ISPs will requisition a new public IP if they detect new network hardware installed in a house. If you get banned, unplug your cable or DSL modem. Then go into your router…

24 171 2K 168K 1K

Ammar Saber @_xLe0x

a year ago

AcquiFinder: Acquisitions Miner Give it a company name and watch it do the magic 🪄 A simple cool script for new bug hunters who hunts on an open scope bug bounty programs github.com/xLe0x/AcquiFin… If you liked it don't forget to give it a star ⭐ #BugBountytips #BugBounty

0 0 2 145 0

Ivan Velichko @iximiuz

a year ago

SSH Tunnels - A Visual Guide To Port Forwarding 🧵 One of my favorite parts of SSH is tunneling. With just the regular ssh client, you can do wonders! 1. Local Port forwarding Access private ports of a remote machine using local tools (your browser, a fancy DB UI client, etc)

9 324 2K 111K 2K

Download Image

hAPI_hacker @hAPI_hacker

a year ago

The Hacking APIs GPT is now available to free ChatGPT users! @OpenAI just announced that ChatGPT Free users can use custom GPTs, including the Hacking APIs GPT. Now you can leverage the Hacking APIs GPT for FREE to perform: 🔍 Endpoint Analysis: Efficiently evaluate a list of…