Prerak Mittal @masquerad3_r

Security Research || Co-Founder @DCG91135 || Automating life with Python and Golang medium.com/@masquerad3r Terminal Joined December 2018

Tweets

458
Followers

234
Following

413
Likes

1K

Alex Stafeev @pixelindigo

6 months ago

Hey, don't miss Tim's YuraScanner presentation today at 11:40 in session 2B, "Web Security" at NDSS '25! Our new task-driven web security scanner features LLM, XSS, and a pinch of 0-days.

1 8 19 3K 11

Download Image

I've made over 100k on SSRF vulnerabilities. They aren't always as simple as pointing it at localhost or AWS Metadata service. Here are some tricks I've picked up over the past 5 years of web app testing:

45 934 3K 439K 3K

Download Image

Moblig @moblig_

2 years ago

$15k+ Worth of IDORs in the past couple of months; it takes a lot of manual verification, but use this regex in BurpSuite in order to filter out potential parameters: (?i)\b\w*id\b(?!\w)\s*=\s*("[^"]*"|'[^']*'|[^&\s}]*) #bugbountytips #CyberSecurity

36 374 1K 124K 1K

Download Image

JS0N Haddix @Jhaddix

3 years ago

📣 Stealth and supercharging your offensive security testing using: 🔥 Axiom 🔥 by @pry0cc & @0xtavian Resources and musings on this epic framework. 👇a thread👇

13 60 274 78K 155

PT SWARM @ptswarm

3 years ago

💰 New article by our researcher Andrey Bachurin: "Binance Smart Chain Token Bridge Hack" The article explains the technical details of one of the largest cryptocurrency hacks ever. Read the blog post: swarm.ptsecurity.com/binance-smart-…

0 36 72 15K 24

JS0N Haddix @Jhaddix

3 years ago

🔍 My ultimate workflow for simple and easy JavaScript Analysis ⚡️ Comprehensive JavaScript analysis in offensive security, appsec testing, and red teaming wins. Often you can find juicy hidden endpoints, parameters, & domains buried JS! A thread 🧵 1/x 👇

43 244 719 126K 564

Rami (drunkrhin0) 🇵🇸 @drunkrhin0

3 years ago

Are you constantly struggling to keep up with the information security cyber security, bug bounties…the list goes on 🙄 So much info but such little time ⏱️ Check out the newsletters I use the most to keep up with the industry below 📬 A thread 🧵 1/7

8 40 200 38K 142

pashov @pashovkrum

3 years ago

I don't think this blog post has been shared enough times, but this is what got me into smart contract security, I have read it countless times. Written by code4rena's #1 @cmichelio cmichel.io/how-to-become-…

10 34 205 14K 97

Trickest @trick3st

3 years ago

7 projects that will improve your subdomain enumeration game today ⚒️

4 44 142 0 109

Intigriti @intigriti

3 years ago

If you want to master SSRF, open this thread! Server-Side Request Forgery vulnerabilities are attacks that allow attackers to send arbitrary requests from the server often resulting in gaining authorized access to data!🤯 A Thread 🧵👇

40 256 736 0 415

Riddhi Suryavanshi @_an0nymiss

3 years ago

Read my blog on how I was rewarded $$$ for HTTP Request Smuggling leading to webpage defacement: an0nymisss.blogspot.com/2022/08/http-r… Collaborated with @masquerad3_r 🤝

0 2 5 0 0

Sergio Medeiros @grumpzsux

3 years ago

🔥 SQL Injection at Scale🔥 | Powered By @pdiscoveryio | Using a combination of subfinder, httpx, katana, GF, and sqlmap. #bugbounty #bugbountytip #bugbountytips #AppSec #hacker #owasp

18 182 457 0 192

Download Image

Eno Leriand @0x3n0

3 years ago

taking endpoint parameters and getting sql injection vulnerabilities with sqlmap

10 127 393 0 148

Download Image

newfolder @newfolderj

3 years ago

None => Critical (10/10) Second Order Account Takeover : (attacker's VERIFIED email attached to attacker's UNVERIFIED email merged can takeover vicitm's VERIFIED account) H1 : Closing as Self Account Takeover (none). Me : Should I Takeover your Account? H1 : Sure! Me : BOOOM

9 35 192 0 41

Download Image

Intigriti @intigriti

3 years ago

If you want to master API security, open this thread! APIs are used EVERYWHERE for applications to communicate, but let's see how you can HACK them! 👩‍💻 A Thread 🧵👇

118 560 2K 0 1K

Peter M @pmnh_

3 years ago

Audited an OSS product running on a Synack target, found over 20 vulns (0 days) including RCE, XXE, path traversal, auth bypass, and many XSS. Hoping to summarize in a blog post once they (and the product) can be safely disclosed. I love this stuff!

25 26 382 0 62

Download Image

Shashank | CredShields @cyberboyIndia

3 years ago

In past 2 months I wrote a lot about Smart Contract and Blockchain security. Here is the recap of @SolidityScan blogs. RT if you find it valuable :) A thread 1/12 1) Access Control vulnerabilities in Smart contracts blog.solidityscan.com/access-control… #security #smartcontracts

18 156 369 0 177

Lu3ky13 ⚡️⚡️ @lu3ky13

3 years ago

Add to your list #SQL #injection payload #BugBounty 1%27/**/%256fR/**/50%2521%253D22%253B%2523 == "0\"XOR(if(now()=sysdate(),sleep(9),0))XOR\"Z", === query=login&username=rrr';SELECT PG_SLEEP(5)--&password=rr&submit=Login == ' AND (SELECT 8871 FROM (SELECT(SLEEP(5)))uZxz)

27 252 772 0 307

Muhammad Fauzan 🇵🇰 @Fozisimi143

3 years ago

-> On Web App UI 403 Forbidden to low-level user to access this endpoint: /admin/users -> I got API Endpoint : /API/users/v1/users -> 403 Forbidden -> API Endpoint on BurpJSLinkFinder : /API/users/v1/users/basic -> Full organization users email,firstname,lastname,role disclose

9 61 261 0 78

Download Image

payloadartist @payloadartist

3 years ago

Perhaps you already know what IDORs are. They are very COMMON. But did you know about Second Order IDORs? If not, @ozgur_bbh wrote an AWESOME blog about this lesser known class of bugs Read it👇 ozguralp.medium.com/a-less-known-a… #bugbounty #bugbountytips #infosec #CyberSecurity