Sahil Mehra 🇮🇳 @nullr3x

Entrepreneur in the making, Python developer by choice, and Penetration tester by passion. Can't live without coding! Joined September 2017

Tweets

26
Followers

285
Following

83
Likes

51

Sahil Mehra 🇮🇳 @nullr3x

2 years ago

🌟Mass Account Takeover Vulnerabilities ① IDOR Vulnerability ② Host Header Vulnerability ③ Chaining IDOR & Host Header => Mass Account Takeover 📷 Read Now: medium.com/@nullr3x/chain… #ethicalhacking #CyberSecurity #bugbountytip #bugbountytips #bugbounty #infosec

0 0 7 420 4

Anuj @bsachunter

3 years ago

Go and check out our new blog of one of the finding on @hackerone Full Access to the Production Portal by us @bsachunter & @a_s_h_Hunter . link.medium.com/ccBiv7Ejaxb Tip:- Recon is the Key to Success. #togetherwehitharder #recon #BugBounty #infosec #infosecurity #cybersecurity

4 60 143 13K 52

Manav Goyal @a_s_h_Hunter

3 years ago

Yay, I was awarded a $2,000 bounty on @Hacker0x01! For P1 bug. Bug type : PII Disclosure of all users. hackerone.com/anuj_manav #TogetherWeHitHarder Bounty partner: @bsachunter Special thanks to our Mentor:@sechunt3r @nullr3x @InfoSecComm @bugbounty18

6 7 60 9K 8

EdikTheFurry @EdikFurry

4 years ago

Just a quick shout out to @nullr3x - found a possible #securitybreach and gave us the full details for is to fix it. Keep this gentleman in mind if you need web or #Android application testing or #VAPT security audit. Cheers!

0 1 1 0 0

Sahil Mehra 🇮🇳 @nullr3x

4 years ago

Acknowledged by Apple Product Team Thanks @sechunt3r support.apple.com/en-in/HT212325 #safari #macos #bigsur #security #bugbounty #TogetherWeHitHarder

1 1 13 0 0

Download Image

Aditya sharma 🇮🇳 @Assass1nmarcos

4 years ago

Saved A*s of a company from following data leak trend😂 2 billion users PII leaked through endpoint (contains banking details too) #databreach #securitybreach #bugbounty #hacking #dataleakage #bugbountytips #bugbountytip @sechunt3r @ADITYASHENDE17 @sratarun

9 28 140 0 14

Download Image

Sergey Toshin @_bagipro

4 years ago

A nice way to grab deeplinks on iOS is to just download them :) Open the "apple-app-site-association" file for the desired domain, and it will contain all the deeplinks Examples: - airbnb.com/apple-app-site… - grab.com/apple-app-site… - zendesk.com/apple-app-site…

5 45 155 0 59

Dave Vieira-Kurz @secalert

5 years ago

When testing password fields, my preferred password is: %01%E2%80%AEalert%0D%0A Let's break it down: %01 is SOH %e2%80%ae is RTLO %0d%0a is CRLF Test cases on login: 1. can I log in only using %01? 2. without the CRLF in it? 3. is trela accepted instead of alert? (due to RTLO)

16 700 3K 0 1K

Mayank Kamboj Dattana @Mayank_hacks

5 years ago

Thanks @redbull for giving me wings 😈 #swag #bugbounty @intigriti Special thanks to Big Bad Brothers @nullr3x @sechunt3r

10 4 95 0 0

Download Image

Shivam @sechunt3r

5 years ago

I'm glad that I've become a part of Synack Red Team @synack @synackRedTeam Thanks to my Big Brothers & Friends for always supporting me @nullr3x @avanish46 @h4ckologic @parveen1015 @gauravnarwani97 @Assass1nmarcos @DattanaMayank

16 6 99 0 2

Download Image

Harsh Bothra @harshbothra_

5 years ago

Doing Recon the right way keeps you a step ahead always and gives you a better attack surface to work on! Here's a snippet from my Recent Talk on Scope Based Recon talking about What to look for during Recon Based on Given Scope. #bugbountytips #appsec #bugbounty #security

6 125 301 0 113

Download Image

Shivam @sechunt3r

5 years ago

P1 Warrior Level 3 @Bugcrowd Thanks to Big Brother @nullr3x & Jr. @DattanaMayank ✌️😁✌️ #bugbounty #bughunter #bugcrowd #stickerpack

3 2 30 0 0

Download Image

Shivam @sechunt3r

5 years ago

MVP Q3 2020 @Bugcrowd Thanks to Big brother @nullr3x & Jr. @DattanaMayank ✌️😁✌️ #bugbounty #mvp #bughunter #bugcrowd

2 2 11 0 0

Download Image

Sergey Toshin @_bagipro

5 years ago

#bugbountytips An almost universal way to theft or overwrite arbitrary files on #android is sharing activities. You can find them in AndroidManifest.xml. They handle android.intent.action.SEND. Use the PoC from blog.oversecured.com/Evernote-Unive… (ctrl+f "EXTRA_STREAM") and test 4 scenarios:

3 70 221 0 89

Sergey Toshin @_bagipro

5 years ago

#bugbountytips One more way to increase the impact of opening arbitrary URLs in a built-in WebView is Universal XSS. They are widespread on #android! Steps:

1 39 129 0 50

Sergey Toshin @_bagipro

5 years ago

#bugbounty You must love #Android deeplinks! They are the easiest way to get bounties 1. Decompile an app with jadx 2. Collect all deeplink handlers from AndroidManifest.xml, they look like <data android:scheme="airbnb" android:host="d"/>