mssoffsec @r0g3rmr3n00b

Proud Indian 127.0.0.1 Joined September 2019

Tweets

2K
Followers

276
Following

2K
Likes

7K

Intigriti @intigriti

3 months ago

12 API hacking bug bounty tips you must try on your target! 😎 🧵 👇

6 153 711 52K 983

Download Image

🔁 File uploads are almost everywhere... Sometimes, a simple validation mistake can result in a high-severity finding (such as RCEs) 🤠 In our technical article, we documented a few cool tricks you could try next time you're testing a file upload feature! Link in next post! 👇

1 20 92 6K 68

Download Image

Harshleen Chawla @harshleenchawl2

2 weeks ago

OSINT-Advanced Searching🔍📝 github.com/The-Osint-Tool…

3 185 842 41K 1K

Download Image

Arshiya @arshiyaiha

2 weeks ago

redacted[.]com/ --> [302]❌ redacted[.]com/app/api/doc/ --> [200 OK] ✅ Bypassed the 302 and hit API doc gold! #BugBountytips #BugBounty

3 11 141 8K 63

Download Image

Ahmet Barut @ahmtbrt07

3 weeks ago

Bug Bounty Tips (1/2) 1- Add users with different roles in your company to the system. 2- Log in as a low-authority user in the incognito tab and log in as a high-authority account in the normal tab for role isolation. #BugBounty #BugBountytips

2 6 115 6K 80

Download Image

Rohan.exe 🖤 @roohaa_n

3 weeks ago

The best informative report 😋 i ever had #bugbounty

14 2 211 13K 34

Download Image

André Baptista @0xacb

3 weeks ago

Try this out on your next target! Some more gold from the guys at @ctbbpodcast! 🔥

2 50 284 16K 262

Download Image

annonimous254 @annonimous254z

a month ago

~IDOR bypass techniques New video out too! youtu.be/JNvnCojTAvI #bugbounty

1 120 562 28K 666

Download Image

Erick Fernando @erickfernandox

4 weeks ago

A simple open redirect can wreak havoc. Simple open redirect -> misconfigured OAuth authentication flow -> privilege abuse using Amazon Cognito token #bugbounty #bugcrowd

5 20 349 13K 119

Download Image

Critical Thinking - Bug Bounty Podcast @ctbbpodcast

a month ago

New episode is out! — youtu.be/rvA8IbyogJ0 Releasing the episode on Monday so you have something to listen to during your travel to DEFCON =) Diego Djurado joins us to discuss XBOW's architecture, hunting approach, hallucination challenges, and AI's future in bug bounty. He…

4 19 69 24K 31

Web Security Academy @WebSecAcademy

a month ago

How to find viable targets for client-side desync attacks: 1️⃣ Open Burp Suite and intercept requests. 2️⃣ Choose an endpoint that wouldn't usually expect a POST request (e.g GET) and send it to repeater. 3️⃣ Go to Inspector > Request Attributes > Protocol field > Upgrade to…

3 53 344 16K 252

Download Video

x1337loser @x1337loser

9 months ago

Alhamdulillah, Awarded a $2500 bounty for an Unauthenticated IDOR which led to getting the User PII of a specific group in Indeed, this was a chain finding I chained 4 different endpoints to get the PII. [1/3] #bugbounty #bugbountytips #bugcrowd

8 11 288 11K 85

Download Image

HackProve @hackprove_

a month ago

How 3 Free Recon Tools Found 40 Bugs — Helped To Score $1200 in Bug Bounties more information : discord.com/invite/h6dKuEt… medium.com/@rashad.desk/h…

0 13 77 3K 33

chux @chux13786509

a month ago

🔥 Bug hunter’s tip for the hot leak of the week: Firebase hacking! How to hunt for Firebase in your targets? 🔍 Step 1: Look for TARGET..firebaseio.com or TARGET..firebaseapp.com in JS files or search for firebaseConfig in APKs 📥 Step 2: Try to access…

4 26 186 8K 115

Download Image

Harshleen Chawla @harshleenchawl2

2 months ago

Vulnerability Research Repositories & Content👾 📌Awesome Vulnerability Research by sergey-pronin github.com/sergey-pronin/… 📌Awesome Embedded Systems Vulnerability Research by IamAlch3mist github.com/IamAlch3mist/A… 📌Awesome Android Vulnerability Research by IamAlch3mist…

0 85 288 12K 260

EL Sayed Mohammed @Shari7a0X

2 months ago

الحمد لله دائماً وابدأ I’m really glad to be collaborating with my brother @0X20MAR! Not a bad round — about 19 duplicate reports submitted. Looking forward to more solid findings ahead.

13 5 120 5K 7

Download Image

Godfather Orwa 🇯🇴 @GodfatherOrwa

3 months ago

Video of my talking in #PHDays at @PTsecurity_EN youtu.be/CJnXjWXXB1Y?si… Hope you like it and enjoy it #bugbounty #bugbountytip #bugbountytips #infosec

11 54 219 39K 148

Mohamed Elkhayat @Mohamed87Khayat

3 months ago

The endpoint was : /storage/users.csv Also try more endpoints like /storage/orders.csv /storage/transactions.csv /storage/reports.csv /storage/customers.csv /storage/backups/users_backup.csv /storage/tables/profiles.csv /storage/tables/roles.csv /storage/tables/invoices.csv

8 85 538 18K 408

Download Image

🔍mrro0o0tt @Joyerz5

3 months ago

I was able to delete anyone's Bookings. But this was so tricky, not an easy IDOR! Original Req: DELETE /api/bookings?bookings=3777104 Response: Invalid Bookings = > 400 Bad Modified req: DELETE /api/bookings?bookings[]=3777104 Response: 200 OK #bugbountytips