Natsu Dragneel @zer0leet

Living In A Random Place of A Planet Called EARTH | Dumb As JAVA | So Called Bug Bounty Hunter | So Called Cyber Security Researcher. The Great Blue Hole Joined April 2023

Tweets

23
Followers

7
Following

49
Likes

12

Abdelkader Mouaz @hamzadzworm

2 months ago

Hi All -.‑ we always talk about security issues today I’ll share how I exploited a feature used to protect the website and turned it into a critical issue hope you like it waiting for your opinions -.- hamzadzworm.medium.com/exploiting-aut… #BugBounty #BugBountytips #infosec #BugBountytip

4 14 136 5K 67

Download Image

payloadartist @payloadartist

2 years ago

🔥 Fuzzing and Bypassing the AWS WAF Interesting writeup by the @sysdig team on building an automated fuzzing tool to trigger XSS by bypassing the AWS WAF sysdig.com/blog/fuzzing-a… Fuzzer: github.com/sysdig/wafer #bugbountytips #bugbounty #infosec #cybersecurity

3 126 414 21K 249

Download Gif

Masonhck357 @Masonhck3571

3 years ago

So it seems like everybody hates hacking GraphQL like me, so lets post some resources so we can all get better at it!

34 285 798 0 678

Intigriti @intigriti

2 years ago

Found a GraphQL endpoint that you want to test? InQL is just for you! InQL is an awesome BurpSuite extension for advanced GraphQL pentesting!! 😎 Check it out 👇 github.com/doyensec/inql

0 95 371 34K 130

Download Image

Will Gates @WllGates

2 years ago

I've found HTTP Verb Tampering can often be used to bypass 403 (and 401) too. Also fuzzing HTTP proxy headers and setting values to localhost often works like a charm. I use this tool to speed up the process credit: @0dayWizard github.com/carlospolop/fu…

2 28 101 7K 50

Hussein Daher @HusseiN98D

2 years ago

Successfully bypassed a SSRF WAF by using a combination of IPV6 + Unicode. Payload for Metadata instances: http://[::ⓕⓕⓕⓕ:①⑥⑨。②⑤④。⑯⑨。②⑤④]:80 Check images for response difference between 169.254.169.254 and the above payload I shared 🔥 #bugbounty #infosec #waf

55 529 2K 182K 874

Download Image

Natsu Dragneel @zer0leet

2 years ago

Hey @Hacker0x01 I reported a critical bug to @Newegg but a H1 Triager closed my report as N/A without asking anything. After that I explained the proper exploitation. Today I checked the issue and it was fixed but still I didn't heared back anything from them it's so unexpected.