Security Researcher | Crypto auditor and malware analyst 🥰
Joined May 2022
- Tweets366
- Following756
- Followers2.6K
- Likes455
Pinned Tweet
Top google Dorking
Thread 🧵:👇 Here is how to find sensitive data issues:
1) publicly exposed documents :- site:target.com ext:doc | ext:docx | ext:odt | ext:rtf | ext:sxw | ext:psw | ext:ppt | ext:pptx | ext:pps | ext:csv
#BugBounty #bugbountytips #infosec
0 day exploit retweeted
I completed a full bug bounty engagement with @lendvest_io through @HackenProof — 8 valid reports (4 High, 4 Medium). I'm currently ranked #1 on their researcher leaderboard (255 reputation, 8 submissions). Here's what happened after how got scam 🧵
#DeFi #BugBounty #Web3Security
Let's gooooo back to back triaged and bounty , thanks @HackenProof what a great platform to test your knowledge 🔥
Top 3 researchers this week:
🥇 @0day_exploit_
🥈 @VagnerAndrei98
🥉 @Nord0x
On a roll! 🔥
Want your handle here? Join active programs: hackenproof.com/programs
Huge congratulations for the great achievement sir 💐 making the web3 more secured day by day 🫡
Thank you, @thedaofund! It’s an honor to be among the ETHSecurity badge holders!
And thank you, @d0rsky and the @HackenProof team, for your daily engagement and support! More security ideas and work are coming!
How I found a Critical ($100k) bug that could allow an attacker to drain the entire pool in under an hour and end on an information already known issue🥲
Read full article at ;-medium.com/@0day_exploit/cri…
🤖 Made with AI
@adeolRxxxx This is the original report you got a duplicate of. Read my story about how I argued and ended up on information rather than paying 100k$ 😰
0 day exploit retweeted
Thread 🧵:📷 Here is how I Do my Recon fast automated bug bounty
1) we are not using any kind of paid service to do automation 🔥
2) We use shell.cloud.google.com/ for hacking open terminal
#infosec #bugbountytips #Hacking #cybersecurity
Top JS Bugs
Thread 🧵:👇 Here is how to find Exposed :
1) collect all the js endpoint by lazyegg
github.com/schooldropout1337…
- using automatic tools find sensitive data
chromewebstore.google.com/de…
#BugBounty #bugbountytips #infosec
5) exploit using jsleak
cat test.txt | jsleaks -s -l -k
github.com/byt3hx/jsleak
6) expoit by nuclei
cat test.txt | nuclei -t credentials-disclosure-all.yaml -c 30
Top AWS S3 Bugs
Thread 🧵:👇 Here is how to find Exposed
1) Misconfigured AWS S3 buckets that may expose sensitive data we can manually check by %c0 on the XML error page or Wappalyzer AWS technology
#BugBounty #bugbountytips #infosec
join our bug bounty community for additional resource and support t.me/+6F5g8_YDGtJjZmFl
9) public searching
GitHub ;- org:target "amazonaws" ,"bucket_name" ,"aws_access_key" , "aws_access_key_id" , "aws_key" ,"aws_secret" , "aws_secret_key" , "S3_BUCKET"
10) Check the access control bugs
aws s3 cp file.txt s3://[bucketname] --no-sign-request
--> used for copy