Offensive Security Engineer @DeepStrike_io
Joined August 2023
- Tweets14
- Following469
- Followers413
- Likes434
AI Help Chat Exposes 14,000+ Internal Support Tickets via Prompt Injection
Read details on LinkedIn:
linkedin.com/posts/0xhamdoonβ¦
#bugbountytips #pentrationtesting #cybersecurity
Hamed Elnwasani retweeted
Hardcoded Bearer Token in Client-Side JavaScript Enables Critical Broken Access Control (All Chats Exposed) by Elnwasani π€―π₯
π¨βπ» Hamed Elnwasani (x/0xhamdoon)
π 0xhamdoon.medium.com/hardcodβ¦
π t.me/ZeroToBug
π whatsapp.com/channel/0029VbCβ¦
Hardcoded Bearer Token in Client-Side JavaScript Enables Critical Broken Access Control (All Chats Exposed)
No complex exploits. No fancy payloads. Just a simple mistake with massive consequences.
link:
medium.com/@0xhamdoon/hardcoβ¦
#penetrationtesting #cybersecurity #bugbounty
Time-Based Blind SQL Injection in Dataapps UUID
Pro Tip: Don't just test UUIDs for IDOR, they're often unparameterized DB inputs. That makes them prime SQLi candidates.
#penetrationtesting #cybersecurity #bugbounty
simple SQLi bug
read details on LinkedIn:
linkedin.com/posts/0xhamdoonβ¦
#bugbounty #penetrationtesting #cybersecurity #SQLinjection
Two useful writeups I recently published:
1. Zero-Click ATO via Self-Stored XSS + WAF Bypass + IDOR
πmedium.com/@0xhamdoon/from-sβ¦
2. Chained Two Logic Flaws to Break a Ticketing System
πmedium.com/@0xhamdoon/how-i-β¦
Enjoy reading, and happy hacking
#bugbounty #cybersecurity
