BBH ( ͡° ͜ʖ ͡°) 💰 @Bugcrowd Top 50 \o/ ✌️ MVP✌️ I am here to learn/share application security stuff ✌️ I enjoy finding auth bypass bugs 🐞
🌎 Earth 🌎
Joined December 2010
- Tweets1.5K
- Following1K
- Followers6.6K
- Likes3.2K
Pinned Tweet
What a great month it was July 2022!
I have ranked #2 world wide on @Bugcrowd
bugcrowd.com/leaderboard
I cannot imagine my daily routine without @ChatGPT ; it serves as an excellent free life advisor.
If you think NUTRITIOUS food is EXPENSIVE
Try ILLNESS once.
If you think LIFTING is DANGEROUS
Try being WEAK.
If you think FITNESS is TIME CONSUMING
Try WAITING in a DOCTORS office.
Short term costs.
Pay LONG TERM dividends.
I¯\_(ツ)_/¯I \ (•◡•) / retweeted
Finding Zero-Days with Any Model - @NielsProvos
provos.org/p/finding-zero-da…
I¯\_(ツ)_/¯I \ (•◡•) / retweeted
Been following @damian_89_ work for years, used his EASM product for bug bounty and it was one of the best out there. Now he just dropped ArgosDNS focused on subdomain intelligence, exactly what the recon space needed. The data quality is crazy, do yourself a favor and check it.
Hey guys, I just launched argosdns.io - if you are into IT security, bug bounty hunting, red teaming, ... this is interesting for you!
argosdns.io/
I¯\_(ツ)_/¯I \ (•◡•) / retweeted
Why to use a simple #XSS vector like this 🤔
<img src=x onerror=alert(1)>
when you can use a much better one? 🤩
1'//"</Script><Img/Src%0AOnError=alert(1)//
The vector above pops in HTML and JS scenarios for single and double quotes! 🤯
Try it here: x55.is/brutelogic/xss.php?a=…
I¯\_(ツ)_/¯I \ (•◡•) / retweeted
New Rhino Blog Post: CVE-2025-0693: AWS IAM User Enumeration
bit.ly/3QcEpnx
I¯\_(ツ)_/¯I \ (•◡•) / retweeted
blog.cloudflare.com/resolvin…
I don’t work there anymore but it’s truly so sick seeing this level of weird bug being patched so fast
Hell yeah
I¯\_(ツ)_/¯I \ (•◡•) / retweeted
Thanks to the recent @PortSwigger top 10, I finally found the motivation to finish writing the 2nd article about DOMPurify security! 😁
Before releasing it, I would like to share a small challenge 🚩
Challenge link 👇
challenges.mizu.re/xss_04.ht…
1/2
Unleashing The Power of a JavaScript Bookmarklet for Endpoint Discovery in Bug Bounty and… execure.medium.com/unleashin…
I¯\_(ツ)_/¯I \ (•◡•) / retweeted
Seems rennie deleted his twitter so original post is gone :/ but someone made a post about it here with the code: execure.medium.com/unleashin…
I¯\_(ツ)_/¯I \ (•◡•) / retweeted
Got a CSRF attack being blocked by Content-Type validation? You might be able to bypass it with this quality technique. xitter.cf/lukejahnke/status/1861…
After a 4-month break, I’m backon @Bugcrowd ! Life kept me busy with something truly special—welcoming my adorable daughter into the world. 🍼💕 Feeling so blessed! 🥰
There is a public website with the following folder path:
txyz.com/wp-content/uploads/…<filename>
Does anyone know of any tricks for WordPress websites that would allow me to list all files and folders in the 'uploads' directory? #thanks-in-adv
I¯\_(ツ)_/¯I \ (•◡•) / retweeted
I was facing a very strict WAF while trying to exploit a XSS : no gt/lt signs, no parentheses, no double quotes, no backticks. I was injecting inside an html tag. Turns out the solution was very simple (and not well documented):
<img src=x onerror=alert(document.domain)>
I¯\_(ツ)_/¯I \ (•◡•) / retweeted
🚨Alert🚨CVE-2024-30103: Microsoft Outlook Remote Code Execution Vulnerability
⚠This Microsoft Outlook vulnerability can be circulated from user to user and doesn’t require a click to execute. Rather, execution initiates when an affected email is opened.This is notably dangerous for accounts using Microsoft Outlook’s auto-open email feature.
📰Refer: blog.morphisec.com/cve-2024-…
#Outlook #Microsoft #hunterhow #infosec #infosecurity #Infosys #Vulnerability
