Cybersecurity Enthusiast | Python Lover | PowerPoint Hero | Fiery Typist | Student at University of Dhaka
Dhaka, Bangladesh
Joined January 2013
- Tweets376
- Following473
- Followers535
- Likes7K
Pinned Tweet
Alhamdulillah...!
#Top_2 once again on Tecno Mobile Security Response Center @TecnoSRC!
Rewarded with $7,300 including the special recognition #Diligent_Star.
"...And Allah provides for whoever He wills without limit." [Al Quran - Sura 24:38]
#bugbounty #cyber #security
1
9
779
14th June, World Blood Donor Day...!
Donated for 16 Times, Alhamdulillah...
Now a member of lifelong "Silver Club"...
1
36
I just completed module #API #Attacks in @hackthebox_eu...!
Price: $10
The last challenge will teach you once again to 'Try Harder'...
You'll learn here the OWASP Top 10 API Security Risks...
My Rating: 4.7
academy.hackthebox.com/achie…
#hackthebox #htbacademy #cybersecurity
180
Don't Use Burp Suite Like Mediocre!
Some Burp Suite Shortcuts for Your Efficient Hacking!
- Ctrl+R Send a request to the 'Repeater' tab
- Ctrl+Shift+R Jump to the 'Repeater' tab
- Ctrl+Space Send the request to the server from the 'Repeater' tab
- Ctrl+U URL Encode your input
1
18
885
PortSwigger featured my tips here portswigger.net/blog/20-burp…
4
143
Don't Start Web Hacking Now, Begin from YESTERDAY!
Get Ready for Bug Bounty in Just 4 Steps:
1. Start learning from portswigger.net/web-security by selecting a particular bug type e.g. Broken Access Control
1/2
#infosec #bugbounty #tips #ethicalhacking #infosecurity #whitehat
2/2
2. Keep reading disclosed reports from hackerone.com/hacktivity/
3. In the next two months, whenever you start using a browser, always intercept all traffic through Burp.
4. Don't fall into the learning loop, start hacking today!
14
647
What an insight! @NahamSec
"When I can't find bugs, I change perspective not targets.
Client-side -> API Issues
Main App -> Developer Platform"
"Give Me 13 Minutes and 2025 Will Be Your Best Bug Bounty Year"
YouTube Link: youtube.com/watch?v=PER6Nvr6…
Alhamdulillah!
Awarded with $600 for finding an IDOR vulnerability!
Context:
- The Web App was letting users to upload payment screenshots if they chose 'Bank Transfer' method for boosting their posts.
- But abusing the IDOR vulnerability, I could upload/replace victims' images.
Alhamdulillah...!
Rewarded with $1,200 for a Stored XSS attack...!
Want to know the secrets?
Reveal them from the comment section...
#infosec #bugbounty #stored #xss #tips #ethicalhacking #infosecurity #whitehat
Secrets:
1/2
If you see, your uploaded image generated a URL and getting passed immediately with another HTTP request like below
POST /comment HTTP/1.1
Host: example.com
commentText=Nice&imageLink=example.com/img/123.jpg
2
1
238
2/2
Replace the image link with an XSS payload like...
POST /comment HTTP/1.1
Host: example.com
commentText=Nice&imageLink=example.com/img/not_exists.j…" onerror=confirm(1337) onerror=confirm(1338)
NB. Don't forget to use 'onerror' event double time.
Alhamdulillah...!
Rewarded with $480 for a Race Condition attack...!
Double Tips for Hunters:
1. Always test #race_condition if a function offers rewards e.g., coin, money, etc.
2. Don't hesitate to negotiate logically with programs.
#bugbounty #whitehat #race #condition #tips
Alhamdulillah...!
Rewarded with $500 for a Stored XSS for Bypassing the Validation...
Tips for You:
Never trust the first page security!
My malicious name was validated when I commented for the first time.
But when I REPLIED to MY comment then it fired.
#bugbounty #xss #tips
Alhamdulillah...!
Awarded with $750 for an IDOR issue...!
Tip: Change the target website's country/language to a different one. Because sometimes it may offer an additional feature for another region.
Example: rashedulcss.com/?lan=en ➡️ rashedulcss.com/?lan=ar
#bugbounty #tips
Huge shout-out to @TecnoSRC !
Glad to have you @L3onid1s, @MdInjamulHaqu, @msnrasel, @araselmir, @Ontu404, @Hasan_Khan0X, @itsz4x, @akbar_ohi who made the meetup more enjoyable...!
Ready for the next journey...?
👍Thanks to @RashedulCSS's organization, we have seen the style of Bangladesh security researchers! 🥰We also look forward to more fresh blood joining us in 2025! Contribute your strength to the 2025 TECNO security journey! #infosec #bugbounty #AppSec #cybersecurity #hack #MEETUP
2
8
491
Thanks for the huge bounty, @TecnoSRC !
💎Congratulations to every one of the top 10 security researchers in 2024! And thank you to all the researchers who supported us in 2024.
💡More activities are coming soon, so stay tuned! #infosec #bugbounty #AppSec #cybersecurity #hack
1
5
259
Creative attack, @AkashHamal0x01 brother...!
He bypassed HackerOne 2FA abusing race condition...
Link: hackerone.com/reports/259854…
3
255
Alhamdulillah...!
@TecnoSRC (TECNO Mobile) featured me in their anniversary as a "#Security_Researcher with the Most Badges" for my contributions to their overall Android Applications and Websites security.
2
6
329