So, for high impaxt bug - severity 9,3 the Hunter received 5,67 USD. Hmmmm.
#bughunting #bugbounty
Hacking AI chatbot adventure. From conversation to leaking internal data.
bergee.it/blog/hacking-ai-ch…
#bugbountytips
#bugbountytip
@rez0__
@NahamSec
@yeswehack
My first success on hacking AI chatbot. Also first success on @yeswehack . Thanks @NahamSec , @ctbbpodcast , @rez0__ .
#BugBounty
Writeup soon...
Some books worth reading, doing bug bounty:
bergee.it/blog/books/
amzn.to/4lW9T0b - "Bug Bounty Bootcamp"
amzn.to/4uVwqO - "Real-World Bug Hunting"
amzn.to/4sCSk85 - "Hacking APIs"
amzn.to/4sCSk85 - Black Hat GraphQL
#BugBounty
Two criticals I found inside one zip uplaod functionality. Have a nice read and Merry Xmas
bergee.it/blog/two-crits-one…
#bugbounty #bugbountytips
My first CVE. Insecure deserialization and PHP objects injection in WP "Doubly" plugin. Thanks @wordfence . #cve
Today, thanks to @NahamSec I bought pretty solid VPS at @Hostinger for 2 years. It is Black Week deal so for $4,79 per month you got parameters as in the screenshot. I need it for bug bounty and hosting so if you need one here it is: shorturl.at/w2bYM
#BugBounty #deal
Dear bughunters. Have you ever heard about self-RCE? I did. I found RCE via command injection and the company said that it is self-RCE as the filesystem is isolated with some chroot and this RCE affects only the user's files. What do you think?
#BugBounty #bugbountytips
bergee.it/blog/waf-bypass-an…
The new write-up on credentials theft with XSS and Google Analytics.
#bugbountytips #BugBounty #bugbountytip
bergee retweeted
Wbijaj na konferencję największej społeczności ITsec w Polsce!
✅ 4 ścieżki / ~40 praktycznych prezentacji, wiedza absolutnie z pierwszej ręki i bez ściemy
✅ Pokazy hackowania na żywo
✅ Jakość i niepowtarzalny klimat gwarantuje Sekurak
✅ 20 października w Krakowie:
hackingparty.pl/
I do recommend reading this blog. Good stuff.
blog.voorivex.team/
#BugBounty
How to read the files on server with zip files. The short story of zip symlink attack:
bergee.it/blog/how-two-dolla…
Have a nice reading
#bugbounty #bugbountytip #bugbountytips
I found the crit on self-hosted program. Reading files on filesystem with unzipping the symlinks. Writeup soon.
#bugbountytips #bugbounty #bugbountytip
How to get paid for subdomain takeover without taking over the domain... :)
bergee.it/blog/subdomain-tak…
#BugBounty #bugbountytips
As Google wanted to close my developer account due to inactivity, I created this simple Dad Jokes app
play.google.com/store/apps/d…
It is not so fast and easy to publish an app today. Pure Kotlin. No frameworks.
#jokes #android #dev #Entertainment
This is brilliant extension for chrome to take frames of YT movie as screenshot. This way I can extract many useful tips and tricks from YT presentations regarding bug bounty.
#BugBounty #bugbountytips #Extension #YouTube
chromewebstore.google.com/de…
Good old SQL injection bugs are still here and there. My latest post on hacking one big company for fun and !profit.
bergee.it/blog/how-i-hacked-…
#bugbounty #bugbountytips #bugbountytip
