Researcher in charge @ Ethical InfoSec Services | HackerOne Top 10 | https://xitter.cf/t.co/JSX03Wv1vl
Joined February 2016
- Tweets974
- Following512
- Followers14.3K
- Likes1.4K
Jayesh Madnani retweeted
An there it is - "Domain Intelligence": argosdns.io/domains (for public access)
Feel free to explore. Trial users can explore preset limited data, growth plans+ can search their own stuff!
@Jayesh25 @ITSecurityguard @Th3G3nt3lman @GodfatherOrwa
Jayesh Madnani retweeted
Why can the ArgosDNS.io database look smaller in some cases?
Because bigger subdomain counts can just mean more wildcard noise.
This article explains why:
argosdns.io/blog/wildcard-dn…
I've had firsthand access to ArgosDNS and can say it’s produced quite a few solid results that I didn’t even have in my own database. Unlike many tools, the data actually feels meaningful rather than just raw volume.
I've known @damian_89_ a while and have been chasing him for ages for his recon secret sauce 😄 From what I’ve seen so far, ArgosDNS is doing a lot of smart permutations, picking up real-world naming patterns, scanning cloud certs, and doing a ton of crawling behind the scenes to get this data. It’s also nice that the dataset is already deduped so you’re not dealing with garbage.
Feel free to give it a shot at argosdns.io/
Hey guys, I just launched argosdns.io - if you are into IT security, bug bounty hunting, red teaming, ... this is interesting for you!
argosdns.io/
Here’s a quick insight into how a single opportunity can dramatically change your earning potential in bug bounties.
Ever wondered what kind of difference a Live Hacking Event (LHE) can make?
Picture this:
You report 10 XSS vulnerabilities on a newly launched public program and walk away with around $5k in total bounties.
Now compare that to someone invited to a Live Hacking Event reporting those same 10 XSS bugs - they could easily walk away with $75k–$100k. Same bugs. Completely different outcome. That’s the power of getting invited to an LHE. It unlocks new scope, direct access to top programs, face-to-face interactions with HackerOne triage and security teams, networking with elite hackers, and opportunities you won’t get anywhere else.
HackerOne has outlined the eligibility criteria for invites here: hackerone.com/blog/earning-h…
My advice? Focus your efforts on aligning with these criteria. One invite can really shift your entire growth curve, skills, learning, recognition, and bounties.
PS: Drop a comment if you feel you should’ve been invited to an LHE but haven’t yet. I’d love to hear your experience and it may help surface visibility for @Hacker0x01.
Scored a $5,000 bounty today. I’ve only started messing around with AI in my workflow THIS week. Normally I’d spend hours trying to escalate certain bugs - the kind that takes a lot of digging and escalation and I'd usually end up moving away from it considering the ROI. But this time I let AI handle some of the painful parts of the manual escalation process and it actually helped me efficiently escalate the bug. Ended up turning what would’ve been a tiny payout into a $5000 bounty.
Now I’ve basically got Burp Suite on one screen, AI on the other, and it feels like cheating (in a good way).
This might actually change how I hunt moving forward with respect to escalating stuff to avoid manual work whereever possible. 🚀
Here’s how I discovered a critical issue on a wide-scope program using @netlas_io 👇
The target had a pretty generic login flow via a 3rd-party service with specific keywords. It was pretty much using the same codebase reused across multiple assets.
I used netlas.io to do a quick response search with a keyword unique to my target's login page.
Here's the query I used:
http.body:("")
The above search returned an EC2 IP with port 80/443 open. This IP had no direct connection to my target via CIDR, WHOIS, SSL certs, or domains and looked completely unaffiliated with the target I was hunting on. But I could tell from the login flow immediately that it was identical to the one used by the company.
Turns out the exposed Instance had sign up enabled and that allowed me to login and dropped me straight into an admin panel exposing massive PII and internal dashboards.
I suppose the key takeaway here is to not limit your recon to basic organization-wide searches like WHOIS, CIDRs, or SSL certificates. Sometimes, targeting unique application fingerprints such as specific UI text or JavaScript snippets can help uncover untracked assets.
Found an interesting bug a while back and thought I’d share it here 👇
I came across an unused API endpoint inside a JavaScript file - `/api/users//activities/`. It wasn’t being called anywhere within the app, so naturally, I tried to hit it manually using my JWT from the web app.
The result? 403 Forbidden. No access.
Later that day, I downloaded the mobile app for the same target just to poke around for some other Issues. While logging in, I noticed something odd - the JWT generated by the mobile app was noticeably bigger than the one from the web.
As a next step I threw it into jwt[.]io for a quick look and to my surprise the token had way more scopes and permissions granted compared to the web version even though It was for the same account..
At this point I had a wild theory which I was pretty sure wouldn't work...
But as you can Imagine I went back to that `/api/users//activities/ endpoint, but this time used the mobile-generated JWT... and boom it worked. I had full access to PII data for other users.
The endpoint was probably gated by permissions that only mobile clients were issuing.
Moral of the story? Don’t just test with the web client. Always compare JWTs from different platforms - web, mobile, maybe even desktop. Misconfigured scopes or overly permissive mobile tokens can open up unimaginable possibilities.
I’ve noticed that most new folks who reach out for guidance in bug bounty feel overwhelmed early on trying to learn everything at once. That often leads to half-baked knowledge across multiple areas and slower overall progress.
Here's what I recommend instead 👇
1/
Pick one vulnerability type and go all in.
Master the ins and outs of that category - how it works, how it breaks, real-world examples, and ways to find it.
Once you’ve got depth in one area, the rest will follow naturally.
2/
To put this into perspective, here’s a snapshot of the types of issues I’ve reported over the last 5 years - gradually expanding focus as I grew more confident:
2020:
• Local cache issues
• Rate limit issues on Login
• Session invalidation
• MFA bypass
2021:
• Rate limit
• MFA bypass
• CSRF
• IDOR
• RBAC
2022:
• CSRF
• IDOR
• RBAC
• XSS
• Business logic
• Info disclosure
2023:
• Everything from 2022 +
• BBP automation
• Cache deception
• DoS Issues
• Subdomain takeover
• Auth bypass / misconfig
• SQLi
• SSRF
• RCE
2024:
• Everything from 2023 +
• AI-related issues
• Vhost misconfigurations
2025:
• Everything from 2024 +
• Many more new things that I will talk about soon :)
3/
There are more, of course, but this covers most of what’s worked well for me.
The key takeaway: you don’t need to know everything.
Play to your strengths. Stay consistent. And let your scope expand naturally.
Hope this helps someone starting out 💪
Note if it wasn’t for the low hanging fruits in 2020 I wouldn’t have made it this far. It was a great motivation booster knowing that i could get some bounties even if it was for the silliest issues I’ve ever reported. There’s nothing to be ashamed of if you’ve gotta scoop up the low hanging fruits in early stages of your journey.
I've often hesitated to participate in public bug bounty programs, mistakenly believing that if a program is public, it's likely already been thoroughly tested and is bug-free. However, I've been proven wrong. Over the past 2 years, I've learned valuable lessons that have humbled me.
The key takeaways are: never assume, never hesitate, and never talk yourself out of taking action due to fear of failure.
My manual submission rate has decreased from 10-15 critical bugs per month to just 2-3 criticals, yet the overall bounties are pretty much the same due to high paying programs.
It's unreal how vulnerable some of the most common applications can be.
My advice is to continually challenge yourself to improve. The journey can be tough, but there's always hope for success. There’s always a greater than 0% chance of something if you’re trying hard enough :)
Most of us are on the same skill sets, with some performing better than others. The key difference lies in persistence and a never-give-up attitude. Invest as many hours as possible, and seize this opportunity to make your mark. Best of luck!
Here's a technique I use to maximize results and avoid VPS abuse reports while testing for automated XSS or similar vulnerabilities.
Malicious payloads are often blocked outright by WAF providers like Akamai, Cloudflare, etc., meaning you won’t even get a chance to work on a WAF bypass—your request will likely be blocked before it even reaches your automated alert.
While this approach has some limitations, instead of using intrusive payloads like ">
Bug Bounty Tip: Keeping It simple & consistent
Over time, I’ve realized that overly complicated automation in bug bounty isn’t as exciting or rewarding—at least not for me. Instead of trying to automate everything under the sun, I’ve found that focused, consistent recon on core targets works much better.
Here’s what’s been working for me:
✅ Daily Recon on Favorite Targets – Just simple, routine checks on a limited set of targets around 10-15 wide scope programs.
✅ Regular Scans & Fuzzing – Run top CVE templates, VHost checks, and other essential tests using ffuf, katana, nuclei, jsluice, etc.
✅ Subdomain Takeover Monitoring – One of the few things worth running across everything.
✅ 0-Day Research & Collabs – If you’re working on new research or working with someone else, spread these checks across multiple assets.
For the past 1-2 months, I’ve mostly been chilling, only reporting leads from automation 80-90% of the time. i.e. Still requires me to manually look at It and escalate the bug and that still seems to be resulting in 8-10 reports per month and $40K-$50K in bounties on average.
The key takeaway? Simplicity, consistency, and strategic targeting matter way more than bloated automation. Keep refining your workflow and focus on what actually works.
🚀 Unspoken Bug Bounty Rules – From many years of failures & experience!
🕵️♂️ Got a similar bug across multiple assets but fear the program might count them as one for payout despite requiring multiple fixes?
✅ Report one at a time. Wait for a bounty. Then submit the next one.
⚖️ Think your report is High/Critical but doesn’t align with CVSS?
✅ Focus on demonstrating Impact. Reference previous reports, screenshots of policies, and clarify why severity should be higher.
🔗 Reporting a subdomain takeover but worried it'll be fixed before triage?
✅ Archive it via Wayback Machine for solid evidence. If they still reject it, at least you 'll have evidence and can fight back and most Importantly won’t have to walk away with a Not Applicable (NA).
🔢 Reporting an IDOR on UUIDs but getting a "Low" payout due to high complexity?
✅ Show how multiple UUIDs can be discovered via web archives, dorks, and OSINT. If IDs are easily accessible, it strengthens your case.
💨 Reporting a Cache Poisoning DoS, but DoS is out of scope?
✅ Never call it DoS! Instead, frame it as Cache Poisoning to Arbitrary Content Injection and clearly explain your attack scenario.
🔒 Working on a program that has both a VDP & BBP?
✅ Submit to VDP initially, but if you prove your skills, politely request an invite to their private BBP via comments.
🤝 Love hunting on a program? Want to do more with them?
✅ Build relationships with program managers & triagers. Being polite and engaging on special occasions never hurts.
📢 Disagree with CVSS or impact assessment?
✅ Instead of frustrated follow-ups, provide detailed reasoning & impact proofs. A well-structured response is likely to better attention from H1 triage and program managers.
🚪 Not happy with how a program treats you despite your contributions?
✅ There are 1000+ programs out there. Take a break and revisit later—management changes, and things improve!
💡 I'm sure there are more such unspoken bug bounty insights. These are just a few that I've learned the hard way. Hope it helps!
Please feel free to add :)
💥 Simple HTTP Parameter Pollution escalated to PII Leak → 4-Digit Bounty!
✅ {"proxyPayload":"Limit=20&userID="} → 200 OK
❌ {"proxyPayload":"Limit=20&userID="} → "errorMessage":"Forbidden Access"
✅ {"proxyPayload":"userID=&Limit=20&userID="} → 200 OK
Here’s what happened:
🔹 The first server validated the second userID in the request for access control.
🔹 The secondary system (context) used the first userID to retrieve PII belonging to the victim.
This mismatch allowed me to validate my attacker userID while accessing the victim’s data.
End result? Access control bypass → Mass PII Leak 🚨
Lesson: Test how APIs handle duplicate parameters, especially in secondary contexts where different parts of the system may interpret them inconsistently.
#BugBountyTips #Hacking #HTTP #BugCrowd #HackerOne #Intigriti #YesWeHack
Jayesh Madnani retweeted
very pleased to announce the release of my new article based on my research that led to CVE-2024-46982 titled:
Next.js, cache, and chains: the stale elixir
zhero-web-sec.github.io/rese…
note: does not cover the latest findings shared in my recent posts
enjoy reading;
Jayesh Madnani retweeted
🔐Secrets no one will share with you - Here's a technique that might grant you access to takeover other users' accounts using "Login with Facebook":
Are you working on a target site that supports "Login with Facebook"?
Disable email sharing during Facebook login and be ready for unusual design flows that could enable you to take over other users' accounts.
Here's how to disable email sharing when using "Login with Facebook":
1️⃣ Log in with Facebook on any app.
2️⃣ Click "Edit Access."
3️⃣ Uncheck the email address checkbox.
4️⃣ Click Continue.
Here are some scenarios of account takeovers I've reported based on different target app behaviors:
Account Takeover via Linking Facebook Flow:
1️⃣ Went to http://example[.]com, used "Login with Facebook" (Uncheck share email on Facebook).
2️⃣ The target site asked to enter an email to link my FB account as no email was shared from FB. Entered [email protected], a confirmation link was sent to the victim's email to bind the account.
3️⃣ Repeated the same steps on the target site using the same FB account, this time choose to link [email protected] on target site – received the same link as step (2) on the attacker controlled email!
4️⃣ Knowing this, repeated the same steps again to link [email protected], and used earlier link which was received on [email protected] to takeover [email protected] account.
Direct Account Takeover via Login with Facebook:
1️⃣ Went to http://example[.]com, used "Login with Facebook" (Uncheck share email on Facebook).
2️⃣ The target site prompted me to enter an email to link the FB account to an existing account since no email was shared from FB. Entered [email protected]. It directly logged me into [email protected] without any further verification, leading to a complete account takeover.
Pre-Account Takeovers:
Do you have a target app that heavily relies on a user's email domain to grant access to organizations or critical features based on whitelisted domains? Using this technique can help you bypass email verification requirements, allowing you to claim any email. Consequently, you may be able to access critical features of other organizations permitted for emails with the same domain.
Lesson: Always test unusual login flows by logging in with a 3rd party provider without sharing email with the target site. These designs can be flawed and lead to nice bounties! 💰 #BugBounty #CyberSecurity #HackerOne #bugcrowd #securitytips #bugbountytips
