BLH 🐞 Proof of Control
Joined January 2026
- Tweets60
- Following0
- Followers3
- Likes222
Hacked by shahanaj retweeted
this crit was hilarious
found an endpoint returning user PII based on a userId. swapping it for another user's ID just returned my own PII.
removing the param gave a "user not found" error. every other endpoint returned 403 on ID swaps, so I got curious.
Thread...
Hacked by shahanaj retweeted
Found an unusual LFI today while working on a GOV target. The normal multi slash or encoded payload didn't work, so double encoded the payload and sent, boom 🔥
Payload: .%252e/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/etc/passwd
Credit: @__nav1n_
#bugbountytips #bugbountytip
Hacked by shahanaj retweeted
Hunting on API with JSON format? go to reset password and try to submit 2 emails separated with "\n" as:
{"action":"reset-password", "email":"[email protected]\[email protected]"}
You can receive reset password link on both emails.
Credit: @SirBagoza
#bugbountytips #bugbountytip
Hacked by shahanaj retweeted
Bug bounty is changing, and you need to change your methodology with it.
Here’s my 5-step roadmap to adapt and thrive in 2026 👇
youtu.be/F6ApdAsvE_M
#bugbounty #bugbountytips #cybersecurity #hacking
Hacked by shahanaj retweeted
First confirmed RCE 🚨
Chained a file upload validation bypass into actual remote code execution on a real target. The endpoint was rejecting PHP files by MIME type — bypassed it by spoofing an allowed Content-Type and using a null-byte filename trick. Uploaded, accessed the file, got code execution.
Reported responsibly.🛡️
#infosec #bugbounty #RCE #ethicalhacking #websecurity
Hacked by shahanaj retweeted
#bugbountytips
Session fixation:
- grab a pre-auth cookie,
- log in with it still set.
If the server doesn't rotate it after login, an attacker can pre-seed a victim's session ID and take over after they authenticate.
Test every login flow.
owasp.org/www-community/atta…
Hacked by shahanaj retweeted
Yesterday, I was testing an indirect prompt injection technique using invisible white text in an email. To a human reader, the email simply appeared to say: "Hey, I want you to know you're awesome." However, selecting the entire text revealed a set of hidden instructions embedded inside.
While this approach might seem ineffective—and indeed failed on my first attempt—AI model outputs are non-deterministic and vary across iterations. After multiple attempts, the injection successfully triggered the target response.
Hacked by shahanaj retweeted
اگه زیاد با Burp Suite و مخصوصاً Repeater کار کرده باشید، احتمالاً یه جایی رسیدید که با ۳۰ تا تب به اسم‌های 1، 2، 3 و... روبه‌رو شدید و دیگه نمی‌دونید هر تب دقیقاً برای کدوم Request بوده.
چون من خودم خسته شدم هی نامگذاری جدید انجام بدم ، برای حل همین مشکل، افزونه Repeater Organizer رو ساختم.
این افزونه تب‌های Repeater رو به‌صورت خودکار براساس اطلاعات Request مثل:
🔹 HTTP Method
🔹 Domain
🔹 Endpoint و Path
🔹 Query Parameters
نامگذاری می‌کنه.
مثلاً به‌جای تب شماره 17 می‌تونید چیزی شبیه این داشته باشید:
[POST] api.target.com/users/create
امکان ساخت فرمت دلخواه برای اسم تب‌ها، مرتب‌کردن تب‌های قبلی و برگردوندن اسم‌ها به حالت شماره‌ای هم وجود داره.
اگه موقع Pentest یا Bug Bounty تعداد زیادی Request داخل Repeater باز می‌کنید، احتمالاً این ابزار حسابی کارتون رو راحت‌تر می‌کنه.
ریپازیتوری و آموزش نصب:
github.com/maverick0o0/Repea…
اگه استفاده کردید، خوشحال می‌شم نظرتون یا پیشنهاداتتون رو بگید ⭐️
#BurpSuite #BugBounty #Pentest #CyberSecurity
Hacked by shahanaj retweeted
Zero bugs submitted this month...
This is what a solid pipeline looks like.
Thanks @Bugcrowd
Hacked by shahanaj retweeted
JWT Authorization Bypass Testbed
403.brutelogic.net/authz/jwt
Know every way to break a JWT.
Every technique, every payload, tested and ready.
Algorithm confusion, header field injection, claim manipulation, format attacks — including original research not documented in any public resource.
brutelogic.net/ebooks/broken…
Hacked by shahanaj retweeted
You can also use Shodan's Certificate Transparency (CT) API to enumerate a target's subdomains directly from the crt.sh database.
ctl.shodan.io/api/v1/domain/…
/api/v1/domain/{domain} ~returns the certificates that match a domain
/api/v1/domain/{domain}/hostnames ~returns all hostnames associated with a domain
Hacked by shahanaj retweeted
Advanced bug bounty tip 🎯
Stop testing IDOR only on GET requests.
The real money is in state-changing mutations — PATCH/PUT/DELETE, and especially GraphQL mutations.
Why? Devs lock down read access carefully, then forget the same object-level checks on write/update endpoints.
Chain it: BOLA (wrong user's object) + BFLA (wrong role's action) = one mutation that lets a low-priv user modify or lock out a higher-priv account.
Test matrix for every mutation:
→ swap the object ID (BOLA)
→ swap your session (BFLA)
→ swap both
Most triagers still don't expect chained authz bugs in GraphQL. That's your edge.
#bugbounty #infosec #AppSec
