https://xitter.cf/t.co/sfzZkMe9r4 Vai, amico, libero da fardelli e paure ☘️☘️☘️ ETHiCaL HaCKeR 🕵🏻♂️ BuG BouNtY HuNTeR🐞 GaMeR 🎮 PuN LoVeR 👻
Nerul, Navi Mumbai
Joined May 2013
- Tweets562
- Following319
- Followers332
- Likes939
ѕнαяαт кαιкσℓαмтнυяυтнιℓ 🇮🇳 retweeted
Are you seeing a 403 when you access this:
GET /api/v2/admin/users ❌
You can try bypassing it by accessing an older API version:
➡️ GET /api/v1/admin/users
➡️ GET /api/admin/users
➡️ GET /api/V2/admin/users
➡️ GET /api/v2/admin/users with X-API-Version: 1
➡️ GET /api/v2.0/admin/users
➡️ GET /api/beta/admin/users
What else will you try? 👇
ѕнαяαт кαιкσℓαмтнυяυтнιℓ 🇮🇳 retweeted
This scrappy setup got him 10+ account takeovers on the same program 👇🏼
ѕнαяαт кαιкσℓαмтнυяυтнιℓ 🇮🇳 retweeted
🚨Bug Bounty Tip: Testing password-reset APIs? Try newline injection in JSON
{"email":"[email protected]\[email protected]"}
✅Join t.me/brutsecurity/
If reset links reach both emails, you may have a parameter parsing/input validation flaw worth investigating.
#BugBounty
ѕнαяαт кαιкσℓαмтнυяυтнιℓ 🇮🇳 retweeted
?action=team-invite - the URL param that ended in a $15k takeover
Front-end JS: "/api/v2/teams/" + teamId + "/invites/" + inviteId — both values read straight off the page URL.
CSPT. Grep your JS bundles for it 👀
teamId=../../../ and a team invite becomes an authenticated PUT at any endpoint, from the victim's own session.
ѕнαяαт кαιкσℓαмтнυяυтнιℓ 🇮🇳 retweeted
403 Forbidden doesn't always mean that access controls are properly enforced... 😅
unKover by @brutelogic tests any target returning a 401/403 URL against proven bypass techniques like path normalization, IP header spoofing, HTTP request method tampering, and URL encoding! 🤠
Check it out! 👇
github.com/BruteLogic/unKove…
ѕнαяαт кαιкσℓαмтнυяυтнιℓ 🇮🇳 retweeted
Found a pretty interesting way to enumerate subdomains:
app.agniops.in/v1/search?dom… give: 813
crt.name/v1/search?apex=x.co… give: 781
Gives you a clean list from the domain's certificate data.
ѕнαяαт кαιкσℓαмтнυяυтнιℓ 🇮🇳 retweeted
When fuzzing is no longer treated as merely bruteforcing, you start to unlock meaningful results 🤠
From discovering hidden assets to turning unusual behavior into exploitable vulnerabilities! 😎
In our latest article, we've teamed up with Orwa Atyat (@GodFatherOrwa) to dive deeper into mastering web fuzzing for reconnaissance and vulnerability exploitation.
Read the article now! 👇
intigriti.com/researchers/bl…
ѕнαяαт кαιкσℓαмтнυяυтнιℓ 🇮🇳 retweeted
An SSRF in Shopify screenshot feature led to root on every container in their cluster.
SSRF → cloud metadata → kube-env → Kubelet certs → kubectl → root shell.
7 steps, $25,000 bounty. Most hunters stop at step 1.
Mapped the full escalation ladder from 313 reports:
medium.com/@Aacle/the-bug-bo…
ѕнαяαт кαιкσℓαмтнυяυтнιℓ 🇮🇳 retweeted
Hacking tip! 🐝
Most beginner hunters just run subfinder with just the domain as input.
Add the -recursive flag to force only recursive-capable sources (like crt.sh, Censys) to go deeper. Combined with rate limiting, you avoid API bans while increasing your coverage.
👇
ѕнαяαт кαιкσℓαмтнυяυтнιℓ 🇮🇳 retweeted
JWT Authorization Bypass Testbed
403.brutelogic.net/authz/jwt
Know every way to break a JWT.
Every technique, every payload, tested and ready.
Algorithm confusion, header field injection, claim manipulation, format attacks — including original research not documented in any public resource.
brutelogic.net/ebooks/broken…
ѕнαяαт кαιкσℓαмтнυяυтнιℓ 🇮🇳 retweeted
#ssrf
extention bypass if it requires the file to end with .yaml
do it: url=http://2852039166/latest/meta-data/iam/security-credentials/target-web-role?a=example.yaml
paramter with bypass #bugbounty #bugbountytrics #
ѕнαяαт кαιкσℓαмтнυяυтнιℓ 🇮🇳 retweeted
It is no secret that hidden parameters can lead to all sorts of vulnerabilities, such as SQLi, XSS & SSTI! 😎
But you have to find them first... 😓
In our comprehensive guide, we've uncovered the top 5 common ways to uncover unreferenced parameters in your target, including a list of common tooling to help you automate these 5 methods.
Check it out! 👇
intigriti.com/researchers/bl…
ѕнαяαт кαιкσℓαмтнυяυтнιℓ 🇮🇳 retweeted
What a write-up must read for anyone
medium.com/@HX007/a-journey-…
ѕнαяαт кαιкσℓαмтнυяυтнιℓ 🇮🇳 retweeted
"$250,000+" - Quarter million dollars. One program.
Here's what nobody tells you.
Here's the full breakdown from my @Atlassian journey on @Bugcrowd:
~ 400 reports submitted:
~ 240 paid reports
~ 80 duplicates
~ 70 N/A
Every duplicate and N/A was a lesson, not a loss.
No automation. No recon tools. Just deep manual research, consistency, and an obsession with understanding how Atlassian products work at their core.
Atlassian runs one of the most professional and well-managed bug bounty programs out there. A huge shoutout to their security team for taking every report seriously. and a special thanks to Mike for building a company that genuinely invests in security.
What made the difference?
→ I stopped hunting broad, started going deep
→ I treated Atlassian attack surface like a full-time research project
→ I documented everything, even the rejections
→ I came back to closed reports and found bypasses
One program. One mindset. $250K+.
The specialization strategy wins every time.
#BugBounty #InfoSec
ѕнαяαт кαιкσℓαмтнυяυтнιℓ 🇮🇳 retweeted
💰~$10,000 bounty
Found valid hardcoded OAuth2 credentials in a public JS asset using Secret Hunter
The exposed credentials were app-level, providing broader access than typical user-scoped tokens
💁♂️ Join us t.me/kassems94
#BugBounty #AppSec #OAuth #CyberSecurity
