~$ 𝔀𝓱𝓸𝓪𝓶𝓲

“Yesterday is history, tomorrow is a mystery, but today is a gift.

[~$ 𝔀𝓱𝓸𝓪𝓶𝓲 @0trusts]

@finance_bitflow @saqibarif98 @lostsec_ @Hacker0x01 It's has impact you have to buy a idn domain, don't use burp collab

[~$ 𝔀𝓱𝓸𝓪𝓶𝓲 @0trusts]

@rutu609 That's good girl🙃🙃🙃

[~$ 𝔀𝓱𝓸𝓪𝓶𝓲 @0trusts]

@nnwakelam Very very big

[~$ 𝔀𝓱𝓸𝓪𝓶𝓲 @0trusts]

@cat_w1th_hat Bro on streak

[~$ 𝔀𝓱𝓸𝓪𝓶𝓲 @0trusts]

@cyberlype Bro what they are finding

[obscaries ❘ AppSec @obscaries]

AutoAR is a powerful framework that automates the bug bounty workflow from recon to monitoring.

✅ Subdomain enumeration
✅ URL collection
✅ JS analysis
✅ Nuclei integration
✅ DNS takeover checks
✅ GitHub recon
✅ Continuous asset monitoring

Less time running tools manually, more time hunting for real bugs.

Repo: https://t.co/fNuKfymHYK

#BugBounty #CyberSecurity #InfoSec #BugBountyHunter #Recon #OSINT #AppSec #Hacking

[Densel @luckyhacker43]

All You Need to Master IDOR: A Complete Resource Guide by B1scuit 🔥

👨‍💻 Raunak Gupta (B1scuit)
🔗 https://t.co/HLaSyhcOJL

Stay connected:
🔗 https://t.co/FeMz53IqCy

[~$ 𝔀𝓱𝓸𝓪𝓶𝓲 @0trusts]

@the_IDORminator @n4itr0_07 I have read it already

[~$ 𝔀𝓱𝓸𝓪𝓶𝓲 @0trusts]

@0xtruthlover @HackenProof Congratulations man

[Rikesh Baniya @rikeshbaniya]

CSRF ATO using not so known technique of chaining facebook login csrf

had made over 11,000$ across programs in 2022

#bugbounty #bugbountytips

[~$ 𝔀𝓱𝓸𝓪𝓶𝓲 @0trusts]

@ArmanSameer95 Hey tess bro what vulnerability you found in T-Mobile which was rewarded 55k $. Do a writeup would love to see crazy findings.

[~$ 𝔀𝓱𝓸𝓪𝓶𝓲 @0trusts]

@rutu609 Send some here

[bsysop @bsysop]

Have you found a WordPress that the home page redirects to an authentication page? It could be used by Internal teams as a CMS, knowledge sharing, etc

The frontend is protected, but what about the API?

1/2 🧵👇

#BugBounty #BugBountyTips

[bsysop @bsysop]

Check the /wp-json/ to see what data is accessible, more specifically:
- /wp-json/wp/v2/posts
- /wp-json/wp/v2/pages
- Custom plugins endpoints

You may find Secrets/PII in the plugins and sensitive data in the posts and pages.

[~$ 𝔀𝓱𝓸𝓪𝓶𝓲 @0trusts]

@the_IDORminator I think T-Mobile has 9-10 days

[~$ 𝔀𝓱𝓸𝓪𝓶𝓲 @0trusts]

@the_IDORminator Hunt on your favorite T-Mobile

[Anastasis Vasileiadis @Anastasis_King]

📌SSRF Bypass Payloads

[Surya naryn 🇮🇳 @surya_naryn_]

Blind XSS Tips
waybackurls https://t.co/odzRZwbak4 | gf xss | sed 's/=.*/=/' | sort -u | tee Possible_xss.txt && cat Possible_xss.txt | dalfox -b https://t.co/sHRn5B6e7F pipe > output.txt

#bugbountytips #infosec #hacking

[🇪🇨🍫 @bxmbn]

Most people overlook PDF files, PDFs may contain Registration links or Registration Codes that can be used to either privilege escalate or access hidden applications

[dirty0124 @dirtycoder0124]

@shamim_12__ @Bugcrowd @Hacker0x01 It depends upon the website workflow. Many times websites do not allow normal bxss payload. So in that case i use payload which extracts cookies only and does not touch anything else like dom, screenshot etc, as these functionalities are very alarming and Waf stops execution.