Ahmed Tarek

[Ahmed Tarek @0x_xnum]

Missed the RCEs… back to hunting.

Thank you @Bugcrowd for the great triage

#bugcrowd #ItTakesACrowd #bugbounty

[Ahmed Tarek @0x_xnum]

I just got my #eMAPT Certificate.
Thanks @INEsecurity

[Ahmed Tarek @0x_xnum]

@Mar0_0uane It is within the organization

[Ahmed Tarek @0x_xnum]

Bypassed the fix three times!
TIP: always try different approaches to access the same data

#ItTakesACrowd #bugbounty #bugbountytips #bugcrowd

[Ahmed Tarek @0x_xnum]

I just published a full write‑up about an interesting dependency confusion bug I found in a Ruby application.

https://t.co/xjxndwzznH

#BugBounty #bugbountytips #bugcrowd #ruby

[Ahmed Tarek @0x_xnum]

I ethically hacked Discord!
#ittakesacrowd #BugBounty

[Ahmed Tarek @0x_xnum]

@sangithinba congratulations

[Ahmed Tarek @0x_xnum]

@starkcharry @Bugcrowd the parser here only allowed file reads. no JNDI or write access. File leak was the max impact

[Ahmed Tarek @0x_xnum]

@habiba_not check the black hat graphql book

[Ahmed Tarek @0x_xnum]

Well that was cute

#eWPTX

[Ahmed Tarek @0x_xnum]

@Eyax0 كل سنة وانت طيب يحبيبي وعقبال سنين كتير وتحقق كل اللي نفسك فيه واشوفك التوب 1 في كل المنصات ❤️❤️

[Ahmed Tarek @0x_xnum]

@Gomawyy هو لسا موقفش كىىم الضحك اللي بيعمله دا

[Ahmed Tarek @0x_xnum]

@Eyax0 I need one for my MacBook 😔

[Ahmed Tarek @0x_xnum]

@Shari7a0X الف مبروك يخويا ❤️❤️

[Ahmed Tarek @0x_xnum]

@Eyhuss1

[Ahmed Tarek @0x_xnum]

@_Pablocoder @Bugcrowd mostly burp suite for scanning plus some manual testing for logic bugs

[Ahmed Tarek @0x_xnum]

I earned $800 for my submission on @bugcrowd

TIP :

DELETE /api/v1/user → blocked

PATCH then DELETE /api/v1/user → works

#ItTakesACrowd #bugbounty #bugbountytips #bugcrowd

[Ahmed Tarek @0x_xnum]

@_bughunter @Bugcrowd انت لسا مكلمتش السكرتيرة

[Ahmed Tarek @0x_xnum]

@lekshman_r @Bugcrowd Just do a PATCH to the same request then DELETE again, no need to change anything

[Ahmed Tarek @0x_xnum]

@_mailler @Bugcrowd Yep, basically patching changes the server state so DELETE isn’t blocked anymore