Darkry

Bug hunter || penetration tester || cyber security

[Darkry @Darkry741]

@0xhunster Hey bro can you please dm me @0xhunster

[Darkry @Darkry741]

@kiranbattaluri @SynackRedTeam Hey bro can you dm me @kiranbattaluri

[Darkry @Darkry741]

Bug- 2FA bypass via Improper Re-authentication in GraphQL API

[Darkry @Darkry741]

The hunt continues...
- IDOR
- Privilege escalation

Never trust the UI, test the API directly.

[Darkry @Darkry741]

@shinchina_ Thanks brother ♥️

[Darkry @Darkry741]

BAC Leads to Premium feature bypass

Tip: Compare premium vs free account requests — many applications enforce feature restrictions only on the frontend, leading to broken access control issues.

[Darkry @Darkry741]

@MhdAsfan Yeah sure

[Darkry @Darkry741]

Initially marked P4, the submission was later upgraded to P3 after we stood by its real impact.

Tip: Shodan trick — try removing the TLD (.com, .io, .in, etc.). It sometimes reveals hidden or related IPs.

Example: ssl:"google" http.status:200

[Darkry @Darkry741]

@dr34lm Thanks bro

[Darkry @Darkry741]

@Jhaddix @arcanuminfosec @the_IDORminator I hope 🤞❤️

[JS0N Haddix @Jhaddix]

Day TWO of FIVE days of celebrating our 2 year ARCANUM-VERSARY! @arcanuminfosec

3rd Giveaway = FOUR seats to our new course by @the_IDORminator "Zero to [BAC] Hero" !

👍 1 Like = 1 Entry!
♻️ 1 Share = 2 Entries!

Winners announced 1/21! Syllabus link below 👇

[Darkry @Darkry741]

@being__aman Yes bro this is happening to everyone i think i should publish a write up on this

[Darkry @Darkry741]

Now 2026 started

Tip: For hidden API endpoints use BurpJSLinkFinder extension for Burp Suite.

[Darkry @Darkry741]

@0trusts Ask specific question bro

[Darkry @Darkry741]

@s7a6k Not yet but soon

[Darkry @Darkry741]

@Bugcrowd Give me @Bugcrowd tshirt

[Darkry @Darkry741]

@zeyad_ashraf_ hey bro can you check dm

[Darkry @Darkry741]

@Bugcrowd Csrf protection bypass and its works then report on bugcrowd and get duplicate 🙃

[Darkry @Darkry741]

@Bugcrowd I found a video by @hakluke on bugcrowd channel. https://t.co/UpEJ8aQfW1

[ROHIT @rynosec]

🚨 GIVEAWAY ALERT !! 🚨
Giving away hacker swags from the shop 👀

How to enter:
Like & Retweet the original post ❤️
Follow @bughuntershop

2 Winners gets customized hacker goodies from the shop

cc: @bug_vs_me @errorsec_ @tabaahi_ @hetmehtaa @3ncryptSaan @krishnsec

#bugbounty