Dreams of Tragedy

bug bounty noob | I also play alot of poker.

[Dreams of Tragedy @DreamsofTragedy]

@ImmortalisDB

[Lu3ky13 ⚡️⚡️ @lu3ky13]

I have reported more than 50 bags with this extension
New version coming soon: one-click crawling of all web

https://t.co/QwYU5zdzcF

[BetRivers Poker @BetRiversPoker]

Not every loss is a bad beat. ⚡

This player didn’t win the $25 CUB3D SNG, but a Glitch Prize still sent $1,250 his way! 🤑

50X the buy-in. Zero complaints. 🤯

[Bug Bounty Insights 🪄 @bbr_bug]

Webhook SSRF filter bypass: many servers block 301/302 redirects but follow 303 See Other.

Host a PHP script returning 303 to the internal target:

ex.👇

Source: Omise #508459 (AWS keys leaked in webhook delivery log).

[VIEH Group @viehgroup]

#ssrf

extention bypass if it requires the file to end with .yaml

do it: url=http://2852039166/latest/meta-data/iam/security-credentials/target-web-role?a=example.yaml

paramter with bypass

#bugbounty #bugbountytrics #infosec

[Bug Bounty Insights 🪄 @bbr_bug]

Rails SSRF: CarrierWave's remote_attachment_url= downloads from arbitrary URLs.

Check any Rails app with uploads or import/export — it may not get stripped.

Also test remote_attachment_request_header= for header injection (e.g. Metadata-Flavor: Google).

Source: GitLab #826361

[Dreams of Tragedy @DreamsofTragedy]

Played 3 tournaments and cash in two of them

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

XSS isn't one bug — it's three different fights depending on where your input lands. 🐀

The HackXpert XSS Playground drops you into all three contexts: HTML injection, HTML tag attribute injection, and JavaScript injection. Learn to read the context first, then craft the payload that actually fires.

Free, hands-on, right in the browser: https://t.co/Yq8dEvsjtM

Want the full path afterwards? Uncle Rat's Pentesting Paradise ties the methodology together — a discount applies via the link: https://t.co/Gqmxzg3ZUf

Authorized testing only. #infosec #bugbounty

[Bug Bounty Insights 🪄 @bbr_bug]

Extract API paths from JavaScript files. Most hunters read JS manually and miss hidden endpoints.

[Dreams of Tragedy @DreamsofTragedy]

I know I was running bad, but 60% for this month. Shit!!!

[Bug Bounty Insights 🪄 @bbr_bug]

Burp Logger++ auto-detect regex for IDOR testing:

\b\d{3,}\b|gid:\/\/|uuid:[0-9a-f]{8}

Flags every numeric, GraphQL gid, and UUID in proxy history. Export matches and test each with a second account.

[bugcrowd @Bugcrowd]

5 rapidfire bug bounty tips in under 2 minutes. GO 🏃‍♂️

[Gareth Heyes \u2028 @garethheyes]

I haven't posted a crazy XSS vector for a while...
Works on every browser

[Brute @BRuteLogic]

OAuth Authorization Bypass Testbed
https://t.co/IRUieJmz68

[VIEH Group @viehgroup]

Use NextJS? Recon ✨

A quick way to find "all" paths for Next.js websites:
DevTools->Console

console.log(__BUILD_MANIFEST.sortedPages)

javascript​:console.log(__BUILD_MANIFEST.sortedPages.join('\n'));

Credit: @ofjaaah

#infosec #bugbountytips #bugbounty

[Web Security Academy @WebSecAcademy]

A simple bypass through IP based application blocklisting 👇

X-Forwarded-For can be used to bypass the IP based blocklisting if the application is configured to trust this header.

[XSS Payloads @XssPayloads]

A Cloudflare bypass payload by @nav1n0x

"%2Bself[%2F*foo*%2F'alert'%2F*bar*%2F](self[%2F*foo*%2F'document'%2F*bar*%2F]['domain'])%2F%2F