Nguyễn Trung Kiên

[Nguyễn Trung Kiên @K1enNT]

hey @grok what is 1+1

[Akshay 🚀 @akshay_pachaar]

Turn any GitHub repository into rich, navigable docs.

Simply replace "github" with "deepwiki" in the repo URL.

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

100 web app exploits for #bugbounty hunters

=== Authentication & Authorization ===
1. Username enumeration
2. Weak password policies
3. Password reset token leakage
4. Reusable/resettable session tokens
5. Missing 2FA enforcement
6. Bypassing 2FA with alternate flows
7. Brute-force login (no rate limiting)
8. Login CSRF
9. Session fixation
10. OAuth misconfiguration
11. JWT token cracking or manipulation
12. Insecure token storage in local/session storage
13. Privilege escalation via parameter tampering
14. IDOR (Insecure Direct Object Reference)
15. Changing user roles via hidden fields
16. Using leaked/stolen cookies
17. SSO bypass or misconfiguration

=== Input Validation & Injection ===
18. SQL Injection (Classic, Blind, Time-Based)
19. NoSQL Injection
20. LDAP Injection
21. XPath Injection
22. Command Injection
23. Host Header Injection
24. CRLF Injection
25. Server-Side Template Injection (SSTI)
26. HTML Injection
27. JavaScript Injection
28. XML External Entity (XXE)
29. XSLT Injection
30. CSV Injection (Excel Formula Injection)

=== Cross-Site Scripting (XSS) ===
31. Reflected XSS
32. Stored XSS
33. DOM-based XSS
34. XSS via file upload preview
35. XSS in 3rd-party widgets
36. XSS through postMessage
37. XSS via PDF rendering
38. XSS through Markdown
39. XSS via unsanitized JSON response

=== File Upload & Deserialization ===
40. Unrestricted file upload
41. Uploading executable scripts (.php, .jsp)
42. File upload path traversal
43. Bypassing MIME-type checks
44. Client-side file validation only
45. Insecure temporary storage of uploads
46. Unauthenticated upload endpoints
47. Deserialization attacks (PHP, Java, .NET)
48. Insecure file parsing (e.g., ImageMagick “ImageTragick”)

=== Access Control & Business Logic ===
49. Bypassing payment steps
50. Redeeming unlimited coupons/vouchers
51. Horizontal privilege escalation
52. Vertical privilege escalation
53. Manipulating prices in client-side requests
54. Race conditions in purchases/bookings
55. Tampering with subscription upgrades
56. Skipping steps in multi-step processes
57. Insecure redirects (open redirect)
58. Abuse of referer-based restrictions

=== Cross-Site Request Forgery (CSRF) ===
59. Account takeover via CSRF
60. CSRF with no anti-CSRF tokens
61. Cookie-based CSRF token reuse
62. Changing user email/password via CSRF
63. Misconfigured CORS leading to CSRF
64. JSON CSRF

=== Security Misconfigurations ===
65. Directory listing enabled
66. Default credentials (admin/admin)
67. Exposed `.git` or `.svn` folders
68. Misconfigured CORS (Access-Control-Allow-Origin: *)
69. Debug mode enabled
70. Verbose error messages
71. Stack traces or internal IPs leaked
72. Publicly accessible admin panels
73. Missing security headers (CSP, X-Frame-Options, etc.)
74. Cache poisoning

=== Client-Side Issues ===
75. Insecure use of postMessage
76. Leaking credentials/tokens in URL fragments
77. Using `eval()` on user input
78. DOM clobbering
79. Clickjacking
80. Sensitive data stored in localStorage/sessionStorage
81. Mobile deep link hijacking
82. Insecure browser autofill

=== Server-Side Logic Bugs ===
83. Race conditions
84. Mass assignment
85. Logic bypass in verification steps
86. Time-of-check to time-of-use (TOCTOU)
87. Unsafe redirects and forwards
88. Excessive data exposure in APIs

=== API & GraphQL ===
89. GraphQL introspection enabled
90. GraphQL injection
91. Lack of rate limiting on API endpoints
92. Improper object-level access control
93. Accessing undocumented/hidden endpoints
94. Sensitive info in API responses
95. Misconfigured CORS for API

=== Miscellaneous ===
96. SSRF (Server-Side Request Forgery)
97. Open URL redirection
98. Weak subdomain takeovers
99. Broken cryptographic implementations
100. Exposed environment variables (.env, config files)

[Nguyễn Trung Kiên @K1enNT]

@sokolicav hi, can i ask why serverity is Exceptional ? PII data Confidentiality: high and Integrity: None, Availability: None
so just 7.5 CVSS with version 3.0 ?

[Nguyễn Trung Kiên @K1enNT]

@bypass38972 what's tips?

[Nguyễn Trung Kiên @K1enNT]

@gudetama_bf what is tips? :))

[Nguyễn Trung Kiên @K1enNT]

@Bugcrowd 1

[Nguyễn Trung Kiên @K1enNT]

@GodfatherOrwa hi, can you dm me?

[Paul Seekamp @nullenc0de]

How I just got gained access to 22 unauthorized endpoints across 116 websites (260k endpoints) in about 10 minutes. Use what your comfy with.

👇

[X @TheMsterDoctor1]

SSRF / LFI / Remote Code Execution

CSZCMS version 1.3.0 server-side request forgery exploit that leverages local file inclusion to inject a remote shell.
#BugBounty #InfoSec #CyberSecurity #HackerOne #BugHunting #WebSecurity #PenTest #AppSec #CyberAttack @elvtnx

[Nguyễn Trung Kiên @K1enNT]

@_ch3t4nn I think so too, thank you

[Nguyễn Trung Kiên @K1enNT]

@_ch3t4nn I think it depends on the case and what the service is, sample elastic, : admin/changeme , company service: admin/admin:password, or there will be default wordlist to try all cases

[Nguyễn Trung Kiên @K1enNT]

@_ch3t4nn How can you know default credentials, I usually use 'admin/admin' and 'admin/password, if not, i change targer

[Nguyễn Trung Kiên @K1enNT]

@beginnbounty I thinks github search now is bad for bug bounty hunter

[Nguyễn Trung Kiên @K1enNT]

@0x1877 🫡

[Nguyễn Trung Kiên @K1enNT]

@Pman474 Do you know why Publicly exposed HashiCorp Vault is a security flaw?

[Nguyễn Trung Kiên @K1enNT]

@_ayoubfathi_ @Yassineaboukir can you explain about it, I don't know that , because HashiCorp Vault need credentials or token to login, thanks so much.

[Nguyễn Trung Kiên @K1enNT]

@AliKM2000 @Bugcrowd It's true.

[Nguyễn Trung Kiên @K1enNT]

@0x0SojalSec are u sure spyse is live?

[Nguyễn Trung Kiên @K1enNT]

@HunterMapping I thinks your tools is bester than shodan or censy! awesome!