Pratik Khalane

Web application pentester | Bug Bounty Hunter | Security Researcher

[Pratik Khalane @KhalanePratik]

Just got a new Offensive Security credential via @Accredible for https://t.co/Le9my2Lic4 via @offsectraining

[Pentester Academy @SecurityTube]

Congratulations to @KhalanePratik for clearing our Certified Red Team Professional exam! #ADLab #CRTP #PentesterAcademy cc @nikhil_mitt https://t.co/gUx9gbXHsq

[Pratik Khalane @KhalanePratik]

@AseemShrey @SaveToNotion #Thread

[Pratik Khalane @KhalanePratik]

@NahamSec @PentesterLab 🅿️ - Passionate

[Pratik Khalane @KhalanePratik]

@coder_rc @elli0t43 @Rudrakshsaini2 @root_tanishq @nagasainikhil @The_CraZy_man_ @d4rckh @K4R4NX @basu_banakar @cyph3r_asr @DixithReddy7 @Neutron__ @InfosecMecha @sahil__soni_18 @souravbaghz ❤️

[Pratik Khalane @KhalanePratik]

@sociosploit @cyph3r_asr @hackthebox_eu I hope that i will win😄🙈

[Hutch (Cyber Cognition) @sociosploit]

$60 USD @hackthebox_eu gift card #GIVEAWAY!!!. To qualify, just follow @sociosploit (if you aren't already), and then retweet! Winner to be selected randomly and announced on Friday (Oct 1st, 2021). #infosec #netsec #ctf #hackthebox #redteam

[Pratik Khalane @KhalanePratik]

@PJBorah2 Like how did you verify the email ?

[Pratik Khalane @KhalanePratik]

@RanjitAdhikar34 Can you explain what is the impact if we are reporting this to any company?

[CVE.report @CVEreport]

CVE-2021-35337 : Sourcecodester Phone Shop Sales Managements System 1.0 is vulnerable to Insecure Direct Object Reference IDOR . Any attacker will be able to see the invoices of different users by changing the id parameter.... https://t.co/y3882ITGax

[Pratik Khalane @KhalanePratik]

@impratikdabhi Thanks for resharing ❤️

[Pratik Khalane @KhalanePratik]

@tyrus_ Thanks for resharing 😁

[Pratik Khalane @KhalanePratik]

@alicanact60 Can you attach some writeups of how were you able to find the bugs?

[Pratik Khalane @KhalanePratik]

@impratikdabhi

@ADITYASHENDE17

@remonsec

@Virdoex_hunter

@coder_rc

@stokfredrik

@MrCyberwarrior

@ofjaaah

@Alra3ees

[Pratik Khalane @KhalanePratik]

Here is my second blog of how i was able to bypass the admin using the default credentials in @BBC website.

Link : https://t.co/n2BPyE8iUv

[Pratik Khalane @KhalanePratik]

@Alra3ees @impratikdabhi @ADITYASHENDE17 @remonsec @Virdoex_hunter @coder_rc @stokfredrik @MrCyberwarrior @ofjaaah Thank you😁

[Pratik Khalane @KhalanePratik]

Recently I was rewarded with 500 € for the bug which is admin panel bypass without using the credentials.

Hope you like my first blog.

https://t.co/LfufT4ejqV

@impratikdabhi @ADITYASHENDE17
@remonsec @Virdoex_hunter
@coder_rc @stokfredrik @MrCyberwarrior @ofjaaah @Alra3ees

[Pratik Khalane @KhalanePratik]

@Rishabh51274497 @Spyboy7711 @impratikdabhi @ADITYASHENDE17 @remonsec @Virdoex_hunter @coder_rc @stokfredrik @MrCyberwarrior @ofjaaah @Alra3ees I used three files
1) dicc.txt (dirbuster) 2)directory-list-lowercase-2.3.big.txt
3) assetnote - raft-medium-directories-lowercase.txt

[Pratik Khalane @KhalanePratik]

@Virdoex_hunter @impratikdabhi @ADITYASHENDE17 @remonsec @coder_rc @stokfredrik @MrCyberwarrior @ofjaaah @Alra3ees Thanks 😁

[Pratik Khalane @KhalanePratik]

@codingo_ Sir can you please have a look at your dm . It might help me for my report