Muzamil

Security Researcher | Bug Bounty Hunter | HackerOne Contributor | Web Application Security Expert

[Muzamil @Kindone09]

Alhamdulillah
I was Awarded a $3000 Bounty on HackerOne 💥

#bugbountytips #bugbounty #CyberSecurity #Hacked #hackingtools

[TrendAI Zero Day Initiative @thezdi]

There it is! Orange Tsai (@orange_8361) of DEVCORE Research Team was able to exploit Microsoft Exchange! If confirmed, they win a whooping $200,000 and 20 Master of Pwn points. Off to the disclosure room to explain how they did it and seal the deal. #Pwn2Own #P2OBerlin

[LaurieWired @lauriewired]

the most low-effort / high reward thing you can do for security is installing the Russian language pack

(not even joking, it's ridiculous how often that prevents execution)

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

MYTHOS FINDS A CURL VULNERABILITY

https://t.co/dhvdvhqqQp

[lookatrobot. @lookatrobot]

I visited a link https://t.co/XHGPdAO3SM. It site was HTTP. It asked me to complete a "CAPTCHA"
This is NOT a CAPTCHA. It copies a hidden PS script to your clipboard and runs it.
DON'T GO THE WEBSITE OR SOLVE THE CAPTCHA.
Did you do this intentionally?? @lostsec_

[NXR🇮🇩 @_nnxxrr_]

Hey I found a bug on your site!! 😃

Oh, it's just informative, no security impact 🙃

Alright then, please disclose it 🤝

Haha nope 😅 only resolved issues can be disclosed 🤭

...
whaw3532io523r9t8wf!!! 🤯🔥

[James Kettle @albinowax]

I'm thrilled to announce "Can AI Do Novel Security Research? Meet the HTTP Terminator" will premiere at @BlackHatEvents #BHUSA! Check out the abstract:

[Shivang @shivangmauryaa]

Reward : 2000 $

IDOR in staging API due to missing object-level authorization
Endpoint:

GET https://example. com/api/workspace/{id}/latest
The {id} parameter is directly mapped to backend objects without any access control enforcement. Since IDs are sequential

[kritika @vibeonX69]

What’s harder to master in Linux?

-Permissions

-Networking

-Shell scripting

-Package management

[Muzamil @Kindone09]

@prasads94955045 @techbromemes There channels 😅

[Shivang @shivangmauryaa]

bounty : 1,100$
Bug 1 : Debug Mode enabled

well i the api endpoint was expecting /api/v1/xyz?id=1 [INT] but instead of int i used string value which thrown errror with a lot of information

Bug 2 : User limit bypass

as per plan you can add only 2 user ,

[Muzamil @Kindone09]

@shivangmauryaa congrats. ✨ And How did you even come up with this payload

[Muzamil @Kindone09]

The panic in the #welcome channel was real—until the realization hit. Check the calendar: April 1st. 📅🤣😂

[Muzamil @Kindone09]

@albinowax True

[James Kettle @albinowax]

CVSS' Attack Complexity metric is the bane of bug bounty hunters: "you tried really hard to find that bug, so we'll pay you less".

[chiefpie @cplearns2h4ck]

pwn2own❌ ai2own✅

[Muzamil @Kindone09]

@tech_cyber1447 Thanks, and I will make a write-up soon.

[Muzamil @Kindone09]

Just another day on hunting. ☕️

Secured a $500 bounty for a PII Exfiltration. It’s wild how a little creative "persuasion" can make an AI leak secrets.

Back to the grind. 🛡️💻

#BugBounty #Infosec #AI #PromptInjection #CyberSecurity #EthicalHacking #RedTeaming #HackerLife

[Muzamil @Kindone09]

@Prajwal030105 I will make a write-up soon.

[Muzamil @Kindone09]

@Arqam992 Thanks . I have been doing bug bounties since August 2024, but I haven’t been very consistent because I am a student. I also just turned 18 and joined university this month

[Muzamil @Kindone09]

@sysxplore Kinda true 😂