MHD

Security Researcher | Web Dev | CTF Player #web3 الحمد لله

[Black Hat @BlackHatEvents]

Discover what's next in cybersecurity.

Debate what's claimed.

Deploy what works.

Black Hat USA, August 1–6. Super Early Bird pricing ends May 22nd — largest savings available. One Step Ahead.

[MHD @MhdAsfan]

✨

[Intigriti @intigriti]

We just dove into our shelf of archived bug bounty write-ups from the most notable hackers! 🤠

In this issue, we selected 5 compelling articles (that are still relevant today) to share with you, from which you can learn something new! 😎

🧵 👇

[LetsDefend @LetsDefendIO]

Friends of SOC Analysts

[Vishal Vishwakarma @rootxvishal]

🔥 Ultimate IDOR Testing Checklist 🔥

📌 https://t.co/NcOjwsBrre

IDOR is still one of the most impactful bugs in bug bounty. Many critical findings start by simply changing an ID in a request.

💡 This checklist covers:
✔️ ID & UUID manipulation
✔️ API & version bypasses
✔️ Multi-account testing
✔️ GraphQL & WebSocket
✔️ Race conditions & batch abuse
✔️ Mobile, gRPC & blind IDOR
If you want high-impact bugs, don’t skip this. 🚀

#bugbountytips #bugbounty #infosec #cybersec

[obscaries ❘ AppSec @obscaries]

If you use Nuclei for bug bounty or recon, this repo is a goldmine.

Source: https://t.co/R1XkF0B6QV

It aggregates hundreds of public/custom Nuclei template repos in one place:
• CVEs
• SSRF
• SSTI
• XSS
• Takeovers
• WAF detections
• Fuzzing templates
• API checks
• and much more.

A very useful resource for expanding your custom scanning workflow and discovering community templates you probably missed. 🔥

#bugbounty #cybersecurity #appsec #infosec #nuclei #hacking

[MHD @MhdAsfan]

https://t.co/1PPcxIQyaT

[Mhmmd Al-Qasaby @0d_Asbawy]

Don’t rush to report.

A UUID IDOR looked informative at first. Dug deeper, found an endpoint leaking valid IDs, chained both, and it became critical.

Full writeup: https://t.co/6RKQqCTnSd

#BugBounty #IDOR #hackerone

[Vivek | Cybersecurity @VivekIntel]

Top 60 Hacker Search Engines 💀🔥

1.🌐Shodan
2.📡Censys
3.🔍Onyphe
4.👁️ZoomEye
5.⚙️GreyNoise
6.🛰️Natlas
7.🌍Netlas
8.🧭FOFA
9.📚NIST NVD
10.🧪https://t.co/MwlmYFSc4W
11.🔓opencve
12.🧠VulnIQ
13.📊Vulmon
14.🗂️VulDB
15.💥Sploitus

16.📰Oday .today
17.⚒️LOLBAS
18.🧰GTFOBins
19.🎯FullHunt
20.💻grep .app
21.🔎SearchCode
22.🤓NerdyData
23.📧https://t.co/Si2T81eO6n
24.🔗SynapsInt
25.☁️skymem
26.🧑ThatsThem
27.🌎Omnisint
28.🧩Riddler
29.🌐RobTex
30.🏗️BuiltWith

31.🔗URLScan
32.🌪️Chaos
33.📡DNSdb
34.📈DNSviz
35.🧾https://t.co/Bt1rfJIqPA
36.🔐crt .sh
37.📶Wigle
38.📍wifimap
39.📡wifispc
40.🌐mylnikov
41.🔑Dehashed
42.🗄️Snusbase
43.🔨HashKiller
44.🕶️AHMIA
45.🧅https://t.co/TQTLISud38

46.🌏Google
47.🇷🇺Yandex
48.🔎Bing
49.🎥Insecam
50.🧠ORKL
51.🧫tria .ge
52.💧leakix
53.📁filesec
54.⚠️malapi
55.📞TellowS
56.🔄https://t.co/M8hc0HJegq
57.☎️SpyDialer
58.💣ExploitDB
59.🚀Rapid7 DB
60.🖼️TinEye

#OSINT #CyberSecurity #Recon #InfoSec

[VIEH Group @viehgroup]

GraphQL Introspection Misconfiguration to Sensitive Data Exposure

POC →

1. While testing a GraphQL endpoint, noticed introspection queries were enabled in production
2. Sent an introspection query to map the full schema
3. Discovered hidden queries related to internal user and admin data
4. Modified the query to fetch user email, roles, and internal metadata
5. Server returned sensitive data without proper authorization checks
6.This allowed attackers to enumerate users and access restricted information

Learning →

- GraphQL introspection should be disabled in production environments
- Always enforce authorization on every resolver
- Hidden schema endpoints often expose internal business logic

#infosec #hacking #hacker #bugbounty #bugbountytips

[Burp Suite @Burp_Suite]

🔍 Testing an application with a GraphQL API?

Learn about common GraphQL vulnerabilities over at the Web Security Academy, and then scan your app with Burp Suite Professional or Burp Suite Enterprise Edition to find GraphQL bugs automatically.

#graphql

https://t.co/Td3PJODvUt

[X @TheMsterDoctor1]

200+ Hacking / Infosec pdfs

Source: https://t.co/nfRHOZgaDz

#infosec #Hacking #infosecurity #Malware #bugbountytips #CTF #BugBounty #vulnerability #pwn #CyberSecurityAwareness #CyberSecurity #cybersecuritytips

[obscaries ❘ AppSec @obscaries]

This one right here… insane value 💀🔥

🔗 https://t.co/XMJUEXp2Z2

Real bugs. Real reports. Real hacker mindset.

If you're serious about bug bounty, you NEED to study this.

#BugBounty #CyberSecurity #Infosec #Hacking

[Reeboot_to_init5 @ReebootToInit5]

The WAF blocked standard SQL keywords (OR, AND, SELECT, UNION, WHERE, etc.)

but got bypassed using Oracle's NVL, NULLIF, SUBSTR, or SYS_CONTEXT.

[bugcrowd @Bugcrowd]

SecLists is a security tester’s best companion.

From usernames and passwords to URLs, payloads, web shells, and sensitive data patterns, it covers almost every recon need.

Use SecLists in your workflow to automate more and find more bugs. 🐞

[Intigriti @intigriti]

|￣￣￣￣￣￣￣￣￣￣￣￣￣￣|
every successful hacker
had to start somewhere
|＿＿＿＿＿＿＿＿＿＿＿＿＿＿|
\ (•◡•) /
\ /
——
| |
|_ |_

[obscaries ❘ AppSec @obscaries]

Bug bounty tip 🔥

Most people stop at subdomain enum… real hunters go further ↓

Take your subs → generate permutations → resolve → profit 💰

Tools you should be using:
• Altdns: https://t.co/1EAylLYiHd
• dnsgen: https://t.co/TWTu9KkDYb
• gotator: https://t.co/R4wIfcUAvp
• shuffledns: https://t.co/0QB8BCS1qm

Pro move 🧠
Use target-specific words (from JS, GitHub, Wayback) instead of generic lists → this is where hidden assets live

Enumeration finds surface.
Permutations find gold. 🔥

#BugBounty #BugBountyHunter #InfoSec #CyberSecurity #Recon

[Bug bounty wizard @bugbountywizard]

Cloudflare WAF Bypass Leading to Reflected XSS via SVG Injection by 0xh7ml https://t.co/sVbr8JZjhZ #bugbounty #bugbountytips #bugbountytip

[Illex @pcuco92]

The Spring Boot Actuators can expose some sensitive informations like env vars, heap dumps, configs, and internal metrics
And sometimes, with simple bypass tricks we can find them:

actuator/env;..
;/actuator/env
actuator;/env
actuator/env%00
actuator/env;
..;/actuator/env
static../actuator/env
actuator/health/..;/env

#bugbounty #bugbountytips #cybersecurity

[Tib3rius @0xTib3rius]

I saw this on LinkedIn. The AWASP Top Ten, a "vibe-researched and vibe-coded" alternative to the OWASP Top Ten.

https://t.co/wgMz9WAqgu

It's...interesting to say the least. 😅

Credit: https://t.co/RpTIq8UwjV

[Frey @n7runr]

2FA Bypass
https://t.co/UEwlbtB4oE