Prajwal Sagar Bhandari

Founder & CEO at Lumica Labs

[Prajwal Sagar Bhandari @Mrzen_Security]

@pdiscoveryio @neo_ai_engineer @Inumarqy It is happening all the time. I guess it was a known issue.

[Prajwal Sagar Bhandari @Mrzen_Security]

@mhdagusprbdi @MiguelVasc97017 I can help you understand how he achieved that. You can send a dm.

[Prajwal Sagar Bhandari @Mrzen_Security]

@Zaddyzaddy @BugBunny_ai Wana try it out.

[Prajwal Sagar Bhandari @Mrzen_Security]

@gabbytech01 https://t.co/z0Y9oouESi

[Prajwal Sagar Bhandari @Mrzen_Security]

@tabaahi_ slack

[Brandon Rossi @0xConda]

If you want to find vulnerabilities with AI, you need to learn how to gaslight AI into thinking it missed something.

[Prajwal Sagar Bhandari @Mrzen_Security]

@xoaanya For my specific task of code cleanup, they were almost similar in terms of execution.

[André Baptista @0xacb]

Been testing the IDOR trick where you wrap the identifier in an array, in Node JS.

You are 123, victim is 124.
{"user_id": [124, 123]}

The ORM doesn't pick the first element. Sequelize and Mongoose turn it into WHERE id IN (124, 123) and can write both rows.

[Prajwal Sagar Bhandari @Mrzen_Security]

@4osp3l @pastelkiss78 Sent you request in discord

[Abhishek @aacle_]

Bug bounty talks that are 5+ years old
and still produce bugs nobody else is
finding.

Most hunters watch the latest recon
tool demo and skip the talks that built
the methodology they're using without
knowing it.

Here are 10 forgotten talks 🧵 that still pay

[Prajwal Sagar Bhandari @Mrzen_Security]

@to1billions

[Prajwal Sagar Bhandari @Mrzen_Security]

@EOEboh We can bypass frontend validation using intercepting proxies like burp suite. So, it must be validated same or better in the backend to make it fully secure.

[André Baptista @0xacb]

Here's a simple concept that's helped me find a lot of bugs. Once it clicks you can't unsee it.

A huge family of bugs is basically the same bug: two components read the same input and disagree about what it means.

- Injection (XSS, SQLi, code injection): a parser (the browser, DBMS, etc) disagrees with the app about what counts as code.
- Request smuggling: frontend and backend disagree on where the request ends.
- SSRF filter bypass: the validator reads the URL one way, an HTTP client reads it another.

These are called parser differentials, and the idea powers a lot of modern research. Some classes, such as broken access control, play by other rules. You can stop hunting for bug types and start hunting for the disagreement, and that's where the magic is.

[Prajwal Sagar Bhandari @Mrzen_Security]

@BnBTianWeb3 @grok 😅

[Prajwal Sagar Bhandari @Mrzen_Security]

@the_IDORminator Hi! I’m about to enroll in the course and am confident it’ll be worth it. I’d appreciate it if you could share a coupon code via DM. 😄

[Prajwal Sagar Bhandari @Mrzen_Security]

@sangithinba Congratulations

[Prajwal Sagar Bhandari @Mrzen_Security]

@melqtx In a vps

[Prajwal Sagar Bhandari @Mrzen_Security]

@prakhar0x01 @Hacker0x01 Was it in audible?