Muhammad Asad

eWPTXv3 | CRTA | CAP | SRT | VAPT | Penetration Tester | Offensive Security Engineer | Security Researcher
#Alhumdulillah❤️

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

@0xatharv Try

Website.tar

Website.tar.gz

WebsiteFUZZ -e .tar,.tar.gz

Website-FUZZ -e .tar,.tar.gz

Website_FUZZ -e .tar,.tar.gz

[Muhammad Asad @Muhammad_AsadPk]

@jsmonsh BOUNTY

[Muhammad Asad @Muhammad_AsadPk]

@NahamSec .

[Ben Sadeghipour @NahamSec]

🚨 Doing a giveaway for my Blind XSS Masterclass
Most people think they know XSS, until they meet blind XSS, the kind that fires where you’ll never see it.
Same methods that helped me earn $250K+ from real reports. https://t.co/VL5jwf8alx
🎁 Retweet and reply to enter.

[Muhammad Asad @Muhammad_AsadPk]

@NullSecurityX Who wants to collaborate on this @YesWeHack private program: https://t.co/fWtxDhLMYT…

[Muhammad Asad @Muhammad_AsadPk]

@alexfariasec @coffinxp7 feroxbuster

[Muhammad Asad @Muhammad_AsadPk]

Who wants to collaborate on this @YesWeHack private program: https://t.co/zAFtuWdkq7 #YesWeRHackers

[Muhammad Asad @Muhammad_AsadPk]

Who wants to collaborate on this @YesWeHack private program: https://t.co/bFRGKqt2Eg #YesWeRHackers

#YesWeHack

[Muhammad Asad @Muhammad_AsadPk]

Who wants to collaborate on this @YesWeHack private program: https://t.co/vIjCGr1dYo #YesWeRHackers

[Muhammad Asad @Muhammad_AsadPk]

10. Use the Param Miner Burp extension to enumerate hidden GET parameters.
11. `/directory/Home.aspx` accepts a `body` parameter that is injected into the DOM and allows `javascript​:` URIs (DOM-based XSS).

[Muhammad Asad @Muhammad_AsadPk]

🚀 Found: DOM XSS

1. Number of web assets in scope.
2. Filter assets with httpx by backend language.
🧵👇
#CyberSec #xss #Pentesting #BugBounty #bugcrowd #pentest #cyber #cybersecurity #redteam #security #bugbounty #applicationsecurity #penetration #VAPT

[Muhammad Asad @Muhammad_AsadPk]

7. A few results were returned.
8. One result returned HTTP 200: `/directory/Home.aspx`.
9. This endpoint executes successfully without authorization. (This is Broken Access Control, but I want to chain it with other bugs.)
🧵👇

[Muhammad Asad @Muhammad_AsadPk]

@Hac10101 How many exam attempts?

[Muhammad Asad @Muhammad_AsadPk]

@cybarx14 @Hoesenbug @intigriti @cybarx14 bro exposed via origin IP or public Subdomain ???

[Muhammad Asad @Muhammad_AsadPk]

@grok Continue with more include Description

[Muhammad Asad @Muhammad_AsadPk]

Alhamdulillah 🔥
I'm excited to share that I’ve officially passed the eWPTXv3

You can view my verified certificate here:
🔗 Web Application Penetration Tester eXtreme – https://t.co/BK6olVAvqt

#eWPTXv3 #websecurity #INE #penetrationtesting #bugbounty #cybersecurity #infosec

[KNOXSS @KN0X55]

🏆 KNOXSS August 2025 Giveaway 🏆

➡️ Follow, like and share! 😍

➡️ 1 Month Pro access for 3 winners on Friday 8th

Good luck! 🤞

https://t.co/3sWDgbdEN9 - #XSS made easy.
Sign up or upgrade now.

#WebAppSec #BugBounty #PenTesting

[Muhammad Asad @Muhammad_AsadPk]

I just completed the "Basic IDOR with hash as user identifier" challenge on @YesWeHack! 🚀

Can you do it?: https://t.co/nToJru2IKF

#ChallengeCompleted #YesWeRHackers #YesWeHackDojo

[Muhammad Asad @Muhammad_AsadPk]

I just completed the "Basic Insecure direct object references (IDOR) in cookie" challenge on @YesWeHack! 🚀

Can you do it?: https://t.co/agNlAakTEM

#ChallengeCompleted #YesWeRHackers #YesWeHackDojo