Ronin

Hi🫪

[Ronin @Roninxgh]

Sometimes I fucking hate bug bounty.

[Ronin @Roninxgh]

@ByteM3Now Appreciate you!🙌

[Ronin @Roninxgh]

Favorite bug chain of the year:

Broken Access Control in Comment Mentions → Stored XSS → CSP bypass → Notification code execution → Domain-wide token → Tenant-wide account takeover.

Sometimes the smallest features hide the biggest bugs.

Should I write a full write-up?

[Ronin @Roninxgh]

@r00t_ak I’ll share it here soon!

[Ronin @Roninxgh]

@ar3za12 I’ll share it soon

[Ronin @Roninxgh]

@r00t_ak I’ll share it soon

[Ronin @Roninxgh]

@satar_nz I’ll share it soon

[Ronin @Roninxgh]

@mahdi_dev1 Thanks 🙌

[Ronin @Roninxgh]

@mosab_4_u Thanks , working on it. It’ll be out soon

[Ronin @Roninxgh]

Two bounties from a WAF bypass that took zero new payloads. Just a different place to put the old one.

#xss

[Ronin @Roninxgh]

Why it works: signature matching runs per input. Neither half matches a rule on its own, so nothing fires. The browser doesn’t care where the bytes came from, it just parses the finished output.
WAF sees input. Browser sees output.

[Ronin @Roninxgh]

The WAF blocked every payload I tried. But two user-controlled fields were rendering side by side in the same response, so I split the payload across both. Half in one, half in the other. Each part looked harmless. The browser put it back together.

[Ronin @Roninxgh]

@mhdagusprbdi @safe_mode01 It’s on the way.

[Ronin @Roninxgh]

Just got paid $2,000 for a single SSRF. 🩸

It started with a simple “fetch this image” endpoint.

A few requests later, I had access to internal APIs that were never meant to be exposed.

Big thanks to my mentor, @safe_mode01 , for the continuous guidance and support. 🙏

[Ronin @Roninxgh]

@Sniff_crypto @safe_mode01 Working on it 😄 Write-up coming soon.

[Ronin @Roninxgh]

@AatankBadb16659 @MiniMjStar @safe_mode01 Soon 👀 I’ll drop the full write-up.

[Ronin @Roninxgh]

@mahdi_dev1 @safe_mode01 Thanks❤️🤝

[Ronin @Roninxgh]

@Sniff_crypto @safe_mode01 No. Private

[Ronin @Roninxgh]

@Mhiztabjay @safe_mode01 Thanks🤝

[Ronin @Roninxgh]

@Harshva97597668 2000$
Pinterest