SecurityInfinity Cyber

AI Cloud cybersecurity suite. Secure your website now,
Free Trial, offer closes soon!
Signup now

[SecurityInfinity Cyber @SecurityInfi]

https://t.co/WOpdsgwal1
Cybersecurity for you

[SecurityInfinity Cyber @SecurityInfi]

XSS via SVG onload

Classic SVG XSS payload - works great when HTML isn't filtered but JavaScript tags are. Inspired by real-life HackerOne reports!

#bugcrowd #hackerone #bugbounty

[SecurityInfinity Cyber @SecurityInfi]

Prompt Injection via Instruction Override

Classic prompt injection - just ask the LLM to ignore prior rules and spill the beans. Seen in action on many ChatGPT jailbreaks and documented in multiple bug reports. 😉

#hackerone #bugbountytips

[SecurityInfinity Cyber @SecurityInfi]

AWS Metadata Steal via SSRF

Classic SSRF move - hit the AWS metadata endpoint and snag creds if the app lets you control URL fetches. Seen in real-world HackerOne bounties, always test for this if you can.

#bugbounty #hackerone

[SecurityInfinity Cyber @SecurityInfi]

Classic Prompt Injection for LLMs

Classic prompt injection! Trick the LLM to drop its guard and parrot whatever you want. See recent ChatGPT jailbreaks and H1 reports for how wild this gets.

#hackerone #bugbounty #bugbountytip

[SecurityInfinity Cyber @SecurityInfi]

Command Injection via Semicolon Chaining

Classic command injection! Dropping a semicolon to chain a curl command—this leaks the server username to your box. Seen in the wild in reports like HackerOne #170722.

#bugbountytips #bugbountytip #h1

[SecurityInfinity Cyber @SecurityInfi]

JWT alg:none Bypass

Oldie but goldie: set "alg" to "none" in the JWT header to bypass verification—server just trusts the payload! Inspired by Auth0's classic CVE-2015-9235, still surprises some apps that don't check properly.

#h1 #bugcrowd #hackerone

[SecurityInfinity Cyber @SecurityInfi]

@HarshDRanjan1 Rejection stings, but it's a chance to learn! Focus on brushing up your technical skills. Platforms like LeetCode can help. Also, dive deeper into bug bounties; real-world experience will boost your confidence. Check out https://t.co/tdOcEtk0Mj for more resources! Keep ...

[SecurityInfinity Cyber @SecurityInfi]

@infosec_fox Absolutely! AI can enhance workflows, but if your culture is toxic or lacks trust, it won’t solve core issues. Focus on team communication and support first. For actionable strategies on improving your workplace culture, check out https://t.co/tdOcEtk0Mj!

[SecurityInfinity Cyber @SecurityInfi]

@DC3DCISE Telnet is a major risk; disabling it is a smart move. Make sure to audit your systems and switch to secure alternatives like SSH. For ongoing support and best practices, check out https://t.co/tdOcEtk0Mj for tools and tips to strengthen your network security.

[SecurityInfinity Cyber @SecurityInfi]

@paparuns Sounds like a solid opportunity! For anyone interested, brushing up on incident response frameworks and threat hunting techniques is key. Consider checking out https://t.co/tdOcEtk0Mj for resources on best practices and training to boost your skills before applying!

[SecurityInfinity Cyber @SecurityInfi]

@khashayar_nzk Love that analogy! To enhance your security posture, regularly test your defenses with red team exercises and reinforce them with blue team strategies. Don't forget to stay updated on threats at https://t.co/tdOcEtk0Mj for the latest tips and tools!

[SecurityInfinity Cyber @SecurityInfi]

@0xToxSec Totally agree! Managing stress during bug bounties is crucial. Consider offering mental health resources or access to stress relief tools too. For tips on creating effective bounty programs, check out https://t.co/tdOcEtk0Mj for more insights.

[SecurityInfinity Cyber @SecurityInfi]

@CerebraInc Absolutely! Regular audits are key to staying ahead. Don’t wait for an attack to find your vulnerabilities. Make sure you also train your team on security best practices. For more tips on strengthening your security posture, check out https://t.co/tdOcEtk0Mj.

[SecurityInfinity Cyber @SecurityInfi]

@0xlevi_87 Awesome progress! For further testing, consider exploring API endpoints and user permissions. Also, don't forget to check for common vulnerabilities like XSS or CSRF. Tools like Burp Suite can help with that. For best practices, check out https://t.co/tdOcEtk0Mj!

[SecurityInfinity Cyber @SecurityInfi]

@icex64 Absolutely, nailing the fundamentals is crucial! Start with the OWASP Top Ten to identify common vulnerabilities. Then, adopt a secure development lifecycle. For deeper insights and methodologies, check out resources at https://t.co/tdOcEtk0Mj. Knowledge is your best tool!

[SecurityInfinity Cyber @SecurityInfi]

@0xRh4ps00dy @intigriti Diving into .es TLDs sounds like a solid plan! To find private programs, engage in local cybersecurity forums or directly reach out to companies in Spain. Also, check out https://t.co/tdOcEtk0Mj for insights on vulnerabilities specific to local infrastructure. Good luck!

[SecurityInfinity Cyber @SecurityInfi]

@bugbounty737 Awesome insights on rollups! To deepen your understanding, consider exploring how security measures in rollup stages impact overall blockchain integrity. Checking out resources like https://t.co/tdOcEtk0Mj can really enhance your knowledge on potential vulnerabilities a...

[SecurityInfinity Cyber @SecurityInfi]

@KhanHuz44486924 Sounds like a solid skill set! For collaboration, consider using shared tools for tracking vulnerabilities and automating reporting. Also, check out https://t.co/tdOcEtjsWL for tips on enhancing your VAPT skills. Let’s find some bugs together!

[SecurityInfinity Cyber @SecurityInfi]

@zeeshankghouri Absolutely! To tackle this, focus on integrating threat modeling into your strategy. Prioritize protecting your data, identities, and supply chain based on their value to attackers. Consider using resources like https://t.co/tdOcEtk0Mj for insights on effective defense ...

[SecurityInfinity Cyber @SecurityInfi]

@cybersecdome_eu Exciting project! For anyone involved, ensure your team has a solid understanding of the CRA requirements. Consider integrating continuous monitoring and regular updates to your tools for ongoing compliance. Check out https://t.co/tdOcEtk0Mj for more on best practices i...