Shay

Penetration Tester, Web Application Security

[Shay @Shay_1337]

Just finished writing 🧑‍💻
"How to Discover SQL Injections"
- A comprehensive writeup emphasizing the importance of context. Check it out and lemme know feedback! 🔥

#websecurity #sqli #injection #bugbounty

https://t.co/qDJ8hSP0BI

[Shay @Shay_1337]

@the_IDORminator Mentioned here as well - https://t.co/vYG0wTwL8Q

[Shay @Shay_1337]

@the_IDORminator Nice! Check out https://t.co/OE5go4E133 which discusses this exact technique.

[Shay @Shay_1337]

@the_IDORminator This can also be called secondary path traversal. See Sam Curry - https://t.co/UTkyIzJHzu

[Shay @Shay_1337]

@irsdl @BSidesLondon This sounds really interesting!

[Shay @Shay_1337]

@NoahEpstein_ SKILLS

[Shay @Shay_1337]

@chux13786509 User can upload a .php file. The validation is empty and getClientOriginalExtension will save the user controlled file + extension. Then its being saved public profiles folder which means the user can execute the file and achieve RCE

[Shay @Shay_1337]

@garethheyes @PortSwigger So I guess it wouldn't be wise to use Burp AI for testing bugbounty Programs.

[Shay @Shay_1337]

BurpSuite Repeater can now use the built in AI feature + user prompt to perform testing. Cool! Except......

Yesterday I was playing around with this feature and it DROPPED the users TABLE 🫨 WHATTTT!!!

Thankfully it was a FP but beware @PortSwigger

[Dirk-jan @_dirkjan]

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3

[Shay @Shay_1337]

@Jacobsklug cohort

[Shay @Shay_1337]

@ShaykhSulaiman lol 🤣

[KNOXSS @KN0X55]

*** KNOXSS GIVEAWAY June 2025 ***

Directions:

1. Like
2. Share
3. Be a follower

Prize: KNOXSS Pro for 1 Month

Results: June 10th
Number of Winners: 3

Good luck! 😀

https://t.co/3sWDgbdEN9 - #XSS for pros.

#BugBounty #PenTesting

[Shay @Shay_1337]

@PwnFunction @MtnBer Heard the feedback: "The probability is so low—a user has to drag, drop, and click!?"
But with AI agents soon browsing and acting for us (e.g., OpenAI operator), this becomes a 0-click XSS.

@ctbbpodcast

[Shay @Shay_1337]

@PwnFunction @MtnBer Heard the feedback: "The probability is so low—a user has to drag, drop, and click!?"
But with AI agents soon browsing and acting for us (e.g., OpenAI operator), this becomes a 0-click XSS.

@ctbbpodcast

[Shay @Shay_1337]

@0xTib3rius looks like an sqli?..... 😜

[Louis Nyffenegger @snyff]

One of the hardest parts of a security code review? Figuring out how the project is structured.

https://t.co/TxPtEGUyuM just changed the game:
🧠 Repo overview
🧩 Component relationships
🧭 Architecture map
💬 Ask: “Any secrets?” “SQLi here?”

Try it. It's 🔥 for AppSec.

[Shay @Shay_1337]

@icon really neat! This looks promising

[Burp Suite @Burp_Suite]

Don't miss this brand new AI extension in the BApp store! ✨

MCP Server allows you to:

✅ Connect Burp Suite to AI clients
✅ Easily integrate with Claude Desktop

MCP Server also comes with a packaged Stdio MCP proxy server.

Check it out 👇

[Yehuda Smirnov @yudasm_]

Blog post: https://t.co/YkFr6vxBD3