Ahsan Sheikh

Bug Hunter | Synack Red Team Member | Security Consultant | CEH

[skull @brutecat]

Hacking Google with A.I. for $500,000

https://t.co/S8NbDU9ZaN

[Intigriti @intigriti]

@Th3G3nt3lman 5️⃣ Write-up: AWS Document Signing Security Control Bypass

Ozgur shares a cool way of abusing application logic to bypass AWS Document Signing!

https://t.co/4bQM414fPb

[Ahsan Sheikh @SnShyk]

@zseano Stay strong mate! Best of luck 💪

[Ahsan Sheikh @SnShyk]

@zseano Congratulations 🎊

[Intigriti @intigriti]

@GodfatherOrwa @net_code 3️⃣ We Hacked Apple for 3 Months: Here’s What We Found

A classic write-up by 5 talented researchers that briefly talked about their experience hacking Apple for 3 months!

https://t.co/ZljiBJd489

[Ahsan Sheikh @SnShyk]

@triplewhale

I'm bringing attention to a critical issue. I reported a vulnerability exposing sensitive org info over a year ago, with @Ariel's commitment to a reward. since then. No reward response. I'm giving you a chance to rectify this. Reach out, or face the consequences.

[Ahsan Sheikh @SnShyk]

@salesboomCRM @SalesboomCloud

Hello team,

I found a CRITICAL vulnerability in one of your digital asset and I tried to contact you guys via email but not getting any response. Kindly reach out to me at [email protected] at your earliest convenience.
Thank you

[ikram nizamani @ikram_niz110]

This post is logically so do reply with logic #BoycottSushantMehta

[Corben Leo @hacker_]

I've made $500k+ from SSRF vulnerabilities.

Here are my tricks:

[Jackson Hinkle 🇺🇸 @jacksonhinkle]

🇮🇱 Israel is MASSACRING CHILDREN in Gaza.

🚨 The media WILL NOT show you the truth.

[HasbullaHive 🐐 @HasbullaHive]

Stop war against children 🇵🇸❤️

[Censored Men @CensoredMen]

🇵🇸🇮🇱 An Israeli strike hit Palestinian rescue teams in Gaza.

[Jackson Hinkle 🇺🇸 @jacksonhinkle]

🇮🇱🇵🇸 The moment Israel BOMBED Gaza’s Baptist Hospital.

Over 500 are reported dead. This is a crime against humanity. https://t.co/F96fKNsl9M

[Gaza Now in English @EnglishGaza]

A group of children miraculously survived the Holocaust at the Al-Ahli Arab Hospital after the Nazi Israeli occupation bombed the hospital, resulting in the deaths of 500 martyrs and the injury of 600 other civilians, most of whom were children and women.

[Justin Gardner @Rhynorater]

XSS -> ATO Escalation Brain Dump:
* Change email -> password reset
* Change password
* Change phone -> SMS password reset
* Change security questions
* Add SSO login (login with GitHub, ect)
* Force logout -> Session Fixation
* Steal session token via non-HTTP only cookie
* Steal session token via insecure embed in page
* Steal API key for application
* Add admin user to organization
* Hijack oAuth flow and steal code
* Steal SSO code to adjacent app, then reverse SSO back to main app
* Add authentication method (SMS, email, etc)
* Gain access to refresh token for JWT or session

Got any more?

[sudi @sudhanshur705]

Found my first RCE on a bb target, probably the best one too :)
HTMLi to RCE 🚀
If the backend is python and the application offers a pdf render endpoint there are high chances that they are using reportlab (very popular) to generate those pdfs .
POC: https://t.co/L3Xf8iUnOV

[Nagli @galnagli]

I've earned more than 5-figure bounties from sensitive links, sent via email, that were leaked without any user interaction. Surprisingly, the leaks came from the very security vendors that were supposed to protect the victims.

Curious how this happens? 👇

#BugBounty

[Ahsan Sheikh @SnShyk]

@GOVUK this time 😎

#cybersecurity #infosec #bugbounty #vdp

[Ahsan Sheikh @SnShyk]

@hamzaavvan @StateDept Sir you are pro MA SHA ALLAH ❤️

[Ahsan Sheikh @SnShyk]

Vulnerability accepted! @StateDept

Vulnerability: Reflected XSS
Tip: Try second or third level URL encoding if application won’t allow you to use simple XSS payload.

#infosec #CyberSecurity