SUNJOYcs

Software Tester @monocloud

Testing Api's, auth flows, weired bugs, the failures that ship at midnight⏰️....

[SUNJOYcs @SunjoYcs]

Reminder: Always test for JWT algorithm confusion.

​Flip alg from RS256 to HS256
​Grab the public key
​Use it as the HMAC secret to sign a fake token

​If the backend trusts the header
instead of enforcing RS256, you're in.

​#AppSec #BugBounty #Auth #JWT

[SUNJOYcs @SunjoYcs]

Spent 3 hours debugging a frontend logout bug.

It wasn’t frontend.

A backend flow was rewriting session TTLs with an old config value, silently shortening active sessions.

Frontend was correctly logging out on 401.

The failure point wasn’t the root cause.
#Auth #Buggs #Test

[SUNJOYcs @SunjoYcs]

Still seeing this in production systems:

Refresh Token A → New Access Token + SAME Refresh Token A

If the same refresh token works twice, rotation is not implemented.

One simple check:
new_refresh_token != old_refresh_token

#CyberSecurity #AppSec #OAuth #JWT

[MonoCloud @MonoCld]

Passwords are a problem your users did not sign up for.

They forget them. They reuse them across every app they use. They reset them at the worst possible time. And every reset email is one more reason to abandon your product entirely.

One-time passcodes remove all of that. A single code sent to your user's email or phone. Enter it, and they are in. No password to remember, no account to recover, no frustration at the login screen.

MonoCloud sends one-off codes via email or SMS, with configurable code length and expiration to match your security requirements. Single use, time-limited, and gone the moment it is used.

No password. Just a quick code.

👉 Try MonoCloud at https://t.co/A0joEXMl51

#Authentication #DeveloperTools #AppSecurity #SaaS

[SUNJOYcs @SunjoYcs]

Most auth bugs are missed because tests run instantly on localhost.

In reality, latency causes:
• Delayed logout
• Broken magic links
• Race conditions

Test with latency. No perfect timing in production.

#Backend #Testing #AppSec #Auth

[SUNJOYcs @SunjoYcs]

User: "I clicked Login twice by accident."

Backend: "Congratulations, you now have two valid sessions."

The concurrent login race condition is small, sneaky, and surprisingly common.

#Auth #SecurityTesting #DeveloperHumor

[SUNJOYcs @SunjoYcs]

Most token replay bugs come from stale assumptions:

• State changed, token still works
• Token lives longer than needed
• Purpose isn't verified

The interesting bugs aren't in token creation—they're in the gap between issuance and use.

#CyberSecurity #BugBounty #OAuth

[SUNJOYcs @SunjoYcs]

Password reset bug:

Invalid password → password unchanged → reset token consumed.

User must request a new reset link.

Consume reset tokens only after a successful password update.

#AppSec #WebSecurity #Auth

[SUNJOYcs @SunjoYcs]

"Rate limiting is implemented."

As a tester, I check:

• IP vs user limits
• Username enumeration
• Window behavior
• Load balancer impact
• 429 information leaks

Test for bypasses, not just functionality.

#AppSec #SecurityTesting #CyberSecurity #Auth

[SUNJOYcs @SunjoYcs]

@meenu_design Sometimes I get frustrated because of this....🤯

[SUNJOYcs @SunjoYcs]

Most OAuth bugs aren’t in OAuth — they’re in state handling.

Open 2 tabs.
Start OAuth in both.
Finish login in one.
Replay the callback from the other.

If it still works, you validated state presence, not ownership.

#OAuth #Auth #PKCE #CyberSecurity

[SUNJOYcs @SunjoYcs]

Supabase auth (pre-2.185.0) accepted oidc tokens from attacker-controlled issuers if the signature was valid.

CVE-2026-31813
Real test: do you verify the issuer matches the expected provider, or only that the jwt signature is valid?

Those are different checks.

[SUNJOYcs @SunjoYcs]

@Cristiano Back in color

[SUNJOYcs @SunjoYcs]

@emirates @Airbus What i love in emirates is that , if they start to provide something new feature we will get full satisfaction. Excellent execution. So cool i loved it...

[SUNJOYcs @SunjoYcs]

@EmiratesSupport Thanks

[SUNJOYcs @SunjoYcs]

@elonmusk It's not regarding the post.
I heard about Tesla entering to the Indian economy. I hope Tesla will step in India as a whole package including
Car, fast charging station , sloar panels, etc. Ur technologies are very cool.
Also don't forget the middle range people.

[SUNJOYcs @SunjoYcs]

@Cristiano Al freaken

[SUNJOYcs @SunjoYcs]

@TeslaNY @elonmusk Make it little more cheep

It's too high price

[SUNJOYcs @SunjoYcs]

@Cristiano You are cute when you are ferocious