Surya S

Team Lead @ NST Cyber

[Joseph Thacker @rez0__]

The hackbot @xssdoctor and I made has found 126 reportable bugs this year 😊 88 were High or Critical!! :)

Check it out: https://t.co/V15zqqx8XR

[0xrudra @0xrudrapratap]

The best hackers I know aren't smarter than me.

They've just read more than me. Somewhere in their memory is the one obscure writeup that turns a dead end into a finding. Preview is that memory, on tap. For you, and for your agent.

-> https://t.co/JQKjIQGWFA

[Ibrahim Elkamali 🇺🇦 @IbrahimElkamali]

New Claude code update is crazy

[Surya S @Surya_Appsec]

@RootxRavi @Bugcrowd Congratulations 🎉

[zhero; @zhero___]

happy to release my new article entitled:

Next.js and cache poisoning: a quest for the black hole

https://t.co/v7aqiYJjyX

good reading;

[RSECloud @Rsecloud]

Discover subdomains and assets across global IPv4 with our advanced search capabilities. As an alternative to #Shodan, our tool offers comprehensive asset discovery features.
Sign up now at https://t.co/090Bf8xhFc and get 2 months of the Starter Plan for free!

[Surya S @Surya_Appsec]

@the_codewala Hi

[Tur.js @Tur24Tur]

I've just developed my first @Burp_Suite Bambdas specifically to identify OWASP Top-25 Parameters potentially vulnerable to XSS, SSRF, RCE, SQLi, LFI, and Open Redirect. For easy code access, visit GitHub:
https://t.co/fCScaTPJ1I

#Bambdas #Java

[Surya S @Surya_Appsec]

@_CryptoCat @PortSwigger Congratulations 🎉

[Surya S @Surya_Appsec]

@imThomasMorales @Wisdom_HQ sop

[Surya S @Surya_Appsec]

@RootxRavi @ReebootToInit5 @errorrsec @bug_vs_me @krishnsec 😅

[Surya S @Surya_Appsec]

@pdiscoveryio @DhiyaneshDK @pdnuclei Congratulations @DhiyaneshDK 🎉🥳

[Hussein Daher @HusseiN98D]

Successfully bypassed a SSRF WAF by using a combination of IPV6 + Unicode. Payload for Metadata instances:
http://[::ⓕⓕⓕⓕ:①⑥⑨。②⑤④。⑯⑨。②⑤④]:80
Check images for response difference between 169.254.169.254 and the above payload I shared 🔥

#bugbounty #infosec #waf

[Surya S @Surya_Appsec]

@mayank98108 @shaybt12 https://t.co/kBtVbDWsCO

[Surya S @Surya_Appsec]

@DarkTamil6 @shaybt12 https://t.co/JkAs97GId5

[hatice @herturk_]

I have developed a small @Burp_Suite extension that allows you to copy HTTP requests without including cookies or tokens. I hope it will help you.

Enjoy! 🧡

https://t.co/STawYMxbNZ

[bugcrowd @Bugcrowd]

Breaking into bug bounty?💻 Skip the cash chase!

Focus on skills, rep, and non-paying programs first. Unpopular advice (we know), but crucial if you want to smash bugs in those bigger programs. 💡 Don't miss @TechAlissa's sly tips in @SearchSecurity: https://t.co/lUWxepGKXS

[Surya S @Surya_Appsec]

@krishnsec @Bugcrowd Congratulations 👏

[Omid Rezaei @omidxrz]

Find Origin IP.
1. subdomain enumeration.
2. Save All A records in IPs.txt.
3. Remove CDN IP.
4. Fuzz Host Header on IPs.txt with list of all subdomains.
for ip in $(cat ip.txt);do echo $ip && ffuf -w ./subdomains.txt -u http://$ip -H "Host: FUZZ" -s -mc 200; done

[Surya S @Surya_Appsec]

@krishnsec 7282