Tank0

Security Researcher

[Tank0 @XTank0]

Stay Sharp
Dup. & info. is part of the journey 💪
@intigriti
#HackWithIntigriti
https://t.co/5gBulOY5hC

[Tank0 @XTank0]

@sin99xx Congrats man, is it ai product ?

[Tank0 @XTank0]

@_xeloxa @Hacker0x01 Always check the status of the report you got duplication for

Because sometimes you will find the report has been closed as N/A

Happened to me

[Tank0 @XTank0]

@omespino @GoogleVRP Congrats, is it ai product ?

[Tank0 @XTank0]

@JubaBaghdad How long they take to mark the report as a duplicate ?

Is it fast or take a month or so then deciding that this is a duplicate

[Tank0 @XTank0]

@_MrPlanB And how long did it takes from submitting till they told you it's a duplicate?

Because someone before had an accepted one for two month then they told him it's a dup.

So I'm asking if they also took a while with you before closing as a dup

[Tank0 @XTank0]

@_MrPlanB In ai product?

[Tank0 @XTank0]

@seragaboushady @Google Why not reporting to google vrp ?

[Tank0 @XTank0]

@nnwakelam Congratulations, is it Ai VRP ?

[Tank0 @XTank0]

@_MrPlanB Congrats, is it Ai VRP ?
And how long from submitting to acceptance

[Tank0 @XTank0]

@PhilippeDelteil @Hacker0x01 Guess what, this warning might be Ai generated

[Tank0 @XTank0]

@wearehackerone @foo125973 Change the platform simply
Choose one that appreciate your time and effort, which is not H1

[Tank0 @XTank0]

@X @Hacker0x01 Are users data lately considered as non vulnerabilities? @X

It's zero click data deletion

[Tank0 @XTank0]

@nnwakelam Congratulations, can you share the name of the vulnerability or which part of google vrp ?

[UCYBERS @UCybersX]

⚡️ هل تعلم أن bytes 15 فقط تفصلك عن اختراق والسيطرة الكاملة على سيرفر PHP؟

نعم! في عالم الـ BugBounty و Pentest عندما تواجه قيود على حجم المدخلات (Input Length Restriction) كل حرف يصنع فرق
إليك أقصر ثغرة RCE يمكنك حقنها: 👇

[Tank0 @XTank0]

@adilburaksen Is any of them on Ai VRP ?
I wanna ask about the average time from submission to bounty

[Tank0 @XTank0]

@or4nge16hehe @intigriti Did you try contact support?

[Tank0 @XTank0]

@ArjeSec Make sure it's not hallucination because gemini is very convincing to the point you think you are inside a real system having rce while in real world it's just hallucinations but in a very professional way

Curl for a webhook and see if it's gonna hit it or not

[Tank0 @XTank0]

@Behi_Sec @Rhynorater Nice one

[Behi @Behi_Sec]

A few months ago, I found a Prompt Injection vulnerability on Google Tasks.

It was simple, yet tricky.

Google rewarded me with a $15,000 bounty for it.

Here's the full story:

[Tank0 @XTank0]

@shaybt12 You could even use ffuf on a list of subdomains and check whether your server will be hit by any of it or not