AminDD

☯️ Bug Hunter

[AminDD @_AminDD]

Again😎
I earned $2,500 for my submission on @bugcrowd #ItTakesACrowd

[AminDD @_AminDD]

@RavinAcademy @m7arm4n_ @MirsoltaniMahdi 🔥🔥

[AminDD @_AminDD]

@amirpayamani حاجی ایرانی کار نکن، اینا پول منم خوردن ۳ سال پیش

[AminDD @_AminDD]

@amirmahdi_irani 🔥

[AminDD @_AminDD]

@XsarrafX 🔥🔥

[AminDD @_AminDD]

@XsarrafX 🔥🔥

[AminDD @_AminDD]

@voorivex کار درست❤️

[AminDD @_AminDD]

@secoder_hunter 🍻

[AminDD @_AminDD]

@randomxvariable عزیزی🌹

[AminDD @_AminDD]

@bdasec_ عزیزی بهنام جان❤️

[AminDD @_AminDD]

@omranisecurity قربانت

[AminDD @_AminDD]

@XsarrafX تاج سری♥️

[AminDD @_AminDD]

@MirsoltaniMahdi قربونت♥️

[AminDD @_AminDD]

@_M0jtaba جیگرتو😘

[AminDD @_AminDD]

@Hossein_golzari ♥️

[AminDD @_AminDD]

@DFIRhero فدات

[AminDD @_AminDD]

@kingcoolvikas raft-large

[AminDD @_AminDD]

What would you do if you came across this page?
#bugbountytips #BugBounty #bugbountytip
My actions were as follows:
1. Google dork & Wayback -> URLs -> Find ApiKey (JS file)
2. FUZZ -> Another JS file was found (It included paths that could not be found with fuzz at all)

[AminDD @_AminDD]

I earned $3,000 for my submission on @bugcrowd #ItTakesACrowd

[AminDD @_AminDD]

3. Found (somethingLookup?apikey=&sessionId=null&emailAddress=)
4. I collected the emails of that company and I sent it with intruder.

[AminDD @_AminDD]

@fattselimi @Bugcrowd thanks bro👍

[AminDD @_AminDD]

I earned $3,000 for my submission on @bugcrowd #ItTakesACrowd

[AminDD @_AminDD]

@XsarrafX @Bugcrowd اوه اوه :)
۹ تیر ضیافت داریم پس