bergee

Webdev, bug hunter

[bergee @_bergee_]

@brutecat Congrats. I bet it took you a long long time to first understand how things work and map attack surface before start any hacking.

[bergee @_bergee_]

https://t.co/wvLAgi3pku

Who can defeat Gandalf? 🧙🏻‍♂️

#ai #hacking

[bergee @_bergee_]

Some books worth reading, doing bug bounty:
https://t.co/irdFgrY8yU

https://t.co/ZlB2xDTDls - "Bug Bounty Bootcamp"
https://t.co/9TbwY6Jmv8 - "Real-World Bug Hunting"
https://t.co/QuC38MpMkk - "Hacking APIs"
https://t.co/QuC38MpMkk - Black Hat GraphQL

#BugBounty

[bergee @_bergee_]

@xandsz__ @intigriti Cool that I could help

[bergee @_bergee_]

@chmodx1sh @SynackRedTeam Good job. Like that you talking about the time spent. Not an illusion of the easy win 💪🏻

[bergee @_bergee_]

@intigriti In fact I need one cert - burp cert installed ;)

[bergee @_bergee_]

I've just order this beer in Pisa/Italy ;) #bugbounty #beer

[bergee @_bergee_]

@saur1n Thanks a lot

[bergee @_bergee_]

I do recommend reading this blog. Good stuff.

https://t.co/WgrdI3O7vt

#BugBounty

[bergee @_bergee_]

@getnow1986 It is not zipslip

[bergee @_bergee_]

Two criticals I found inside one zip uplaod functionality. Have a nice read and Merry Xmas

https://t.co/oDIoPoYJwQ

#bugbounty #bugbountytips

[bergee @_bergee_]

My first CVE. Insecure deserialization and PHP objects injection in WP "Doubly" plugin. Thanks @wordfence . #cve

[bergee @_bergee_]

Today, thanks to @NahamSec I bought pretty solid VPS at @Hostinger for 2 years. It is Black Week deal so for $4,79 per month you got parameters as in the screenshot. I need it for bug bounty and hosting so if you need one here it is: https://t.co/ii9rgxuT0f

#BugBounty #deal

[bergee @_bergee_]

Dear bughunters. Have you ever heard about self-RCE? I did. I found RCE via command injection and the company said that it is self-RCE as the filesystem is isolated with some chroot and this RCE affects only the user's files. What do you think?

#BugBounty #bugbountytips

[bergee @_bergee_]

https://t.co/mc8vSkjZSL

The new write-up on credentials theft with XSS and Google Analytics.

#bugbountytips #BugBounty #bugbountytip

[Sekurak @Sekurak]

Wbijaj na konferencję największej społeczności ITsec w Polsce!

✅ 4 ścieżki / ~40 praktycznych prezentacji, wiedza absolutnie z pierwszej ręki i bez ściemy
✅ Pokazy hackowania na żywo
✅ Jakość i niepowtarzalny klimat gwarantuje Sekurak
✅ 20 października w Krakowie:

https://t.co/cMSl43jnhn

[bergee @_bergee_]

How to read the files on server with zip files. The short story of zip symlink attack:

https://t.co/XiEiUJrr4z

Have a nice reading

#bugbounty #bugbountytip #bugbountytips

[bergee @_bergee_]

I found the crit on self-hosted program. Reading files on filesystem with unzipping the symlinks. Writeup soon.

#bugbountytips #bugbounty #bugbountytip

[bergee @_bergee_]

How to get paid for subdomain takeover without taking over the domain... :)

https://t.co/mZFgy2V2eb

#BugBounty #bugbountytips