jarom

Bug bounty hunter | Software engineer in security | Building & breaking with automation + AI | DEFCON fan | Sharing tips & weird bugs

[jarom @_jarom_]

@0xLupin @Rhynorater @NahamSec npm install

[jarom @_jarom_]

This definitely made my day. Thanks @YesWeHack.

[jarom @_jarom_]

Just completed a CTF challenge in #TheUltimateCloudSecurityChampionship by @Wiz_io 🥊 Put your cloud security skills to the test in this monthly series and join the competition https://t.co/GvCpN0CTQL

[jarom @_jarom_]

@ArchAngelDDay @Hacker0x01 Wow, killing it! 🔥

[jarom @_jarom_]

Had a fun time with the Google Security team yesterday, got to see a lot of innovative things they are doing to keep users safe.

Definitely want to look into scalibr when I get back home .

Excited to see what #defcon33 has to offer today!

[jarom @_jarom_]

If you’re going to DEFCON this year, would love to meet up and connect, I’ll be spending time at the @BugBountyDEFCON village. Come say hi!

[jarom @_jarom_]

@albinowax Half way to buying this Tesla https://t.co/fwyOoc6pFq

[jarom @_jarom_]

@jobertabma @NahamSec @stokfredrik @Hacker0x01 jarom

[jarom @_jarom_]

Don't always have time to hack and the reports don't always turn out in my favor, but it's fun when they do!

Just got a reward for a critical vulnerability submitted on @yeswehack -- Insecure Storage of Sensitive Information (CWE-922). #YesWeRHackers

[jarom @_jarom_]

@Rhynorater Thanks for the reminder, doing it now!

[jarom @_jarom_]

@HackingDave Looks good man!

[jarom @_jarom_]

@dagrz Aww yes, I remember running into this. It was every tens of thousands of requests though, they must have tightened down 😃

[jarom @_jarom_]

@HackingDave Awesome man, looks great! I was half expecting to see a stash of airsoft equipment in there as it was opening.

[jarom @_jarom_]

@rez0__ Wait, what did I just listen to? All AI generated based off of a write up?! That’s really impressive!

[jarom @_jarom_]

Just got a reward for a vulnerability submitted on @yeswehack -- Unrestricted Upload of File with Dangerous Type (CWE-434). #YesWeRHackers

[jarom @_jarom_]

I recently had the opportunity to speak @fwdcloudsec in Arlington, VA alongside some amazing people. My talk leveraged research published by Sam Cox and Ben Bridts that allows anyone to discover the AWS account ID of any S3 bucket. I go into detail of what I did (and any attacker could do 😉) with this information.

I've even been able to send in a few #BugBounty reports with some of the data I've collected.

https://t.co/lSFyug7bbE

[jarom @_jarom_]

@ArchAngelDDay You’ve got this, let’s go!! 🔥

[jarom @_jarom_]

@ArchAngelDDay @Hacker0x01 @CapitalOne Congrats man!

[jarom @_jarom_]

@naglinagli @hacker_ @m0chan98 @Hacker0x01 @CapitalOne Great job to all involved! Very impressive work!

[jarom @_jarom_]

@stealthybugs @Hacker0x01 Congrats, well deserved!