Tobi Weißhaar

MSc Advanced Computer Science | Pentester | OSCP | OSWE | CRTO | CRTP| Bug Bounty Hunter #kaeferjaeger

[Tobi Weißhaar @_kun_19]

Got a $12,000 bounty on @Hacker0x01! https://t.co/Gogh73TvTd #TogetherWeHitHarder

My highest single bounty ever 🙂 And…it was a mobile bug 📱
Unfortunately can‘t share any details, but Android permissions used across multiple apps of the company can be an issue ;)

[Tobi Weißhaar @_kun_19]

@rootxharsh @HacktronAI What I observed is that CloudFront, Akamai, etc. are most of the time used and are blocking the suspicious payload

[pwn.ai @pwn_ai]

🚨 ZERODAY: ImageMagick 🚨

Our autonomous pentester https://t.co/zHUcIkHqvr just dropped multiple zeroday chains in ImageMagick that achieve RCE and File Leak from a single .jpg or .pdf file, bypassing EVERY security policy (Default, Limited, AND Secure). 🤯

💥 Affects Ubuntu, Debian, WordPress & millions of servers globally. Happy Monday and Happy Hunting! 🥰

https://t.co/nNAvFAvPOx

[Tobi Weißhaar @_kun_19]

Took a long break from bug bounty hunting but feels good to know muscle memory is still there 😅

Got a $800 bounty on @Hacker0x01! https://t.co/Gogh73TvTd #TogetherWeHitHarder

[Tobi Weißhaar @_kun_19]

Thrilled to announce the start of a new chapter @codewhitesec 🙂 Thank you for the welcome package 🙃

[Tobi Weißhaar @_kun_19]

..to exploit it in 2025 I recommend

https://t.co/38VqENznWi

[Tobi Weißhaar @_kun_19]

Yay, I was awarded a $900 bounty on @Hacker0x01! https://t.co/Gogh73U3IL #TogetherWeHitHarder #bugBounty

Cross-Site attacks become very rare with the latest browser security mechanisms but found a cross-site web socket hijacking vulnerability recently. If you want to know how..

[Tobi Weißhaar @_kun_19]

First experience with the @SamsungMobile Bug Bounty Program. Takes a looong time to get rewarded and the reward was not as expected…but anyways what stays is a CVE for Samsung (Browser App) 😅 Thanks @_m1tZ for the collab!#bugBounty #hacking

https://t.co/rnw5zchWyc

[Shopify Engineering @ShopifyEng]

🪲 Bug bounty disclosure: account vulnerability

Here's how @_kun_19 highlighted a security gap in Shopify Collabs 🧵

[Tobi Weißhaar @_kun_19]

...the configured redirect uri in the Facebook Dev Portal. On this way I showed how I'm able to steal the Oauth authorization code, which also allows me to log into the victim's account

[Tobi Weißhaar @_kun_19]

Got a $500 bounty on @Hacker0x01! https://t.co/Gogh73TvTd #TogetherWeHitHarder

Exploited an Intent Redirection in a mobile app. It's a kind of equivalent to an Open Redirect in web apps.
🧵

[Tobi Weißhaar @_kun_19]

...I created an own Facebook OAuth Client in Facebook's Developer Portal and started the activity with the appropriate OAuth config. The victim is now prompted to log in via Facebook and after doing that, the OAuth victim's authorization code is sent to my web server due to...

[Tobi Weißhaar @_kun_19]

@bogbounty @Hacker0x01 had the source code 🤷🏻‍♂️😄 So no real advice sorry😅

[Tobi Weißhaar @_kun_19]

Got a $6,000 bounty on @Hacker0x01!

Hmm…seems SQL injections are still a thing 🙃

https://t.co/Gogh73TvTd #TogetherWeHitHarder

[Tobi Weißhaar @_kun_19]

@AatankBadb16659 @Hacker0x01 I had the target‘s source code and just saw it in the code so it was no black box for me 😅

[publiclyDisclosed @disclosedh1]

Shopify disclosed a bug submitted by @_kun_19: https://t.co/5FuSXlZK3V - Bounty: $800 #hackerone #bugbounty

[Tobi Weißhaar @_kun_19]

One of my reports to @ShopifyEng was disclosed. ATO with some preconditions that must be met, but maybe interesting for you 😉 #BugBounty @Hacker0x01

https://t.co/TYatqQ7PxH

[Tobi Weißhaar @_kun_19]

And now it‘s weekend 😫