Got a $12,000 bounty on @Hacker0x01! https://t.co/Gogh73TvTd #TogetherWeHitHarder
My highest single bounty ever 🙂 And…it was a mobile bug 📱
Unfortunately can‘t share any details, but Android permissions used across multiple apps of the company can be an issue ;)
🚨 ZERODAY: ImageMagick 🚨
Our autonomous pentester https://t.co/zHUcIkHqvr just dropped multiple zeroday chains in ImageMagick that achieve RCE and File Leak from a single .jpg or .pdf file, bypassing EVERY security policy (Default, Limited, AND Secure). 🤯
💥 Affects Ubuntu, Debian, WordPress & millions of servers globally. Happy Monday and Happy Hunting! 🥰
https://t.co/nNAvFAvPOx
Took a long break from bug bounty hunting but feels good to know muscle memory is still there 😅
Got a $800 bounty on @Hacker0x01! https://t.co/Gogh73TvTd #TogetherWeHitHarder
Yay, I was awarded a $900 bounty on @Hacker0x01! https://t.co/Gogh73U3IL #TogetherWeHitHarder#bugBounty
Cross-Site attacks become very rare with the latest browser security mechanisms but found a cross-site web socket hijacking vulnerability recently. If you want to know how..
First experience with the @SamsungMobile Bug Bounty Program. Takes a looong time to get rewarded and the reward was not as expected…but anyways what stays is a CVE for Samsung (Browser App) 😅 Thanks @_m1tZ for the collab!#bugBounty#hacking
https://t.co/rnw5zchWyc
...the configured redirect uri in the Facebook Dev Portal. On this way I showed how I'm able to steal the Oauth authorization code, which also allows me to log into the victim's account
Got a $500 bounty on @Hacker0x01! https://t.co/Gogh73TvTd #TogetherWeHitHarder
Exploited an Intent Redirection in a mobile app. It's a kind of equivalent to an Open Redirect in web apps.
🧵
...I created an own Facebook OAuth Client in Facebook's Developer Portal and started the activity with the appropriate OAuth config. The victim is now prompted to log in via Facebook and after doing that, the OAuth victim's authorization code is sent to my web server due to...
One of my reports to @ShopifyEng was disclosed. ATO with some preconditions that must be met, but maybe interesting for you 😉 #BugBounty@Hacker0x01
https://t.co/TYatqQ7PxH