_tas

CS Student. Aspiring Bug bounty hunter. Aotearoa, NZ. 🇼🇸 🇳🇿

[Justin Gardner @Rhynorater]

Becoming a pro in finding client-side bugs is simple. Not easy, but simple.

1. Go through a JS tutorial and understand the basics.
2. Ready everything on this blog 8x until you understand it: https://t.co/OxfS2YJmbr
3. Read JS for Hackers by @garethheyes 4x

Then go hack stuff

[_tas @_tas]

@NahamSec 🎅

[Ben Sadeghipour @NahamSec]

🎯With the holidays coming up, I'm going to host a week of giveaways starting with my Hands-On Web Hacking course which includes:

✅ 100+ lessons
✅ 15+ hours of video content
✅ Dedicated community

👉🏼https://t.co/yZGD6JgBO3

🎁To enter: retweet and reply with a 🎅🏼

[Hack The Box @hackthebox_eu]

Ready to shell-abrate? 🥳
Because this #MSF Console commands cheat sheet is worth cheering for! Check our full step-by-step guide to the #Metasploit Framework on our blog: https://t.co/U6gicoriVq

#HackTheBox #HTB #Cybersecurity #InformationSecurity #Pentesting #Exploit

[🇷🇴 cristi @CristiVlad25]

Always free VPS with 24GB RAM by Oracle Cloud. Look it up ;)

[Intigriti @intigriti]

Do you want to master authentication bypasses? 🤑

Open this thread! 🧵👇

[_tas @_tas]

@vxunderground Happy Christmas folks, thanks for the work you continue to do 🙌🏽

[_tas @_tas]

@vxunderground @AlteredSecurity Ooooh this would be great!

[Intigriti @intigriti]

Hidden parameters are where you can often find SQLi, XSS & IDOR vulnerabilities for example! 🤑

Arjun is an open-source tool that can help you bruteforce and uncover hidden parameters on endpoints! It's easy to use and supports multiple body/content types & request methods! 😎

Check it out on Github!👇
https://t.co/mEzZNnLBo6

[_tas @_tas]

@vxunderground @TorGuard 👋🤞🏽

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

How to earn $100k in your first year of bug bounty hunting!

In a recent tweet, @Rhynorater outlined his roadmap for hitting $100k in his first year of bug bounty hunting (if he had to start from scratch).

Here's what he'd do:

[_tas @_tas]

@vxunderground @cyberwarfarelab Putting my entry in 🙌🏽

[Bug Bounty Reports Explained @gregxsunday]

OAuth #5 - OAuth recon

#BBRENewsletter85

[Jeffrey Scholz @Jeyffre]

A quantum computer, instead of using bits, uses a qbit.

A qbit is a two-dimensional vector of real numbers. This means one qbit can hold "infinitely" more information than a single regular bit.

A bit can only hold 0 or 1, but a qbit can hold a 2d vector of real numbers, so it is much more expressive.

[Gareth Heyes \u2028 @garethheyes]

The Shazzer unicode table now contains info about HTML entities including the named, decimal and hex entities a code point supports! Thanks to @myfonj for the suggestion

https://t.co/pVBOYgm7Pm

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

I have an endpoint, /api/users/<id>, which retrieves user data . when I use * as ID, like `/api/users/*`, it takes 60 seconds and returns a Timeout .
I think this request is trying to retrieve data for all users, but due to the large volume of data, the response is timing out.

[_tas @_tas]

@intigriti Patience

[Intigriti @intigriti]

Few tips on bypassing 401/403s 👇

What else can you add? 🧐

[bugcrowd @Bugcrowd]

Wise words from the man himself, @Jhaddix 🪲👇

[nolen @itseieio]

how do you all remember every UUID? I find it really hard. so I wrote them all down on every uuid dot com

the list has fast search across all 2^122 values (so you can find your favorites) - hoping to add some social features like "trending UUIDs" soon!