Manik Koirala

Bug Bounty Hunter and Penetration Tester

[Yunus Aydın @aydinnyunuss]

Found broken access control and SSRF vulnerabilities in Odysseus (@pewdiepie's self-hosted AI workspace).

Vulnerabilities have been fixed. Full write-up coming to the blog soon.

https://t.co/sRjG3SQ8sE

https://t.co/AqP1mazfXP

#security
#websecurity
#appsec
#bugbounty

[publiclyDisclosed @disclosedh1]

LY Corporation disclosed a bug submitted by imnotr3al: https://t.co/WtyU3F1yqs - Bounty: $1,000 #hackerone #bugbounty

[Suresh Aydi (xploiterr) @_xploiterr]

From Blocked to Bypassed: A Reflected XSS Journey with accesskey Trick.

#bugbounty

https://t.co/ZeDXbdjM1u

[cTino @tinopreter]

$2000 for a web cache deception bug. As always I share my methodology 👇

Identifying a deception bug is always easy but exploiting it can be hard due to SameSite restrictions on victims cookie

I bypassed this to steal victim JWT. Read about it here:

🔗 https://t.co/CAxfKAC0eP

[Preben @prebenve]

Found a cool bug at Meta.

From misconfigured Grafana instance to R/W access on 507 private Meta repositories.

Wrote up the full chain here:
https://t.co/LYQ0prc68d

$157k bounty awarded by @metabugbounty

[Suresh Aydi (xploiterr) @_xploiterr]

24 Characters to Super Admin.

#bugbounty

https://t.co/5xsGBSuoS4

[Suresh Aydi (xploiterr) @_xploiterr]

Deleting any user’s account from the platform via exposed /admin/manage-user

#BugBounty

https://t.co/dwBFbZVHDw

[Yunus Aydın @aydinnyunuss]

I built a pipeline to find security fixes that never got CVE numbers.

Results: 258 alerts, 62 legitimate fixes.

Full breakdown on the blog
https://t.co/uQh5Z5USyy

#security #websecurity #appsec #cve #bugbounty

[Suresh Aydi (xploiterr) @_xploiterr]

A Simple Edit That Paid $800: Tampering Developer Application Information #bugbounty
https://t.co/8cEzcT7RhJ

[Yasho @YShahinzadeh]

I created a challenge based on one of my Google bugs worth $12,000. It is an OAuth misconf. I will drop a writeup for it soon, before that, give it a try & practice, it doesn't matter if u r capable of solving it or not, just click and start poking 🙂

https://t.co/lAW53dVyk5

[payloadartist @payloadartist]

Do you watch Netflix in your free time?

Try hackflix for security conference talks

https://t.co/SVbkWApdoe

#cybersecurity #bugbounty

[Dhanian 🗯️ @e_opore]

AWS PROJECT IDEAS TO BUILD IN THE MODERN ERA

FOUNDATIONS: CORE AWS SKILLS

→ Build a static website using S3 + CloudFront
→ Deploy a scalable web application on EC2
→ Set up a VPC with public and private subnets
→ Configure IAM roles and security policies
→ Create an automated EC2 backup system
→ Build a server monitoring system with CloudWatch
→ Implement Route 53 DNS management
→ Create an Auto Scaling architecture
→ Build a secure bastion host setup
→ Deploy a containerized app using ECS

SERVERLESS & EVENT-DRIVEN APPLICATIONS

→ Build a serverless REST API using Lambda + API Gateway
→ Create a real-time notification system with SNS
→ Develop an event-driven image processing system
→ Build a serverless chat application
→ Create a Lambda-powered automation workflow
→ Develop a serverless file upload pipeline
→ Build a background job queue with SQS
→ Create a serverless authentication service
→ Develop a Step Functions workflow engine
→ Build a serverless email automation system

DATABASE & STORAGE PROJECTS

→ Build a scalable NoSQL app using DynamoDB
→ Create a relational database architecture with RDS
→ Develop a distributed caching system using ElastiCache
→ Build a backup and disaster recovery solution
→ Create a data archiving system with Glacier
→ Develop a multi-region database replication setup
→ Build a search engine using OpenSearch
→ Create a data synchronization pipeline
→ Develop a secure file storage system with S3
→ Build a time-series analytics database

DEVOPS, CI/CD & INFRASTRUCTURE

→ Build a CI/CD pipeline using CodePipeline
→ Deploy infrastructure using Terraform on AWS
→ Create a Kubernetes cluster using EKS
→ Develop a Dockerized microservices architecture
→ Build a centralized logging system
→ Create a monitoring dashboard with CloudWatch + Grafana
→ Develop blue-green deployment pipelines
→ Build a secrets management system with Secrets Manager
→ Create an infrastructure automation toolkit
→ Develop a multi-environment deployment strategy

BIG DATA, ANALYTICS & AI

→ Build a real-time analytics dashboard using Kinesis
→ Create a data lake architecture using S3 + Athena
→ Develop a machine learning pipeline with SageMaker
→ Build an ETL pipeline using AWS Glue
→ Create a recommendation engine on AWS
→ Develop an AI-powered chatbot using Bedrock
→ Build a semantic search engine
→ Create a fraud detection analytics system
→ Develop a real-time log processing system
→ Build an AI document processing workflow

SECURITY & HIGH-AVAILABILITY SYSTEMS

→ Build a WAF-protected web application
→ Create a DDoS protection architecture
→ Develop a secure API Gateway architecture
→ Build a zero-trust AWS infrastructure
→ Create a multi-region failover system
→ Develop a disaster recovery architecture
→ Build a compliance monitoring system
→ Create a centralized security logging platform
→ Develop an encrypted secrets storage system
→ Build a highly available multi-AZ application

PRODUCT-LEVEL AWS SYSTEMS

→ Build a scalable SaaS platform on AWS
→ Create a video streaming backend architecture
→ Develop an e-commerce infrastructure system
→ Build a fintech transaction processing platform
→ Create a social media backend on AWS
→ Develop a ride-sharing backend infrastructure
→ Build a real-time collaboration platform
→ Create a scalable gaming backend
→ Develop a large-scale IoT platform
→ Build an AI-powered enterprise application

To master AWS by building scalable, production-grade cloud systems, get the complete handbook here:

https://t.co/nlLqzIQfE0

[Suresh Aydi (xploiterr) @_xploiterr]

Bypass for the earlier reported issue leading to Organization Takeover via IDOR ($3,700)
#BugBounty
https://t.co/aGKpK0DyR8

[the_IDORminator @the_IDORminator]

#BugBounty Step 1: "Find the things"

So you open a brief, and https://t.co/lMGtLFrLgw is in scope. What is your first move?

A]
For me, I find every domain/subdomain I can affiliated with https://t.co/lMGtLFrLgw. I dump them all, from numerous sources, and de-duplicate. Create your own process here.

B]
Now I blast all unique domains for https://t.co/lMGtLFrLgw on common web ports to see which are readily internet facing (80,443,8080,8443,etc.). This is lazy but catches 99% of them. If it responds, regardless of response code, its alive. If you feel like overachieving, scan more ports.

C]
Now I create a list of unique "responsive domains". I run each of these through <insert favorite tools here> to find links and save a unique file for each domain containing links, way back info, indexed search engine URI's, etc. This step generally contains money by itself.

D]
Use your brain and start exploring the data (links, sites, paths) manually to see what looks interesting or vulnerable, while recording everything in Burp to start collecting JS files and paths. Clicking things really isn't hard, so maybe don't skip this step. Though I appreciate it when everyone does.

E]
For best ROI (at least on new targets), start with domains with the most data/indexed links as it keeps the fuzzing/guest work to a minimum. For older mature targets, perhaps start with those where the site responded but zero history or search engine data comes back. These may have been mostly untouched, but you will have to figure out what lives there. Sometimes visiting other sites uncovers these paths in JS.

... now the fun begins. OK BYE 😆

[Lupin @0xLupin]

We just released a new article on how we made more than 50,000$ in #BugBounty by doing a really cool Software Supply Chain Attack🔥

🔗 https://t.co/wDYdgWYbut

[Yasho @YShahinzadeh]

I just dropped a new blog post, happy hacking :)

https://t.co/I9qh8cpNe9

[Suresh Aydi (xploiterr) @_xploiterr]

Organization Takeover via IDOR ($3,700)
https://t.co/tdKBNJRDbm
#BugBounty

[TrendAI Zero Day Initiative @thezdi]

Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin

[Tech Fusionist @techyoutbe]

Learn Kubernetes from Scratch - Visually 🔥🔥

[s1r1us (mohan) @S1r1u5_]

when react2shell hit last year, i think vercel handled it brilliantly.

to protect their users, they paid $50,000 for every bypass researchers could find. we decided to participate, and ended up earning $170,000.

read how we did it here: https://t.co/2dM6Mf9PHU