Geetansh Aditya

[Web Security Academy @WebSecAcademy]

Apps behind reverse proxies can't use the visiting IP address as a source of truth, because the actual request to the webserver comes through the proxy, not directly from the browser. To fix this, many reverse proxies add a HTTP header with the source IP as the value (typically X-Forwarded-For).

This can sometimes be spoofed by simply adding that HTTP header ourselves.

Follow along with this lab walkthrough here 👇

https://t.co/MgHTPdCQAv

[Web Security Academy @WebSecAcademy]

Password brute-forcing doesn't always need to happen on a login field! 🚨

In this lab walkthrough, we brute-force a password by abusing "change password" functionality.

Play along here 👇

https://t.co/AIb1ehWQYA

[Web Security Academy @WebSecAcademy]

🚨NEW LAB!

Exploiting an AI powered security scanner to perform destructive actions.

Watch the video walkthrough and follow along for here (free) 👇

https://t.co/jkZcMklzeg

[Web Security Academy @WebSecAcademy]

In this lab walkthrough, we exploit a blind OS command injection vulnerability to exfiltrate the output of a command via DNS! Pretty nifty!

Follow along here 👉 https://t.co/AjNlGav1DS

[Web Security Academy @WebSecAcademy]

On live targets, password reset flows are an *excellent* target. Any bug in the flow can result in a full account takeover and getting them right is surprisingly complex.

Walk with me through exploiting some broken logic in a password reset flow.

Follow along here: https://t.co/lMzyWlOn1V

[Web Security Academy @WebSecAcademy]

Full account takeover via 2FA bypass!

Follow along as we perform a 2FA bypass against Carlos' account.

Sign up and navigate here to access the free lab: https://t.co/aH1V9UQTlO

[Web Security Academy @WebSecAcademy]

When an application is vulnerable to SQL injection, attackers can leverage the UNION keyword to extract data from additional tables within the database.

What is UNION keyword used for?

UNION is used in SQL to combine the results of two or more SELECT queries into a single result set.

Here is how it works:

Example SQL Query:
`SELECT a, b FROM table1 UNION SELECT c, d FROM table2`

For the above query to work, the following needs to be true:

- Both queries return the same number of columns.
- The data types in each column are compatible.

Once true, both the tables will be output as a single result.

Find out how the UNION keyword can be used to figure out the number of columns and data type in a database!

Check out our SQL Injection course for more 👇

https://t.co/3L2wcurHzD

[Web Security Academy @WebSecAcademy]

Have you ever cracked a password? 🔑

In this lab we use an XSS to steal Carlos' password, which contains an encrypted password, and then we crack it to gain access to his account!

Follow along with me here: https://t.co/EkXXP2Q6ot

[bugcrowd @Bugcrowd]

Turn your Nmap scan into a clean report in seconds ⚡

1️⃣ Scan with XML output
2️⃣ Convert it to a readable report

Simple flow: 
nmap -> xml -> xsltproc -> html

Perfect for documenting recon during bug bounty hunts.

[ProjectDiscovery @pdiscoveryio]

AI code review has come a long way, but it can't catch everything.

We gave Neo MedPortal and asked it to find IDOR and authorization flaws.

Neo cloned it from GitHub, deployed it, and ran AI code review AND runtime testing parallel.

🟣 Identified IDORs and auth flaws  
🟣 Created test users to validate exploits  
🟣 Discovered 17 vulnerabilities (CVSS 5.4–8.1)  
🟣 Patient-to-Patient and Doctor-to-Doctor attack paths

With runtime testing, it iterates through the application, verifies each finding, and provides reproducible PoCs.

Finally, it prioritizes fixes and provides clear remediation.

Try Neo today 👇  
https://t.co/0mTmsRlHNJ

[ProjectDiscovery @pdiscoveryio]

Discover URLs passively from multiple sources with urlfinder 🌀

Urlfinder quietly maps web assets without ever touching the target!

[ProjectDiscovery @pdiscoveryio]

Watch Neo test an application and uncover critical access control flaws with perfect accuracy.

It found that a policyholder could approve their own claim and set arbitrary payout amounts by bypassing role checks. 

Try Neo today 👇  
https://t.co/TshfnAi43Q

[Geetansh Aditya @AlphaXAstrum]

@Bugcrowd B can stop Path Traversal, but isn't safe as we can access any file from uploads. So all of them are bypassable in a way. But path traversal, then yes B can stop it.

[bugcrowd @Bugcrowd]

What’s going on here? 

Spot the bug. 🐞

[bugcrowd @Bugcrowd]

Production is hardened, but staging often isn’t.

Use this one-liner to discover dev and staging environments.

[HackingHub @hackinghub_io]

Your FFUF command isn’t returning anything useful, is it?

The problem usually isn’t the wordlist. You’re likely getting filtered or rate-limited.

Slow it down, control your rate, use realistic headers like a browser, and filter the noise so real endpoints stand out.

Try now 👇

[Web Security Academy @WebSecAcademy]

Want to try out a simple 2FA bypass with me?

Follow along here 👉 https://t.co/GMwnKdyQo1

[Geetansh Aditya @AlphaXAstrum]

@ritu_twts I mean VS code in itself isn't an IDE either, it needs the right extensions. And if that's the case then Neovim can't be beaten, its better if you know how to use it.

[Geetansh Aditya @AlphaXAstrum]

@Dussyme 15

[bugcrowd @Bugcrowd]

This one is common in SPAs.

Did you SPOT it already?👀

👇