Amit

websec enthusiast

[publiclyDisclosed @disclosedh1]

Pornhub disclosed a bug submitted by @avr4mit: https://t.co/klGV6xcOU9 - Bounty: $750 #hackerone #bugbounty

[Amit @avr4mit]

@WHITEHACKSEC @codecancare @samwcyo @bbuerhaus Thanks!

[Amit @avr4mit]

I swear it was just for research purposes

[publiclyDisclosed @disclosedh1]

Pornhub disclosed a bug submitted by @avr4mit: https://t.co/flo5Sg0y66 - Bounty: $250 #hackerone #bugbounty

[Amit @avr4mit]

@0xhuesca @JacksonHHax I can guess that the injection point is an iframe's attribute which in this case means that the rest of the payload is considered as a child of the iframe tag (unless you close it beforehand). The standard defines that childs of an iframe treated as text.
https://t.co/ZeJR97KzKv

[Amit @avr4mit]

@intigriti Solved it once again, cool challenge, I managed to bypass the anti CSRF protection pretty quick and was stuck on the XSS part.

[Amit @avr4mit]

@intigriti I guess I'm gonna win

[Amit @avr4mit]

@intigriti @holme_sec Solved it

[Amit @avr4mit]

I got my first CVE✨CVE-2021-24073✨

Thanks for @aussinfosec for making it possible.

[Amit @avr4mit]

@intigriti @TomNomNom @laytonctf @NRockhouse Ayy, thanks!

[Amit @avr4mit]

@Nearcyan @AydaoAI @gwern @arfafax @theshawwn Hi, please check your DMs

[Amit @avr4mit]

@intigriti Found another solution and now I'm sure it is the intended one, this challenge is awesome!

[Amit @avr4mit]

@intigriti Cool challenge, I solved it the unintended way but it was still pretty fun 💥

[Amit @avr4mit]

@intigriti My solution for the challenge: https://t.co/rwmx9AfK5s

[Amit @avr4mit]

@intigriti Great challenge, I was able to solve it without any user interaction.

[Amit @avr4mit]

@RenwaX23 Amazing, thanks for participating. KiPosts & TextBin were mine I hope you liked them (-;

[Amit @avr4mit]

@GuesserSuper Congrats guys, you were amazing!

[Amit @avr4mit]

Just a little reminder, the CTF is up and running✨

[KipodAfterFree @KipodAfterFree]

Have you ever...
- Found vulns in a JIT engine?
- Exploited a C2 server?
- Exploited client-side vulnerabilities?

Join us in https://t.co/4VyYhUQmpm at 17:00 UTC! 🦔🚩

[Amit @avr4mit]

@M69636861656c I'm glad you liked my challenge, I will DM you regards to the source code of it

[Amit @avr4mit]

Great write-up💥

[CmdEngineer @CmdEngineer_]

Check out my writeup for SomeVideos (by @avr4mit) in the latest AppSec-IL CTF (@OWASP_IL)
The challenge was very fun, creative and cool!
It involved some really cool websec tricks that I love!

https://t.co/X6ygIEOHcO

[Amit @avr4mit]

@disclosedh1 woah ! that's me 💁‍♂️