BALA

[NullSecurityX @NullSecurityX]

Delete highlight cover IDOR bug in Instagram
$3000 Bug Bounty PoC

Write-up:

https://t.co/27HLldM3wl

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

Super nice write ….

[OFFA @0xOFFA]

@zomasec @GodfatherOrwa جزاكم الله خيرًا. أنا كنت لخصت أغلب فيديوهات Orwa في صفحة Notion وساعدتني كتير وأنا بتعلم Recon، وحابب أشاركها لعلها تفيد أي حد بيبدأ. بس الرابط مش راضي يتحط في التعليقات على اليوتيوب، فلو حضرتك ممكن تضيفه في تعليق مثبت عندك هتفيد الناس
https://t.co/4cH5DGX3s9

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

😍😍😍
super fast for getting subdomains ....
highly recommended, and for sure it can be used as free

[NullSecurityX @NullSecurityX]

New video is live.
Shopify Account Takeover via Email Verification Bypass $22,500 Bug Bounty PoC.

This wasn’t about injection or RCE.
It was a pure business logic flaw in the email verification flow that led to ATO.
🎥 https://t.co/IVBxmM2F9M

#BugBounty #CyberSecurity

[Zhenwarx @zhenwarx]

Blind XSS to Admin Panel Access - $6500

https://t.co/YGSDIMOJqy

[Aditya @ADITYASHENDE17]

Recon Smarter: Finding Sensitive Files in Large URL Lists
Most bug hunters stop at URLs.
Real impact comes from what those URLs expose.
This workflow combines:
• high-risk file extensions
• real-world secret patterns
• automated URL discovery
Result → fewer URLs, higher signal, better findings.

Step 1: Asset discovery
subfinder -d https://t.co/L5yl0Td0lI | httpx -mc 200,401,403,404 | tee domains.txt

Step 2 URL extraction
cat domains.txt | katana | tee urls.txt

Step 3: Smart grep (FILES + SECRETS)
We combine:
• Sensitive file extensions
• High-signal secret regex

cat urls.txt | grep -aiE "\.(zip|rar|tar|gz|config|log|bak|backup|java|old|xlsx|json|pdf|doc|docx|pptx|csv|htaccess|7z)$|(?i)(?:(?:access_key|access_token|admin_pass|admin_user|algolia_admin_key|algolia_api_key|alias_pass|alicloud_access_key|amazon_secret_access_key|amazonaws|ansible_vault_password|aos_key|api_key|api_key_secret|api_key_sid|api_secret|api.googlemaps AIza|apidocs|apikey|apiSecret|app_debug|app_id|app_key|app_log_level|app_secret|appkey|appkeysecret|application_key|appsecret|appspot|auth_token|authorizationToken|authsecret|aws_access|aws_access_key_id|aws_bucket|aws_key|aws_secret|aws_secret_key|aws_token|AWSSecretKey|b2_app_key|bashrc password|bintray_apikey|bintray_gpg_password|bintray_key|bintraykey|bluemix_api_key|bluemix_pass|browserstack_access_key|bucket_password|bucketeer_aws_access_key_id|bucketeer_aws_secret_access_key|built_branch_deploy_key|bx_password|cache_driver|cache_s3_secret_key|cattle_access_key|cattle_secret_key|certificate_password|ci_deploy_password|client_secret|client_zpk_secret_key|clojars_password|cloud_api_key|cloud_watch_aws_access_key|cloudant_password|cloudflare_api_key|cloudflare_auth_key|cloudinary_api_secret|cloudinary_name|codecov_token|config|conn.login|connectionstring|consumer_key|consumer_secret|credentials|cypress_record_key|database_password|database_schema_test|datadog_api_key|datadog_app_key|db_password|db_server|db_username|dbpasswd|dbpassword|dbuser|deploy_password|digitalocean_ssh_key_body|digitalocean_ssh_key_ids|docker_hub_password|docker_key|docker_pass|docker_passwd|docker_password|dockerhub_password|dockerhubpassword|dot-files|dotfiles|droplet_travis_password|dynamoaccesskeyid|dynamosecretaccesskey|elastica_host|elastica_port|elasticsearch_password|encryption_key|encryption_password|env.heroku_api_key|env.sonatype_password|eureka.awssecretkey)[a-z0-9_.,-]{0,25})[:<>=|]{1,2}.{0,5}['\"]([0-9A-Za-z\-_=]{8,64})['\"]"

#bugbounty
#recon
#infosec
#cybersecurity
#pentesting
#websecurity
#hacking

[Koupon @Shabosec]

Power of Yandex Dorking 🚀🚀🚀🚀

Tips- use Google Dorking Context into Yandex Search Query
Example: Site:https://t.co/DSqIYQGA6l ext:pdf,aspx,csv and Search 🔍

Don’t forget to Leverage it

Big shout out @Olamdeen @4osp3l @GodfatherOrwa @fattselimi @badcrack3r

[Ahmed Abdel Rasoul🦅 @0xbartita]

Tip:
Always report Android bugs, even if you think they'll be closed as P5. You might be surprised $$$
#androidsecurity #bugbountytip #bugbountytips
#mobilesecurity

[Nagli @galnagli]

Introducing my Bug Bounty Masterclass. 100% free.

I've made $2,000,000+ finding security bugs. I spent the last year turning my methodology into a complete blueprint.

4 hours of video - foundations, reconnaissance, web proxies, hands-on challenges, and certification.

Finish it in a weekend and start hacking real-world applications 🐞

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

@Athul_m_s @Osaqii Try

/umbraco.zip
/umbracoFUZZ.zip

[Kirill Firsov @k_firsov]

Our latest research is out!

If you missed a good write-up for nice vulnerabilities, I brought you one!

Enjoy the reading! @FearsOff @Cloudflare

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

A bug that worth $200,000
Well done @Ehsan1579

[André Baptista @0xacb]

Have you ever tried to find JSON Web Token (JWT) bugs?

5 ideas to try 👇

> Change alg to "none" and strip the signature but keep the trailing dot
> “jwt_tool <JWT> --crack -d <wordlist>”  to crack weak secret keys
> Change alg from "RS256" to "HS256", then sign with the server public key
> Kid manipulation: try path traversal like "kid": "../../dev/null"
> Reuse JWTs between environments (staging vs prod). The same secret may be used and you may be able to takeover production accounts 💥

[the_IDORminator @the_IDORminator]

DoS bugs in graphQL are fun!

When you run into a GQL (graph query language) instance when testing, check for DoS (denial of service) if it is in scope for the program. It is very common for developers to create a structure that can be queried recursively to cause resource exhaustion, be it CPU, memory, etc, leading to a denial of service for the either the entire graph endpoint or a subset of services/APIs that drive it.

What is graphQL?
Its basically an annoyingly structured query language built around JSON for calling APIs. Everything is explicit, case sensitive, and generally hates you. Hundreds of APIs can all be gated by a single graphQL instance, allowing developers to create queries or mutations that pull or update data points from multiple back end APIs in a single call. Most of the time the endpoint is "/graphql" or "gql"

How does this Denial of Service thing work?
I've found a bunch of these in my time in bug bounty. Its actually the first thing I check when I hit a graph endpoint. In its simplest form, lets say we have three different points of data: users, friends, and posts.

If we query the "users" object, we can request the friends of that user, and any posts the user has made. As we drill into the friends, we see it also lists the friends posts, and if we drill into posts, we see posts list the "user" object again so we can see who made it. What is the problem?

We can build a query that grabs users, and all its posts. Then for each user, all the friends, and all their posts. Then for each post for each friend, which user: pause here. Now we are back to users. So we nest it another layer deeper, for each user of each post of each friend, do it all over again.. and repeat, and repeat, and repeat. Then you run it once and the server dies. But don't actually do that.

The catastrophic nature of this type of query is multiplied by the data points you return, so if you find a single intensive/robust field and return it for each loop, that is enough to kill it. When testing this, start small (only one or two deep to gauge the server response time) so you don't hurt anything. If you are able to see that the response time is doubling or more, go ahead and stop and report it for safety.

The $8000 bounty was the best I've gotten for this particular bug, most companies aren't super keen to pay for denial of service bugs but they are real enough.

Here are a couple good explanations on this:
https://t.co/s68mSY8RRt

https://t.co/RvZ6TaPozb

#hacking #appsec #bugbountytips

[Ahmed Tarek @0x_xnum]

Just dropped a new write-up about the latest privilege escalation I found
check it out : https://t.co/Wdf7Qph7ME

#bugbountytips #bugbounty #bugcrowd #hackerone

[Th4m1 @Th4m1_Official]

Best IDOR reads!

https://t.co/RGiRxEUegA

https://t.co/FmPvjfzhsf

#BugBounty #bugbountytips

[Abdelrhman Allam 🇵🇸 @sl4x0]

Me and a friend just landed a bounty for an RCE using a technique I addict it earlier and have kept refining ever since. Grateful for the results. Alhamdulillah.

More here:
https://t.co/rcXoFYE8r7 or https://t.co/1uaYDcSjFb

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

Going live on @HackwithIndiaa in 20 min

https://t.co/alVghv2AW3

Live Manuall Recon ....

#Bugobunty #bugbountyTips

[Youssef Sammouda (sam0) @samm0uda]

Leaking FXAuth Token leading to account takeover ($65,000)
https://t.co/d1jQ26tTjD
Instagram account takeover via Facebook Pixel script abuse ($32,500)
https://t.co/DRjgIa92aa
Multiple XS-leaks disclosing Facebook users in third-party websites ($8,400)
https://t.co/F1hbXk7jNa