Bhautik Patel

🔸Bug Hunter
🔸Security Researcher

[Bhautik Patel @bhautikXploit]

@JioCare Thank you!! Waiting for the engineer visit.

[Bhautik Patel @bhautikXploit]

Dear @JioCare,

I booked my JioFiber WiFi installation 2 days ago, and there's still no update on the installation status. This delay is really disappointing. Could you please look into this and provide an update at the earliest?

Request ID: [LR00001EJ5D1]

[bugcrowd @Bugcrowd]

🦾❤️ #BugBounty

[Bhautik Patel @bhautikXploit]

Attended @BsidesMussoorie ⛰️—great experience and an amazing conference!

Big thanks to @4non_Hunter for organizing such a great conference . Always good catching up with @amoshkov 🤝.

Great to meet my fellow colleagues.

Looking forward to attending more such conferences 🚀

[Bhautik Patel @bhautikXploit]

@Ari_crypt0 Fully manual hunting

[Bhautik Patel @bhautikXploit]

Crossed 500+ reputation on HackerOne 🎯

Biggest lesson: Duplicate ≠ Invalid. It still means you found a real issue.

Learning, hunting, improving 🚀
https://t.co/5stJCaHuVf

#BugBounty #HackerOne #InfoSec

[Bhautik Patel @bhautikXploit]

@DuyHoang51448 @yeswehack Thanks

[Bhautik Patel @bhautikXploit]

🚀 Proof That Manual Testing Still Wins 🐞

Happy to share a small win from my recent work on @yeswehack

📌 10 vulnerability reports submitted
✅ 9 accepted
🔁 1 marked as duplicate (part of the game!)

#BugBounty #YesWeHack #CyberSecurity

[Bhautik Patel @bhautikXploit]

@4osp3l @yeswehack Thanks

[Bhautik Patel @bhautikXploit]

@yeswehack Thanks for the amazing platform

[Bhautik Patel @bhautikXploit]

🚀 One of my early wins of 2026

I’ve successfully reported a Critical SQL Injection vulnerability, which has been triaged and accepted by the program.

#BugBounty #infosec #Cybersecurity

[Bhautik Patel @bhautikXploit]

Kicked off the year with my first SQL Injection report triaged on HackerOne 🎯

Identified a potential Time-Based SQL Injection via the status parameter.

A small win, but a strong start and great motivation for the year ahead 🚀
#BugBounty #SQLInjection #HackerOne #InfoSec

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

Big #Bugbountytip / #bugbountytips
Google Services Hunting
Google services are amazing, and for bug hunters, it's amazing as well. In some cases, you can get some P1-P2-P3 from these services, such as
Workspaces / Sheets / Groups / Drives / Etc...

In groups: you can access emails / internal data/ credentials
In Sheets, you can access PIIs / Edit access
In Drive: you can access backups/ PII / Etc...

still hard to find and
It was an issue how to make good and at the same time fresh dorks for bug bounty programs

Then I found out that a lot of links have the same path, and it was like this
All Google resources I've found
https://t.co/2SixYDAKvE
https://t.co/tbE8WaX9CX
https://t.co/5D7Clds9cH
https://t.co/OfodYVKOk0
https://t.co/ZyA0JFkax4
https://t.co/mhIbyMF03b
https://t.co/QwByRWofh8
https://t.co/vAwAEX8KxI
https://t.co/4y1UMeZdq7
https://t.co/u7mOVPnus3
https://t.co/V9ALsFoqP9
https://t.co/2eLIaEPCGm
https://t.co/VxllqvwT6n
https://t.co/c1vkp8YrBt
https://t.co/2EkMSEUpIt

UrlScan Dorking:
page.url:"https://t.co/qb3s3f8koJ*"
page.url:"https://t.co/BNLIA1rXht*"
You can replace * => the program domain

Google Dorking:

site:https://t.co/qb3s3f8koJ* "inurl:/a/"
Or for specific domain
site:https://t.co/qb3s3f8koJ* "inurl:/a/domain.com"

GitHub Dorking:
"https://t.co/qb3s3f8koJ"
Or for a specific domain
"https://t.co/FKHqr19e0o"

Shodan Dorking:
"https://t.co/3vQLeWEs54"

Web Archive
https://t.co/c8tGyvVlH7

Don't forget:
It's not just https://t.co/pbqxKC9P4s
still you have to look for docs/groups/mail/drive/spreadsheetsX

still working in Google Research and will add more and more soon ......

Happy Hunting♥

#bugbounty

[Peter Girnus 🦅 @gothburz]

Someone found an RCE on my website yesterday.

CVE-2025-55182.

React2Shell.

I don't have a bug bounty program.

I never asked for a security assessment.

I woke up to a DM: "Hey I found a critical vulnerability in your site. I only ran the exploit to verify it worked. Here's my PayPal for the bounty."

Bounty?

I checked my logs.

Forty-seven requests to my RSC endpoint.

Something, something ... Prototype pollution payloads.

They used the GitHub script.

The one with 2,000 stars.

The one that runs id automatically "for verification purposes."

They spawned a shell on my production server.

uid=1001(nextjs) gid=65533(nogroup)

They took a screenshot.

They posted it on Twitter.

"Popped a Shell on a Live Website 🚀💀 #BugBounty #CVE-2025-55182 #YOLO"

They got 84781 likes.

My customers' data was on that server.

I asked them to delete the screenshots.

They said "I removed the domain name, you should be thanking me."

Thanking them.

For unauthorized access to my production infrastructure.

For running arbitrary commands on systems I own.

For posting proof of exploitation for clout.

They called it "responsible disclosure."

I called my lawyer.

They called me "ungrateful."

I called the FBI.

Now they're in my DMs explaining that "this is how the industry works" and I "don't understand pen testing."

A pen what?

I understand it perfectly.

I understand that running https://t.co/C6kmBequB5 against random websites isn't research.

I understand that "I removed the identifying info" doesn't undo the unauthorized access.

I understand that #BugBounty doesn't apply when there's no bounty program.

I understand that finding my site on Shodan doesn't constitute authorization.

Their followers are defending them now.

"Presumption of innocence."

"You don't know if it was authorized."

"The screenshots were redacted."

Three hundred people are calling me a bootlicker for reporting a crime.

Someone said I should be grateful they didn't deploy a cryptominer.

The bar is underground.

I just wanted to run a small Next.js app.

I didn't ask to be someone's proof-of-concept.

I didn't consent to being their "first"

I didn't sign up for an unscheduled penetration test from a stranger with a GitHub account.

There is no safe harbor for spraying public exploits at random websites.

There is no legal protection for "I was just verifying the vulnerability."

There is no ethical framework where unauthorized prototype pollution is a favor.

But sure.

Thank you for your service.

You found a CVE that was already public.

Using a tool someone else wrote.

Against a target that never authorized you.

And you posted about it on main.

For likes.

Hero.

[Aditya Patel @hackXadi]

🎉 We’re absolutely thrilled to be a part of this amazing event! 🚀 Bugquell is incredibly excited to support Security BSides Mussoorie 2026 as a Cheering Sponsor. It's an honor to be aligned with such a vibrant community of security professionals and enthusiasts.

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

How in 1-hour recon and working I was able to locate 0day (R-XSS)

I've been invited to a private program and the scope was (anything owned by the program is in scope)

**Step1**

I start looking for 3rd party over Urlscan by using the Dorks
Program.*
Program-*

then I found an interesting 3rd party and the domain looks like

program[.]app[.]3rdParty[.]com

**Step2**

i collected all the endpoints for
*.3rdParty[.]com
then I added to Wordlist and i run it on the app

then found an interesting endpoint including (wvstest= parameter)

**Step3**

by using @xss0r xss payloads I got a valid hit on the payload

```
orwa%27\"><svg/onload=alert(document.cookie)>
```

**Step4**

i tested on all the clients, and all of the clients were vulnerable to the XSS

Bug Reported and it's time to dig deeper ....

#BugBountyTip #Bugbountytips

[Bhautik Patel @bhautikXploit]

@yeswehack 🎃

[Bhautik Patel @bhautikXploit]

@hackXadi

[Security Bsides Mussoorie @BsidesMussoorie]

Do you want this exclusive Limited edition #BSidesMussoorie Hoodie?

Follow us, Retweet, Tag your Friends
and stay tuned

@Bugcrowd
@StandoffBB
@Hacker0x01
@SecurityBSides
@yeswehack
@intigriti

#CyberSecurity
#BugBounty
#ctfchallenge

[Bhautik Patel @bhautikXploit]

I earned $650 for my submission on @bugcrowd https://t.co/pIc63b0e6y #ItTakesACrowd

[bugcrowd @Bugcrowd]

$1,000 GIVEAWAY 🎁‼️

Here’s how to enter:
1️⃣ Fill out the ITMOAH survey
2️⃣ Like this post
3️⃣ Comment your fave tool
4️⃣ Repost bc your friends deserve a chance too

Giveaway closes Sept 30 at 11:59pm ET. One hacker takes home $1K. 20 others will score $200 each. Already filled out the survey? You’re entered to win!

If not, now's your chance: https://t.co/aweXU9Lr3R