Cosmosec

Security Researcher on HackerOne | Security analyst | Focusing on XSS and Web cache bugs | Always a N00B who try to learn new things

[Cosmosec @Cosmos_sec]

@Sachinsaud777 Okay sure

[Cosmosec @Cosmos_sec]

Challenge to earn 5000 USD Bounties from Bug-bounty

Day-9
Study: 2.5 hours
Hunt: 2 Hours
Bugs submit today: 0,
Bugs submitted total: 14
Duplicates Bugs: 4 Triaged: 2
Bounty Earned: 1500 USD

[Cosmosec @Cosmos_sec]

@Phoenix28500 Then you are good to jump in for real hunting bro

[Cosmosec @Cosmos_sec]

@Phoenix28500 Have you also completed portswigger labs because they were very much helpful for me

[Cosmosec @Cosmos_sec]

@ImSavlonmarko I am using recon to find wayback urls then I directly move to the website which are in scope of the program for hunting

[Cosmosec @Cosmos_sec]

Challenge to earn 5000 USD Bounties from Bug-bounty

Day-8
Study: 2 hours
Hunt: 5 Hours
Bugs submit today: 1, I have also identify 3 more bugs
Bugs submitted total: 14
Duplicates Bugs: 3
Triaged: 1
Bounty Earned: 1000 USD

[Cosmosec @Cosmos_sec]

@Anji1140896 @wise_the_great_ I am hunting on 1 program for 1 week and then next week I choose another target

[Cosmosec @Cosmos_sec]

@Phoenix28500 IDOR and Business logic mostly

[Cosmosec @Cosmos_sec]

@Equity_Traders4 Firefox developer browser I am using with Multiple account container extension and burpsuite pro and community both

[Cosmosec @Cosmos_sec]

@Deepanshu_2_5 Bounty earned from the bugs I have submitted from the 1st day of the challenge

[Cosmosec @Cosmos_sec]

@oladm3ji Hackerone

[Cosmosec @Cosmos_sec]

@PhineasX Thanks bro

[Cosmosec @Cosmos_sec]

@MalikDisha8108 It was Bulk PII Disclosure of many users via GET API query, only difficult part was that it was accepting UUID as parameter value which I got many from waybackurls

[Cosmosec @Cosmos_sec]

@yussuff111 On medium you can read some good reports about each vulnerability types like IDOR, SQLi, SSRF and when you are hunting on a program you will remember these reports tricks and it will help you to get some cool findings

[Cosmosec @Cosmos_sec]

@yussuff111 I am using medium articles for learnings new attack methods, Portswigger web security academy labs for getting hands on experience about vulnerability

[Cosmosec @Cosmos_sec]

@AatankBadb16659 Thank you bro :)

[Cosmosec @Cosmos_sec]

@Shravan73962 If you are having experience in web development then you can start with hackthebox or portswigger Web security academy and read hackerone disclosed reports and medium. Com infosec write-up

[Cosmosec @Cosmos_sec]

Challenge to earn 5000 USD Bounties from Bug-bounty Day-7:-

Study: 1 hour
Hunt: 3 Hour
Bugs submit today: 1 Also have some bug which i will be submitting
Bugs submitted total: 12
Duplicates Bugs: 3
Triaged: 1
Bounty Earned: 1000 USD

[Cosmosec @Cosmos_sec]

@whats_next9 Bro, choose the target based on your favourite bug type, like say you like Auth bypass kind of vulnerability then you should choose a target which has many roles like Admin, Owner, Viewer, Guest etc

[Cosmosec @Cosmos_sec]

@Adarsh_Mj_7 It's opened now

[Cosmosec @Cosmos_sec]

@kingvin10 Definitely, if I need some help for report writing when I will get bunch of new findings like dozens of them :)