0xadull4m

Offensive Security || YesWeHack || Synack Red Team || OSCP || OSEP || Malware Developer

[0xadull4m @cyb3radull4m]

I just realized I haven’t put a face behind this account

So, here’s to me introducing myself 🥂

I’m going to be sharing all things bug bounty/Offensive security here.

[HackingHub @hackinghub_io]

There are still a LOT of bugs to be found. 🐞 

Even on hardened public programs!

@NahamSec shares a hacking approach that helps him find bugs on hardened targets. 👇

[0xadull4m @cyb3radull4m]

@4osp3l @yeswehack Thanks man

[0xadull4m @cyb3radull4m]

Participated in my first Live Hacking event on @yeswehack - GovTech

Made over $6800 in bounties. Not bad bad for a first try :)

Thank you @yeswehack

[0xadull4m @cyb3radull4m]

@destro4evr @yeswehack It’s a live hacking event

[0xadull4m @cyb3radull4m]

Recently it has been /api/v1/user/1001 with encoded whitespaces (%20) as either prefix or suffix to bypass 404/403/404 responses.

[HackingHub @hackinghub_io]

Keep your eyes peeled on these endpoints. 👀

/login ➡️ authentication bugs
/reset-password ➡️ATO
/upload ➡️ RCE
/api/v1/user/1001 ➡️ BOLA
/search?q=query ➡️ Injection bugs
/view?file= ➡️ SSRF
/admin ➡️ internal access

Which endpoint have you found the most bugs on? 👇

[0xadull4m @cyb3radull4m]

@linuxadii I’d give an update when this has been completed

[0xadull4m @cyb3radull4m]

Unauthenticated Account Takeover of any account.

I’ll be so pained if this turns out to be a dupe

Fingers crossed.

[0xadull4m @cyb3radull4m]

@____jayz____ @yeswehack Thanks a lot🎉

[0xadull4m @cyb3radull4m]

How my day is going!🎉

Another accepted report from @yeswehack 🤩

It has been an amazing month!

[0xadull4m @cyb3radull4m]

@Mydeen4u Thanks bro 🎉

[0xadull4m @cyb3radull4m]

I hacked EC-Council 🎉

[0xadull4m @cyb3radull4m]

@Levi_Hack3rman @Mydeen4u @yeswehack My Oga🔥

[0xadull4m @cyb3radull4m]

@4osp3l @yeswehack Thanks brother!🎉

[0xadull4m @cyb3radull4m]

I’ve been away from hunting for a week to actively execute this project I’m on. I came back today to submit 3 reports 🎉

Wish me luck!

Tip : Always test DELETE HTTP method on endpoints like /users/current or /users/me etc.
Combining it with IDOR too cannot be overemphasized.

[0xadull4m @cyb3radull4m]

Woke up to another accepted report

Thank you @yeswehack 🎉

[0xadull4m @cyb3radull4m]

Got back home to 3 accepted reports

Thank you @yeswehack

[0xadull4m @cyb3radull4m]

@hetmehtaa Hi

[0xadull4m @cyb3radull4m]

12. Encoded Whitespace Bypass
/api/v2/users/%209 → 200 OK
/api/v2/users/9%20 → 200 OK

Sometimes you might need to combine some of these to bypass 403/404

#Cybersecurity #appsec #IDOR #bugbountytips

[0xadull4m @cyb3radull4m]

5. Multiple ID Abuse
/api/v1/users/10,9 → 200 OK
/api/v1/users/10.9 → 200 OK
/api/v1/users?id=10,9 → 200 OK

6. Type Confusion
/api/v1/users/*9* → 200 OK
/api/v1/users/9abc → 200 OK

7. Leading Zero/
/api/v1/users/09 → 200 OK

[0xadull4m @cyb3radull4m]

8. Hex representation of ID
/api/v1/users/0x63 → 200 OK

10. Null Byte Injection
/api/v1/users/9%00 → 200 OK
/api/v1/users/%009 → 200 OK

11. Header-Based Bypass
/api/v1/users/09
* X-Original-URL: /api/v2/users/10 → 200 OK
* X-Forwarded-For: /api/v2/users/10 → 200 OK