Mammad_Rahimzada

penetration tester, bug hunter

[Mammad_Rahimzada @cyber_aze]

Yay, I was awarded a $$$$ bounty on @Hacker0x01! https://t.co/eINxu4WSBA #TogetherWeHitHarder

[Mammad_Rahimzada @cyber_aze]

@ContaboCom @ContaboCom Hello, my payment card has expired, but when I change it to a new one, an error occurs. Please tell the support service to write a reply, I have opened a ticket. If the answer is late, my server may be shut down, why is support not operational?

[Mammad_Rahimzada @cyber_aze]

@ContaboCom @ContaboCom why support doesn't reply?

[Mammad_Rahimzada @cyber_aze]

@ContaboCom How can you be so relaxed?

[Mammad_Rahimzada @cyber_aze]

@ContaboCom why the servers are down? explain pls

[Mammad_Rahimzada @cyber_aze]

@Iggy_o7 @ContaboCom same for me

[Mammad_Rahimzada @cyber_aze]

Yay, I was awarded a $$$ bounty on @Hacker0x01!
Bug type: improper access control - Swagger UI
https://t.co/eINxu4WSBA
#TogetherWeHitHarder

[Mammad_Rahimzada @cyber_aze]

@sainath29 @galnagli on the hackerone platform?

[Mammad_Rahimzada @cyber_aze]

@h1Disclosed @hasn0x ))

[Mammad_Rahimzada @cyber_aze]

@AhmedMa07846126 are u using eset security?

[Mammad_Rahimzada @cyber_aze]

Anyone has an idea of how to XSS,open redirection, etc. via CRLF on a 301 redirect(I have tried Location header tricks but not working)
#bugbounty #bugbountytips #hackerone #bugcrowd #crlf #crlfinjection

[Mammad_Rahimzada @cyber_aze]

I was awarded a $$$ bounty from the Responsible Disclosure Program
Bug type : subdomain takeover 🐞
#bugbounty #cybersecurity #cybertime #bugbountytip

[Mammad_Rahimzada @cyber_aze]

@errorsec_ this is p5(informational)

[Mammad_Rahimzada @cyber_aze]

@ynsmroztas @intigriti what's difference with sqlmap?

[Mammad_Rahimzada @cyber_aze]

@PabloDabe777 @Hacker0x01 sure

[Mammad_Rahimzada @cyber_aze]

I was awarded a $$ bounty on @Hacker0x01!
https://t.co/eINxu4WSBA
#TogetherWeHitHarder #hackerone #bugbounty

[Mammad_Rahimzada @cyber_aze]

@Botami143 qsreplace <interactsh-client> or qsreplace http://<interactsh-client> ?

[Mammad_Rahimzada @cyber_aze]

bug bounty tip: check header based sqli using HBSQLI
#BugBounty #bugbountytip #cybertime #bugcrowd #hackerone #sqli

[Mammad_Rahimzada @cyber_aze]

tip:
1. enumerate swagger endpoints using nuclei (--tags swagger)
2.if you find swagger ui then check every option on the api. maybe some options doesn't require any authorization token ;)
#bugbounty #bugbountytip #hackerone #bugcrowd #swagger

[Mammad_Rahimzada @cyber_aze]

bug bounty tip : always check /api/users/% for WAF bypass
#bugbounty #cybertime #bugbountytip #bugcrowd #hackerone