Cyberman

Security Researcher | Artist | Building @hellocybersafe

[Cyberman @cybermansec]

Day 36/100
Found my first real bug today. IDOR on a live #BugBounty target.
Fully documented; screenshots, PoC & written report. Then hit a signal wall, can't submit yet as a new researcher. But the bug is real & the report ready
#IDOR

[Cyberman @cybermansec]

@Ogechee_ @tryhackme Well done 👏🏽

[Cyberman @cybermansec]

@chinky365251453 @Ogechee_ @tryhackme A name alone isn't generally considered sensitive information in the same way as id, account numbers or personal contact details.

[Cyberman @cybermansec]

@chinky365251453 @Ogechee_ @tryhackme Certs are meant to identify who earned them. If you're sharing a cert publicly for professional purposes having your name visible allows employers and recruiters to verify that the cert actually belongs to you.

[Cyberman @cybermansec]

Day 76/100
Tested a targets API today; graphql mutations, address endpoints, and checkout flow.
Found graphql introspection enabled on a production endpoint. Full schema exposed, no authentication required.
No critical finding yet...
#BugBounty #CyberSecurity

[Gospel @4osp3l]

This is an interesting one. I will tell more about the vulnerability as soon as it’s resolved.

[Gospel @4osp3l]

Let’s see

[Cyberman @cybermansec]

@4osp3l 🔥

[Gospel @4osp3l]

👀

[Cyberman @cybermansec]

Day 75/100
Set up a fresh hunting environment today- new attack surface and new opportunities.
Getting everything ready for the next round of testing.

#BugBounty #CyberSecurity

[Cyberman @cybermansec]

Day 74/100
Got the outcome on the #IDOR I reported. My first reported vulnerability was validated as a duplicate of a bounty-awarded report. Back to hunting!
#BugBounty

[Naina Malik @Naina___Malik]

CRITICAL 🫣 Not duplicate this time…
Some relief after long days, Dont get demotivated coz of AI just do your part..
#bugbountytips #Bugbounty

[Cyberman @cybermansec]

Day 74/100
Got the outcome on the #IDOR I reported. My first reported vulnerability was validated as a duplicate of a bounty-awarded report. Back to hunting!
#BugBounty

[Cyberman @cybermansec]

@ravimahile Appreciate it 🙏🏽

[Cyberman @cybermansec]

Day 73/100
Finally submitted the IDOR I found back on Day 36 to shopify's #BugBounty program, after walking an asset in scope of my new target. It took longer than expected but the report is in now. Whatever the outcome I'm glad I followed through and got it reported properly.

[Cyberman @cybermansec]

Day 36/100
Found my first real bug today. IDOR on a live #BugBounty target.
Fully documented; screenshots, PoC & written report. Then hit a signal wall, can't submit yet as a new researcher. But the bug is real & the report ready
#IDOR

[Gospel @4osp3l]

DAY 2 Of Mastering FUZZING. ( Stack Overflow )

[spencer @techspence]

As much as we may not like it, and fight like heck against it, there's NO SUBSTITUTE for hard work. Doing your own research is an advantage.

[Cyberman @cybermansec]

@gabbytech01 How did you prove your thinking

[Cyberman @cybermansec]

Day 72/100

Started exploring a new target today.
Spent time mapping application functionality, observing registration flows, and identifying areas worth deeper testing.

#BugBounty #CyberSecurity