Dat Pham 🇻🇳

Bughunter

[Dat Pham 🇻🇳 @datph4m]

I am proud to be a part of it 😁

[TikTokComms @TikTokComms]

For #CyberSecMonth, we're proud to collaborate with industry-leading organizations like @GlobalCyberAlln, @StaySafeOnline & @Hacker0x01 to spread cybersecurity awareness, education & opportunity. Learn more here: https://t.co/FVRw8PC7f1

[James Kettle @albinowax]

You can now scan for #react2shell in @Burp_Suite. To enable, install the Extensibility Helper bapp, go to the bambda tab and search for react2shell. Shout-out to @assetnote for sharing a reliable detection technique!

[publiclyDisclosed @disclosedh1]

GitLab disclosed a bug submitted by asterion04: https://t.co/92F845dmCJ - Bounty: $35,000 #hackerone #bugbounty

[Flysec Corp @flysec_corp]

Congrats🇻🇳squad's good win with 2nd highest score in the 1/8 finals of the #AmbassadorWorldCup, secure a spot in the Elite Eight round at Prague, 🇨🇿!

🔥Flysec has a great hacking experience in AWC 1/8 finals being in Top 1 of Report Leaderboard!

Fighting for semi-final spot!

[Dat Pham 🇻🇳 @datph4m]

@JubaBaghdad No, nothing is needed except the private user’s user ID.

[Dat Pham 🇻🇳 @datph4m]

With this report, $3,500 was the final reward I received.

Clearly, its severity was not just medium.

[Ben Sadeghipour @NahamSec]

Do you think that your private TikTok profile was actually private? #bugbounty

[Dat Pham 🇻🇳 @datph4m]

TikTok has a private program where they mention that:

"Private posts and .... is usually high-critical."
Yes, initially, I reported this issue through that program. After they reviewed it, they transferred my report to the main program (TikTok) and downgraded it to medium.

[Dat Pham 🇻🇳 @datph4m]

I was able to view all videos of any private account on TikTok.
In this report, the Confidentiality level is rated as LOW.
The reason provided by the TikTok and H1 mediation team:
"The attacker cannot guarantee that every video they steal contains sensitive information."

[publiclyDisclosed @disclosedh1]

TikTok disclosed a bug submitted by @datph4m: https://t.co/eURM3fP43Y #hackerone #bugbounty

[Dat Pham 🇻🇳 @datph4m]

@hugopicanzo @disclosedh1 It’s just a UserID; anyone can find it.

[Dat Pham 🇻🇳 @datph4m]

@hugopicanzo @disclosedh1 All videos, even revealing interactions and analyzing video data.

[Dat Pham 🇻🇳 @datph4m]

@h4x0r_dz @disclosedh1 They did not provide a reason why. However, this is the response from the H1 Mediation team:

[Dat Pham 🇻🇳 @datph4m]

@696e746c6f6c They always tried to downgrade the severity to avoid paying a bounty large. I decided to leave the program after this report.

[Dat Pham 🇻🇳 @datph4m]

I discovered an endpoint that allows retrieving all videos from a private TikTok user, and he consider the confidentiality impact to be Low.

#bugbounty #hackerone

[Dat Pham 🇻🇳 @datph4m]

@indept01 @tiktok_us yes they are not transparent

[Dat Pham 🇻🇳 @datph4m]

3/

Compared to the report that earned the $8,000 reward, the private video disclosure issue was more severe. However, they managed to downgrade it to a medium severity level and fixed it within 24 hours.

[Dat Pham 🇻🇳 @datph4m]

1/

Last month, I was awarded $8,000 for identifying a user privacy-related issue.

[Dat Pham 🇻🇳 @datph4m]

2/

I can’t disclose much, but a TikTok employee has confirmed it.

[Dat Pham 🇻🇳 @datph4m]

TikTok has a private program. If you’re part of this program, It can be seen in the program’s policy that video disclosure is considered Critical. I initially reported the issue there, but they transferred it to their public program and downgraded the severity to Medium.

[Rikesh Baniya @rikeshbaniya]

I just published
Tale of Zendesk 0 day and a potential 25K $ bounty https://t.co/dgkbWxDe8q

#bugbounty #bugbountytips

[Dat Pham 🇻🇳 @datph4m]

For three consecutive years, I’ve held a position as one of TikTok’s top hackers – I’m proud to contribute to securing the platform and ensuring safety for its global community of users. Thanks @tiktok_us @Hacker0x01

#togetherwehitharder

https://t.co/xFocBz6qEq