dec0bb

h1 | open to collab

#5 in us for q4. hunting down #1

[dec0bb @dec0bb]

@fahadkhan_h1 @kbksi_ @Hacker0x01 Like 70

[dec0bb @dec0bb]

2 days ago, I was paid $15,000 for one bug on @Hacker0x01.

After 2 months of hunting on one program, I found a Critical RCE leading to prod database access.

Sometimes, it just takes time. You can hunt on a program forever and continue to find new, impactful bugs.

[dec0bb @dec0bb]

@hamekameka @Hacker0x01 sure, just dm me

[dec0bb @dec0bb]

@hamekameka @Hacker0x01 I plan on doing some writeups from findings over the last few months. I’ll probably post them here.

[dec0bb @dec0bb]

@kbksi_ @Hacker0x01 Yeah I spent a good 2 months on there. They’re a good program and the team is great and quick. I’ve rotated probably 5-6 times through features and everything to continue looking for new hypotheses.

It’s definitely hardened though haha

[dec0bb @dec0bb]

@kbksi_ @Hacker0x01 When you hear RCE, and the impact it has - yes, max is typically usual.

Without specific details, the method of extraction was limited and it would've taken a decent bit of time for someone to actually abuse it to the fullest extent.

[dec0bb @dec0bb]

@ilyyeees7 @Hacker0x01 my guy

[dec0bb @dec0bb]

@NineRemmy 6-8 hours every day

[dec0bb @dec0bb]

12 days into Nov, and I've surpassed the entire months of Oct and Sep.

It is all about dedication, passion, and hardwork.
1 good submission can yield a better return than 50.

Let's see where we can get 🙂

[dec0bb @dec0bb]

@labelblueice A mixture of both. In my honest opinion, if you aren’t utilizing AI in some form nowadays, you are going to fall behind.

Everything from Info Disclosure/BAC to RCE.

[dec0bb @dec0bb]

@8888q57 @0xb4dg0d it has been roughly 5 days a week of actual hunting in the evenings & weekends. i work full time as well so don't have 24/7 to hunt