z141

[encodedguy - jsmon.sh @3nc0d3dGuY]

500 Bug Submissions Done on @Hacker0x01

The first submission was on 16 July 2020.
100th submission took 2 years, 2 months and 6 days.
200th submission took 3 months and 100 days.
500th submission took 5 months and 24 days.

Thank you so much Hackerone for this great platform.

[z141 @dr4wfmo3]

@Sazouki_ @bxmbn Did you try to iframe website with caching payload ?, then in your xss payload, fetching cached website then send back to your host ?

[z141 @dr4wfmo3]

@Theunstablegoa1 @FaZeClan @FaZeShop #FazeDown

[z141 @dr4wfmo3]

https://t.co/4T90eCzDph

[Paul Seekamp @nullenc0de]

Let's recap how this happened.

Was provided a subdomain and creds > crawled and found a chunk.js > link finder pulled all API endpoints > parameter bruteforce with seclists (GET & POST) > found POST "filename" param > burp found /etc/passwd on active scan >

[Stealthy @stealthybugs]

Check out my vulnerability write up about critical bugs in Apple infrastructure worth 36,000 in bounties.

https://t.co/lT59uEGNZi

#BugBounty #exploit #infosec #whitehat #bugbountytips #ethicalhacking

[JS0N Haddix @Jhaddix]

(a LONG thread) 🧵

Inspired by @infosec_au & @hacker_ here's one of my fun hacker stories:

= The complete compromise of a password manager company =

Here's how I did it (so you can learn):

I was given the project to pentest a password manager company: *.redacted.com

(1/16)

[shubs @infosec_au]

Inspired by @hacker_’s tweets about hacker stories, I’ll share one of mine. When looking at a global company, I realised that certain sub divisions in different countries of the company were more vulnerable than others. How did I identify these assets? 1/n

[Yassine Aboukir 🐐 @Yassineaboukir]

I wrote the story of exploiting a double-edged SSRF on a bug bounty program for both server and client-side impact.

https://t.co/R3U8kXUuMr

[Immunefi @immunefi]

@samwcyo @InsiderPhD @graphprotocol @bbuerhaus A few recent ones reported and paid out:

-https://t.co/N2EVXq0TfB ($560k)

-https://t.co/bvc2woGnoC ($2m)

-https://t.co/HJfv4F6QsN ($75k)

-https://t.co/duPkDWYsNe ($1m)

-https://t.co/yfNZeN0kZO ($2.2m)

[Mustafa Can İPEKÇİ @mcipekci]

What a month it was on @SynackRedTeam , technically I'm almost 100k with pending ones but time is ended before they got triaged and paid out. There are 3 more vulns to be triaged, considering max payout is 3K per vuln on @synack, almost all of them were SQLis. #BugBounty

[AEMSecurity @AEMSecurity]

[+] Linkedin XSS vulnerability affecting 40+ domains...

https://t.co/XXusjr0kFf

#AEMSecurity #bugbountytips

[shubs @infosec_au]

I've released the first episode of Bug Bounty Redacted today (Exposed Redis & HAProxy):

https://t.co/AA0xlUE1k2

This series walks you through real bug bounty reports that were rewarded, and explains the discovery process, and reporting process in detail.

New episodes Monthly!

[Julien | MrTuxracer 🇪🇺 @MrTuxracer]

Yay! I've finally crossed the magical 1,000,000 USD #BugBounty mark on @Hacker0x01 !!

Thanks for providing me with a great platform to hack on 😎 A very special thanks goes to my favorite private program 🍻!

So here are some stats:
-Paid through 571 reports (741 total)

1/4

[Nagli @galnagli]

As the @Hacker0x01 Ambassador's competition came to an end, it sure has many areas to get better on, but overall it was a nice experience.

During the event, I managed to find 45 valid submissions:

5 Crits, 5 High, 17 Medium and 18 Low.
All on Public(!) programs.

#bugbounty

[mitul patel @A9HORA]

Special thanks to @_danielthatcher for such an amazing research on HTTP header smuggling.
As a small contribution to the hacker community I'm posting this mind map containing key points of that research.
#BlackHat @NullAhm

[publiclyDisclosed @disclosedh1]

TikTok disclosed a bug submitted by @Imrannissar3: https://t.co/0Lp0nx0TTn - Bounty: $6,000 #hackerone #bugbounty

[Sayaan Alam @ehsayaan]

Got Awarded approx $7k of bounty in first 7 days of this month at @SynackRedTeam and @Hacker0x01 , Received my first feedback on @Hacker0x01 , On 30 days $30k challenge to myself :)
Most of the bugs were ACPV and IDORS
#bugbounty

[Alp @alp0x01]

The full story of my #bugbounty journey!

Doing this since May 2021. and in this month I earned total of $19,750 (almost $20K :c)

I don't like clichés, but you should never give up when doing this job. I remember not sleeping for 2 days when I'm a beginner.

Thanks @Hacker0x01!