Ehtesham

Bounty Hunter

[Ehtesham @eh_tesham]

I just published How a GraphQL Invitation Flow Exposed Users at Scale https://t.co/HODSVJleAU

[Ehtesham @eh_tesham]

I kept delaying certifications… until I finally took eJPT — here’s what happened.
#CyberSecurity #BugBounty #InfoSec #EthicalHacking #WebSecurity #Vulnerability #SecurityResearch #Pentesting #AppSec #OWASP

https://t.co/7VHbv2wZhZ

[Ehtesham @eh_tesham]

https://t.co/DlNeEgI2C4

[Ehtesham @eh_tesham]

A background integration → broken trust boundary.
https://t.co/v7H2LPicG2

[Ehtesham @eh_tesham]

I just published Breaking the Same-Origin Policy: A Dive into a CORS Misconfiguration https://t.co/PkfrruUd8r

[Ehtesham @eh_tesham]

I just published BurpSuite vs Caido: Rethinking Proxy Tools for Bug Hunters https://t.co/CJ4ePO6c6T

[Ehtesham @eh_tesham]

I just published Open Redirect Vulnerability in SSO API https://t.co/1yWsUzcOOx

[Ehtesham @eh_tesham]

I just published IDOR in Password Reset Workflow — A Path to Account Takeover https://t.co/Qqfs2iKKuy

[Ehtesham @eh_tesham]

I just published Open Redirect in Password Reset Flow Leading to Token Exposure https://t.co/n1JluAjNqp

[Ehtesham @eh_tesham]

I just published Exposed xmlrpc.php – How a Legacy File Opens the Door to Attacks https://t.co/HLSJMvOwN6

[Ehtesham @eh_tesham]

I just published Pre-Account Takeover via OAuth Misconfiguration https://t.co/KOz8j9EDi9

[Ehtesham @eh_tesham]

I just published Unauthenticated Password Reset Abuse https://t.co/15CG0QvS95

[Ehtesham @eh_tesham]

I just published How an OAuth Misconfiguration Led to Token Leakage https://t.co/0qEHhczjCg

[Ehtesham @eh_tesham]

I just published How a Simple Redirect Led to a $550 XSS Vulnerability https://t.co/9dToRsrNiJ

[Ehtesham @eh_tesham]

I just published Information Disclosure via GraphQL in Production https://t.co/gSDyWxM3HS

[Ehtesham @eh_tesham]

I just published HTML Injection in Traveler Profiles https://t.co/KniF2AdCVm

[Ehtesham @eh_tesham]

I just published How a Welcome Email Can Be Used for Malicious Redirection https://t.co/01JjO3Yqby

[Ehtesham @eh_tesham]

I just published Exploiting the Gaps in Password Reset Verification https://t.co/pkRk7F2pmi

[Ehtesham @eh_tesham]

I just published A Hidden Backdoor: Bypassing reCAPTCHA on the Sign-up Page https://t.co/sDJRGPbw8H

[Ehtesham @eh_tesham]

I just published Organization Takeover via Privilege Escalation (IDOR)

https://t.co/Qk7Qad57a9

#bugbounty #InfoSec #AppSec #WebSecurity #ResponsibleDisclosure #BugHunter #RedTeam #DevSecOps