Al-hassan abbas | الحسن عباس

Certifed : #Ecptxv2 #Oscp #Ecpptv2 #Ceh11 #Ejpt #ECES
#Metasploit_pro_specialist #Ewpt #Ceh_master
Snap & instagram : exploit.msf
CVE-2021-40303

[Al-hassan abbas | الحسن عباس @exploit_msf]

third week respectively 1st on hackerone
#hackerone #BugBounty #bugbountytips

[Al-hassan abbas | الحسن عباس @exploit_msf]

@thestevennabil @zaidfad2000 لوكي جهز نفسك مثل عمرو اديب لان تركي ال شيخ يحب يضرب لوكية مالتة 😂😂

[Al-hassan abbas | الحسن عباس @exploit_msf]

I was awarded a $3,000 bounty on @Hacker0x01! https://t.co/5dbKBrWp1S #TogetherWeHitHarder
Default credential lead to infrastructure takeover

[Al-hassan abbas | الحسن عباس @exploit_msf]

Just got a reward for a vulnerability submitted on @yeswehack -- Improper Access Control - Generic (CWE-284). https://t.co/SFKMZBkHba #YesWeRHackers

[Al-hassan abbas | الحسن عباس @exploit_msf]

They forgot to add 00

[Al-hassan abbas | الحسن عباس @exploit_msf]

Yay, I was awarded a $500 bounty on @Hacker0x01! https://t.co/5dbKBrWp1S #TogetherWeHitHarder #bugbountytip
Tip: GraphQL Voyager via /api/graphql/voyager

[Al-hassan abbas | الحسن عباس @exploit_msf]

Just got a reward for a vulnerability submitted on @yeswehack -- Cross-site Scripting (XSS) - Reflected (CWE-79). https://t.co/SFKMZBkHba #YesWeRHackers

[Al-hassan abbas | الحسن عباس @exploit_msf]

Just scored a reward @intigriti, Bounty+Bouns $500 https://t.co/vRjHd22Je6 #HackWithIntigriti
Tip: Unauthenticated Grafana

[Al-hassan abbas | الحسن عباس @exploit_msf]

@mysanismine @Hacker0x01 😂😂

[Al-hassan abbas | الحسن عباس @exploit_msf]

I earned $300 for my submission on @bugcrowd https://t.co/F8Nnc5iCN0 #ItTakesACrowd
Tip: CVE-2025-4123

[Al-hassan abbas | الحسن عباس @exploit_msf]

Just got a reward for a vulnerability submitted on @yeswehack -- Cross-site Scripting (XSS) - Stored (CWE-79). https://t.co/SFKMZBlf0I #YesWeRHackers

[Al-hassan abbas | الحسن عباس @exploit_msf]

@no_zidan @Hacker0x01 Httpbin simple http server for requests and response

[Al-hassan abbas | الحسن عباس @exploit_msf]

I was awarded a $300 bounty on @Hacker0x01! https://t.co/5dbKBrWp1S #TogetherWeHitHarder
Tip: 1 XSS via httpbin & 2 Url redirect via httpbin

[Al-hassan abbas | الحسن عباس @exploit_msf]

@0xsaiyann @Hacker0x01 Not all programs close url redirect as NA
Httpbin simple http server for requests and response

[Al-hassan abbas | الحسن عباس @exploit_msf]

I earned $200 for my submission on @bugcrowd https://t.co/fWtnh2YxC1 #ItTakesACrowd #bugbountytips
Tip: CVE-2022-46463 Download repo's in harbor

[Al-hassan abbas | الحسن عباس @exploit_msf]

I was awarded a $3,100 bounty on @Hacker0x01! https://t.co/5dbKBrWp1S #TogetherWeHitHarder

[Al-hassan abbas | الحسن عباس @exploit_msf]

@h4x0r_dz @intigriti Yes, it was airflow web app then you need to access to admin airflow then you can read user,pass for jenkins in anothet port then get rce from jenkins then you need get root using python script with rwx permissions

[Al-hassan abbas | الحسن عباس @exploit_msf]

Just scored a reward 1875€ @intigriti #HackWithIntigriti #bugbountytips
Tip: I played ctf this year and i found this vulnerability because i solve machine challenge with same bug
If you found apache airflow use flask-unsign to found secret key and generate new jwt for admin

[Al-hassan abbas | الحسن عباس @exploit_msf]

@h4x0r_dz @intigriti Thanks
I don't remember name 🥲

[Al-hassan abbas | الحسن عباس @exploit_msf]

I was awarded a $290 bounty on @Hacker0x01! https://t.co/5dbKBrWp1S #TogetherWeHitHarder #bugbountytips
Tip: CVE-2025-29927 via /admin

[Al-hassan abbas | الحسن عباس @exploit_msf]

I was awarded a $450 bounty on @Hacker0x01! https://t.co/5dbKBrWWRq #TogetherWeHitHarder