Fallen Apple 🍎

[Fallen Apple 🍎 @fallenapplle]

@tabaahi_ BOOM P1 era is over. now it’s ‘Found P1 with AI in 10 minutes’ 🥹

[Fallen Apple 🍎 @fallenapplle]

@bugoverfl0w This is the reason why RAM prices are high 😾

[Fallen Apple 🍎 @fallenapplle]

@being__aman @Hacker0x01 congrats dude

[Fallen Apple 🍎 @fallenapplle]

@bugoverfl0w @Hacker0x01 Thats awesome brother congrats

[Fallen Apple 🍎 @fallenapplle]

@intigriti

[André Baptista @0xacb]

IDOR hunting workflow I keep coming back to:

1) Map object IDs (UUIDs, ints, slugs) across endpoints (REST + GraphQL).
2) Change one dimension at a time: user_id, org_id, project_id.
3) Watch for soft failures: 200 with partial data, empty arrays, unexpected responses.
4) Test non-GETs too: PATCH/DELETE often skip the same checks.
5) Test for different paths/platforms: UI vs API vs mobile vs webapp.

Most IDORs aren’t fancy, they’re just inconsistent, and it only takes one.

[Fallen Apple 🍎 @fallenapplle]

Took me 2 and half hour. But challange was awesome!

[AmirMohammad Safari @AmirMSafari]

Can you spot the XSS vulnerability? 👀
Test it out live at: https://t.co/vRpgo8PTBE

[Fallen Apple 🍎 @fallenapplle]

@exploit5lover Congratulations brother!

Can you tell me how much you hunt a day ?

[Fallen Apple 🍎 @fallenapplle]

@intigriti Via postmassage where oauhtData sent to wildcard. Attacker phish the user to their page and open a window for fetch data.

[Fallen Apple 🍎 @fallenapplle]

@Abdulid895 @TakiasSec Sure!

[the_IDORminator @the_IDORminator]

Weird graphQL IDOR / access control bypass:

In this one, graphQL would check the "tin" (tax identification number), if supplied, against the Bearer token. If the Bearer did not have access to the tin, you would get access denied. Normal stuff there. So my thought was, how could I make the server still lookup the tin value without the access check?

It regularly expected:
\"tin\"

This causes the server, since "tin" is present, to check access control prior to returning data.

What worked was:

\"tin\\\"\"

So adding \\\" after tin bypassed the access control logic (for some reason), meanwhile the graphQl query still ran and sent back the PII for any TIN I sent it.

#bugbounty is just strange sometimes. Some of the battle is finding neat endpoints and places, and some of it is endless tinkering.

[Fallen Apple 🍎 @fallenapplle]

@z0idsec looking forward to this

[zseano @zseano]

It’s time to lock in. If you’re struggling with bug bounties, spend the next few weeks finding a target you personally enjoy. Bigger the scope the better! Then focus on them everyday for the entire year. Aim to hack 2-3 hours minimum a day. You’ll learn lots and find bugs.

GL!

[Abdallah @d3doxp]

In this write-up, I detail how I escalated info/P4 into P1 and avoided brute-force 36^11 for UUIDs by exploiting typical human behavior.

https://t.co/C2qAUB14iZ

[Fallen Apple 🍎 @fallenapplle]

@tabaahi_ @TheTradingwolf0 Duplicates N/A ka bhi btao 🥹

[cTino @tinopreter]

Late one, hunted for 2 weeks in December and made $6000+. Excited for what we can achieve this year. Below are some writeups I published in 2025:

$1,500 Recon Tips: https://t.co/gOMDxw9etm

Lets $ Leak $ OTP: https://t.co/m2w8rcWOqq

From 429 to 200: https://t.co/VWEt9HM6YT

[xyzeva @xyz3va]

how to hack discord, vercel and more with one easy trick

https://t.co/jqGWp5KDP6

[Fallen Apple 🍎 @fallenapplle]

@wgujjer11 set :)

[Abdelhy khaled🦅 @cysky0x1]

Hello everyone,

🧵Zero-click account takeover via Punycode email.

One of the most critical and interesting vulnerabilities I’ve discovered recently leads to a full account takeover with zero user interaction.

(1/7)