𝐒𝐢𝐦𝐨𝐧

𝐁𝐮𝐠 𝐇𝐮𝐧𝐭𝐞𝐫
| 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐑𝐞𝐬𝐞𝐚𝐫𝐜𝐡𝐞𝐫
| 𝐈𝐧 𝐦𝐲 𝐨𝐩𝐢𝐧𝐢𝐨𝐧:
→𝐈 𝐡𝐚𝐯𝐞 𝐍𝐎 𝐢𝐝𝐞𝐚 𝐰𝐡𝐨 𝐭𝐡𝐞 𝐟𝐮𝐜𝐤 𝐈 𝐚𝐦...

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

FINALLY
Simon-Crawlext V3.0.0

GitHub: https://t.co/sjAZxg5zFn
𝐅ˢ : https://t.co/fWAtCebvxs

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

After a week of building and refining,
Simon Recon is finally out...🐿️
Designed to make scoped recon easier and save time during bug bounty hunting.
Let me know what you think.
https://t.co/O4vxJ7aQda

[reMIKz @RemikzT]

Dirty Work

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

The keys themselves aren't necessarily sensitive.

By finding the right API paths and using the exposed configs/credentials, I was able to reach backend functionality and access sensitive data...

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

And another critical....💀🐿

#bugbounty

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

@MertPolatis Not everything here is sensitive by itself.

The interesting part is the combination of exposed endpoints, configs, and credentials , some of which can lead to sensitive backend access depending on their permissions...

That’s where the real impact is...

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

@apihog Not the Firebase config itself. The interesting part was the exposed service endpoints and credentials, and what I could access through them.

[Nitin Gavhane @NitinGavhane_]

XSS2Shell — a WordPress Core pre-auth XSS → RCE vulnerability reportedly discovered autonomously by @pwn_ai using open-source models.

https://t.co/J367yeG2jO

The flaw affects WordPress versions broadly and could impact a huge portion of the web.

If you run WordPress, patch CVE-2026-64638 ASAP.

#WordPress #CyberSecurity #XSS #RCE #CVE #AppSec #InfoSec #AI

[جوجه ماشینی سایکو @ziziwithzed]

ذکر روز یکشنبه:

[𝗗𝘀𝗼𝗸𝗲𝗩🧑‍💻 @DsokeyyV]

Critical XSS with impact 🥰

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

@Sharo_k_h 😑😑😑👍

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

واقعا جریان این cors ها چیه؟؟
من جدیدا زیاد پیدا میکنم یا همینجوری ریخته کف بازار؟؟؟
فصل تولید مثله؟

#bugbounty

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

FUUUCKKKKKK
Another CORS misconf...😑💀

#bugbounty
#cors

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

@kafinil با اینا

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

FUUUCKKKKKK
Another CORS misconf...😑💀

#bugbounty
#cors

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

انقد این چند وقت از سایت های ایرانی cors misconfiguration پیدا کردم که دیگه حالم به هم میخوره از هر چی :
HTTP/2 200
access-control-allow-origin: https://t.co/82dY34QWvU
access-control-allow-credentials: true

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

@torik_1999 Nah, pulled it from the target's production environment🙃

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

FULL ACCESS...

#bugbounty

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

CVSS ≈9.8

#bugbounty

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

CVSS ≈9.8

#bugbounty

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

تازه بعد از اینکه این باگ رو گزارش دادم
تریاژر محترم فرمودن ما خودمون باز گذاشتیم و هیچ چیز مخفی از مردم نداریم😐😐😂

(حدس میزنم اصن نمیدونست api key چیه)
خدایی سطح پاسخگویی و سعی در ماسمالی کردن باگ و بانتی ندادنشون در حد پاتریکه...

#bugbounty

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

Lesson:
Secrets in NEXT_DATA and public .env files = bad. Very bad. Same bug, different location. Time to rotate everything. 🚀

* Choose a long-term target and stay committed to it *
@voorivex🙏

•𝐒𝐢𝐦𝐨𝐧𝐬𝐞𝐜🐿

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

انقد این چند وقت از سایت های ایرانی cors misconfiguration پیدا کردم که دیگه حالم به هم میخوره از هر چی :
HTTP/2 200
access-control-allow-origin: https://t.co/82dY34QWvU
access-control-allow-credentials: true

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

Lesson:
Secrets in NEXT_DATA and public .env files = bad. Very bad. Same bug, different location. Time to rotate everything. 🚀

* Choose a long-term target and stay committed to it *
@voorivex🙏

•𝐒𝐢𝐦𝐨𝐧𝐬𝐞𝐜🐿

[𝐒𝐢𝐦𝐨𝐧 @fsimonsec]

CVSS Notes:

· Both are 9.1 (Critical).
· Attack Vector: Network
· Complexity: Low
· Auth Required: None
· Impact: Full system compromise—data theft, log injection, feature flag manipulation, infrastructure mapping...