hackermater

#: Penetration Tester & Security Researcher | eMAPT

[hackermater @hackermater11]

It's hard to believe, but after a long time I got my FIRST BOUNTY... and yeah: it was a P1 Critical $3.000 !!!!

#bugbountytips don't try to automate everything, use Burp Suite and dedicate at least 1-2 weeks to understand the whole application and do manual hacking ;) #bugbounty

[hackermater @hackermater11]

@md_kasif_uddin Neovim

[hackermater @hackermater11]

🔥Finally got a $250 bounty on Bugcrowd!!
👉 Initially Triaged as P3 -> Customer downgraded to P4 -> $250 bounty 💸💸💰💰💰
#bugbounty #bugbountytips #bugcrowd

[hackermater @hackermater11]

Yes! P3 Triaged on Bugcrowd! 💯🤞.
Another bug in mobile scope, I'm still waiting for the customer response in this new week! 💪🍀.
🧠 Tip: Always try bypass client-side restrictions/blocks via backend API through Caido/Burp proxy interceptions.
#bugbounty #bugbountytips #hacking

[hackermater @hackermater11]

@cyber__razz supply chain attack...

[hackermater @hackermater11]

So, do you want to do Bug Bounty in Mobile Apps? 💰📱
🤔 Frida maybe a headache with actual modern RASP protections, so I published my personal method to Bypass SSL Pinning on Play Store Android Emulators WITHOUT Frida!👇
#bugbountytips #bugbounty #hacking
https://t.co/K1oScHDD6j

[hackermater @hackermater11]

😂😂😅

[hackermater @hackermater11]

Yes! P3 Triaged on Bugcrowd! 💯🤞.
Another bug in mobile scope, I'm still waiting for the customer response in this new week! 💪🍀.
🧠 Tip: Always try bypass client-side restrictions/blocks via backend API through Caido/Burp proxy interceptions.
#bugbounty #bugbountytips #hacking

[hackermater @hackermater11]

@Magn4_ the goat 🐐⚡⚡

[hackermater @hackermater11]

@intigriti the Global Search, Match & Replace (IN SCOPE) and filter using Bambdas, (also Race Conditions in Repeater ⚡👌)

[Intigriti @intigriti]

friendly reminder 🙃

[NullSecurityX @NullSecurityX]

Delete highlight cover IDOR bug in Instagram
$3000 Bug Bounty PoC

Write-up:

https://t.co/27HLldM3wl

[hackermater @hackermater11]

I've been using Caido since (sadly) my Burp Pro license expired a week ago😂... and WOW! " I l o v e Caido ❤️. " Never have used it before and it's a really game changer 🔥.
#bugbounty #bugbountytips @CaidoIO #appsec

[hackermater @hackermater11]

@CyberRacheal if the OTP is never stored in the server, then just intercept the response and check it and also the client-side: is a mobile app? then debug with Frida and check logcat. is a web app? use devtools.

[hackermater @hackermater11]

#AndroidSecurity #Pentesting #AppSec #MobileSecurity #BugBountyTips #CyberSecurity

[hackermater @hackermater11]

👉 Escalating WebView Vulnerabilities: From Deep Link XSS to Local File Inclusion (LFI)📱
https://t.co/0VlDsWwcM7

[hackermater @hackermater11]

👉 Escalating WebView Vulnerabilities: From Deep Link XSS to Local File Inclusion (LFI)📱
https://t.co/0VlDsWwcM7

[hackermater @hackermater11]

@F4tM4n2k @PortSwigger @intigriti hey bro, chat with support (they often reply in seconds), with the Intercom floating chat 🙌.

[PortSwigger @PortSwigger]

Exciting news: we have teamed up with @intigriti

Bug hunters can now earn a FREE 6-month Burp Suite Professional license by hitting 400 reputation points on Intigriti.

More power. Deeper testing. Bigger impact.

Happy hunting 🐝

#BugBounty #Intigriti #BurpSuite

[hackermater @hackermater11]

Is this for real? Yeah it is!! 😎💥
👀 DumpDork has a new version, v1.2.0 and this is huge!!

This release now supports GitHub Code Search using Dorks.

Hack using dumpdork from your TERMINAL without CAPTCHA limits right now!

⭐ GitHub repo: https://t.co/zItp4tbpuK

[hackermater @hackermater11]

@CyberRacheal That is the case when you're inside an internal network, not the common LAN network, and this could be part of the configuration of the Router or in the worst scenario, you are under almost total network control by someone else!!😅😂..

[hackermater @hackermater11]

I just learned how to perform an XSS via Host Header Injection and via Cache Poisoning (at the same time).. And.. This is a lot... !

[hackermater @hackermater11]

@intigriti honestly, I just used "CloudHunter" ;)
It was an easy discovery 🔥
https://t.co/dhVG4uUYWI