Muhammad Sarim Raza

Breaking Security Legally

[Muhammad Sarim Raza @hackipy]

Thanks for the swag❤️ @Sony

[Abhishek Meena 🏵️ @aacle_]

Everyone knows HackerOne Hacktivity.

Nobody knows this repo:

reddelexc/hackerone-reports (6.4k stars).

Bug types Hacktivity doesn't: Business Logic, REST API, GraphQL, Web Cache, MFA, Auth Bypass, Mobile.

https://t.co/zmobQYk1KA

Bookmark before it disappears.

[Muhammad Sarim Raza @hackipy]

@georgegalloway @grok What do you say in this matter?

[Bill Madden @maddenifico]

"Your attack on Iran is working. No one is talking about you raping children."

[dawgyg - WoH @thedawgyg]

Friendly reminder: Fuck Netanyahu.

[Tib3rius @0xTib3rius]

Just heard about HackerOne allegedly training an AI pentesting agent on private bug bounty reports.

Which is great news.

I’ve always wanted to be part of something bigger than myself.

Like a dataset.

I logged into the platform to review one of my old private reports.

The one with the 47-step reproduction chain and the custom Burp extension I wrote at 2:13am.

It now feels less like a finding.

More like a contribution to the collective.

Some people are upset that private reports might be used to train an AI.

I prefer to think of it as mentorship.

I walked so the model could run automated recon at scale.

That’s legacy.

The platform says it’s trained on years of proprietary exploit intelligence.

Which sounds suspiciously like “stuff we already did.”

But I appreciate the rebrand.

I used to be a hacker.

Now I’m pre-training data.

Career growth.

I checked my dashboard to see if I get royalties.

There is no royalties tab.

But there is a leaderboard.

I assume the AI is climbing it.

I hope it enjoys the hoodie.

A few researchers are worried this devalues human work.

I disagree.

My work has never been more valuable.

It’s now infinitely reusable.

Like a zero-day sourdough starter.

I submit vulnerability reports.

The AI absorbs them.

The AI pentests the same targets next quarter.

Somewhere in there is synergy.

Or recursion.

Hard to tell.

I asked support if the AI will be submitting duplicate reports based on patterns it learned from mine.

They said the system is designed to enhance signal.

I respect that.

Nothing enhances signal like automation replaying my exact payloads at machine speed.

I’ve decided to lean into this.

From now on, I will optimize my reports for model readability.

Clear headings.

Concise PoCs.

Structured exploitation paths.

If I can’t win the bounty, I can at least improve the weights.

This is what scale looks like.

The future of bug bounty is continuous, AI-driven testing powered by historical exploit intelligence.

Which is a very elegant way of saying:

“Remember that bug you found? It found you back.”

I’m proud to be part of the ecosystem.

Even if the ecosystem is now pentesting itself.

Submitting my next report tonight.

For training purposes.

[BugBountyHQ @BugBountyHQ]

Thread - My own opinion & this is to the Bug Hunters, What @Hacker0x01 is doing re AI, is essentially stealing “our work” “our research” for their own profitability. They are for sure breaking client agreements, wherein a clients data / vulns belong to the client. Not H1!!

[Intigriti @intigriti]

Quickly testing for dependency confusion attacks:

1. Find package names used by your target (look for package.json/package-lock.json or sourcemap files)
2. Check the package name at npmjs\.com/package/<PACKAGE_NAME>
3. If it returns a "package '<PACKAGE_NAME>' not found", you may be able to take it over! 😎

Example 👇

[Muhammad Sarim Raza @hackipy]

@BuildHackSecure Read Code Easily

[Muhammad Sarim Raza @hackipy]

@BellicIV This game is a masterpiece no doubt. If someone is liking Fifa (or any other E-Football) there's no problem there is no comparison between these two, they are two different genres

[Muhammad Sarim Raza @hackipy]

@thedawgyg Focused on a private program on HackerOne. I must say finding a program that interests me and sticking to it for longer is the biggest challenge for me.

[DarkShadow @darkshadow2bd]

💀RCE in mail☠️
In Login/register page:

1. Insert a normal mail and intercept on burp
2. Replace the mail to OS command payload
3. Don't use space in the payload
4. Replace space to ${IFS}
5. Try blind OS injection using burp collab URL

Join my telegram https://t.co/J6uPf8H57o

[Muhammad Sarim Raza @hackipy]

@Adityapandeydev still ChatGPT

[Intigriti @intigriti]

Web message (postMessage) vulnerabilities can be anywhere! 🤠

But tracking them manually across multiple iframes and windows is a nightmare 😓

postMessage-tracker by @fransrosen is a Chrome extension that automatically monitors and logs all postMessage listeners in real-time, including hidden listeners in iframes, short-lived listeners, and cross-window communication.

Check it out! 👇
https://t.co/tDnQh15ZHQ

[Muhammad Sarim Raza @hackipy]

sad to see all of this

[Seokchan Yoon / 윤석찬 @_seokchan_yoon]

The Django team is considering dropping @Hacker0x01 due to the large number of low-quality reports. 👀

[Muhammad Sarim Raza @hackipy]

yeah totally

[Muhammad Sarim Raza @hackipy]

trash

[The Bingus Man @NotNordgaren]

Windows is SO GOOD that when I search for an app I want to open, it opens up the website of the app instead of the actual app I have installed on my PC.

LOVE IT!

[Muhammad Sarim Raza @hackipy]

😂😂😂

[Infinity Gamer @official_IG_X]

🤣🤣🤣

[Muhammad Sarim Raza @hackipy]

Just completed the Bug Bounty Masterclass by @galnagli It was amazing. A huge shoutout to Gal Nagli for creating such a powerful learning experience. In just 4 hours, this masterclass delivered more value than many multi-day courses.
#bugbounty #hacking #webhacking

[Muhammad Sarim Raza @hackipy]

@thedawgyg Auth Bypass via weak creds

[X @TheMsterDoctor1]

Default Credentials (Extended)
12.Apache

User: admin
Password: admin

13.Apache Tomcat (Manager)

User: admin
Password: admin

https://t.co/lstTwcQKb4 EC2 AMI (Linux)

User: ec2-user
Password: (SSH key only / none)

15.Fortinet FortiGate

User: admin
Password: (blank)

16.F5 BIG-IP

User: admin
Password: admin

17.GitLab (fresh install)

User: root
Password: 5iveL!fe

18.Grafana

User: admin
Password: admin

19.HP iLO

User: Administrator
Password: admin

20.Jenkins

User: admin
Password: admin

21.Kubernetes Dashboard (older setups)

User: admin
Password: admin

22.Magento

User: admin
Password: admin123

23.Mikrotik RouterOS

User: admin
Password: (blank)

24.MongoDB (legacy / misconfigured)

User: admin
Password: admin

25.MySQL

User: root
Password: (blank)

https://t.co/kHXxkVPR9E WebLogic (alt)

User: system
Password: manager

27.PostgreSQL

User: postgres
Password: postgres

28.QNAP NAS

User: admin
Password: admin

29.Redis

User: (none)
Password: (none)

30.Synology DSM

User: admin
Password: admin

31.VMware ESXi

User: root
Password: vmware

32.WordPress

User: admin
Password: admin

33.XenServer

User: root
Password: xenroot

34.Zyxel Router

User: admin
Password: 1234