Hamid Ashraf

Security Researcher

[Adnan Aadi🇵🇰 @Hussain3Adnan]

U dont give a f**k about youth when our time comes we dont give a f**k about u 🖐 #ImranKhanKhulwaoPUBG

[Hamid Ashraf @hamihax]

@hinaparvezbutt Ramzan m be nashah nhii choro ap na ??

[Salman Nizami @SalmanNizami_]

After Arab's stand against Indian Islamophobics, those who work in Gulf have deactivated their fb & twitter accounts. Many have been booked, others have apologised for their remarks. Jab peet pe laat padhti hai, tab dharam aur bhakti bhool Jati hai!

[Osama Avvan @osamaavvan]

Writeup about $1800 worth Clickjacking.
@Bugcrowd #BugBountyTip

https://t.co/FORx9tP4Zf

[Aditya @ADITYASHENDE17]

RCE for life♥️😛
$$$$+$$$ Bonus
1.Started knockpy for scan
2.Found odoo service IP
3.Checked response in https://t.co/OVBbdnC30s
4. 302 redirect 😅😛
5.Redirected to jenkins instance
6.Unauthorized access to CLI terminal
7. Command id

[Sarmad Hassan @JubaBaghdad]

I just published my write up:
https://t.co/oqXbQXlViw

[Khizer Javed @KHIZER_JAVED47]

sad to see such a Blog @PayPal & @Hacker0x01 both need to address this accordingly... #BugBounty

https://t.co/6J7Uk7E6dJ

[Somdev Sangwan @s0md3v]

Another example of two systems handling data differently and how it can be exploited.

tl;dr
ℹ️ <[email protected]>[email protected] is submitted as the email address
ℹ️ Email is sent to [email protected]
ℹ️ But [email protected] gets registered

https://t.co/9BNelny0AY

[payloadartist @payloadartist]

Amazing handy cheatsheets for mobile #security testing!

#bugbounty #bugbountytip

[Intigriti @intigriti]

Ever wonder how @Th3G3nt3lman consistently collects $15K bounties? 💰How to attack API's or React Native apps? 📱Read this, and much more, in this week's #BugBytes!
https://t.co/0AtM3gTxZj

[Hamid Ashraf @hamihax]

@iihtishamm @majorgauravarya ye bc pagal lagta hai mujy .......

[Z. #Messi @zainnwho]

Must watch Series:

Designated Survivor
House Of Cards
Viking
Money Heist
The Spy
Fauda
Punisher
Narcos
Breaking Bad
Dexter
Sons Of Anarchy
True Detective
Suits
Bodyguard
Peaky Blinders
Lost
Prison Break
You
Chernobyl
Originals
Flash
Banshee
Spartacus
The Wire
GOT
Brooklyn Nine9

[clos2100 @pirateducky]

https://t.co/V5dtZj1dpX

added a few more thing's after I submitted, but here's my writeup for the 30K CTF from @NahamSec

thank you @garagosy & @NahamSec - it was a lot of fun

[Seebug @seebug_team]

Mysql Client Arbitrary File Reading Attack Chain Extension by Knownsec 404 Team https://t.co/HEMURjVRwp https://t.co/aCJJBlDkeT

[BRute Logic @BRuteLogic]

Nice stuff, check it out! 😎

[mpgn @mpgn_x64]

Update CVE-2019-19781

You can exploit the vulnerability without the file https://t.co/HwA04i1qfJ and only use the file https://t.co/PJ0l4BRdXN !

You can inject your payload inside the name of the XML file and fire the command execution ! 🔥💪

#shitrix #citrix

[Youssef A. Mohamed @GeneralEG64]

I just released some of my PoCs!

IDOR:
https://t.co/E6hBaWp5Zp
Stored XSS:
https://t.co/5laqvlf2U7
Stored XSS:
https://t.co/KkJRiliLAA
RXSS:
https://t.co/gH79T97lnm
RXSS:
https://t.co/cJUzLJOWYn
RXSS:
https://t.co/Kn51livk47
RXSS:
https://t.co/Dc9irDxZSC

#GeneralEG
#BugBounty

[Raunak Parmar @trouble1_raunak]

Ppl interested to learn about SSRF attacks👇

1. https://t.co/oSlzImMal8

2. https://t.co/g22nDDaYUW

3. https://t.co/AQaViw4qLN

4. https://t.co/ulr5d1k1Ar

5. https://t.co/nlU3YmFWh1

6. https://t.co/JDsoeBBOvZ

7. https://t.co/dOrbxSFH6i

8. https://t.co/ksMGmQVlUE

Writeups

[Abhishek Yadav @abhishekY495]

I just published "My First RCE (Stressed Employee gets me 2x bounty 🤑)"
#bugbounty #bug #bounty #bugbountytip
https://t.co/11GF7bsr8J

[Katie Paxton-Fear @InsiderPhD]

New video incoming! 🚨

In this video, we talk APIs. What they are, where to find them, and most importantly how to test them for bugs! We cover: API recon, the most common API bugs and teach you how to find them
#bugbountytip #BugBounty #CyberSecurity

https://t.co/3hDwOizxwl