Hamza Avvan

Cybersecurity Researcher | Bug Bounty Hunter ❤

[Hamza Avvan @hamzaavvan]

VDP to Bounty!! I was awarded a $250 bounty on @Hacker0x01!

I started hunting on a VDP. Luckily I found an open redirect. Reported it via their website's responsibile disclosure page. Got a verification email from hackerone.

https://t.co/vYLfoIvbpC #TogetherWeHitHarder

[Hamza Avvan @hamzaavvan]

@bektips321 @gitconnected Sorry for the late reply but are they using some third party application?

[Hamza Avvan @hamzaavvan]

I just published in @gitconnected Quick & Easy $100 Bug That You Can Find In 5 minutes https://t.co/VwB7wjphDS

[Hamza Avvan @hamzaavvan]

@intigriti @chux13786509 Done🙂

[Hamza Avvan @hamzaavvan]

@intigriti @chux13786509 Done🙂

[Hamza Avvan @hamzaavvan]

@MalouTenebroso @jordsjailacc When you find out its a bot account.

[Hamza Avvan @hamzaavvan]

@Gisme_1 @snfiidev @gitconnected knowledge of javascript can help you. The trick is to replace repetitive operators with variables for making it shorter.

[Hamza Avvan @hamzaavvan]

I just published in @gitconnected 4 XSSs With A Simple & Optimized Payload https://t.co/vGgT98izrK

[Hamza Avvan @hamzaavvan]

Bug Bounty Intigriti Challenge 0223 Stored XSS Via Image Exif https://t.co/kuuijkJy7z via @YouTube

[Hamza Avvan @hamzaavvan]

@snfiidev @gitconnected Try this link, it will work😉
https://t.co/lUUMIO7XrG

[Hamza Avvan @hamzaavvan]

@snfiidev @gitconnected The optimized one. It's mentioned in the article 🙂

A=![]+'';B=!![]+'';C=[][[]]+'';F=[][C[4]+C[5]+A[2]+B[0]+A[4]+B[1]];D=F+'';F[D[3]+D[6]+C[1]+A[3]+B[0]+B[1]+C[0]+D[3]+B[0]+D[6]+B[1]](A[1]+A[2]+A[4]+B[1]+B[0]+'(1)')()

[Hamza Avvan @hamzaavvan]

A Unique Tale Of P1: Exposed GraphQL Leads to Mass User Account Takeovers https://t.co/NmKHymxQcJ

[Hamza Avvan @hamzaavvan]

Check out my playlist: Road To Ethical Hacking https://t.co/OlKzqowoEz via @YouTube

[Tib3rius @0xTib3rius]

.@hamzaavvan has made some awesome YouTube Shorts answering my #AppSec interview questions! Check them out: https://t.co/qudEr4vB83

[Hamza Avvan @hamzaavvan]

@Abubaka35643889 @Hacker0x01 Walikum salam. Come inbox

[Hamza Avvan @hamzaavvan]

VDP to Bounty!! I was awarded a $250 bounty on @Hacker0x01!

I started hunting on a VDP. Luckily I found an open redirect. Reported it via their website's responsibile disclosure page. Got a verification email from hackerone.

https://t.co/vYLfoIvbpC #TogetherWeHitHarder

[Hamza Avvan @hamzaavvan]

@badthin2 @Hacker0x01 I apologize for the late reply but you can increase the severity of clickjacking by tricking a user into performing sensitive actions like changing their email address, deleting account, etc.

[Hamza Avvan @hamzaavvan]

@Brumens2 @yeswehack Thanks😊

[Hamza Avvan @hamzaavvan]

Second-order SQL injection on view parameter.

1. Create a malicious note with SQLi payload through /?note=<payload> parameter.
2. Goto /?view to execute your SQLi payload

#SQLI #bugbountytips

[YesWeHack ⠵ @yeswehack]

Vulnerable Code Snippet 💀

🥁 This time we have improved the experience by making it possible to run this code snippet in a docker environment!

Can you find the bug this time?
Practice your skills and try it yourself on our Github👇
https://t.co/fILsXfBZDi

#YesWeRHackers #BugBounty #YWHSnippet

[Hamza Avvan @hamzaavvan]

@Brumens2 Thank you

[Hamza Avvan @hamzaavvan]

Worth trying for anyone who wants to improve their XSS skills or learn something new. XSS via stylesheet injection challenge by @yeswehack.

#YesWeRHackers

[Hamza Avvan @hamzaavvan]

@yeswehack @yeswehack Is this the right way?