Habibur Rahman Hasan

Assalamualaikum.
Trying to be a bug hunter.

[Habibur Rahman Hasan @hasn0x]

I helped secure the Internet 😃

Alhamdulillah! Recently I received swag from @Hacker0x01 and @fastly .

[Densel @luckyhacker43]

"$500 for a UUID Swap: I Almost Gave Up on This IDOR" by tinopreter 🤯🔥

👨‍💻 tinopreter (x/tinopreter)
🔗 https://t.co/bOYIuLHxVx

🔗 Join team 👉https://t.co/FeMz53HSN0

[Amr Elsagaei @amrelsagaei]

Auth bugs pay the most in bug bounty. Most hunters never touch them, because they never actually understood how auth works.

In this video, I break down web auth the way the developer who built it sees it. Sessions, JWTs, OAuth 2.0, the Authorisation Code Flow, PKCE, and OpenID Connect. Why each protection exists, what it defends, and the exact bug that shows up when it's missing.

Auth For Hackers https://t.co/RJ8gr7FkpS

#BugBounty #WebSecurity #EthicalHacking #AmrSec #OAuth #JWT #OIDC

[Kuldeep Pandya @kuldeepdotexe]

They verify your login in client-side JavaScript, never on the server. So you can walk right in.

New write-up: Client-side Authentication Bypass. 4 real cases (one led to a $4,000 SQLi):

https://t.co/XYNTSx2t6q

#BugBounty #AppSec #InfoSec #BarracksArmy

[Densel @luckyhacker43]

$15,000 Facebook Bug Bounty 🤑

How a Simple GraphQL Query Exposed Facebook Page Admins and Their Personal Emails by Vivek PS 🤯🔥

👨‍💻 Vivek PS (x/vivekps143)
🔗 https://t.co/5w9lpVLcQE

🔗 Join team 👉https://t.co/FeMz53HSN0

[Intigriti @intigriti]

We just dove into our shelf of archived bug bounty write-ups from the most notable hackers! 🤠

In this issue, we selected 5 compelling articles (that are still relevant today) to share with you, from which you can learn something new! 😎

🧵 👇

[Intigriti @intigriti]

Quick reminder!

With or without AI, developers still accidentally push API keys, credentials, and any other types of secrets to public repositories every day! 🤠

Our complete guide shows how you can find them before anyone else using several techniques. 😎

Check it out! 👇
https://t.co/Jxe0FJC4pz

[skull @brutecat]

Hacking Google with A.I. for $500,000

https://t.co/S8NbDU9ZaN

[Habibur Rahman Hasan @hasn0x]

@asad0x01 @wunderwuzzi23 Yeah, submitted on May 5, got initial eval on May 11. No further portal updates since then, but noticed it's completely fixed. It’s a core logical bypass with high revenue impact, so I guess they are taking time to fully assess the numbers.

[Habibur Rahman Hasan @hasn0x]

@mamunwhh @Hacker0x01 ma sha allah vai

[Habibur Rahman Hasan @hasn0x]

@Emad777_ @wunderwuzzi23 same question dude

[Habibur Rahman Hasan @hasn0x]

@syper_shuvo Owh acchaa
btw bug type?

[Habibur Rahman Hasan @hasn0x]

Any Meta bounty hunters around? Need to clear up a few general doubts regarding their payout timeline/process.

[Densel @luckyhacker43]

A Journey of Limited Path Traversal To RCE With $40,000 Bounty!

https://t.co/s4pzvjTIiT
Join my channel. Link on Bio

[Habibur Rahman Hasan @hasn0x]

@BugBountyDEFCON @hackthebox_eu @PentesterLab @fteagleeye1 @mmnah1an

[Bug Bounty Village @BugBountyDEFCON]

Time for another giveaway!

We will pick 6 winners to win one of the following:

1x Annual VIP @hackthebox_eu Licence
5x @PentesterLab 3 Month Licences

To enter:
1️⃣ Follow us @BugBountyDefcon
2️⃣ Like this post ❤️
3️⃣ Re-tweet this post 🔁

Giveaway open until Monday June 15th! GOOD LUCK!

[Habibur Rahman Hasan @hasn0x]

@kamrul0x @Hacker0x01 ma sha allah vai

[systemd @secsystemd]

Stored XSS in markdown via the DesignReferenceFilter

Read Disclosed Report : https://t.co/hATe8NqWCZ

Report Submitted by vakzz
Bounty 16000$

[Habibur Rahman Hasan @hasn0x]

@intigriti in sha allah

[Habibur Rahman Hasan @hasn0x]

Selected as the 1st Write-up Winner for the @intigriti Challenge 0526!
Out of 33 submissions, they liked my documentation of 3 different solve paths (including an unintended one). Waiting for the SWAG!

Read it here: https://t.co/Csh6LD8W3l

#Intigriti #bugbountytips