Hein Thant

the darker the night, the brighter the stars.

[Hein Thant @ht0x0_]

tf is really going on?

[Leandro Barragan @lean0x2f]

I'm not sure the community will like this. @Hacker0x01 will now reuse your novel techniques / exploits / old reports to look for vulns on the rest of the customer's infra. I guess they will add you as collab and give you a bounty, right? right?!

[ggwhyp @ggwhyp]

I was hoping to compete in Pwn2Own with a Firefox full-chain entry, but unfortunately it was rejected. I’ve reported the vulnerability to the Mozilla team.

[Julien | MrTuxracer 🇪🇺 @MrTuxracer]

As promised: Here's my story about 8 CVEs resulting in a plugin removal and more than $30,000 in bounties!

I've chained 3 of them to go from unauthenticated to admin, aka how to exploit a blind SQL Injection via XSS.

https://t.co/Uti9trhWUX

#BugBounty #security

[Hein Thant @ht0x0_]

@LdrTom @Nutritionist_AP hi, i wasn't using paraminer in that case tho. the request was fetching ticket list details from backend in i noticed "employee_name" field in request body array. Thought it'd disclose email if i change with "employee_email" and it did eventually.

[publiclyDisclosed @disclosedh1]

TikTok disclosed a bug submitted by @_heinthant: https://t.co/pkzMVZSBUL - Bounty: $1,000 #hackerone #bugbounty

[Hein Thant @ht0x0_]

holy moly @sudhanshur705

[Hein Thant @ht0x0_]

Stumbled upon an interesting SSRF where i can’t control HTTP method. Is there any way to hit AWS metadata with “POST” method please? #bugbounty

[Frans Rosén @fransrosen]

I decided to make a homage-post to @homakov and @Nirgoldshlager about different OAuth-token leakage methods I've been researching – ten years after their blog posts that inspired me to start hunt for bugs ♥️ thank you.
https://t.co/pODPvDUOU9

[Hein Thant @ht0x0_]

Managed to cross $12000 in June ;)
@Hacker0x01 @SynackRedTeam

[Samuel @saamux]

I have created an article for the Bug Bounty community which is focused on how to orchestrate hacking tools through Slack using python, ideal to be able to work with a workspace and thus be able to manage the tools easily, I hope it can help you.

https://t.co/jIP5sEihem

[Nagli @galnagli]

During @Hacker0x01 Ambassador Worldcup We (me, @rotembar and @realgam3) found DOM Based XSS that affected 6.5m+ Elementor websites, leading to 1 click WordPress panel takeover.

Full writeup on Rotem's blog ->
https://t.co/AfMwENptlt

#BugBounty #BugBountyTips

[Hein Thant @ht0x0_]

In May, I submitted 21 vulnerabilities to 4 programs on @Hacker0x01. #TogetherWeHitHarder https://t.co/oD25hdcvI9

[The Bug Bounty Hunter @tbbhunter]

Hacking Smart Contracts: Beginners Guide

https://t.co/cbZhXWKsvn

[张惠倩 @momika233]

Swagger-UI - from XSS to account takeovers

hxxp://x.x.x.x/index.html?configUrl=https://t.co/vrO9u1ZNG9

https://t.co/alCbaQ8V2G

#bugbountytips #BugsBunny

[Hein Thant @ht0x0_]

Good to be back at H1 after a long break.

Dont just blindly bruteforce 6-8 OTP. Try to understand the applications logic and bypass with alternative path which dev might not notice about.
#bugbounty

[yappare @yappare]

@hacker_ https://t.co/2gap9suWY3 unashamedly share my post here :D

[Shashank | CredShields @cyberboyIndia]

Blockchain & Smart Contract Security #1
Understanding Access Control in Smart Contracts and the Hospowise smart contract hack.
Detailed blog post and a thread 1/6
https://t.co/eNNIMRQHT0

[Corben Leo @hacker_]

How you can learn to hack web3 (and protect millions of dollars):

[Hein Thant @ht0x0_]

@kuldeepdotexe @SynackRedTeam I was on this target. nice find and great writeup man!