Himanshu J

Strategy | Security. Recognized and awarded under responsible disclosure program by Microsoft, Google, Red Hat, Zoom and many more in the past.

[Himanshu J @jhimansh]

Third security research report that I submitted got accepted by Microsoft.

Three cases in 1 year. Goal achieved.

Will be disclosing about the finding once I get a confirmation on the implementation of a fix.

#hacktosecure #responsibledisclosure #bugbounty #infosec #CyberSec

[Himanshu J @jhimansh]

Need to extract API endpoints and the request body schema of each endpoint after supplying a web URL as input. Exploring Puppeteer and Cheerio library, but facing accuracy issues affecting data quality. Which library should I use? Suggestions?
#appsec #opensource #NodeJS #API

[Himanshu J @jhimansh]

@airtelindia Your broadband is non-existent since last entire month in Pune and there is no way to contact the customer care. If you cannot fix the issue for a month, just inform the customers that you have given up so we can switch to a better internet service provider.

[Hillel Solow @hsolow]

What happens to AppSec when moving to an API environment?

One of the things that I observed when trying to understand the difference between doing application security and API security, is that we're often pushing business logic out to the client.

This…https://t.co/MdncrBYAkK

[Hillel Solow @hsolow]

Agentless vs. agent AppSec for SaaS startups 

Let me start by saying - I know. I know the sound of the word agent probably gives you the shivers. Hear me out. 

Agents have gotten a really bad reputation in the past years, and in most cases rightfully so…https://t.co/akInpxQ0vV

[Himanshu J @jhimansh]

@ShubhamPargaon1 Thanks brother!!

[Himanshu J @jhimansh]

Thrilled to get an invite to celebrate with Microsoft MSRC's most valuable security researchers and Microsoft employees in Las Vegas next month.

#SecurityResearch #infosec #responsibledisclosure #bugbounty #MSRC

[Himanshu J @jhimansh]

Type: HTTP parameter pollution to horizontal privilege escalation.
Asset: Azure Active Directory

It's always a pleasure working with the amazing analysts at Microsoft Security Response Center.

#SecurityResearch #bugbounty #hacktosecure #infosec #MicrosoftSecurity

[Himanshu J @jhimansh]

This is my 4th case with Microsoft's MSRC. This report got triaged in April and a fix was recently pushed. My 1st report was accepted in 2020, then 2 cases in 2021 and now another case in 2022. Happy to receive recognition from Microsoft 3 years in a row for 4 independent cases.

[SickSec 🇲🇦 🇵🇸 @OriginalSicksec]

If your repeater tab is not like this
then you are doing something wrong x)
#Burpsuite #Bugbounty

[shubs @infosec_au]

just because an exploit payload looks simple doesn’t mean it didn’t take a bajillion hours of source code auditing to find

[Yash Devkate 🇮🇳 @rootxyash]

A thread all about CSRF Tips

Pro tip : Bookmark and Retweet this Tweet!

[Himanshu J @jhimansh]

Another security report triaged, accepted and resolved.
Program: Private.
Severity: Medium.
#cybersecurity #responsibledisclosure #hacktosecure
#informationsecurity

[Himanshu J @jhimansh]

Thank you @GoogleVRP for the book! Looking forward to reading this one soon.
#InformationSecurity #Bugbounty #hacktosecure

[Himanshu J @jhimansh]

Happy birthday @stokfredrik!🎉
Thank you for the amazing work that you do! Wishing you a wonderful year of good health, happiness and success!
Hoping to see many more Bounty Thursdays in the future. Cheers!

[Prof. Feynman @ProfFeynman]

Be humble. Be teachable. The universe is bigger than your view of the universe. There's always room for a new idea. Humility is necessary for growth. 🧠

[Himanshu J @jhimansh]

One of the very first few reports that I submitted to Rockset on Hackerone just got disclosed. A non-admin user could access a page meant to be accessed only by the user with admin privileges.
Severity: Medium(4.3)
https://t.co/8nnY087VEC

#informationsecurity #infosec

[publiclyDisclosed @disclosedh1]

Rockset disclosed a bug submitted by @jhimansh: https://t.co/dQbcFRGtbg #hackerone #bugbounty

[Himanshu J @jhimansh]

A submission got accepted as a valid issue by Asana on Bugcrowd.
Vulnerability falls under broken access control to information disclosure.
Severity: P4
#hacktosecure #responsibledisclosure #bugbounty #infosec #CyberSec #informationsecurity

[Louis Nyffenegger @snyff]

“Hacking cannot be taught. Hacking can only be learned.”

(based on a quote from Mikhail Botvinnik about Chess)

[shubs @infosec_au]

I’ve been doing a lot of offensive security source code auditing of enterprise apps over the last six months and every time I show my friends critical pre-auth PoCs they usually respond with “wow i can’t believe no else found that” - the magic is uncovering this attack surface