karkisec

[karkisec @kaks3c]

@roohaa_n thanks mate

[karkisec @kaks3c]

Just bypassed akamai for xss and also showed full ATO

Reported to public program on @bugcrowd

XSS ato sounds impossible on prod apps, but it is not.

#bugbounty

[karkisec @kaks3c]

@SuyashS91823422 login and access sensitive info

[karkisec @kaks3c]

github finding
#bugbounty

[karkisec @kaks3c]

@srsoumyax11 misconfigured opencart api endpoint

[karkisec @kaks3c]

s3 full access
#bugbounty

[karkisec @kaks3c]

@HuynhcHi9 Yes, but in my case i showed pii access from azure blob since it was preprod environment

[karkisec @kaks3c]

phpinfo exposed 🤣
#bugbounty

[karkisec @kaks3c]

@Monir_Ish i forgot

[karkisec @kaks3c]

idor
#bugbounty

[karkisec @kaks3c]

app backup access and csrf sxss
#bugbounty

[karkisec @kaks3c]

😂#bugbounty

[karkisec @kaks3c]

@Edx103 next week

[karkisec @kaks3c]

@GokTest very common issue

[karkisec @kaks3c]

@roohaa_n :)

[karkisec @kaks3c]

test

[karkisec @kaks3c]

@radcipher @Bugcrowd thankyou

[karkisec @kaks3c]

I got my first bounty!! many thanks, @Bugcrowd

https://t.co/jS6YcfIOKQ

[karkisec @kaks3c]

@Elam59443 @Bugcrowd thanks @Elam59443

[karkisec @kaks3c]

@ay0ub_n0uri @Bugcrowd thanks @ay0ub_n0uri

[karkisec @kaks3c]

@ashkulyo @Bugcrowd thankyou @ashkulyo💕