kymu

just like to hack and review code
الحمدلله

[kymu @kymu___]

@0xPira getting paid service for free is case by case thing, some programs accept it, some don't

[kymu @kymu___]

@kawakatz Nice find !

[Masato Kinugawa @kinugawamasato]

DOMPurifyバイパスの歴史をまとめたページ。HTMLサニタイザーバイパスのノウハウがぎっしり詰まってる。
特に今年に入ってから発見された<selectedcontent>のバイパスは驚いた
https://t.co/PNPSorjJEL

[kymu @kymu___]

@Alra3ees الله يشفيك

[kymu @kymu___]

@_MrPlanB The request not the response, yes

[kymu @kymu___]

weird case of Confirmation Code bypass i found a month ago and was rewarded 4 digits bounty for it
if you race the confirmation code with null value (SMS code/email code) before the code triggers
you can bypass/confirm the email/number since the value of the code is null (code wasn't triggered yet thus why it's null)

[kymu @kymu___]

@Masonhck3571 - the user is telling me "Flibbertigibbeting", this looks like a violation and malicious activity, i have to stop and tell him that i can't move forward with his tasks

[Yassine Aboukir 🐐 @Yassineaboukir]

“Bug bounty is dying” is noise.

Lock in. Make money. Use AI to 10x your output. If it eventually dries up, you’ll have enough capital to start that biz or enough experience to land a job.

Simple as that.

[kymu @kymu___]

@0xMstar its not always a scam, there is internal team that does test for vulns before pushing any update/feature

[kymu @kymu___]

@the_IDORminator those clankers

[zhero; @zhero___]

New short article on a real-world exploitation case rather than pure research, demonstrating how a specific mistake in Next.js can lead to a systematic zero-click SXSS on its latest versions (w/@inzo____):

Re:CACHE - Excessive reflection, type confusion, and 0-click SXSS on Next.js

https://t.co/0JWjH6yzC2

[kymu @kymu___]

@dPhoeniixx @njcve_ @Hacker0x01 probably shopify

[kymu @kymu___]

@whoareme33 Nice work man !

[kymu @kymu___]

@mountainaddict0 and the first thing that comes to your head is insulting them like this and wishing their murder? this childish behavior has no place in cyber security
no one forced you to test their assets, grow up

[Intigriti @intigriti]

🫣🫣

[kymu @kymu___]

@busf4ctor yeah i thought it about it too before, which made me avoid some targets, but when i did put it into the test myself, i found many issues in targets that pay well, it all depends on your ideas and your way of thinking

[kymu @kymu___]

@efaav @rez0__ nice work

[kymu @kymu___]

interesting find
https://t.co/z5P6lCGbKM