زياد

BUG HUNTER

[زياد @marshall9944]

@Ah_AKA_NG @yeswehack بتعلم منك كده كده يا قائد ❤️

[زياد @marshall9944]

"Dojo #54 - Highscore"? Pwned! It was a blast on @YesWeHack!
Think you can take it on? 🌟
https://t.co/y7s52b1UiK
#YesWeHack #ChallengeAccepted

[زياد @marshall9944]

From learning automation security to building something real

Check this out : https://t.co/n33NxEdQz5

[Today Cyber News @TodayCyberNews]

Bug Bounty Tips by @securinti

⛈ Attacks on the phone number input mechanism

Hello! Let's figure out How to find vulnerabilities in the Phone 📱 Number input form.

According to RFC 5341, the URI of a phone number can have parameters that are needed to transfer more accurate data.
Most often, parameters are accepted by mail services or web applications that do not have strict number validation.

⚡ Example: The phone-context parameter can be used to determine which country code(+7,+1) is being used. If you went to the site and determined your city, then when registering by entering your phone number, you can enter your number without the country code. it can be substituted in the parameter.

⚡ Attacks using parameters:
⚡ XSS
[phone];phone-context=<script>alert(1)</script>
// You should put in the query string the parameter in which the number is placed

⚡ SSRF
[phone];phone-context=burpcollab

// Rarely works, mostly on older systems

⚡ OTP Bypass Lock
[phone];ext=0
[phone];ext=2
[phone];ext=3

// If blocked, then we substitute ext with a number and continue to brute from the code from which we locked

📌 Refference
https://t.co/ZW7vhgjDEo

👀 Check Out Old Tweets Of @TodayCyberNews

#CyberSecurity #bugbountytips #BugBounty #infosec #Pentesting

[Unknownzerobit @AhmedMa07846126]

You've been running nuclei + subfinder + httpx for weeks. Zero bugs.
Meanwhile someone tweets "automated my way to a $10k bounty" and it feels like they know something you don't.
They don't. Here's what's actually different 🧐

[زياد @marshall9944]

EZ 🥀❤️

[زياد @marshall9944]

نجهز لامتحان nti و recap الactive directory في السريع

[Resh3à @Rechards00n]

صباح الخير. ( لا تنشغل بغير الطريق)

[زياد @marshall9944]

هي ال ray ban meta glasses دي رخيصة اوي علشان يبقى كل شوية يطلعلي ريلز لكونتنت معمول بيها

[أحمد عبد المنعم @A_Abdelmonem82]

- هذا اللقاء رحلة سريعة داخل سورة النور في محاولة لاستكشاف النور الرباني الذي أنزله الله في هذه السورة ليخرج الناس من ظلمات الشهوات والأهواء إلى نور ربهم.
- رحلة مع بعض حكم الشريعة من الجمع بين الحدود التشريعية والوعظ، رحلة مع تفاصيل مجتمع النور ومجتمع الظلام الذي يغيب عنه النور

[bugcrowd @Bugcrowd]

/api/user/profile?user_id=12345

Tweaks you can do on this endpoint: 🤔
➡️ user_id=12344
➡️ user_id=-1
➡️ user_id=123′ OR ‘1’=’1
➡️ user_id=12345&amp;user_id=12344
➡️ {“user_id”:[“12345″,”12344”]}

What else will you try? 👇

[زياد @marshall9944]

@OmarGhazaly26 @NBE1898

[زياد @marshall9944]

@khaled014123651 @DsokeyyV لأنه هو شخصيا بيقول انه بيستخدم ai

[زياد @marshall9944]

@DsokeyyV ده الواد الصربي عارفه عملتله بلوك من كتر مكرهني في عيشتي
الواد ده من كتر ما هو جامد بقيت اشك انه ممكن يكون بيفيك الحاجات دي

[زياد @marshall9944]

نجهز لامتحان nti و recap الactive directory في السريع

[Nitin Gavhane @NitinGavhane_]

📂 BUG BOUNTY
┃
┣ 📂 Recon
┃ ┣ 📂 Subdomain Enumeration
┃ ┣ 📂 Asset Discovery
┃ ┣ 📂 Port Scanning
┃ ┣ 📂 HTTP Probing
┃ ┣ 📂 DNS Enumeration
┃ ┗ 📂 Tech Detection
┃
┣ 📂 Web
┃ ┣ 📂 IDOR
┃ ┣ 📂 XSS
┃ ┣ 📂 SSRF
┃ ┣ 📂 SQLi
┃ ┣ 📂 CSRF
┃ ┣ 📂 SSTI
┃ ┗ 📂 File Upload
┃
┣ 📂 API
┃ ┣ 📂 API Discovery
┃ ┣ 📂 BOLA
┃ ┣ 📂 Authentication
┃ ┣ 📂 Authorization
┃ ┣ 📂 Rate Limiting
┃ ┗ 📂 Mass Assignment
┃
┣ 📂 Auth
┃ ┣ 📂 OAuth
┃ ┣ 📂 JWT
┃ ┣ 📂 Sessions
┃ ┣ 📂 MFA
┃ ┗ 📂 Account Takeover
┃
┣ 📂 Automation
┃ ┣ 📂 Recon Automation
┃ ┣ 📂 Nuclei
┃ ┣ 📂 Custom Scripts
┃ ┣ 📂 Asset Monitoring
┃ ┗ 📂 Workflow Orchestration
┃
┣ 📂 Burp Suite
┃ ┣ 📂 Proxy
┃ ┣ 📂 Repeater
┃ ┣ 📂 Intruder
┃ ┣ 📂 Extensions
┃ ┗ 📂 Match & Replace
┃
┣ 📂 Cloud
┃ ┣ 📂 AWS
┃ ┣ 📂 Azure
┃ ┣ 📂 GCP
┃ ┣ 📂 S3
┃ ┗ 📂 Misconfigurations
┃
┣ 📂 Reporting
┃ ┣ 📂 Validation
┃ ┣ 📂 PoC
┃ ┣ 📂 Impact
┃ ┣ 📂 Severity
┃ ┗ 📂 Report Writing
┃
┗ 📂 Growth
┣ 📂 Writeups
┣ 📂 CVE Research
┣ 📂 New Attack Surfaces
┣ 📂 Workflow Optimization
┗ 📂 Continuous Learning

The goal isn't to use more tools.

It's to build a workflow where every step feeds the next.

Recon → Discover → Test → Validate → Report

That's bug bounty orchestration.

#BugBounty #CyberSecurity #AppSec

[أجمل ما قرأت @AJM900]

مفاتيح الفرج عشرة..

[زياد @marshall9944]

جميل

[Naru @OmarNaru1110]

كتبت المقال يخواتي
اقروه هتستفادوا إن شاء الله
https://t.co/PzhXXAX5cW

[زياد @marshall9944]

المجد للكادحين المجد لكل واحد بيكتب كود في ورقه

[Microsoft Learn @MicrosoftLearn]

If you're wondering whether it's still worth learning how to code, the answer is:
Now more than ever.

[bl0rph 🇩🇿 @bl0rph]

This is how changing my profile picture turned into a 4000$ bounty !

https://t.co/NOXjzKsCWN