Mass0ma

Bug Bounty Hunter

[Hussein Daher @HusseiN98D]

3 months ago, I took the challenge to take over one of the most hardened bug bounty programs ever. 30 days later, ranked top 1 within the rules and exited. Since then, I still have the crown. Sharing a couple mental tips ⏬️

[Tanner @itscachemoney]

New blog post outlining a fun phishing technique to look out for!

https://t.co/HosbhKB7WF

[David Schütz @xdavidhu]

I found a vulnerability that allowed me to unlock any @Google Pixel phone without knowing the passcode. This may be my most impactful bug so far.

Google fixed the issue in the November 5, 2022 security patch. Update your devices!

https://t.co/LUwSvEMF3w

[Justin Gardner @Rhynorater]

Here are a couple things I always check when looking at a web application: 🧵

[siLLyDaddy @sillydadddy]

📢#infosec AMA v2.0 #61

Our next guest for v2.0 is :-

✨✨ @hunter0x7 ✨✨

Ask him about #bugbounty #cybersec or anything else.

RT, Like, ask question to win (guest selects the winner) a voucher by
@PentesterLab

Date :- Oct 7

[Peter M @pmnh_]

New blog post looking back on my first 2 years in bug bounty, happy to answer questions or comments about the experience here: https://t.co/j56V33na2X

[Mass0ma @mass0ma]

@monkehack @0xDexter0us @Rhynorater @ryotkak @0xDexter0us bhai aap toh kafi famous ho gaye 😁

[Yassine Aboukir 🐐 @Yassineaboukir]

I’ve never done a similar giveaway but got 2 professional passes to @bsidesahmedabad 🇮🇳 that I’d love to donate should you be interested in attending and haven’t purchased one yet.

Just FOLLOW me and RETWEET this post to participate 🤍

[Neeraj Sharma @root_n33r4j]

How I found a Critical Bug in Instagram and Got 49500$ Bounty From Facebook
Write-up: https://t.co/CIRAhuAVMC

[HTTPVoid @httpvoid0x2f]

Thread - Confluence Blind OGNL Injection analysis from our limited java knowledge. From vulnerable sink to becoming admin of the confluence instance. #CVE-2022-26134. Tested on latest vulnerable version 7.18.0.

[Mass0ma @mass0ma]

@0xDexter0us Sed

[Immunefi @immunefi]

Whitehat satya0x reported a critical vulnerability in @wormholecrypto on Feb 24 via Immunefi.

The bug was quickly patched, no user funds were affected, and satya0x received a $10 million payout from Wormhole, the largest bounty payout on record.

https://t.co/xKDGxfFLjA

[Orange Tsai 🍊 @orange_8361]

Not every research ended with RCEs, but I can promise the bugs (especially the Auth-Bypass) in my #BHUSA talk must be fun and insane! @BlackHatEvents

[Youssef Sammouda (sam0) @samm0uda]

Multiple bugs chained to takeover Facebook Accounts which uses Gmail. ( $42k )

https://t.co/tdXO3u5ddA

[Hussein Daher @HusseiN98D]

If you haven't yet seen, this is how we hacked a BIG bank 😱 . With @infosec_au , We were able to gain RCE on more than 100 different subdomains by exploiting a 0day we discovered. Reported through their #bugbounty program. Enjoy the read!

https://t.co/TlG6e5DINs

[Peter M @pmnh_]

Finally, my first blog post on an interesting advanced sqlmap use case I found recently through a code audit. Shows how to combine sqlmap options to automate a complex scenario involving a mid-parameter SQLi on an error page. Enjoy! https://t.co/FzXM4BalOb

[Masonhck357 @Masonhck3571]

I have finally finished one of my many writeups due to the community. In celebration, I will be giving out 3 1-month subscriptions to @PrettyRecon. Comment, RT and follow to be considered for the giveaway! #bugbountytips #bugbounty #cybersecurity

https://t.co/GVVk8MOScU

[H4x0r.DZ @h4x0r_dz]

Search for all leaked keys/secrets using one regex!

regex: https://t.co/LKUYvLbWBr

#BugBounty #bugbountytip

[shubs @infosec_au]

A few months ago, I collaborated with @HusseiN98D to find critical vulnerabilities in a bank. It involved finding a 0day in dotCMS. You can read about the discovery and exploitation process here: https://t.co/prFg60QieF

[PentesterLab @PentesterLab]

🍾🪩🪅🎉🥳Giveaway time! 🥳🎉🪅🪩🍾

We are going to send a t-shirt and few goodies to one person who follows
@PentesterLab

and likes this tweet !!

And we are going to give a 1-year voucher to someone who RT this tweet!