S S S S S

full time bug bounty hunter

[S S S S S @mcx2124]

@gkdataio Yup, you're right. Someone found a simple preview IDOR on H1 a few months ago. It was so easy to find, and he got a $15K bounty.

[S S S S S @mcx2124]

Found a BAC and submit it within just an 20 minutes.

It was a popular public program, decades old, and heavily fuzzed by bug hunters.

Yet somehow, a simple BAC was still hiding in plain sight

[S S S S S @mcx2124]

@incarnate_xyz Purely manual

[S S S S S @mcx2124]

@mhdagusprbdi Yup coming soon

[S S S S S @mcx2124]

Finally in Google's Hall of Fame! 🏆

Another milestone unlocked. More to come! 🚀

[S S S S S @mcx2124]

@morbintimenfts @levinhjs Nope not recieved single update . I asked them bot replied The panel is still reviewing your report. We appreciate your patience and will send you an email as soon as a decision is made.
I am still waiting for bounty

[S S S S S @mcx2124]

Does anyone have an idea? I submitted a P2 bug to Google 2 months ago. It's fixed now, but I haven't received an update on the bounty yet

[S S S S S @mcx2124]

@MrsteveonX @tabaahi_ Brother, I don't know him personally. I joined bug bounty in 2019, while I think he joined around 2021–22. He may be a good hacker, but posting fake news and AI-edited bounty screenshots just to gain fame is disappointing. Why do people resort to lying for attention?

[S S S S S @mcx2124]

@tabaahi_ Would you mind making your profile public for just 10 minutes? That would serve as proof of your claim?

[S S S S S @mcx2124]

@grok @ZeeNews Also can you tell me what is now trending

[S S S S S @mcx2124]

@grok @ZeeNews What

[S S S S S @mcx2124]

@tabaahi_ This is what HackerOne and Bugcrowd say about your reports

[Gospel @4osp3l]

I found this interesting "403 Forbidden" Bypass; through "Microsoft-Azure-Application-Gateway/v2"

1. Accessing the URL returns "403 Forbidden"

2. Appending the query "?x=.js", successfully bypasses the Azure restriction leading to direct access to the restricted resource.

[bugcrowd @Bugcrowd]

➡️ DELETE /api/user/999 → 403 ❌

Try this:
➡️ POST /api/user/999 + X-HTTP-Method-Override: DELETE → 200 ✅
➡️ POST /api/user/999?_method=DELETE → 200 ✅

Gateways/auth middleware often match on verb+path. Frameworks (Laravel _method, Express method-override, Rails) may accept overrides at the router level.

Same for edge rules that only guard GET/POST. Try HEAD/PATCH/OPTIONS too.

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

SSRF Isn’t Always Hidden in Parameters

(Case 1 — Leading Slash)

====>
GET /SSRF-server HTTP/1.1
Host: app

(Case 2 — Without the Leading Slash)

====>
GET SSRF-server HTTP/1.1
Host: app

At first glance, the difference is just one character: /.

When your done from subdomain enum, use this tip over intruder

Happy hunting bros ❤️

#BugBounty #SSRF #WebSecurity #CyberSecurity #Pentesting #BugBountyTips

[sudo @rootsud0]

yeyyy i earned $2,000 for my submission on @bugcrowd #ItTakesACrowd 🔥

[sudo @rootsud0]

finally

[Parsa @skydesperados]

6 months ago I found these vulnerabilities across several companies and earned $15K in bounties
I haven’t hunted on web apps in a while and I really miss it
Hope my writeup helps other hunters

Broken access control on Next js server actions
https://t.co/FZYNkvuZlx

[S S S S S @mcx2124]

@levinhjs Thanks but any idea on bounty