micro

Sharing code, projects, and failures so you don’t make the same mistakes.

[micro @micro0xff]

I got my first hall of fame 🥳🥳 on @NASA
#BugBounty #CyberSec #NASA #Hacking

[bugcrowd @Bugcrowd]

➡️ DELETE /api/user/999 → 403 ❌

Try this:
➡️ POST /api/user/999 + X-HTTP-Method-Override: DELETE → 200 ✅
➡️ POST /api/user/999?_method=DELETE → 200 ✅

Gateways/auth middleware often match on verb+path. Frameworks (Laravel _method, Express method-override, Rails) may accept overrides at the router level.

Same for edge rules that only guard GET/POST. Try HEAD/PATCH/OPTIONS too.

[Rıdvan Yağlı @ridvanyagli]

🔴 İddiaya göre dün yayınlanan ve CVE-2026-109618/109619 açıklarını kapatan yamaya rağmen PHP 8.5.12 üzerinde çalışan bir RCE oluşturulmuş.

Memory corruption yok, ASAN-clean, pure logic bug. Session serialize_handler mismatch + uygulamada uygun bir gadget olduğunda Apache + mod_php üzerinde tek HTTP isteğiyle uid=33(www-data) alıyor.

[micro @micro0xff]

@adxtyahq How you got that job ?? Where did you apply?

[micro @micro0xff]

@Emunah_0x Give me job refferal instead 😛

[micro @micro0xff]

@your_niaaaa Do they need any cybersecurity professional

[Elon Musk @elonmusk]

https://t.co/yvJOwOS4xE

[micro @micro0xff]

@sumitdotml Cool

[micro @micro0xff]

@VivekIntel Bro is there any job related to reverse engineering, malware development or cracking patching software???

[micro @micro0xff]

@jino_rohit Arch Linux ?

[Muqsit 𝕏 @mqst_]

🔥 A Comprehensive Guide on JavaScript Analysis for Pentesters

Blog: https://t.co/KvHGu75K7L

Author: Konstantin

[micro @micro0xff]

@hamidonsolo What was the vulnerability??

[micro @micro0xff]

@iamMayurChouhan

[VIEH Group @viehgroup]

IDOR in APPLE 🍎

POC ->
1. Created two separate user accounts Account A (attacker), Account B (victim) on
https://t.co/veSFHH5zMp[.]com/publicLocator/deleteApplication
https://t.co/veSFHH5zMp[.]com/publicLocator/submitJoinForm

2. Logged in as Account B, submited the application form and captured the application ID of Account B

3. Now Log in as Account A and intercepted a request to the affected endpoint

4. Replaced Account A’s application ID with Account B’s application ID.

5. Forwarded the modified request

6. Server accepted the request without authorization validation

7. Logged back into Account B

8. Account B’s data is modified or deleted without consent

Impact ->
Any authenticated user can modify or delete other users’ data

Credited to the respected owner
#bugbounty #bughunting #bounty #hacking #ethicalhacking #infosec #cybersecurity #bugbountytips #bugbounty #bugbountytip #bughunting #infosecurity #OWASP #ApplicationSecurity #Bugcrowd #Hackerone #day_20

[bugcrowd @Bugcrowd]

Manual recon doesn’t scale, especially for hidden URLs.

This one-liner surfaces endpoints you didn’t know existed. 👇

[micro @micro0xff]

@three_cube What are the benefits of using caido ? Nothing, burp is best

[micro @micro0xff]

@iyoushetwt That's literally python on your screen

[micro @micro0xff]

day - 9 of ML

> Batch gradient descent
> stocastic Gradient Descent.
> Mini Batch gradient descent
> revised hypothesis testing
> solved leetcode

#DataScientist #machinelearningquiz #ChatGPT #AI

[micro @micro0xff]

@tabXport What was the tech stack?