Mohamed Ahmed

Here to break things

[Mohamed Ahmed @mooo_sec]

@nowisar1878 I don't have i only have YouTube

[Mohamed Ahmed @mooo_sec]

🚨 Another critical vulnerability 10/10.

#bugbountytips #bugbounty #cybersecurity

[Mohamed Ahmed @mooo_sec]

@professor_xa1 Shodan

[Mohamed Ahmed @mooo_sec]

@bugoverfl0w User: admin
Pass: (empty)

[Mohamed Ahmed @mooo_sec]

@4osp3l Congratulations

[Mohamed Ahmed @mooo_sec]

@Gl1tchhx Yes

[Mohamed Ahmed @mooo_sec]

How I accessed a Grafana admin panel during my recon process:

• Chose a target with all assets in scope
• Used Shodan (SSL search) and Google dorking ("Copyright © target") to discover related domains outside the main domain

[Mohamed Ahmed @mooo_sec]

Got paid even though the vulnerability was duplicate 💸
Because of the way I exploited it.

#BugBountyTips #BugBounty #CyberSecurity

[Mohamed Ahmed @mooo_sec]

@fahadkhan__101 It depends on the day It's pretty random and based on my mood and whether I have college or not so I don't have a fixed number of hours per day

[Mohamed Ahmed @mooo_sec]

🚨 40+ Vulnerabilities Found This Month, including 10+ critical issues:

RCE, Mass PII Exposure, Unauthorized Access, ATO, LFI, Information Disclosure

#CyberSecurity #BugBounty #BugBountyTips

[Mohamed Ahmed @mooo_sec]

@crypto_profit1 Check my YouTube soon i will do writeups

[Mohamed Ahmed @mooo_sec]

@Younis_J_ I will share here and on my YouTube

[Mohamed Ahmed @mooo_sec]

@OX0DAYS Check my YouTube video

[Mohamed Ahmed @mooo_sec]

New Video – I found admin panels & leaked credentials using just one GitHub dork! 🚨

Watch here:
https://t.co/jofniYHGKj

#BugBounty #GitHubDork #CyberSecurity

[Mohamed Ahmed @mooo_sec]

@pent0ss Dm me if u need a help

[Mohamed Ahmed @mooo_sec]

@pent0ss Firstly verify whether this is a production RSA key or only a test/example key as test or placeholder keys are usually not accepted. Then verify whether the key is valid or not.

[Mohamed Ahmed @mooo_sec]

@Steiner254 Yeah

[Mohamed Ahmed @mooo_sec]

Admin Panel Access Scenario I Found

• During recon I found a domain with an empty main page
• Port scan showed 1950 open
• Visiting https://t.co/NjkyANbdyw revealed an admin login
• Default creds worked and gave full admin access

#CyberSecurity #BugBounty #bugbountytips