N15H

Security Researcher | Application Security Tester | VAPT | Cyber Threat Intelligence | CTF Developer

[N15H @muggl34]

Report closed P5. Informational. $0.

Vendor said a config option "fully mitigates" it. So I enabled their config, reproduced their own block, then bypassed it anyway. 7/7.

Still P5. They paid me anyway. 💰

A closure reason is a claim. Claims can be tested.
#ItTakesACrowd

[N15H @muggl34]

#FirstBounty and Got $50💸

Found a valid p4 BAC (IDOR) bug.

#BugBounty #Cybersecurity #ApplicationSecurity

[N15H @muggl34]

14 hours cost me $1,100💸

Found a valid P2 Broken Access Control (IDOR) bug.

Another researcher reported it just 14 hours before me.

Duplicate. No bounty.

Lesson learned: In bug bounty, speed is just as important as skill.

#BugBounty #CyberSecurity #ApplicationSecurity

[N15H @muggl34]

Again Lost $900 for a Duplicate SSRF

[International Cyber Digest @IntCyberDigest]

‼️17.5 Million Instagram Users' Data Leaked

The data includes phone numbers, emails, usernames, user IDs, and physical addresses.

This appears to be from the Instagram 2024 API breach, in which 489 million records were obtained. (See second screenshot)

[N15H @muggl34]

@13ijoy @stealthmole_int @stealthmole_iol @Louishur @CyberNews wow nice insightfull @13ijoy

[N15H @muggl34]

ELLA @13ijoy

#stealthmole

[N15H @muggl34]

@13ijoy @stealthmole_int @stealthmole_iol @Louishur @CyberNews wow item @13ijoy so insightful