king 👑

[Yunus Emre Öztaş @ynsmroztas]

I created a simple but effective tool that examines and analyzes .js files.
🔗 Project: https://t.co/c8N8Uzdf8M

#DevTools #Js #JavaScript #bugbountytip #bugbountytips #InfoSec #recon

[Ahmed Elheny @Ahmex000]

I did it 4 times.
Also, think about how you do fuzzing

EX 1: GET /DIR/sens/01567777 =>
GET /DIR/sens/0156FUZZ (4)

Since most large IDs usually start after a large number (if sequentially), therefore
GET /DIR/sens/FUZZ (8) It takes a lot of time & most are actually empty.

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

7 SQLs

4 in php

(select(0)from(select(sleep(6)))v)/*'+(select(0)from(select(sleep(6)))v)+'"+(select(0)from(select(sleep(6)))v)+"*/

1 in aspx

orwa';%20waitfor%20delay%20'0:0:6'%20--%20

2 in graphql
orwa') OR 11=(SELECT 11 FROM PG_SLEEP(6))--
#bugbountytips #bugbountytip 💕

[king 👑 @MusengeNg]

@BinsaeedRashid Just $300 so others can have some as well

[Debangshu 🇮🇳🥷 @ThisIsDK999]

I'm sharing my $20,000 bug bounty secret 😱

https://t.co/3IWFiOVR47

[Yasho @YShahinzadeh]

This one was easy: searched JS files → revealing endpoints → JSON HTTP request → exposed PII. Tip: account for lazy-loading. many hunters miss endpoints. Method: click to trigger lazy-loaded JS, then search again for endpoints. Happy hunting :]

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

for the first time ever, Pwn2Own ...

WhatsApp - Zero-Click Remote Code Execution
and it’s worth $1,000,000.

[Yunus Emre Öztaş @ynsmroztas]

I wrote a tool for Vite Arbitary File Read, you can find it here 🔥🔥🔥

#github

https://t.co/M5Cn2ycJue

for search

@zoomeye_team
service="http" && app="vite"

#BugBounty
#bugbountytip

[Sanjay Gondaliya @devsecboy]

Not able to understand the behavior.
Anyone has any clue?
Two different result of java program on 2 different operating system.
@Burp_Suite @hackvertor #deserialization #Java

[king 👑 @MusengeNg]

@Cristo_C_J What's the tool u use bxss?

[Abdullah Nawaf (HackerX007)🇯🇴 @XHackerx007]

What’s happening here is really strange! @Hacker0x01 is playing judge! A minor disagreement broke out between a few people on X—so why is HackerOne banning them from the platform? Conflicts between bug hunters on Twitter happen all the time, yet H1 has no right to step in and act as court. If I argue with another hunter on Twitter, does HackerOne get to ban me too?

And what about the hunters who openly insult Islamic beliefs or Arabs, or who explicitly support the genocide and massacres in Gaza? Shouldn’t they be banned? Or is that protected as “freedom of expression”?

I remember about a year ago @GodfatherOrwa received racist slurs and death threats for being Muslim from a well-known hunter, and nothing happened on the platform, even though the story spread across Twitter, and he is still getting invited to LHE by H1 !!

It’s heartbreaking to see people like @GodfatherOrwa , @Eyax0 , and @h4x0r_dz get banned over a Twitter spat, while the CEO (@martenmickos ) openly declares support for Israel and overlooks documented crimes against Palestinians—crimes recognized by an international court—and wounds the feelings of countless Arab hunters on H1.

How much longer will these blatantly unfair double standards continue? @Hacker0x01, YOU are not the executioner or the judge!

[Jayesh Madnani @Jayesh25]

🔐Secrets no one will share with you - Here's a technique that might grant you access to takeover other users' accounts using "Login with Facebook":

Are you working on a target site that supports "Login with Facebook"?

Disable email sharing during Facebook login and be ready for unusual design flows that could enable you to take over other users' accounts.

Here's how to disable email sharing when using "Login with Facebook":

1️⃣ Log in with Facebook on any app.
2️⃣ Click "Edit Access."
3️⃣ Uncheck the email address checkbox.
4️⃣ Click Continue.

Here are some scenarios of account takeovers I've reported based on different target app behaviors:

Account Takeover via Linking Facebook Flow:
1️⃣ Went to http://example[.]com, used "Login with Facebook" (Uncheck share email on Facebook).

2️⃣ The target site asked to enter an email to link my FB account as no email was shared from FB. Entered [email protected], a confirmation link was sent to the victim's email to bind the account.

3️⃣ Repeated the same steps on the target site using the same FB account, this time choose to link [email protected] on target site – received the same link as step (2) on the attacker controlled email!

4️⃣ Knowing this, repeated the same steps again to link [email protected], and used earlier link which was received on [email protected] to takeover [email protected] account.

Direct Account Takeover via Login with Facebook:
1️⃣ Went to http://example[.]com, used "Login with Facebook" (Uncheck share email on Facebook).

2️⃣ The target site prompted me to enter an email to link the FB account to an existing account since no email was shared from FB. Entered [email protected]. It directly logged me into [email protected] without any further verification, leading to a complete account takeover.

Pre-Account Takeovers:
Do you have a target app that heavily relies on a user's email domain to grant access to organizations or critical features based on whitelisted domains? Using this technique can help you bypass email verification requirements, allowing you to claim any email. Consequently, you may be able to access critical features of other organizations permitted for emails with the same domain.

Lesson: Always test unusual login flows by logging in with a 3rd party provider without sharing email with the target site. These designs can be flawed and lead to nice bounties! 💰 #BugBounty #CyberSecurity #HackerOne #bugcrowd #securitytips #bugbountytips

[king 👑 @MusengeNg]

@ott3rly We have been waiting for xsshunter configuration video for a long period of time now have u stopped making videos? 😭💔

[king 👑 @MusengeNg]

@GodfatherOrwa @XHackerx007 @BSidesAmman Can't wait 😁🙏🏼😎❤️

[king 👑 @MusengeNg]

@mar73lon Please DM me 🙏🏼

[king 👑 @MusengeNg]

@mar73lon Please DM me 🙏🏼

[king 👑 @MusengeNg]

@mar73lon Please DM me 🙏🏼

[Youstin @iustinBB]

https://t.co/ygzJ6XdEH0 responds with a 400 bad request on all requests containing two referer headers. This can be used to acheive cache poisoning DoS if the cache stores 400 response errors.

[Nagli @galnagli]

And that's a wrap! To dive deeper into how email security strategies can unintentionally leak sensitive info to the public, check out the full slides in @shockwave_sec's blog post 👇 🔗

https://t.co/GgMRMMVCO0

[James Kettle @albinowax]

Are you a Burp Repeater power user? The latest release introduces a new feature called 'Custom actions'. With these you can quickly build your own repeater features. Here's a few samples I made for you: