PwrSpl0it

Bug bounty hunter, web app security enthusiast, chess player, soccer player sometimes

[PwrSpl0it @newbiepath]

today I crossed 23 years, one year ago I got arrested for illegal hacking and I was about going to jail but thanks god and I thank everyone from the bug bounty hunting community for changing my life from the worst to the better especially
@NahamSec @Jhaddix @Bugcrowd @Hacker0x01

[PwrSpl0it @newbiepath]

@h4x0r_dz Isn't private?

[PwrSpl0it @newbiepath]

@karan_srma try for sensitive cases DELETE endpoints / PATCH etc ...

[PwrSpl0it @newbiepath]

@skulldentist @chanukaisdumb @Bug_X_hunter bro it's not guessing here for UUID you can retrieve from different ways such as (archive-dorks-github) and for uber program they do accept idor on UUID

[PwrSpl0it @newbiepath]

My Progress :

Almost 2 month of hunting
10 informative bugs,

let's keep grinding

[PwrSpl0it @newbiepath]

@skulldentist @chanukaisdumb @Bug_X_hunter no i was able to see anyone data. that was the vulnerable endpoint: https://t.co/4Vibg6z8dL

so basically any new order happened in right momment with the right uuid you will be able to see the data of otehr customers ( driver - geolocation)

[PwrSpl0it @newbiepath]

@Bug_X_hunter But it still impact for any new orders

[PwrSpl0it @newbiepath]

@Bug_X_hunter And the problem happened i did not realize there is time bounding and the triager while doing the assessment the information already deleted

[PwrSpl0it @newbiepath]

@chanukaisdumb @Bug_X_hunter @skulldentist No they did not , and it's not full positive , the problem as i said about time bounding, after u order the 48 hours i can see driver info and the geolocation info after 48 hours those information automatically deleted by system

[PwrSpl0it @newbiepath]

@0trusts Im using cvss score

[PwrSpl0it @newbiepath]

let's see if we will got another informative bug or triaged

[PwrSpl0it @newbiepath]

@calvin_minyate Thank you @calvin_minyate

[PwrSpl0it @newbiepath]

@Gomawyy That's funny

[PwrSpl0it @newbiepath]

@Bug_X_hunter @skulldentist So when i report the bug the information were exposed but after 48 hours they disappear

[PwrSpl0it @newbiepath]

@skulldentist @Bug_X_hunter not really that was the reason

[PwrSpl0it @newbiepath]

@stilla1ex unicode is much more effective but i think most of host providers patch it since you can register any domain with other keyboards schemes and it will exactly match the keywords

[PwrSpl0it @newbiepath]

@elonmusk Even @elonmusk forgot to put his phone on charge

[PwrSpl0it @newbiepath]

@fattselimi Play chess

[PwrSpl0it @newbiepath]

@Cubed_h1 @Michael1026H1 That's mean they had a strong security engineer and that's a compliment to him hahahaha instead of offending hahaha

[PwrSpl0it @newbiepath]

@Michael1026H1 No don't feel offended im just shared my experienced i know my fault for not digging more