Akram Khan

Security Researcher

[Akram Khan @nobbieboy_1337]

#Alhamdulillah #bugcrowd #redteam #bughunting #bugbounty
#Happy #RamadanMubarak

I have earned $ 2100 for my submission over @Bugcrowd
#ItTakesCrowd special thanks to @hst_kishan and @ctgsecurity

[The OSINT Newsletter @osintnewsletter]

🚨 Launching: The OSINT Tools Library

A curated, investigator-first directory of tools used in real cases.

→ https://t.co/U5CJ3JJmHE

We’re building the largest and best maintained OSINT tools resource and need your help.

Reply and tag a tool we should add 👇

[digital ghost @vibeeval]

geçen hafta claude ile 6 saat dijital ayak izimi sildim.

sonuç: 47 data broker listingi kaldırıldı. 12 ölü hesap silindi. 3 arama sonucu bastırıldı.

nasıl yaptım, adım adım. thread.

[Nate @nnwakelam]

In the next 12-18 months there’s really never been a better time to make a million dollars doing bug bounties. If I was young and poor I would be locking myself in a room from now until this time next year and making finding a reproducible methodology or way of hacking that I can scale my primary and only objective in life.

[Akram Khan @nobbieboy_1337]

@DorkixAI Can't dm you I want to give an try

[Damian Strobel @damian_89_]

Another read about the topic of "dead subdomains" and why I decided to keep them in https://t.co/ruxCzwsAni

https://t.co/OewimdvHXa

(But: DNS data will come soon to the platform :))

[Patrik Grobshäuser @ITSecurityguard]

https://t.co/Jv0NUI2dAN

One command: hack("program") and you are good to go

[Profundis.io @profundisio]

Bugbounty hunters & threat intel pros: Here's what you're missing 👀

Find infrastructure links no one else can see. No shared headers. No host patterns. Not even the same ASN.

Only one thing in common: the favicon.

[Ahsan Khan @hunter0x7]

Critical: Client-Side Encryption Collapse

https://t.co/nbScR5c6hj
↓
some_javascript.js
↓
Line no 80519 → encObj + base64 key
↓
atob(val) → "Encoded_Password"
↓
CryptoJS.AES.decrypt(encObj, passphrase)
↓
55 configuration properties → 107 operational secrets exposed
→ Azure AD client_secret → OAuth client_credentials flow
→ RSA public keys → Forge encrypted /enc/ API requests
→ HMAC key → Backend-accepted payload signing
→ Direct Line token → Production chatbot access
→ Monitoring / RUM keys → Telemetry manipulation
→ Auth0 + reCAPTCHA config → Auth flow manipulation
→ 31+ encrypted authentication endpoints mapped
↓
Use extracted Azure AD credentials
↓
Request token from Microsoft OAuth endpoint (client_credentials)
↓
Receive valid JWT with high-privilege role (e.g., AllAccess)
↓
“Super token” accepted by backend across protected API routes
(No user interaction required, role-based authorization granted)
↓
All sensitive authentication and account endpoints
were wrapped in client-side hybrid encryption
→ Every request payload encrypted in browser
→ AES-256-CBC used for body encryption
→ RSA-OAEP used to wrap per-request AES key
→ Server accepts any request that decrypts successfully
→ Decryption success treated as implicit authorization
↓
Reverse-engineer encryption module (@**6246)
→ Algorithm: AES-256-CBC + RSA-OAEP (SHA-512)
→ Random 32-byte AES key per request
→ IV derived client-side
→ AES key wrapped with embedded RSA public key (promocode_pem)
→ Final format: { "key": base64(RSA_key), "body": hex(AES_ciphertext) }
↓
Hook JSON.stringify + XMLHttpRequest
↓
Capture plaintext BEFORE encryption (credentials, OTPs, tokens)
Capture encrypted wrapper AFTER encryption
Capture correlated server responses
↓
Analyze MFA implementation
↓
IP-based rate limiting only (lockout resets on IP change)
OTP expiration not strictly enforced server-side
Encrypted payload fields trusted after decryption
↓
Mass takeover method
↓
1. Trigger MFA or password reset
2. Rotate IP to bypass rate limiting
3. Reuse or brute-force OTP under weak enforcement
4. Complete password reset flow
5. Authenticate as victim
6. Capture decrypted OTP and auth tokens via runtime hook
7. Reuse valid 2FA tokens for subsequent authenticated requests
↓
Full attack chain achieved:
→ Extract secrets from client bundle
→ Generate high-privilege JWT (“super token”)
→ Read any plaintext request (credentials, PII, tokens)
→ Forge any encrypted request the server will accept
→ Bypass MFA protections via IP rotation
→ Reset victim passwords
→ Decrypt authentication flows in runtime
→ Mass account takeover

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

Big #Bugbountytip / #bugbountytips
Google Services Hunting
Google services are amazing, and for bug hunters, it's amazing as well. In some cases, you can get some P1-P2-P3 from these services, such as
Workspaces / Sheets / Groups / Drives / Etc...

In groups: you can access emails / internal data/ credentials
In Sheets, you can access PIIs / Edit access
In Drive: you can access backups/ PII / Etc...

still hard to find and
It was an issue how to make good and at the same time fresh dorks for bug bounty programs

Then I found out that a lot of links have the same path, and it was like this
All Google resources I've found
https://t.co/2SixYDAKvE
https://t.co/tbE8WaX9CX
https://t.co/5D7Clds9cH
https://t.co/OfodYVKOk0
https://t.co/ZyA0JFkax4
https://t.co/mhIbyMF03b
https://t.co/QwByRWofh8
https://t.co/vAwAEX8KxI
https://t.co/4y1UMeZdq7
https://t.co/u7mOVPnus3
https://t.co/V9ALsFoqP9
https://t.co/2eLIaEPCGm
https://t.co/VxllqvwT6n
https://t.co/c1vkp8YrBt
https://t.co/2EkMSEUpIt

UrlScan Dorking:
page.url:"https://t.co/qb3s3f8koJ*"
page.url:"https://t.co/BNLIA1rXht*"
You can replace * => the program domain

Google Dorking:

site:https://t.co/qb3s3f8koJ* "inurl:/a/"
Or for specific domain
site:https://t.co/qb3s3f8koJ* "inurl:/a/domain.com"

GitHub Dorking:
"https://t.co/qb3s3f8koJ"
Or for a specific domain
"https://t.co/FKHqr19e0o"

Shodan Dorking:
"https://t.co/3vQLeWEs54"

Web Archive
https://t.co/c8tGyvVlH7

Don't forget:
It's not just https://t.co/pbqxKC9P4s
still you have to look for docs/groups/mail/drive/spreadsheetsX

still working in Google Research and will add more and more soon ......

Happy Hunting♥

#bugbounty

[Muhammad Waseem @wgujjer11]

Alhamdolilah Released BackupFinder ❤️
Big thanks to all contributors for making BackupFinder awesome! @infosec_au @coffinxp7 @intigriti @GodfatherOrwa For Wordlists @assetnote and for chaining with tools @pdiscoveryio
Github : https://t.co/CPV6CmjAcN

#OpenSource #BugBounty

[Akram Khan @nobbieboy_1337]

Hey @grok, based on your analysis of the last 365 days, list in sequence 10 accounts that frequently visit my profile. Do not mention the person, only @.username and the rate of visits to the profile per month.

[Jayesh Madnani @Jayesh25]

Here’s how I discovered a critical issue on a wide-scope program using @netlas_io 👇

The target had a pretty generic login flow via a 3rd-party service with specific keywords. It was pretty much using the same codebase reused across multiple assets.

I used https://t.co/aM6Uub3AYe to do a quick response search with a keyword unique to my target's login page.

Here's the query I used:

http.body:("<keywords_from_login_page_of_my_target>")

The above search returned an EC2 IP with port 80/443 open. This IP had no direct connection to my target via CIDR, WHOIS, SSL certs, or domains and looked completely unaffiliated with the target I was hunting on. But I could tell from the login flow immediately that it was identical to the one used by the company.

Turns out the exposed Instance had sign up enabled and that allowed me to login and dropped me straight into an admin panel exposing massive PII and internal dashboards.

I suppose the key takeaway here is to not limit your recon to basic organization-wide searches like WHOIS, CIDRs, or SSL certificates. Sometimes, targeting unique application fingerprints such as specific UI text or JavaScript snippets can help uncover untracked assets.

[Jayesh Madnani @Jayesh25]

Found an interesting bug a while back and thought I’d share it here 👇

I came across an unused API endpoint inside a JavaScript file - `/api/users/<user_id>/activities/`. It wasn’t being called anywhere within the app, so naturally, I tried to hit it manually using my JWT from the web app.

The result? 403 Forbidden. No access.

Later that day, I downloaded the mobile app for the same target just to poke around for some other Issues. While logging in, I noticed something odd - the JWT generated by the mobile app was noticeably bigger than the one from the web.

As a next step I threw it into jwt[.]io for a quick look and to my surprise the token had way more scopes and permissions granted compared to the web version even though It was for the same account..

At this point I had a wild theory which I was pretty sure wouldn't work...

But as you can Imagine I went back to that `/api/users/<user_id>/activities/ endpoint, but this time used the mobile-generated JWT... and boom it worked. I had full access to PII data for other users.

The endpoint was probably gated by permissions that only mobile clients were issuing.

Moral of the story? Don’t just test with the web client. Always compare JWTs from different platforms - web, mobile, maybe even desktop. Misconfigured scopes or overly permissive mobile tokens can open up unimaginable possibilities.

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

If the target sets X-Frame-Options: DENY, you can’t iframe it to abuse session context. But @slonser_ points out a slick workaround: use the fetchLater() API to schedule deferred requests that execute even after the page is closed or navigated away from.

[Rikesh Baniya @rikeshbaniya]

if the target uses zendesk to handle support emails

you could send an email with payload

`{{ticket.ccs[0].name}}a{{ticket.ccs[0].phone}}` by adding `[email protected]` in CC

and extract victim info ranging from phone, address to payment info

#bugbounty #bugbountytips

[HAHWUL @hahwul]

👀

https://t.co/z7U6s8fgez

[ʞʞıdɐɔoɥƆ @Chocapikk_]

Just released WPProbe v0.6.0! It now includes a bruteforce mode and a hybrid scan (REST endpoints + bruteforce). Check it out: https://t.co/RT1mhSFSJm (Thanks @ibrahimsql for the PR)

[Akram Khan @nobbieboy_1337]

@Masonhck3571 Eid Mubarak

[Jenish Sojitra @_jensec]

Last month, I was able to view millions of orders from well known coffee chain using a very simple but strange vulnerability.

Here is how:
1/ Found a domain https://t.co/mzISHOJPkM with login and reset password page. Immediately knew this was meant for internal employees.

2/ Request reset password email to my personal email and to my surprise I received the email and reset the password.

3/ When logging in, I was able to signin, however Immediately forced logged out with error "unable to map user_id with the user_role"

4/ I was able to fetch JWT token from the login API request, upon decoding JWT noticed it is missing "role" and "id" parameter value which was essential.

5/ Looking at JS file I was able to find alll internal API endpoints, Most of them didn't work due to same error. however surprisingly I was able to "/manageadmin/api/v3" endpoints that resulted ability invite new user as an admin.

6/ Later, a new user was able to login and access portal normally as an admin.

I think only super admin endpoints worked because of faulty coding where missing role in JWT means super admin. which I was able to verify later with actual user.

They were issuing JWT based on email ID instead of User_id that's why login API call worked.

#bugbountytips #bugbounty

[Debangshu 🇮🇳🥷 @ThisIsDK999]

Also, with this, I'm creating my first github repo, aiming to create something similar to can-i-takeover-xyz but for Admin Panels/Exposed Portals/Consoles!

Feel free to checkout and/or contribute to the repo!
Link 🔗 - https://t.co/YknlMxlxtF

#bugbounty #bugbountytip #aem