Mahmoud Omar

Hacker

[Mahmoud Omar @nullthrix]

lots of people asked me for my recon methodology

HYG:
https://t.co/KtYEXs0iJk

soon will publish my full WAP methodology...
#BugBounty #hacking #security #hackerone #bugcrowd #integrity #yeswehack

[Mahmoud Omar @nullthrix]

#BugBounty #hacking #security #hackerone #bugcrowd #integrity #yeswehack

[Mahmoud Omar @nullthrix]

Not reinventing the wheel — but something more practical than generic lists.

focused on:-
• OAuth
• MFA/OTP bypass
• ATO chains
• IDOR
• session/auth flaws
• real implementation mistakes

https://t.co/yhLICB9G0e

#BugBounty #AppSec #hacking #CyberSecurity #KnowledgeIsFree

[Mahmoud Omar @nullthrix]

Not reinventing the wheel — but something more practical than generic lists.

focused on:-
• OAuth
• MFA/OTP bypass
• ATO chains
• IDOR
• session/auth flaws
• real implementation mistakes

https://t.co/yhLICB9G0e

#BugBounty #AppSec #hacking #CyberSecurity #KnowledgeIsFree

[Mahmoud Omar @nullthrix]

@inspector_amb That's huge.. congrats!

[Mahmoud Omar @nullthrix]

Just found this in my archive 🙂‍↕️
Good old days. It was domain take over on a VDP program, but felt good as first crit

[Mahmoud Omar @nullthrix]

@krishnsec @yeswehack Who is supposed to act and defend hacker's rights here?
Or is it a one way entitlement for companies only?
One might think to dump all DB and then report sqli lol

[Mahmoud Omar @nullthrix]

@hakluke Vibe coding is stirring the way to bug hunters advantage, as developers are getting lazier and less OG

[Mahmoud Omar @nullthrix]

@xofin904 Will post more soon.

[Mahmoud Omar @nullthrix]

lots of people asked me for my recon methodology

HYG:
https://t.co/KtYEXs0iJk

soon will publish my full WAP methodology...
#BugBounty #hacking #security #hackerone #bugcrowd #integrity #yeswehack

[Mahmoud Omar @nullthrix]

time to come back after a 3 year break :")
Couldn't recover my old X account

[Mahmoud Omar @nullthrix]

@h4x0r_dz Starting to realize that it's happening with other platforms as well. I dont know anymore if its cuz of lack of documentation passed to the bb platform or not.
Just reported OAuth flaw high vuln on bugcrowd, and got NA, so I contacted company's sec team.

[Mahmoud Omar @nullthrix]

@NullSecurityX Turkish coffee 🤑