Rahul Gairola

[Rahul Gairola @pub3g]

This is another article I've published as part of my series sharing my findings.

https://t.co/zwgTlWmwz3

#BugBounty #bugbountytip

[Behi @Behi_Sec]

Bug Bounty Lesson:

Don’t treat a target as pages.

Treat it as a collection of flows.

Login → reset password → change email → delete account.

Each step has params. Each param is a chance for bugs.

Flows reveal more than single endpoints.

[ashish_r_padelkar @engi_arp]

If you're working 2–4 hours daily on bug bounties, that's equivalent to working 8+ hours at a regular job. I mean, let’s be honest.We don’t really work nonstop at our jobs, do we? Bug bounty hunting is serious work, not just some time-pass.
#bugbountytips #bugbounty

[Arshad Kazmi @arshadkazmi42]

I just published How a GitHub Quirk Helped Me Earn $40K+ in Bug Bounties https://t.co/tzTq3rfZTk

[Jayesh Madnani @Jayesh25]

Found an interesting bug a while back and thought I’d share it here 👇

I came across an unused API endpoint inside a JavaScript file - `/api/users/<user_id>/activities/`. It wasn’t being called anywhere within the app, so naturally, I tried to hit it manually using my JWT from the web app.

The result? 403 Forbidden. No access.

Later that day, I downloaded the mobile app for the same target just to poke around for some other Issues. While logging in, I noticed something odd - the JWT generated by the mobile app was noticeably bigger than the one from the web.

As a next step I threw it into jwt[.]io for a quick look and to my surprise the token had way more scopes and permissions granted compared to the web version even though It was for the same account..

At this point I had a wild theory which I was pretty sure wouldn't work...

But as you can Imagine I went back to that `/api/users/<user_id>/activities/ endpoint, but this time used the mobile-generated JWT... and boom it worked. I had full access to PII data for other users.

The endpoint was probably gated by permissions that only mobile clients were issuing.

Moral of the story? Don’t just test with the web client. Always compare JWTs from different platforms - web, mobile, maybe even desktop. Misconfigured scopes or overly permissive mobile tokens can open up unimaginable possibilities.

[Rahul Gairola @pub3g]

@stilla1ex Hacking starts in the mind, not in the toolbox.

[Rahul Gairola @pub3g]

@jeetbhdr @Bugcrowd yes bro 😎

[Rahul Gairola @pub3g]

@jeetbhdr @Bugcrowd are bhai, main bhi try hee kar raha hun kuch banne ki🙁🙏

[Intigriti @intigriti]

🔗 Testing static websites and uncovering hidden security vulnerabilities
https://t.co/xXH2kZp6iy

[Rahul Gairola @pub3g]

@Freyxfi I generally downloaded it on my Android phone from the Google Play Store and then extracted the APK using APK Extractor.

[Intigriti @intigriti]

Want to find more vulnerabilities using BurpSuite match &amp; replace rules? 🤑

Open this thread! 🧵 👇

[Luke Tucker @luketucker]

So cool. @Hacker0x01 has paid out over $380,000,000 to hackers all time.

[Ph @Phantom_07x_]

🌟 Read about my new finding

🌟 Host header injection to account takeover (WHO hall of fame )

Give it 50 claps if you like it 👏👏

https://t.co/QpoLb64VBh

#BugBounty #bugbountytips #bugbountytip #BugHunter #bug #web2 #web3

[Rahul Gairola @pub3g]

@TeslaTheGod excellent 👍

[Rahul Gairola @pub3g]

Another article:
This is OAuth-related article, In the coming days, I'll be sharing more insights on OAuth security. Meanwhile, check out my first Oauth related article here:
https://t.co/AzUbGQ72Rk

#bugbountytips #OauthSecurity #BugBounty

[Intigriti @intigriti]

4 Ways to bypass checkout systems in e-commerce targets! 🤑

A thread! 🧵 👇

[Rahul Gairola @pub3g]

One of the most supportive and genuine individuals @hunter0x7 in the infosec community, always willing to help others.

[Ahsan Khan @hunter0x7]

I can see your pain (new bug hunters), I can see that it’s really hard to find bugs. I know some of you are working for years but didn’t succeed like the way you should be, I just want to let all of you know who are suffering, I am with you guys, I believe in you guys, I know no one believes in you, People call you a failure, Lets convert this pain into something big something worthy ❤️‍🩹.

[Intigriti @intigriti]

Dealing with a whitelist when testing for file upload vulnerabilities? 🧐

Try one of the following bypasses! 👇

#BugBountyTips #HackWithIntigriti

[Intigriti @intigriti]

7 components in your target that are commonly vulnerable to open URL redirects: 🤠

• Sign in & register pages
• Sign out endpoint
• Password resets (inspect the generated token link too as it may contain a redirect parameter)
• Profile account page
• Email verification links
• Error pages
• Any important action within the app that requires multiple steps

[Rahul Gairola @pub3g]

@XHackerx007 Always, Keep up the great work.

[Rahul Gairola @pub3g]

What an amazing write-up by @XHackerx007 So much to learn, especially the creative fuzzing technique, and taking it further, most of us stop after the first step. Brilliant.

[The Bug Bounty Hunter @tbbhunter]

A Journey of Limited Path Traversal To RCE With $40,000 Bounty!

https://t.co/wXfRIIHpFJ