s3rdz0

panem et circenses

[s3rdz0 @s3rdz0]

→ Technology-specific payloads - Always adapt your payloads to the underlying technology. In this case the server was running Windows/IIS, so Windows-specific paths led to arbitrary file read.

[s3rdz0 @s3rdz0]

Recently dropped a new writeup 🚀

Turned an SSRF + arbitrary file read into a $5000 bounty by digging into internal services and escalating impact.

Breakdown, payloads, and lessons learned 👇
https://t.co/hdGR5hsrjW

#bugbounty #hacking #cybersecurity #infosec #bugbountytips

[s3rdz0 @s3rdz0]

→ IIS Tilde Enumeration leaks partial file/directory names — always try it on IIS targets.

[s3rdz0 @s3rdz0]

→ Identify backend tech — at the time I was too lazy to dig into what was responsible for converting the upload to a PDF. But if you're not: point SSRF at your own server and catch the incoming request. Check the User-Agent header — it often reveals which service made the call.

[s3rdz0 @s3rdz0]

Golden Retrievers, PDFs, Iframes and SSRFs 🐕

What do golden retrievers and vulnerable servers have in common?

They’ll fetch anything you throw at them.

PDF file upload > SSRF writeup 📖 https://t.co/43fKcYW7xI

#bugbounty #cybersecurity #pentesting #ethicalhacking #hacking

[s3rdz0 @s3rdz0]

→ 169.254.169.254 is always worth trying when you have any form of SSRF or server-side render.

[s3rdz0 @s3rdz0]

@Yn0tWhy @zseano Thanks!

[s3rdz0 @s3rdz0]

@zseano Thank you for your work! Can't wait for the release :D

[s3rdz0 @s3rdz0]

@NahamSec @LLSusa @LLSGreaterSac @bbuerhaus @arneswinnen @TomNomNom @MrTuxracer How will you pick beginners for mentoring?