Sappi

Bug Hunter @Hacker0x01 email: [email protected]

[Sappi @sappi_13]

#CMC20
#BBW2025
@binance

[Sappi @sappi_13]

Most of these so-called AI agents aren’t doing much. They can’t even meet their own stated purpose. What’s the point? @qtum

[Sappi @sappi_13]

@Burp_Suite
No scanner, No AI and eating all my resources.

[N$🌟 @__nav1n_]

Here is the list of traversal payloads I scraped from the internet. Not mine, credit to the respective authors.

https://t.co/pCqrs3zpUs

[Osama Avvan @osamaavvan]

Just released Part 1 of my series on 'Android SSL Pinning Bypass'! Dive into the essentials without the need for a rooted device. Stay tuned for more advanced techniques in the upcoming writeups!

https://t.co/TcrD3OYbuu

#bugbounty #android #mobilesecurity

[Maniesh.Neupane @pwn4arn]

403 bypass methodology !

[Sappi @sappi_13]

@MalikTuyyab @MalikTuyyab They are the worst I have seen in recent years. I also received a used OnePlus product. They didn't accept returns. I've been using the product since I had no other choice. Since then, I haven't used their services. @flipkartsupport @Flipkart @OnePlus_IN

[Cybernetic Research @cybernetic_res]

PoC + Nuclei + Query CVE-2024-25600 Unauth RCE - WordPress Bricks <= 1.9.6 CVSS 9.8

Query Fofa: body="/wp-content/themes/bricks/"
Poc:https://t.co/pVCHgtOvJs
Nuclei:https://t.co/X8kkGZqopz
#bugbountytips #bugbounty

[Cybernetic Research @cybernetic_res]

SQL Injection on JSON body POST request.
``sqlmap -r request.txt --level=5 --risk=3 --force-ssl --ignore-code=500 --dbs``
By:@nav1n0x
#bugbountytips
#bugbounty

[shubs @infosec_au]

Some really cool AWS enumeration research was released today by @dagrz that's worth reading and understanding: https://t.co/HSxHyGJ1Jb

[Rodolfo Assis @RodoAssis]

Great infographic for non-hackers!
#Hacking #CyberSecurity

[Corben Leo @hacker_]

I've made $500k+ from SSRF vulnerabilities.

Here are my tricks:

[Harleen Kaur @ASilentRhapsody]

@PAU_Ldh is burning and under debt, but @CMOPb @AAPPunjab @harjotbains @icarindia @ugc_india @PMOIndia @PunjabGovtIndia are busy renovating it instead of extinguishing this fire of breaking down hostels.

Isn’t it a violation of human rights?

@UNHumanRights

#FundsForPAU

[Moblig @moblig_]

I was awarded $7,666 for a Critical XSS

Reflected XSS, but no particular sensitive data was exposed.
Here is how I was able to escalate to account takeover👇
#bugbountytips

[Bug Bounty Reports Explained @gregxsunday]

The Trail of Bits Testing Handbook by @trailofbits
https://t.co/kaezADfFxi
#BBRENewsletter59

[Bhavuk Jain @bhavukjain1]

📢 #bugbountytip

🛡️ If you can't see HTTP requests on Burp Suite while proxying a mobile device, the app might be built on Dart or Xamarin. Don't worry! Check out this handy trick to reveal all HTTP requests on Burp. Easy peasy bugs lying around. 😃

https://t.co/t6H65PCfAQ

[Aditya Gujar @fyoorer]

Just pushed a pretty neat update for ShadowClone. In my testing, this change makes it about 25-40% faster that before! Check it out https://t.co/ojNAm0Ku2X

[Sappi @sappi_13]

@iluminatibot @ezdubs_bot English hindi

[Manas @ManasH4rsh]

Try these to check bugs in PDF uploads:-

https://t.co/kFD190NGyb

[Patrik Grobshäuser @ITSecurityguard]

I just found an unbelievable number of unauthorized API endpoints using this 1 liner.

katana -u $url -hl -nos -jc -silent -aff -kf all,robotstxt,sitemapxml -c 150 -fs fqdn |subjs | python3 /opt/JSA/jsa.py |goverview probe -N -c 500 |sort -u -t';' -k2,14 |cut -d ';' -f1