Shuva

Security Researcher

[Shuva @scriptshuva]

@r3d0ys3c Thank you Bondhu😇

[Shuva @scriptshuva]

Once again, bypassed 2FA. Another $$$$$ bounty from meta

#BugBounty #Infosec #AppSec

[Shuva @scriptshuva]

@hackeriron1 Thanks brother

[Shuva @scriptshuva]

@imranHudaA Thanks brother 🙂

[Shuva @scriptshuva]

@grandfathersaha bypassed 2FA with user interaction

[Shuva @scriptshuva]

https://t.co/bfv1AcIxy9

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

Bug bounty can be a cruel mistress sometimes.

Dupes, downgrades, mass closes and misunderstandings get us all down.

Solid tips were dropped on the pod last week to help in these times.

Here are 14 of them.

[Web Security Academy @WebSecAcademy]

🔔 New topic alert: Web LLM attacks 🔔

Stay ahead in application security - dive into the world of LLMs to discover their weaknesses and understand how to exploit them.

Read our latest learning materials and try your hand at the new interactive labs.

https://t.co/Trvc0x2Wj0

[Shuva @scriptshuva]

@albinowax congrats!

[Orange Tsai 🍊 @orange_8361]

@man_maii @pyn3rd 可搭配部落格一同觀賞XD
https://t.co/JEB2uvEDp1

[Doyensec @Doyensec]

Interested in #appsec and/or #graphql and contributing to an #opensource project? We're announcing a call for contributors for #inql! InQL is our #BurpSuite extension for GraphQL security testing - check it out today!
#doyensec

https://t.co/N7rfebmFB2

[Doyensec @Doyensec]

Great news! Our Proxy Enriched Sequence Diagrams (PSED) Exporter tool is fully integrated in #Burpsuite & in the BApp Store. You'll love how it creates professional diagrams & helps communicate complicated traffic flows. Install today!

#doyensec #appsec

https://t.co/WosH6VrGuJ

[Shuva @scriptshuva]

@a1woareS @YogoshaOfficial 🐛congratulations 🍾

[JS0N Haddix @Jhaddix]

= Infosec super-thread =

A big part of my presos is tools/resources I like for offensive security & bug hunting.

Here's a thread of "PRINT" resources cited in the Bug Hunter's Methodology Application Analysis v1

https://t.co/Qt6H4VOSd7

a 🧵

#bugbountytips #Pentesting

1/x

[PortSwigger Research @PortSwiggerRes]

You can now trigger file-upload XSS with no user-interaction using a technique spotted by @kkotowicz. We've just added it to our XSS cheat sheet:

https://t.co/AxgyDnZHLK

[Shuva @scriptshuva]

@imranHudaA @Hacker0x01 Congratulations! 😍

[Youstin @iustinBB]

Cache Poisoning at Scale:
Identifying and Exploiting over 70 Cache Poisoning Vulnerabilities

https://t.co/cjkx8zsqb2

[PortSwigger Research @PortSwiggerRes]

We've launched the long-awaited @WebSecAcademy HTTP/2 topic! Learn about and practice HTTP/2 request smuggling, request tunnelling, and response queue poisoning! https://t.co/ggrpBCHKJv

[James Kettle @albinowax]

H2C Smuggling is a seriously cool HTTP/2 attack technique. It won't directly feature in my upcoming presentation, but you should still check it out:
https://t.co/b0LjuF6ljp
https://t.co/g8yyIpWIGi