Harshit Sengar

CREST CPSA & CRT | OSCP | Synack Red Team Member | Security Engineer | PenTester | Yogosha Community Member | Author @

[Harshit Sengar @sengarharshit1]

Hey! check my new blog.
I published A tale of VoIP Security Testing https://t.co/yqjaQCsBZP
#voip #security #CybersecurityAwarenessMonth #CyberSec #CyberSecurityMonth #bugbountytip #infosec #infosecurity #Ethicalhacking #hacking #cybersecurity #bugbounty #bugbountytips #redteam

[Harshit Sengar @sengarharshit1]

https://t.co/fTtTtUjWRz

[Charlie Bromberg « Shutdown » @_nwodtuhs]

Active Directory ACEs abuse mindmap

[Harshit Sengar @sengarharshit1]

@maverickNerd Congratulations bhaijaan🎉🎉

[Bug bounty notes @bugbounty0]

How Gopher works in escalating SSRFs
#bugbounty
#bugbountytips
#infosec

https://t.co/JgcfoDhMRm

[Harshit Sengar @sengarharshit1]

@sml555_ @Bugcrowd @udit_thakkur

[Bug bounty notes @bugbounty0]

Automating BURP to find IDORs

#bugbounty
#bugbountytips
#infosec

https://t.co/8vbs2aNeiq

[Synack Red Team @SynackRedTeam]

Out today: @SynackRedTeam member @naglinagli shares his thoughts on Mass Assignment exploitation / privilege escalation vulnerabilities. Read the blog: https://t.co/ZzaxZeov6i

[Vickie Li @vickieli7]

How attackers hack API authentication and other API development pitfalls.
https://t.co/xqmNEfm2F4

[InfoSec Community @InfoSecComm]

New Write-up on InfoSec Write-ups publication : "Leveraging Burp Suite extension for finding HTTP request smuggling." #bugbounty #bugbountywriteup #bugbountytips https://t.co/RAy1JrcAID

[Blue Team News @blueteamsec1]

From Word to Lateral Movement in 1 Hour https://t.co/4NqpoOCeLb #security #threathunting #infosec

[Harshit Sengar @sengarharshit1]

@udit_thakkur @Bugcrowd 🔥🔥

[Sven Schleier @bsd_daemon]

Here is a quick summary for penetration testers of what you want to consider when analysing the log output of an iOS app:

https://t.co/mLOQUzpRcH

Happy Hacking ⛏

[Harshit Sengar @sengarharshit1]

Fuzzzzzzzziiiiiinnnnngggggggg

[Kathan Patel @KathanP19]

When Fuzzing For Directories Follow these wordlists.
1. dirsearch
2. directory-list-2.3-medium
3. httparchive_directories
4. Raft
5. RobotsDisallowed
Then go for technology-specific chances are high with these wordlists
[1/2]
#bugbounty #bugbountytips

[Harshit Sengar @sengarharshit1]

@PwnFunction

[Harshit Sengar @sengarharshit1]

I think @MobiKwik Security team accepted the breach but @MobiKwik didn't. And now everyone has proofs. I've also checked the breached data.
In digital world, no-one can be secure. Accept it!!!
#MobikwikDataLeak #MobikwikDataBreach

[MobiKwik @MobiKwik]

Finally, our legal team will be pursuing strict action against this so-called researcher who is trying to malign our brand reputation for ulterior motives. n/n

-Team MobiKwik

[Ammar Amer @cry__pto]

Tools designed to automate phishing attacks that are intended to bypass 2FA
evilginx2: https://t.co/9haUXdvpV1
Modlishka: https://t.co/mHNvbvYzF7
KoiPhish: https://t.co/JTA9T4r5yF
ReelPhish https://t.co/FXtzjwgCYG
CredSniper:https://t.co/mFTPZYg8xY
muraena:https://t.co/e5Cl66DsFv

[Exploit Database @ExploitDB]

[webapps] Microsoft Exchange 2019 - SSRF to Arbitrary File Write (Proxylogon) https://t.co/dYn17OeDEN

[Harshit Sengar @sengarharshit1]

#Android #Pentesting

[Emad Shanab - أبو عبد الله @Alra3ees]

Android Penetration Testing:-

https://t.co/Z26oD4fWri
https://t.co/Dm4lYH1ItH
https://t.co/ZogaWLCM28
https://t.co/BouHgnsCrP
https://t.co/fbr36q1QoN
https://t.co/OQra4DzsLr
https://t.co/oIdcNxIC4C
https://t.co/b2cQXFNC3B
https://t.co/cNaEvIYUNX

[Harshit Sengar @sengarharshit1]

@vyvivekyadav04 @Olacabs @Uber I think, they should work on their policies to make them customer centric too.

[Harshit Sengar @sengarharshit1]

@udit_thakkur @Bugcrowd 🔥