shubham maheshwari

Part Time Bug Bounty Hunter, ranked Under 200 at Bugcrowd and 500 on Hackerone.

[shubham maheshwari @shubhack319]

I don't understand how @Hacker0x01 has such a weak support team, taking nearly six months to reply to a support ticket!

#bugbounty #h01support

[shubham maheshwari @shubhack319]

@assetnote I think puredns solves that problem !!

[shubham maheshwari @shubhack319]

@Bugcrowd Definitely THIS 🖥️

[shubham maheshwari @shubhack319]

@intigriti How T.C.P handshake !!

T

🤝 🤝

P 🤝 C

😂😂

[shubham maheshwari @shubhack319]

@AnupamAS01 @Hacker0x01 Congrats ... but what an IRONIC statement 🧐🧐 #bountyshowoff

[shubham maheshwari @shubhack319]

@sshbounty @Hacker0x01 Congratulations 👏👏

[shubham maheshwari @shubhack319]

@intigriti When request for forgot password -> application changes password of requested user to default 123456 -> ATO 🤑🤑

[shubham maheshwari @shubhack319]

@Bugcrowd @mr_7h3xc4

[shubham maheshwari @shubhack319]

@intigriti Don't consider the number of vulnerabilities reported as a factor to deselect a target because everyone has a different perspective and approach !!
#keephacking

[shubham maheshwari @shubhack319]

A motivating and inspirational talk by @AnkitCuriosity at Josh Talks. You are really a great Bug hunter and as person also. You never talked about the reward amount - this shows you are focused on quality of bug more than amount. Love to get connect with you !!

[Ankit Singh @AnkitCuriosity]

My recent talk (Hindi) on the grand stage of @JoshTalksLive about my life and journey so far as a Cyber Security enthusiast and Bug Hunter is out now. I hope you may find it useful.

Check it out at https://t.co/nOdZVZB11W

#cybersecurity #Ethicalhacking #infosec #hacker #hacking

[shubham maheshwari @shubhack319]

@harshbothra_ Race condition and its different attack !!

[shubham maheshwari @shubhack319]

@snap_sec B) LFI due to Direct passing of user input in include function

[shubham maheshwari @shubhack319]

@Bugcrowd @NahamSec

[shubham maheshwari @shubhack319]

@DoffyOn @h4x0r_dz And also go For Javascript files for hidden api endpoints fuzzing.

[shubham maheshwari @shubhack319]

@infosec_au @assetnote wordlist are best especially the javascript files list , from which i have find many hidden admin js files and later used to get some priv esc and idors.

[shubham maheshwari @shubhack319]

@AnkitCuriosity @Bugcrowd Congratulations @AnkitCuriosity !!!

[shubham maheshwari @shubhack319]

@Bugcrowd Graphql Introspection -> Hidden Registration Mutation Query -> Created Super Admin Account -> Authentication Bypass !!!

[shubham maheshwari @shubhack319]

@notselwyn @hackersden_ @GodfatherOrwa Yes its allowed but only upto banner grabbing .

[shubham maheshwari @shubhack319]

@remonsec Not sure but seems like dom xss triggered while checking sender name length in javascript .