skymig0

cybersecurity Researcher

[skymig0 @skymig0]

@h_hussein11 هتلاقيها منى ولا من الترياج تيم 😂😂

[skymig0 @skymig0]

@h_hussein11 Duplicate

[MaTaRyA @h_hussein11]

Breaking the same Stored XSS twice — before and after the fix. A story about not stopping at “Resolved.”

New write-up 🔗 [https://t.co/rr1GZB4vdZ]

#bugbounty #bugbountytips #bugbountytip #cybersecuritytips #cybersecurityawareness #hacker

[skymig0 @skymig0]

@h_hussein11 What ?

[skymig0 @skymig0]

@VittoStack Hey! I’d like to join

[FOFA @fofabot]

⚠️⚠️ NGINX 0-Day (nginx-poolslip): RCE reported on NGINX 1.31.0; no upstream patch yet
🔗FOFA Link: https://t.co/baLc49KQmv
🎯493.1M+ Results are found on https://t.co/HSOBZfCA2r in the past year.
FOFA Query: app="NGINX"
🔖Refer: https://t.co/MjnLU0NWP6
#OSINT #FOFA #CyberSecurity #Vulnerability

[MaTaRyA @h_hussein11]

ادخل سجل باكونت Github على Agent Router وهتاخد حوالي 150$
فيه موديلز حلوة زي Claude و GLM
ده اللينك:
https://t.co/NHqSv0mEMV

[skymig0 @skymig0]

@Soo000ly

[Youssef Sammouda (sam0) @samm0uda]

Leaking FXAuth Token leading to account takeover ($65,000)
https://t.co/d1jQ26tTjD
Instagram account takeover via Facebook Pixel script abuse ($32,500)
https://t.co/DRjgIa92aa
Multiple XS-leaks disclosing Facebook users in third-party websites ($8,400)
https://t.co/F1hbXk7jNa

[skymig0 @skymig0]

Lesson: Always test case variations (lower/upper/mixed) on UUIDs — authorization can break on case-sensitivity bugs.

Simple bypass, high impact

[skymig0 @skymig0]

I Found IDOR in a chat AI system:

Normal: `/chats/7b9fa258-b4d8-40e4-8560-9f7d4b82ee46/messages` → 403 Forbidden

Change one letter to UPPERCASE: `/chats/7B9fa258-b4d8-40e4-8560-9f7d4b82ee46/messages` → 200 OK + full chat history of another user!

#bugbountytips #BugBounty

[skymig0 @skymig0]

@RedwanurG @zerocopter https://t.co/TY4NXMNpHn

[Emad Shanab - أبو عبد الله @Alra3ees]

Find bug bounty programs that running on @zerocopter via waybackurls and google dorks:-

waybackurls https://t.co/Ygyq1PwXea |grep /cvd/ |sort

waybackurls https://t.co/Ygyq1PwXea |grep /rd/ |sort

Google dorks:-

intext:"https://t.co/Ygyq1PwXea"
intext:"https://t.co/RJXdSEUnym"

[skymig0 @skymig0]

By Allah's grace!
Submitted 7 reports: 4 accepted, 2 duplicated, 1 info. Got awarded on @zerocopter Keep pushing! #BugBounty #CyberSecurity #TogetherWeHitHarder

[skymig0 @skymig0]

@0xsolos @zerocopter معرفش انا عامل اكونت وببعت منه

[Shodan @shodanhq]

$5 Membership sale is live for the next 24 hours: https://t.co/0iqiq2vlzP

[s0ly @Soo000ly]

Working with my brothers @0xmagdy & @h_hussein11, we turned a Stored XSS into a full Account Takeover by bypassing a WAF.
Tip: window.location.href can bypass some WAFs 😉
Thanks @intigriti for the platform.
story :https://t.co/1AePVR0VUd
#BugBounty #bugbountytips

[MaTaRyA @h_hussein11]

Tip:
In organizations, always test by sending requests to access sensitive data from all roles. Check if roles without permissions can still retrieve the data—you might just find a hidden goldmine of vulnerabilities!
#BugBounty #CyberSecurity #EthicalHacking #PrivilegeEscalation

[skymig0 @skymig0]

@NahamSec 🫶🏼

[Abdullah Nawaf (HackerX007)🇯🇴 @XHackerx007]

The Slides of (The Art Of Authentication Bypass) on
@bsidesahmedabad
You will find a lot of useful tips and tricks that will help you bypass some admin panels😉
https://t.co/ORwf8nNNQ7
Thanks to @bsidesahmedabad for giving this topic chance
#bugbounty #bugbountytips #infosec

[conqueror - Ahmed Qaramany @c0nqr0r]

الحلقة الرابعه مع Souhaib Naceri @h4x0r_dz واتكلمنا فيها عن حاجات كتير وتجربتة في الوصول لـ LHE بتاع هاكرون وفيه نصايح جداً مهمة لتطوير مستواك، وحاجات تانية كتير تقدر تشوفها من هنا :
https://t.co/cqJwGZLvY8

#BugBounty