Tarun mahour

Cyber security researcher and Bug bounty hunter

[Tarun mahour @sratarun]

Listed on #Google
Honorable Mentions @Alra3ees @secuninja @eSecHax0r @s0md3v

[Tarun mahour @sratarun]

I have successfully bypassed DOMPurify version 3.4.5.

[Tarun mahour @sratarun]

@HusseiN98D https://t.co/hz5MKBNsj9

[def1ant @0xdef1ant]

☝️did you know: if you have CRLF injection on a 302 redirect, you can still trigger XSS by providing an empty value for the "Location:" header #bugbountytip #hackerone

[Tarun mahour @sratarun]

@ethicalrohitt @lostsec_ T-mobile

[Tarun mahour @sratarun]

@intigriti Burp and https://t.co/tILmq8MDXl , subfinder , nuclie ,

[Tarun mahour @sratarun]

@intigriti Made by me in 2024

[Tarun mahour @sratarun]

@intigriti 💀✅️

[Tarun mahour @sratarun]

@visitorBhuwan @k_wijewardhane Not vulnerable

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Burp Suite Secret Finder - Burp Suite Extension To Discover Apikeys/Tokens From HTTP Response⚡️

> https://t.co/z7qG9eZXTk

#bugbounty #cybersec #bugbountytips

[Tarun mahour @sratarun]

@intigriti City of Miami skyline from bridge to Brickell Key,

[Tarun mahour @sratarun]

@intigriti Rce

[Tarun mahour @sratarun]

@popc0rn94 Php website

[Tarun mahour @sratarun]

👿👿After a long time, finally got a Pwn again! 💀💻
This time it’s a Windows WebApp RCE 🧠⚡
Feels great to get that exploit adrenaline back!

🚀 #BugBounty #RCE #HackerVibes #HackTrainingHackers TrainingHack Training

[👑 OFJAAAH 👑 @ofjaaah]

Use NextJS? Recon ✨

A quick way to find "all" paths for Next.js websites:
DevTools->Console

console.log(__BUILD_MANIFEST.sortedPages)

javascript​:console.log(__BUILD_MANIFEST.sortedPages.join('\n'));

Cred = https://t.co/4hiJXDNlmU

#infosec #cybersec #bugbountytips

[Tarun mahour @sratarun]

@intigriti Soldier statue in Ceuta, Spain

[Tarun mahour @sratarun]

@Assass1nmarcos @Hacker0x01 @Bugcrowd @ThisIsDK999 @_venom26 Congratulations mac ko configure krne me thodi dikkat hoti shuru me mujhe bhi huyi thi 😄

[XSS Payloads @XssPayloads]

Nice list of non-latin alphabet payloads by @Yass1nMohamed
https://t.co/ovBcNaPSZJ

[Tarun mahour @sratarun]

@therceman Ssti Polygot
{{7*7}} *{7*7} {{7*7}} ${7*7} @(7*7) <?=7*7?> <%= 7*7 %> ${= 7*7} {{= 7*7}} ${{7*7}} #{7*7} [[ 7*7 ]] {{% 7*7 %}} {{<% 7*7 %>}} [% 7*7 %] <% 7*7 %> [%= 7*7 %] <# 7*7 #> [=7*7] [- 7*7 -]

[Tarun mahour @sratarun]

Welcome to XSS Under Siege — an advanced-level XSS challenge designed to push your skills to the limit.

📷Challange Link := > https://t.co/N1NqrhRvDq
@sudhanshur705 @Assass1nmarcos

[Mustafa Adam Gamaraldin Abdalla 🇸🇩♥️ @wadgamaraldeen]

الحمد لله♥️
I got my first 2 bounty rewards from Standoff365 (1 public, 1 private).
Still got accepted reports pending, including a High severity in the platform itself! Great experience with their professional and respectful teams.
🔗 https://t.co/wm0n4fcAO6

#infosecurity

[Anton @therceman]

Bug Bounty Cheat Sheet

File Upload Extension Splitting