𓆩SคᴛᎥຮн𓆪

It's never too late 2 start the life u've always wanted.
😍🥳
security Researcher |
Bug Bounty Hunter |
Android | Web | Ubuntu

[𓆩SคᴛᎥຮн𓆪 @stissh834]

I earned $2,000 for my submission on
@bugcrowd #ItTakesACrowd #bugbountytips #bugbounty

[𓆩SคᴛᎥຮн𓆪 @stissh834]

@m3h3di01 @XssReport Sometimes

[𓆩SคᴛᎥຮн𓆪 @stissh834]

Crossed 9,600+ Blind XSS callbacks across 72+ domains.
My payloads are getting more views than my social media posts.
10K next! I'll drop a blog on my Blind XSS hunting workflow when I get there.
#BugBounty #BlindXSS @XssReport
Still learning. Still hunting. 🤗

[𓆩SคᴛᎥຮн𓆪 @stissh834]

@bug_vs_me @zomato Congratulations bro

[Yasho @YShahinzadeh]

I published one of the techniques that I've been using against OAuth providers, honetly, it's led me to discover many flaws, and recently I used it to find a 1-click ATO on one of the most widely visited websites,I hope you find it useful :-)

https://t.co/o7OO8Y7e3K

[bugcrowd @Bugcrowd]

$1,000 GIVEAWAY 🎁‼️

Here’s how to enter:
1️⃣ Fill out the ITMOAH survey
2️⃣ Like this post
3️⃣ Comment your fave tool
4️⃣ Repost bc your friends deserve a chance too

Giveaway closes Sept 30 at 11:59pm ET. One hacker takes home $1K. 20 others will score $200 each. Already filled out the survey? You’re entered to win!

If not, now's your chance: https://t.co/aweXU9Lr3R

[𓆩SคᴛᎥຮн𓆪 @stissh834]

@Bugcrowd @Burp_Suite

[𓆩SคᴛᎥຮн𓆪 @stissh834]

@bug_vs_me 🙏🙏

[𓆩SคᴛᎥຮн𓆪 @stissh834]

@NahamSec 👌👌

[𓆩SคᴛᎥຮн𓆪 @stissh834]

@Bugcrowd Ohh, that’s why I received password reset link.

Thanks

[𓆩SคᴛᎥຮн𓆪 @stissh834]

@Bugcrowd

[𓆩SคᴛᎥຮн𓆪 @stissh834]

@ImanGurung13 Congratulations mate 😄

[𓆩SคᴛᎥຮн𓆪 @stissh834]

I earned $750 for my submission on @bugcrowd #ItTakesACrowd
#BugBounty

[𓆩SคᴛᎥຮн𓆪 @stissh834]

@ImanGurung13 Congratulations 🥳

[𓆩SคᴛᎥຮн𓆪 @stissh834]

@crypt0grapherr 1/100 or even zero possibility.
By the way congratulations 🙌

[𓆩SคᴛᎥຮн𓆪 @stissh834]

@mijanhaque_ @Yaseen11211 Open the triggered page. > go to down of the page > at DOM > copy the code to .html file > open in any browser.
Now you will able to see the dashboard.
> At final REPORT IT.

[Abdullah Nawaf (HackerX007)🇯🇴 @XHackerx007]

Wildest auth bypass I’ve ever seen in my entire career!
PHP+MySQL+[]= Recipe for BUGS!
Auth bypass bugs are often simple;just try any wild idea that pops into your mind. You’re a hacker, and those ideas didn’t come from nowhere!
#BugBounty #bugbountytips #bugbountytip #Bugcrowd

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

Hello everyone ♥
a little bit write-up of #bugbountytip #bugbountytips I am going to write here .....

Title:
getting unauthorized access on 3rd party's/workspaces & and building your checklist for quickly locating bugs there via massive recon

we know that its helpful to look for google
groups/docs/etc..

Slack as well just like when the amazing @h4x0r_dz shared days ago ..

Use google dork "site:https://t.co/ravW2tHHcP"

so I was not in a good mode the last months to doing Google Dorks, so what I did was build a checklist ready for me & very huge one

for EX:

https://t.co/wPxAHXvC18
https://t.co/hs3VHvhT92
https://t.co/ravW2tHHcP

and here is just an example you can add more similar workspaces for your checklist

thin I extracted all internet endpoints and as example here join[.]slack[.]com

https://t.co/OlHQSEQ6Qz

https://t.co/e8jB8H6nMS

https://t.co/w5h4VkESyQ

you can use the ready tools to do it such as waymore

important note: you have to keep your checklist updated every week

and from here I just keep looking for the company name or domain name to see if there's anything connected

and mostly the company name or domain name in the URL it self EX: tesla

https://t.co/QesyI4MHu2

Ex For Bugs found:

1 unauthorized access to the workspaces
(PII | Information disclose)
2 account takeover as Ex: valid signup employee link
3 account takeover as Ex: valid reset password employee link

now about Slack, as an example if you found an invitation link for tesla
Tesla https://t.co/QesyI4MHu2 and that link was not valid, don't stop here
it will redirect for Ex:
tesla-internal[.]slack[.]com

here back and start looking manually for endpoints of this subdomain as well EX:

https://t.co/w2dhvfdBhL

now there are a lot of 3rd party's/workspaces I just shared here
slack & Google Docs/groups

What I wrote is a bit long and annoying to some, so I apologize. I hope, as usual, that this will be useful to all who follow me here.

#Bugounty
don't forget to retweet if you like it ♥♥♥

[𓆩SคᴛᎥຮн𓆪 @stissh834]

@ImanGurung13 👌 super

[𓆩SคᴛᎥຮн𓆪 @stissh834]

@zhero___ @nextjs Superb 🥳🥳

[𓆩SคᴛᎥຮн𓆪 @stissh834]

When they don't have any option leftover 😈

#bugbounty