Sujan Thapa Magar

This lazy noob isLearning about the Web Security.
Bug bounty hunting and pentesting with noob mind set.

[Sujan Thapa Magar @suzan_mgr]

I have Successfully bypassed their fix 🤫🤫

#bugbounty #responsibledisclosure #ethicalHacking #HackingForFood #HackSujanHack

[Sujan Thapa Magar @suzan_mgr]

@tine_code I am just learning brother but i almost found every vulnerability. 😂

[Sujan Thapa Magar @suzan_mgr]

Bug hunters i got this message after reporting 100 plus bugs in this program. You guys also can try this bug bounty target. Magic of 100 plus reports.

[Sujan Thapa Magar @suzan_mgr]

@jonaskilucaski Hell yeah bro you told the truth. They want to make my akills budget friendly . Not going to accept this proposal

[Sujan Thapa Magar @suzan_mgr]

@MeshvPatel18 Yeah sure

[Sujan Thapa Magar @suzan_mgr]

@dipeshxy Bhai keep hunting. It means alot for me

[Sujan Thapa Magar @suzan_mgr]

@0xocdsec Same here brother i am not intrested in consulting jobs. I need a proper technical role.

[Sujan Thapa Magar @suzan_mgr]

@11divk Just using google brother.

[Sujan Thapa Magar @suzan_mgr]

@0xocdsec My english is not good 😅

[Sujan Thapa Magar @suzan_mgr]

A true bug hunter's morning routine: wake up, grab the phone, and check email before doing anything else.

[Sujan Thapa Magar @suzan_mgr]

@Imesmael Yes. Inbox

[Sujan Thapa Magar @suzan_mgr]

Back to back. This is my second bug in this program. Previously i was rewarded with 5 digit. Now this time 4 digit. I don't have much skill. But using a little skills on programs.

[Sujan Thapa Magar @suzan_mgr]

@torik_1999 Its configuration issue. Which let you to create valid jwt access token for other users.

[Sujan Thapa Magar @suzan_mgr]

@RedwanurG Yes brother. I got 5 digit from self hosted program. Its crypto based site.

[Sujan Thapa Magar @suzan_mgr]

@destro4evr Yes brother self hosted program

[Sujan Thapa Magar @suzan_mgr]

@destro4evr Thanks mate

[Sujan Thapa Magar @suzan_mgr]

Five-digit hit. You skipped third-party issues, but I targeted them anyway 🙂 Both findings were technically in third-party components, but the program owner had deployed them with insecure default settings. The vulnerability may originate 3rdpart but fix needs from program

[Sujan Thapa Magar @suzan_mgr]

@itsmeNxSTY Yes brother self hosted

[Sujan Thapa Magar @suzan_mgr]

@dipeshxy Thank you brother 🥰

[Sujan Thapa Magar @suzan_mgr]

@Zaddyzaddy @BugBunny_ai Go bunny go @Zaddyzaddy