Techie

bug hunter

[Techie @Techie90336584]

@BeeFaauBee09 @stokfredrik

[Techie @Techie90336584]

@DivyatejOm What about 30% crypto tax?

[Mr Anon @ShieldifyAnon]

In one post - Bookmark % Repost 🫡

You must read these papers if you're auditing ________

1. Lending Protocol

- Lending and Borrowing:
Link: https://t.co/adUsGzQvK4
- Liquidations:
Link: https://t.co/ASzppXFkyi
- Rewards:
Link: https://t.co/exPB5taUhe
- Typical vulnerabilities:
Link: https://t.co/W7Ih0v8WQ3
- Attacks Checklist:
Link: https://t.co/GDadbarki0
- Vectors of Attack and Preventing Potential Issues: Link: https://t.co/W71euMcbtR

2. AMM Protocol

- Decentralised Finance and Automated Market Making:
Link: https://t.co/axHffm5TmV
- AMM Integration Tips:
Link: https://t.co/DjQrXCYCvX
- Understanding the Vulnerabilities:
Link: https://t.co/KARypoKnSW
- Typical vulnerabilities:
Link: https://t.co/q7kf0ULahU
- DeFi Slippage Attacks:
Link: https://t.co/EJwqGZXWgX
- Generalizing knowledge on DEXs with AMMs -Part I: Link: https://t.co/CYJSUreJoI
- Generalizing Knowledge on DEXs with AMMs -Part II: Link: https://t.co/oT3D2cOHGe

3. Liquid Staking protocol

- Staking withdrawals:
Link: https://t.co/wfoeJQhl47
- How Do Ethereum Withdrawals Work:
Link: https://t.co/X3tlMakFfq
- EIP-4895: Beacon chain push withdrawals as operations:
Link: https://t.co/fwCKRRkURg
- Ethereum Distributed Validator Specification:
Link: https://t.co/QNgKqockaD
- Maximal extractable value (MEV):
Link: https://t.co/jCUvnmCUw2

4. Cross Chain Protocol(LayerZero) protocol

- Best Practice:
Link: https://t.co/jwu2XrwvP4
- A Deeper Look Into DeFi's Cross-Chain Tech:
Link: https://t.co/oetqTFQDON
- LayerZero Omnichain Contract Examples:
Link:https://t.co/8iY1X0WHKN
- LayerZero Integration Checklist:
Link:https://t.co/JZhPW8CPZC
- LayerZero’s Cross-Chain Messaging Vulnerability Link: https://t.co/iZovtVC7gt
- Cross-Chain Security with LayerZero Labs:
Link:https://t.co/wlO0Ic9xby
- UA Configuration Lock:
Link: https://t.co/sGobPlPiEm

5. Cross-chain/Bridge

- Open problems in cross-chain protocols
Link: https://t.co/nGIqpU1WG2

6. Protocol integrates with external Oracle smart contracts

- All about Oracles:
Link:https://t.co/aVusAT9DVI
- The Dangers of Price Oracles in Smart Contracts: Link: https://t.co/1SIuqHMR1a
- TWAP Oracle Manipulation Risks, Mudit Gupta:
Link: https://t.co/gCXMJHdMuA
- TWAP Oracles After the Merge, Mark Toda:
Link: https://t.co/VjON9qs0NG
- So you want to use a price oracle:
Link: https://t.co/M3QRszIA7U
- Pricing LP tokens | Warp Finance hack:
Link: https://t.co/js90u5J2O9
- Uniswap V3 tick price manipulation:
Link: https://t.co/R0BADP3aBR
- Chainlink Oracle Security Considerations:
Link: https://t.co/u7T6VoijGc

7. ERC-4337(Account Abstraction)

- All About ERC-4337 (Account Abstraction): Link:https://t.co/FRSOMjHc4K
- Account Abstraction Security Guide:
Link:https://t.co/CaU0faKjfu
- ERC4337 Audit Checklist:
Link:https://t.co/g5ymwpyzHG

8. ZK (Zero Knowledge) Protocol

- A curated list of awesome ZK resources, libraries, tools and more:
Link: https://t.co/cr8hPQ123V
- Security Reviews:
Link: https://t.co/BZ5WhCZhqY
- ZK Bug Tracker - Common Vulnerabilities:
Link: https://t.co/GYhHcq7Vky

9. NFT protocol

- NFT Attack Vectors:
Link: https://t.co/hMAKb2gInK
- NFT attacks:
Link: https://t.co/7PbdZAKe2r

10. Vault Protocol

- Check if the user's balance is updated based on funds received and not the funds declared to be sent - If there is a Vault in the system, then users' funds are stored on it
- Check if the depositing rounds down the assets and withdrawing rounds up
- Check if shares are distributed in proportion to the user's deposited funds
- Check that the vault is allowed to transfer tokens only from msg.sender to prohibit stealing from users who approved the vault contract

[Piyush Shukla 🇮🇳 @PiyushShukla__]

Did you check out this awesome list of the top 10 bugs of 2023 on Immunefi? It's really insightful, and you'll notice that these bugs aren't exactly rocket science to find ? https://t.co/VbHhy7LWMi

[Techie @Techie90336584]

@x1337loser @saur1n How to understand min js files?

[Techie @Techie90336584]

@bhavukjain1 @Hacker0x01 @Bugcrowd How many bugs ( percentage) found by automations and how much are of manual testing?

[Jayesh Madnani @Jayesh25]

Bug Bounty Tips: Working on a target app that requires an International phone # for sign up? 📲🌏

Don't let International phone number requirements stop your bug bounty journey! Here are my top 3 favorite services for receiving SMS online to tackle these targets:

1️⃣ https://receive-sms[.]cc - Swift and efficient, it covers the US, UK, and more, receiving SMS almost instantly.

2️⃣ TextNow Android App - Get a dedicated phone number for free using the TextNow Android App. Install it from https://t.co/OHlLiUVSGn and enjoy seamless SMS and phone call reception.

3️⃣ https://onlinesim[.]io/ - This service lets you purchase or rent dedicated phone numbers for specified durations, capable of receiving SMS from any services.

Don't overlook targets demanding an International phone number for sign-up/login; they often hold juicy opportunities for discovering authentication bugs and earning bounties! 🌐🔐 #BugBounty #InfoSec #Hacking #Cybersecurity #SMSVerification #BugBountyTips #HackerOne #BugCrowd

[Deepak bug_vs_me @bug_vs_me]

https://t.co/2l6MNINlZX

web3 vulnerabilities are insane! this channel post really cool vulnerability post-mortem !

@Jun1on

[Jayesh Madnani @Jayesh25]

Bug Bounty Tips: Learn from My Early Mistakes 🚫

In my bug bounty journey, I've made several mistakes that I hope you can avoid. Here are the top 5 lessons:

1️⃣ Program Diversification: Imagine you've found a goldmine program with a stack of issues to keep you busy for months. It's tempting to focus all your efforts there, but why just stick to one program? Instead, seize this opportunity to diversify. Find 1-2 backup programs to hunt on. You're motivated and can handle multiple programs at once. This approach builds multiple income streams, reducing your reliance on a single favorite program. The strategy would be to report 2-3 issues on your favorite program and then hop on to explore new programs to find Issues on there for future readiness. Can't find any Issues? Time to buy some more motivation by reporting an Issue on your favorite program and then keep jumping back and forth.

2️⃣ Comfort Zone Trap: Landing a big bounty or a couple of them might make you want to kick back and relax for the rest of the month. However, if you're just starting out, it's crucial not to get too comfortable. I learned this the hard way. Staying in your comfort zone can stunt your growth. Instead, aim to double your monthly targets. This strategy ensures consistent progress and mitigates the impact of lean months.

3️⃣ XSS to ATO Escalation: Reporting XSS issues is great, but don't stop there. One of my biggest regrets is not escalating XSS to Account Takeover (ATO) issues. I potentially missed out on substantial rewards over 100k+. Some programs are willing to pay generously for XSS escalations to ATO up to $10k-30k. If you're unsure how to escalate, feel free to reach out to me for collaboration.

4️⃣ Automation Neglect: I made the mistake of ignoring automation for over two years. If you're not using any automation, you're likely missing out on numerous opportunities. Even a basic automation setup can help you save time and uncover issues that manual testing might overlook.

5️⃣ Balancing Automation: While automation is a valuable tool, it shouldn't be your sole reliance. Bug bounty hunting isn't a guaranteed source of free money. Even with automation, it's crucial to maintain a hybrid approach. This means investigating the leads generated by your automated tools thoroughly. A well-rounded manual testing methodology is essential for success.

Avoid these early mistakes, and you'll be better equipped for your bug bounty journey! 🚀💰 #BugBounty #InfoSec #SecurityTips #HackerOne #BugCrowd #Cybersecurity

[Pallav Singh @pallavserene]

What a mess is the system which we have created. Yes, we all have a role to play. Maybe some of us were not diligeng performing our duties, some corrupt, some dishonest. I realise what we go through.

This is not my story, this is the story of most of the people here.

[Pallav Singh @pallavserene]

If I happened to be a minister, the same hospital would run behind me and my surgery would have got done till now. But I happen to be the middle class one, the voter, who is the king during elections, and no one after that. Literally, no one.

[Rishikesh📱 🏊‍♂️ @RustyRishii]

Found a website that allows you to read paid medium articles for free

https://t.co/bSSGc2LQ85

[Techie @Techie90336584]

@chainSiren @immunefi Congratulations 🎉 can you share resources to learn web3 smart contract auditing?

[Suhrad @SuhradMakwana]

The powerful checklist I use while doing bug bounty or pentesting assessment

It's @owasp based checklist and has 500+ Test Cases

https://t.co/jUkDV6IeYX

#bugbountytip #bugbounty #Pentesting #infosecurity #cybersecurity #Security

[Techie @Techie90336584]

@krishnsec This maybe unique question ( and a silly one) how to not excited after getting bounty 🥲 after i get bounty i stopped hunting ( and comback is damn hard)

[Techie @Techie90336584]

@InfoSecComm 100 Bitcoins

[0xDjango @0xDjangoOnChain]

@Techie90336584 @immunefi I recommend checking out Immunefi's Medium page

[Techie @Techie90336584]

@7odamoo constructor.constructor('alert(1)');

[Techie @Techie90336584]

@0xDjangoOnChain @immunefi Can you please suggest resources to learn web3 bug bounty ?

[Justin Gardner @Rhynorater]

I've made over 100k on SSRF vulnerabilities.

They aren't always as simple as pointing it at localhost or AWS Metadata service.

Here are some tricks I've picked up over the past 5 years of web app testing:

[7h3h4ckv157 @7h3h4ckv157]

100 Days of Hacking! Day 83 #Special ⬇

~# How to get your 1st CVE 📍❤️‍🔥

- Choose a Project
- Identify a vulnerability
- Confirm its impact
- Notify the vendor
- Collaborate on a fix (suggest)
- Request a CVE
- Document the issue
- Submit to a CNA
- Receive CVE ID
- Share responsibly

This resources will guide you, how ⤵️

- A Simple Guide to Getting CVEs Published
https://t.co/5Bvo2Tkp8X

- How to get your 1st: https://t.co/LkFp7EyQPn

- Road map to getting your first cve: https://t.co/8DbIP4HrNY

- CVE IDs and How to Get Them: https://t.co/TfqJJfy0QR

- Using GitHub to manage your first CVE: https://t.co/wnU3fJJnER

- Almost every publicly available CVE PoC
https://t.co/dZa6AUOrCN

- CVE assignment documentation
https://t.co/76LCjnRF1V

- Read Hacktivity: @huntrdev @huntrHacktivity

#Pentesting #Hacking #bugbountytips #infosec #cybersecuritytips #redteam #CTF #pwn #blueteam #Offsec #100DaysOfHacking #networksecurity #Software #coding #programming #computer #Hardware #BugBounty #CybersecurityNews #cybersecurity #CyberSecurityAwareness