Thamzhack

[Thamzhack @thamzhack]

@PearceChen45 My first bounty on Hackerone. I have received bounties before on different platforms.

[Thamzhack @thamzhack]

Yay, I was awarded a $12,500 bounty on @Hacker0x01! https://t.co/VeVfoiDoVA #TogetherWeHitHarder

[Thamzhack @thamzhack]

@bugoverfl0w Nope. On a private program

[Thamzhack @thamzhack]

@payloadartist @sysdig I had this bypass with me for months. This one was a very simple WAF bypass as the WAF forgot to update the event-handlers from the Portswiggers Cheat sheet. They could have simply ran those even-handlers on intruder instead of the complicated fuzzing.

[Thamzhack @thamzhack]

@xnl_h4ck3r @xssdoctor I have one target where the server gives a generic error for everything. Zero hints.

[Thamzhack @thamzhack]

@bxmbn @amanmahendra_ Not true. I have had my 9k bug triaged by Adam. It's completely unrelated to XSS. Stop harassing Triagers.

[Thamzhack @thamzhack]

I earned $500 for my submission on @bugcrowd https://t.co/7biigzcLcp #ItTakesACrowd
Sometimes, basic features are bugs waiting to be reported

[Thamzhack @thamzhack]

@MrTuxracer @ArchAngelDDay @renniepak I'm curious to know why availability is none here?

[Thamzhack @thamzhack]

@krishnsec @Bugcrowd Hi! On what basis they give swags? Points or Total bounty earned or P1 submissions ?

[Pomme @pxmme1337]

@irsdl Once you’ve reported something, erase the report from your memory and move on. Keep looking for more bugs while your first report is being worked on by the platforms. This is a good way to stay engaged and motivated while not obsessing on something that’s already been reported

[Thamzhack @thamzhack]

@Farah_Hawaa @feross

[Thamzhack @thamzhack]

@xnl_h4ck3r @codingo_ @PentesterLab Sure!

[Thamzhack @thamzhack]

The app was a collaboration based platform. It disclosed other teammates emails, their verification status, privileges(admin, manager and user) to anyone in the team. This design increased the impact of the bug.

[Thamzhack @thamzhack]

Highest bounty so far on @Bugcrowd #ItTakesACrowd
#BugBounty

[Thamzhack @thamzhack]

This was an app-specific issue, when signing up, the app assigned an uuid for the email and sent an OTP. The verification endpoint took email, uuid and OTP as parameters. I supplied an already verified email's uuid and wrong OTP. It worked, allowing me to verify anyone's account.

[Thamzhack @thamzhack]

@IAmMandatory I don't think it's possible on devices with locked bootloader but on a bootloader unlocked device you can do it with a custom recovery tool like TWRP.

[Thamzhack @thamzhack]

@H4R3L @intlulz @VLobstein_ I was really impressed by your cache poisoning writeup. Someone of your calibre should never have been discouraged and it's truly bad it happened.