tmz900

[tmz900 @tmz900]

Deploy your next app in seconds. Get $200 in cloud credits from @DigitalOcean using my link: https://t.co/JLtQcmGvZJ

#bugbounty
#bugbountytips
#bugbountytip

[tmz900 @tmz900]

@Mr_mars_hacker my app is unauthenticated, seems like they see it like rxss, only paid at `medium`

[tmz900 @tmz900]

@3th1c_yuk1 @chux13786509 I think before .pdf

[tmz900 @tmz900]

@Ya21nSec dm me endpoint, we can collaborate !

[tmz900 @tmz900]

@AatankBadb16659 @bugoverfl0w I think everyone has been in the same situation, it's part of the process, keep trying.

[tmz900 @tmz900]

@bugoverfl0w arjun, x8 😄

[tmz900 @tmz900]

@7hamiid manual focus, i only have a few automated scripts, no vulnerability scanning, choose the method that works for you.

[tmz900 @tmz900]

@7hamiid nothing special, just FUZZ and find hidden parameters at the endpoint while fuzzing and during testing.
i use ffuf for fuzzing
arjun, x8 for finding parameters.

[tmz900 @tmz900]

@JoaoGomes12243

[tmz900 @tmz900]

@AatankBadb16659 @Bugcrowd in this case it's just a bug fix that didn't fix it, and I'm reporting it a second time. not a WAF bypass, it's basic XSS

[tmz900 @tmz900]

@JoshuaProvoste Thanks, very helpful.

[tmz900 @tmz900]

@JoaoGomes12243 @Hacker0x01 thanks u !🔥🔥

[tmz900 @tmz900]

@roohaa_n @Bugcrowd 🔥🔥🔥🔥🔥

[tmz900 @tmz900]

@7hamiid it's nothing special dude, subfinder and google dork site:*.examle.com and bing search: domain:https://t.co/vdMWoNPzAF, if you have good internet speed then add dns permutations to get more subdomains. mostly i brute force list from lot, few million directories to not miss them

[tmz900 @tmz900]

@roohaa_n I bought the domain and have the POC fully setup, hope it's not a dupe with someone's previous report. 😄

[tmz900 @tmz900]

@MiniMjStar @Hacker0x01 Exactly

[tmz900 @tmz900]

@MiniMjStar @Hacker0x01 like what you said, it is React

[tmz900 @tmz900]

@actuallyclover @Hacker0x01 private

[tmz900 @tmz900]

@nuoyan2008 @Hacker0x01 @Bugcrowd no bro, this endpoint is still active i discovered it a long time ago but it is still there.

[tmz900 @tmz900]

@MiniMjStar @Hacker0x01 no i mean the list from directory discovery, this subdomain is quite popular, it is easily found by subfinder

[tmz900 @tmz900]

@MiniMjStar @Hacker0x01 I'm not sure, but there have been quite a few reports of this program, I've brute force millions of word lists to detect it, I think if anyone uses a short word list it's easy to miss it.