Kanishk Dadhich

noob hacker

[Kanishk Dadhich @whotfbunny]

I was about to close Burp Suite when one API request caught my attention.

Booring --> PII leak it was that big transition

Go and read my new article and give your opinions

👇 Full write-up
https://t.co/455udBDy3b

#BugBounty #AppSec #WebSecurity #IDOR #API #SecurityResearch @theXSSrat

[Kanishk Dadhich @whotfbunny]

"Random" doesn't always mean "secure."

A UUID in a URL turned into a security finding that taught an important lesson about authentication design.

Wrote about the discovery process here 👇

https://t.co/q1HFjXqhtd

#BugBounty #SecurityResearch @theXSSrat @bugbountywizard

[Kanishk Dadhich @whotfbunny]

If you're in tech and don't understand OAuth 2.0 flow — start now. It's the auth standard powering nearly every major company's login system. Non-negotiable knowledge. 🧵

#appsec #bughunters

[Kanishk Dadhich @whotfbunny]

@theXSSrat Thankyou

[Kanishk Dadhich @whotfbunny]

Finally I am publishing my first medium article pls go and read and give your thoughts on: “From Self-XSS to Account Takeover: How I Turned a Low-Severity Finding into a Critical…“ by Kanishk dadhich on Medium: https://t.co/jct581TbHT
@theXSSrat

[Kanishk Dadhich @whotfbunny]

@bugbountywizard It's a result of crusity. Exceptional finding
Keep growing brother

[Kanishk Dadhich @whotfbunny]

@theXSSrat Thanks for showing your love.

[Kanishk Dadhich @whotfbunny]

Broken Access Control is like hide and seek — it can hide anywhere.

Found a case where a low-privileged user could access an admin-only export API and download org membership data containing PII + metadata.

No download button existed in the UI 👀

#bugbounty #appsec @theXSSrat

[Kanishk Dadhich @whotfbunny]

If you are in bugbounty then repeatedly ask yourself "what is it" and "what if". Most impactful findings come from curiosity, not payload lists.

#BugBounty #CyberSecurity #InfoSec #EthicalHacking #BugHunter #AppSec #Pentesting #SecurityResearch

[Kanishk Dadhich @whotfbunny]

🐛 Found an XSS that escalated to full Account Takeover!What started as a simple injection turned into complete Admin account compromise 🔥Never underestimate low-severity findings 👀

#XSS #AccountTakeover #BugBounty #InfoSec #WebSecurity #CyberSecurity #BugBountyTips

[Kanishk Dadhich @whotfbunny]

It's is so frustrating when you got xss but can't show the impact because it's self xss. I tried a lot to chain ⛓️ but didn't work

#hacker #bughunter #storedxss #securityresearcher

[Kanishk Dadhich @whotfbunny]

It's is so frustrating when you got xss but can't show the impact because it's self xss. I tried a lot to chain ⛓️ but didn't work

#hacker #bughunter #storedxss #securityresearcher

[Kanishk Dadhich @whotfbunny]

@theXSSrat Php upload on server executing xss and content hosting I found this same bug on 2 sub domains of my target site

[Kanishk Dadhich @whotfbunny]

I just found same vulnerability on different sub domain leads to sorted xxs and content hosting 🥳
#Hackers #bugbounty #securityresearch @theXSSrat

[Kanishk Dadhich @whotfbunny]

Hey hackers👋

How do you Pentest/Bughunt on Salesforce applications, also any good resources for it?

[Kanishk Dadhich @whotfbunny]

Thought I was testing a review feature.

Actually found a file upload issue that turned user-generated content into attacker-controlled content hosting.

Small feature. Bigger impact.

Lesson: Never underestimate file upload functionality.

#CyberSecurity #BugBounty #Security

[Kanishk Dadhich @whotfbunny]

I found an exposed django administration panel. But I got no clue how to exploit

#bughunters #bugbounty

[The Cybersecurity guy @cyber__razz]

This video contains the main methodologies attackers use to hack Wordpress websites

[Kanishk Dadhich @whotfbunny]

@_xploiterr That's a nice finding bro. How much time it takes you to get

[Kanishk Dadhich @whotfbunny]

@Be5Lmt @or4nge16hehe That's just crazy finding bro