Krishna Kumar

Penetration tester | Bug Bounty Hunter

[Krishna Kumar @xalgord]

How to Learn Web & API Hacking in 2026: The Complete Roadmap

#BugBounty #Cybersecurity #Programming #Technology #WebSec

https://t.co/AaOFDn2tXO

[Krishna Kumar @xalgord]

Autonomous AI-Powered Pentesting Engine

https://t.co/GoPEtG1ldB

[Krishna Kumar @xalgord]

The Logic Flaw That Leads to Total Control: Mastering Account Takeovers in 2026 https://t.co/oLtR1yFoLp

[Krishna Kumar @xalgord]

@7h3h4ckv157 Can it perform black-box testing?

[Krishna Kumar @xalgord]

Releasing React2Shell - A new standalone exploit for CVE-2025-55182.

🔗 GitHub: https://t.co/xBHHhVlUXh

#Infosec #CyberSecurity #RedTeam #ExploitDevelopment #NextJS #CVE202555182 #Python #PenTest

[Krishna Kumar @xalgord]

Checkout "How to Rotate Your IP Address & Stay Anonymous System-Wide on Windows (2025 Guide)" #BugBounty #cybersecurity #Hacking

https://t.co/rohDDBTAEV

[Krishna Kumar @xalgord]

@theXSSrat Got it! thanks ❤️

[Krishna Kumar @xalgord]

An SQL dump file (mysql.sql) was exposed at "http:// SUB.REDACTED .net/ wp-content/mysql.sql", revealing sensitive information like user credentials and API keys.

Tip: Create a custom wordlist instead of using common ones.

#bugbounty #CyberSecurity #hacking

[Krishna Kumar @xalgord]

Made a POC for How I was able to access AWS metadata service from outside the EC2 Instance. #bugbounty #CyberSecurity

https://t.co/CLT743W7q2

[Krishna Kumar @xalgord]

I just published Comprehensive Bug Bounty Hunting Methodology (2024 Edition) https://t.co/Hcoj7P5rek

#bugbountytip #bugbounty #Hacking #CyberSecurity

[N$🌟 @__nav1n_]

Advanced SQL Injection Techniques now available in GitBook. Make a copy/ Archive / Convert to PDF before they report this too :).

#bugbountytip #BugBounty #SQLInjection #SQLi

https://t.co/APxU4CULCt

[Krishna Kumar @xalgord]

@xsgames_ work

[Krishna Kumar @xalgord]

@bug4you this is awesome brother 🤩🔥🔥 Keep it up 💪

[Anton @therceman]

Bug Bounty Tip

List of localhost addresses for SSRF bypass

🔹http://localhost
🔹http://127.1
🔹http://127.0.0.0
🔹http://127.0.0.1
🔹http://2130706433
🔹http://0177.1
🔹http://0x7f.1
🔹http://127.000.000.1
🔹http://localtest .me
🔹http://[::1]
🔹http://[::]

Cheers!

[Krishna Kumar @xalgord]

https://t.co/n6zb9MKlFv #BugBounty #XSS #CyberSecurity

[Krishna Kumar @xalgord]

Found a stored XSS in 15 minutes.
Payload used: "></div><a/href="j	a	v	asc	ri	pt:alert(document.cookie)">

#bugbounty #cybersecurity #penetrationtesting

[Krishna Kumar @xalgord]

XSS via Comment Bypass. The reflected payload was commented out in the source code like this: <!-- <h1>test</h1> -->. So, I used this payload to uncomment the code: --><h1>test</h1>. Now the source code becomes this: <!----><h1>test</h1> and it works. #bugbounty #xss #Pentesting

[Krishna Kumar @xalgord]

@BendikMatej somewhere in the mid

[Krishna Kumar @xalgord]

payload used: %27%22%3E%3CScRipt+class%3DXalgord%3Ealert.bind%28%29%281%29%3C%2Fscript%3E

[Krishna Kumar @xalgord]

Found an XSS in a VDP using paramspider, gau, waybackurls, and kxss #XSS #BugBounty