Shebiiiii

Cyber Security Researcher - Red Team Member at Synack

[Shebiiiii @xshebix]

Hello all security enthusiasts!

During a recent security assessment for a private client, I came across a potential cross-site scripting (XSS) vulnerability that I wanted to share with you.

1/n

#security #cybersecurity #penetrationtesting #informationsecurity #bughunting #xss

[HAHWUL @hahwul]

Oh wow… this is actually insane 😵‍💫

https://t.co/iCiYD05eAW

[cTino @tinopreter]

$2000 for a web cache deception bug. As always I share my methodology 👇

Identifying a deception bug is always easy but exploiting it can be hard due to SameSite restrictions on victims cookie

I bypassed this to steal victim JWT. Read about it here:

🔗 https://t.co/CAxfKAC0eP

[Shebiiiii @xshebix]

@bug_vs_me @Hacker0x01

[3NVZ | Robert S. @YourFinalSin]

Found this very interesting article about SSRF and abusing microservices - maybe it's gonna help someone!

https://t.co/JKpbGRyfHa

[Shebiiiii @xshebix]

@hetmehtaa Check their company emails on hunter io or check their employees on LinkedIn also check crunchbase for their company mail

[Shebiiiii @xshebix]

@krishnsec Phishing 🔗🫣

[Shebiiiii @xshebix]

@YShahinzadeh Great 👍

[Behi @Behi_Sec]

This is a very clever technique: Task Injection in AI Agents.
https://t.co/pr91ApL8zO

[Shebiiiii @xshebix]

@cyb3rshi3ld Ccep

[Shebiiiii @xshebix]

@mijanhaque_ Laravel debug mode enabled

[Swissky @pentest_swissky]

Configuring Android Emulator with Burp Suite
https://t.co/fpDDlQ7Ek6

[Shebiiiii @xshebix]

@HarshDRanjan1 @Hacker0x01 Congrats

[Shebiiiii @xshebix]

@GodfatherOrwa How can we exploit further ?  is there a possibility to gain access to their current database?

[Ahmed Elmorsi 🇵🇸 @0Xhunterx]

This Writeup exaplains how we got ATO from Android Application
https://t.co/fGNdTIM8HA
#BugBounty #bugbountytip #cybersecuritytips #hackerone

[Shebiiiii @xshebix]

@sw33tLie @ArmanSameer95 Could you provide any code samples or references? I saw your reply mentioning it's a JavaScript-based miner, so we should be able to locate it in the .js files. What kind of code or other indicators should we look for?

[Lu3ky13 ⚡️⚡️ @lu3ky13]

Bypass Reset Password Code Lead to Account Takeover

https://t.co/aHGsODSaJF

GitHub python script

https://t.co/4kIA4YFlsS

#bugbountytips #bugbounty

[Paul Seekamp @nullenc0de]

@TanmayLP7 If you are running automated scanners. This is about 95-98% of the things that are missed.

Also, if you want to make a name for yourself in BB or web app pentest world. Get really good at these.

[Shebiiiii @xshebix]

@sherafzalmarwat Lanat iG and ssp pr

[Shebiiiii @xshebix]

@PTI_OFFICIAL9 Yes 👍

[Hamza Avvan @hamzaavvan]

Check out my playlist: Road To Ethical Hacking https://t.co/OlKzqowoEz via @YouTube