yaala

bug bounty hunter

[yaala @yaalaab]

@PaulosYibelo Congrats :) .waiting for detail

[Omar Alzughaibi @Omarzzu]

https://t.co/HkH6UIgQML

[Youssef Sammouda (sam0) @samm0uda]

Account Takeover in Facebook mobile app due to usage of cryptographically unsecure random number generator and XSS in Facebook JS SDK ($66,000)

https://t.co/XmqTaNwmds

[l0cpd @l0cpd]

“Escalating Impact: Full Account Takeover in Microsoft via XSS in Login Flow” by Asem Eleraky https://t.co/vt13dJJlT4

[yaala @yaalaab]

@sho3hit @jobertabma Maybe you are testing with a report that doesn’t have a summary ??

[James Kettle @albinowax]

Detect the NextJS middleware bypass directly in Burp Suite with this BCheck from @eternalky_u
https://t.co/dByPxACndM

[yaala @yaalaab]

@samm0uda @Meta @phwd_ @JosipFranjkovic @vulnano Congratulations Youssef.👏

[yaala @yaalaab]

@NahamSec @Meta Congrats ,

[RyotaK @ryotkak]

I recently developed and posted about a technique called "First sequence sync", expanding @albinowax's single packet attack.

This technique allowed me to send 10,000 requests in 166ms, which breaks the packet size limitation of the single packet attack.

https://t.co/puM7hZWIlE

[yaala @yaalaab]

@disclosedh1 @sagarbhavar Impact

[Karishma Kaur @newbondjames]

According to the media, it is a "war crime" to bomb military targets in #Ukraine, but it is perfectly fine to bomb civilians in #Gaza.

If the media won’t say it, I will.

Israel is a TERRORIST state‼️

#ZionistTerror #Gaza_Genocide #IsraelGazaWar #GazaAttack #PalestineGenocide

[Bhavuk Jain @bhavukjain1]

Solved! Chrome debugger was enabled and allowed access via http://localhost:9222/json. This allowed exfiltrating data from other users whosoever was hitting this headless chrome browser - more info here - https://t.co/yBCTp5p9LE

Thanks everyone for the tips :)

[yaala @yaalaab]

@eman_yazji When you hunt yes. but when shopping It is considered Theft

[yaala @yaalaab]

@HivarekarPranav @Hacker0x01 Congrats

[yaala @yaalaab]

Sometimes going back to old old versions is not a waste of time.
A bug was found in 2022.
Title : from username all contact points associated with that account were disclosed in the invalid login error message

https://t.co/dZvX0twnXO

[yaala @yaalaab]

@bazzounkassem Keep going , congratz

[yaala @yaalaab]

@KieranClaessens Thank you for saying nice

[yaala @yaalaab]

https://t.co/kpKoEr8gRd

[yaala @yaalaab]

@PaulosYibelo Thanks you 😘

[yaala @yaalaab]

@lokeshdlk77 Thanks you brother

[yaala @yaalaab]

@gfx_shrey Yes, i forget to mention android