Remember the SQLi that gave me 204 DBs? Company patched it in 10 mins… but as a hunter, the hunt doesn’t stop there. 🕵️‍♂️ I started looking for connected legacy assets → and found my way back in. #BugBounty #SQLi #bugbountytips

Found an untouched asset (built in 2018) with an unsubscribe functionality. Turned out it was vulnerable to time-based blind SQLi → from a single entry point I accessed 200+ databases. Patience + curiosity always pay off 💰€€€€ #BugBounty #SQLi #bugbountytips Thread 🧵

Huge shoutout to the one I call "the SQLi master", @5hady_ Thanks so much for the help and tips, whatever is in this article is definitely inspired by your ideas, plus a mix of my own research and what I've learned along the way. https://t.co/EWGuujn8my

👻👻👻Nuclei AI Prompts for @pdnuclei Nuclei v3.3.9 (@pdiscoveryio) has -ai option to generate and run nuclei templates on the fly in natural language. This is a list of prompts for this option: - sensitive data exposure - SQLi - XSS - SSRF ✅Join Telegram-

Cloudflare 403 bypass to time-based blind SQLi: PL: (select(0)from(select(sleep(10)))v) → 403 but PL: (select(0)from(select(sleep(6)))v)/*'%2B(select(0)from(select(sleep(6)))v)%2B'%5C"%2B(select(0)from(select(sleep(6)))v) → Time-based Blind SQLi #BugBounty #SQLi

Today's finding with @d3q0w; it's a boolean-based o-data sorting injection ( SQLi ) that allows internal database fields enumeration.

🔁 Finding hidden parameters can be rewarding as they're most of the time susceptible to SQLi, XSS, and even command injections! 😎 The tricky part is that you have to manage to find all of them first 🤠 In our article, we outlined 5 different ways to find hidden input

From SQLi to RCE – and bypassing developer regex filters During a recent security assessment, I was able to demonstrate how a seemingly simple SQL Injection vulnerability could be escalated into Remote Code Execution (RCE). Threads 🧵 #infosec #hacking #hacker #BugBounty

Adding a sqli module to my c2 suite so you can pentest sites as well in the same suite

#bugbounty #cybersecurity #sqli #bugs #dev

Day 64 of #100DaysOfCyberSecurity Used Burp Suite Repeater to exploit a Union SQLi vulnerability. Was able to retrieve the CEO's private notes from the database. This is where theory becomes practice! @ireteeh @segoslavia @comp_guyy #CyberSecurity #SQLI

That’s enough SQLi for today 💉 Stocked up a few extra for the busy days ahead ☠️ #SQLIMaster #BugBounty #InfoSec #CyberSecurity #EthicalHacking #WebSecurity #AppSec

Find vulnerable with automation Tips :- 1. site:*.company. com ext:php 2. echo https://company .com | gau | grep "\?" | uro | httpx -silent > parameters.txt 3. nuclei -l parameters.txt -t fuzzing-templates 4. Found xss,sqli,ssrf,open redirect etc #bugbountytips

Sometimes, when you get "500 internal server error" when testing for SQLi, that could be an indication that SQL is happening behind the application; don't stop there, you've to keep testing, and don't forget to apply "break and repair" :).... let's wait for part 2 from @5hady_

Exceptional SQLi ✔️ Top 100 overall severity high to exceptional @intigriti ✔️ And this is just the warm-up 🔥 #SQLIMaster #BugBounty #SQLi #InfoSec #CyberSecurity #Leaderboard

ملف ميجا فيه كورس Bug Bounty كامل من الصفر كل سكشن فيه فيديو شرح + ملف ترجمة + تدريب عملي ي��لمك من الأساسيات لين الثغرات الكبيرة زي SQLi و XSS الرابط : https://t.co/mnJpfWfC8w

ring ring... who is it? a bucket of sand to bury your head in. Join us today on our journey through FreePBX's CVE-2025-57819, as we chain unusual behaviour to demonstrate the auth bypass, to SQLi, to RCE, used in-the-wild. https://t.co/02BoDnDPct

Couple more bugs in the bag ✅ SQLI 💉 #BugBounty #BugBountyLife #EthicalHacking #CyberSecurity #InfoSec #SQLi #WebSecurity #KeepHacking

Others wait for good morning texts… Me: waiting for the dump message 💀 Now I can sleep well 🤝 #SQLIMaster #BugBounty #BugBountyLife #EthicalHacking #CyberSecurity #InfoSec #SQLi #WebSecurity #KeepHacking