Bug hunter | eWPTX v3 | https://nitter.cf/t.co/9dmKreAziI
Joined June 2021
- Tweets3.6K
- Following304
- Followers2.7K
- Likes5.8K
Yay ! I was awarded $4000 from @Hacker0x01
Bug-type:- stored XSS
No AI , No reconā just fully manual work.
š¤ Made with AI
being_amanš„ retweeted
Chinese scientists have developed,
The best shortest-path algorithm in 41 years!
A team from Tsinghua University has broken Dijkstra's "sorting barrier" - the first improvement since 1984.
Just use for a world-map š¤Æ
Paper - arxiv.org/pdf/2504.17033
being_amanš„ retweeted
šØ BREAKING: Wiz Research discovered Remote Code Execution on GitHub.com with a single git push
The flaw in @github allowed unauthorized access to millions of repositories belonging to other users and organizations š¤Æ
Found a very interesting client-side path traversal vulnerability.
@Hacker0x01 #bugbounty
Found an interesting htmli
My input field was rendering inside an <a> tag, so it was working as a link.
So I broke the tag and created a new tag like </a><h1>being_man, and it executed instantly.
Even though the bug was oos, they still paid me $$$ as a bonus.
@Hacker0x01
being_amanš„ retweeted
š„ Handy resource for Bug Bounty Hunters & AppSec folks
If CSP keeps blocking your XSS payloads, this tool is worth checking out:
š cspbypass.com
You can paste a CSP header and it highlights known script gadgets, JSONP endpoints, and potential bypass vectors from allowed domains. Instead of manually digging through whitelisted sources, you get quick leads you can validate on real targets.
A solid addition to any client-side testing workflow ā especially when turning reflection ā CSP bypass ā real XSS impact.
#BugBounty #AppSec #WebSecurity #XSS #CSP #Infosec #Pentesting
Open to collaboration with anyone interested. š„ļø
Found an HTML Injection on github where multiple tags are filtered, so direct XSS isnāt possible.
The triager mentioned theyād be happy to reopen the report if I can demonstrate DOM clobbering or JavaScript execution.
#bugbounty
being_amanš„ retweeted
šØ Doing a giveaway for my Blind XSS Masterclass
Most people think they know XSS, until they meet blind XSS, the kind that fires where youāll never see it.
Same methods that helped me earn $250K+ from real reports. hhub.io/nahamsecbxss
š Retweet and reply to enter.
Dear GitHub Security Team,
I wanted to share some feedback ā the response time appears to have slowed down recently. Please improve your response time.
Thank you for your continued support.@github @GitHubSecurity @Hacker0x01 #BugBounty
being_amanš„ retweeted
Once a security guard, now a software engineer at the same company. šŖš„
Abdul Alim from Assam worked as a security guard at @Zoho learned coding after shifts, built an app, and earned an engineer role.
Kudos to Zoho for valuing skills over degrees and giving true talent a chance. ā¤ļø #Inspiration #Zoho
being_amanš„ retweeted
Weekend reading:
Huli's blog is a gem, and you should start reading it if you want to excel in frontend/client-side security
blog.huli.tw/en/categories/
