Erick Fernando (@erickfernandox) profile picture

Erick Fernando

@erickfernandox

https://nitter.cf/t.co/qju40dBXtK

 Brazil
Joined May 2011
  • Tweets94
  • Following271
  • Followers2K
25Media
Photo by Erick Fernando (@erickfernandox)Photo by Erick Fernando (@erickfernandox)Photo by Erick Fernando (@erickfernandox)Photo by Erick Fernando (@erickfernandox)Photo by Erick Fernando (@erickfernandox)Photo by Erick Fernando (@erickfernandox)Photo by Erick Fernando (@erickfernandox)Photo by Erick Fernando (@erickfernandox)Photo by Erick Fernando (@erickfernandox)Photo by Erick Fernando (@erickfernandox)
This is the most unusual/crazy vulnerability I have ever encountered. It is possible to extract the `/etc/*` file from the disk, cache it globally, and display it to all users. 🤯
Image from Erick Fernando (@erickfernandox)
5
6
211
8,540
Another Day, Another Critical Path Traversal. #BugCrowd
Image from Erick Fernando (@erickfernandox)
13
9
1
416
15,168
Path Traversal still alive. 1 payload = 3 x 5,000 reward. #bugbounty
Image from Erick Fernando (@erickfernandox)
Image from Erick Fernando (@erickfernandox)
Image from Erick Fernando (@erickfernandox)
32
13
486
15,791
Erick Fernando retweeted
zack0x01 (@zack0x01_) profile picture
zack0x01
@zack0x01_Sep 15
Manual hacking will make you smarter , and automating it make you richer !
17
39
3
481
11,893
Yeay, I was awarded for a valid submission on @HackenProof hackenproof.com/ #hackenproofed #bugbounty
Image from Erick Fernando (@erickfernandox)
8
1
141
5,306
Thanks, @intigriti, for sharing my write-up alongside findings from some of the most notable hackers. :)
Intigriti (@intigriti) profile pictureIntigriti
@intigritiJun 19
Replying to @intigriti @albinowax @voorivex @gregxsunday
4️⃣ $1000 Bounty: Scaling a self-redirect to XSS in a Web 3.0 system @erickfernandox documents how they turned a low-impact self-redirect into a full XSS by chaining it with a Web 3.0 platform's authentication flow, landing a $1,000 bounty. erickfernandox.medium.com/10…
$1000 Bounty: How I scaled a Self-Redirect to an XSS in a web 3.0 system at Hackenproof

$1000 Bounty: How I scaled a Self-Redirect to an XSS in a web 3.0 system at Hackenproof

Hello everyone, in this article, I will share how I scaled from a self-redirect that redirected only to a link containing the host itself…

erickfernandox.medium.com
2
41
4,464
Erick Fernando retweeted
Intigriti (@intigriti) profile picture
Intigriti
@intigritiJun 19
We just dove into our shelf of archived bug bounty write-ups from the most notable hackers! 🤠 In this issue, we selected 5 compelling articles (that are still relevant today) to share with you, from which you can learn something new! 😎 🧵 👇
Image from Intigriti (@intigriti)
3
15
104
6,686
Proud to be named the Most Valuable Hacker (MVH) for Q1 2026 in the Goldman Sachs program on @Hacker0x01. 🏆 #bugbounty #hackerone
Image from Erick Fernando (@erickfernandox)
6
2
1
133
5,871
My first vulnerability capable of compromising accounts on a social network. Yay, I was awarded a $15,000 bounty on @Hacker0x01! hackerone.com/erickfernandox #TogetherWeHitHarder
Image from Erick Fernando (@erickfernandox)
21
16
599
21,062
🚨 WARNING: A 0day vulnerability in Adobe Acrobat Reader is being actively exploited in the wild for 4 months now. Simply opening a malicious PDF can lead to data theft and potentially full system compromise. Adobe has not released a patch for this vulnerability.
Image from International Cyber Digest (@IntCyberDigest)
39
414
52
1,723
140,151
I love Cache Poisoning! ❤️ #bugbounty #bugcrowd
Image from Erick Fernando (@erickfernandox)
17
10
558
14,584
Starting the year with a beautiful XXE exfiltration at @Bugcrowd. #bugbounty
Image from Erick Fernando (@erickfernandox)
11
311
9,765
Erick Fernando retweeted
Will Gates (@WllGates) profile picture
Will Gates@WllGatesJan 14
A very good xss payload.🔥 <sCriPt x>(((confirm)))``</scRipt x> credit: @viehgroup #bugbountytips #xss #bugbounty
Image from Will Gates (@WllGates)
3
33
277
13,588
Yay, I was awarded a $10,000 bounty on @Hacker0x01! hackerone.com/erickfernandox #TogetherWeHitHarder
Image from Erick Fernando (@erickfernandox)
17
10
424
13,073
Critical Vulnerability Rewarded by Deutsche Telekom (T-Mobile Germany/European Union) #bugbounty #p1
Image from Erick Fernando (@erickfernandox)
6
5
251
14,554
Erick Fernando retweeted
c4ng4c3ir0 (@c4ng4c3ir0) profile picture
c4ng4c3ir0
@c4ng4c3ir026 Aug 2025
Tamo bem rankeado na @bugcrowod no mês de agosto dentre os BR hein @sushicomabacate @erickfernandox
Image from c4ng4c3ir0 (@c4ng4c3ir0)
7
4
97
4,501
A simple open redirect can wreak havoc. Simple open redirect -> misconfigured OAuth authentication flow -> privilege abuse using Amazon Cognito token #bugbounty #bugcrowd
Image from Erick Fernando (@erickfernandox)
5
16
344
14,582
Yay, I was awarded a $10,000 bounty on @Hacker0x01! hackerone.com/erickfernandox My First Five Digits on @Hacker0x01 #TogetherWeHitHarder
Image from Erick Fernando (@erickfernandox)
16
15
356
12,682
Host Header Injection🤝Cache Poisoning 🤝 Path Traversal = Stored XSS via Path Confusion❤️ #bugbounty #intigriti
Image from Erick Fernando (@erickfernandox)
4
9
167
7,534
Erick Fernando retweeted
Hackmanac (@H4ckmanac) profile picture
Hackmanac
@H4ckmanac16 Jul 2025
🚨Chrome Zero-day Alert: PATCH NOW‼️ Google released an emergency security update for Chrome to patch CVE-2025-6558, a high-severity zero-day vulnerability (CVSS 8.8) that is actively exploited in the wild. The flaw resides in Chrome’s ANGLE and GPU components, where insufficient validation of untrusted input can allow remote attackers to perform a sandbox escape through a crafted HTML page. This enables attackers to break out of the browser’s security environment and potentially gain access to the underlying system without user interaction. The vulnerability was discovered by Clément Lecigne and Vlad Stolyarov from Google’s Threat Analysis Group (TAG) on June 23, 2025. While the full details of the exploitation have not been disclosed, Google’s acknowledgment suggests possible nation-state involvement. Users are urged to update Chrome to version 138.0.7204.157 or later. more: thehackernews.com/2025/07/ur…
Image from Hackmanac (@H4ckmanac)
1
48
4
80
12,860
Load more