$BountyOverflow's profile picture. BBH ( ͡° ͜ʖ ͡°) 💰 @Bugcrowd Top 50 \o/ ✌️ MVP✌️ I am here to learn/share application security stuff ✌️ I enjoy finding auth bypass bugs 🐞$

I¯\_(ツ)_/¯I \ (•◡•) /

@BountyOverflow

BBH ( ͡° ͜ʖ ͡°) 💰 @Bugcrowd Top 50 \o/ ✌️ MVP✌️ I am here to learn/share application security stuff ✌️ I enjoy finding auth bypass bugs 🐞

Media Personality

🌎 Earth 🌎

Присоединился в Декабрь 2010

1KПосты 7Kчитателей 1Kв читаемых

Вам может понравиться

@samm0uda

@tbbhunter

@zapstiko

@HusseiN98D

@payloadartist

@0xMstar

@MrTuxracer

@lu3ky13

@codecancare

@0x_rood

@galnagli

@_bughunter

@hunter0x7

@7odamoo

@alicanact60

Закреплено

I¯\_(ツ)_/¯I \ (•◡•) /

@BountyOverflow

1 авг. 2022 г.

What a great month it was July 2022! I have ranked #2 world wide on @Bugcrowd bugcrowd.com/leaderboard

I¯\_(ツ)_/¯I \ (•◡•) / сделал(а) репост

Why to use a simple #XSS vector like this 🤔 <img src=x onerror=alert(1)> when you can use a much better one? 🤩 1'//"</Script><Img/Src%0AOnError=alert(1)// The vector above pops in HTML and JS scenarios for single and double quotes! 🤯 Try it here: x55.is/brutelogic/xss…

I¯\_(ツ)_/¯I \ (•◡•) / сделал(а) репост

Rhino Security Labs

@RhinoSecurity

11 февр.г.

New Rhino Blog Post: CVE-2025-0693: AWS IAM User Enumeration bit.ly/3QcEpnx

RhinoSecurity's tweet card. Rhino Security Labs discovered two username enumeration vulnerabilities in the AWS Web Console.

CVE-2025-0693: AWS IAM User Enumeration

Источник: rhinosecuritylabs.com

I¯\_(ツ)_/¯I \ (•◡•) / сделал(а) репост

evan j

@ejcx_

8 февр.г.

blog.cloudflare.com/resolving-a-mu… I don’t work there anymore but it’s truly so sick seeing this level of weird bug being patched so fast Hell yeah

ejcx_'s tweet card. Cloudflare patched a Mutual TLS (mTLS) vulnerability (CVE-2025-23419) reported via its Bug Bounty Program. The flaw in session resumption allowed client certificates to authenticate across different...

Resolving a Mutual TLS session resumption vulnerability

Источник: blog.cloudflare.com

I¯\_(ツ)_/¯I \ (•◡•) / сделал(а) репост

Kévin GERVOT (Mizu)

@kevin_mizu

7 февр.г.

Thanks to the recent @PortSwigger top 10, I finally found the motivation to finish writing the 2nd article about DOMPurify security! 😁 Before releasing it, I would like to share a small challenge 🚩 Challenge link 👇 challenges.mizu.re/xss_04.html 1/2

kevin_mizu's tweet image. Thanks to the recent @PortSwigger top 10, I finally found the motivation to finish writing the 2nd article about DOMPurify security! 😁

Before releasing it, I would like to share a small challenge 🚩

Challenge link 👇
challenges.mizu.re/xss_04.html

1/2

I¯\_(ツ)_/¯I \ (•◡•) /

@BountyOverflow

4 янв.г.

paulosyibelo.com/2024/12/double…

I¯\_(ツ)_/¯I \ (•◡•) /

@BountyOverflow

21 дек.г.

Unleashing The Power of a JavaScript Bookmarklet for Endpoint Discovery in Bug Bounty and… execure.medium.com/unleashing-the…

BountyOverflow's tweet card. Awesome Script for Finding Endpoints

Unleashing The Power of a JavaScript Bookmarklet for Endpoint Discovery in Bug Bounty and…

Источник: execure.medium.com

I¯\_(ツ)_/¯I \ (•◡•) / сделал(а) репост

zseano

@zseano

21 дек.г.

Seems rennie deleted his twitter so original post is gone :/ but someone made a post about it here with the code: execure.medium.com/unleashing-the…

zseano's tweet card. Awesome Script for Finding Endpoints

Unleashing The Power of a JavaScript Bookmarklet for Endpoint Discovery in Bug Bounty and…

Источник: execure.medium.com

I¯\_(ツ)_/¯I \ (•◡•) / сделал(а) репост

James Kettle

@albinowax

27 нояб.г.

Got a CSRF attack being blocked by Content-Type validation? You might be able to bypass it with this quality technique. x.com/lukejahnke/sta…

Luke Jahnke

@lukejahnke

27 нояб.г.

🧵Can you work out how to bypass this vulnerable CSRF protection? Read all about this gotcha in my latest blog post

I¯\_(ツ)_/¯I \ (•◡•) /

@BountyOverflow

18 нояб.г.

After a 4-month break, I’m backon @Bugcrowd ! Life kept me busy with something truly special—welcoming my adorable daughter into the world. 🍼💕 Feeling so blessed! 🥰

BountyOverflow's tweet image. After a 4-month break, I’m backon @Bugcrowd ! Life kept me busy with something truly special—welcoming my adorable daughter into the world. 🍼💕 Feeling so blessed! 🥰

I¯\_(ツ)_/¯I \ (•◡•) /

@BountyOverflow

20 авг. 2024 г.

There is a public website with the following folder path: txyz.com/wp-content/upl…<filename> Does anyone know of any tricks for WordPress websites that would allow me to list all files and folders in the 'uploads' directory? #thanks-in-adv

I¯\_(ツ)_/¯I \ (•◡•) / сделал(а) репост

ramsexy

@plmaltais

17 июн. 2024 г.

I was facing a very strict WAF while trying to exploit a XSS : no gt/lt signs, no parentheses, no double quotes, no backticks. I was injecting inside an html tag. Turns out the solution was very simple (and not well documented): <img src=x onerror=alert&#40document.domain&#41>

plmaltais's tweet image. I was facing a very strict WAF while trying to exploit a XSS : no gt/lt signs, no parentheses, no double quotes, no backticks. I was injecting inside an html tag. Turns out the solution was very simple (and not well documented):

&lt;img src=x onerror=alert&amp;#40document.domain&amp;#41&gt;

I¯\_(ツ)_/¯I \ (•◡•) / сделал(а) репост

Hunter

@HunterMapping

17 июн. 2024 г.

🚨Alert🚨CVE-2024-30103: Microsoft Outlook Remote Code Execution Vulnerability ⚠This Microsoft Outlook vulnerability can be circulated from user to user and doesn’t require a click to execute. Rather, execution initiates when an affected email is opened.This is notably dangerous…

HunterMapping's tweet image. 🚨Alert🚨CVE-2024-30103: Microsoft Outlook Remote Code Execution Vulnerability
⚠This Microsoft Outlook vulnerability can be circulated from user to user and doesn’t require a click to execute. Rather, execution initiates when an affected email is opened.This is notably dangerous…

I¯\_(ツ)_/¯I \ (•◡•) /

@BountyOverflow

10 июн. 2024 г.

it sucks. Just after opening @Burp_Suite

I¯\_(ツ)_/¯I \ (•◡•) / сделал(а) репост

Alexander Mia

@arekusandr_

4 мая 2024 г.

INTRODUCING: Agentic Security - LLM Security Scanner! 🔍 🛠️ Customizable Rule Sets: Tackle agent-based attacks with precision! 🧪 Comprehensive Fuzzing: Dive deep into any LLM's vulnerabilities! 🔄 LLM API Integration & Stress Testing: Ensure robust performance!

I¯\_(ツ)_/¯I \ (•◡•) /

@BountyOverflow

21 мая 2024 г.

Indeed, for me aswell ! Thanks @Bugcrowd from my bottom of the heart ❤️!

Hussein Daher

@HusseiN98D

20 мая 2024 г.

I <3 @Bugcrowd and everyone that worked to make it so good. Definitely improved my life overall.

I¯\_(ツ)_/¯I \ (•◡•) / сделал(а) репост

xssdoctor

@xssdoctor

18 мая 2024 г.

When it comes to GraphQL recon, JavaScript is the next best thing to introspection. I made a tool (in go) which finds all graphql queries in js files (or folders) and uses ChatGPT to build the queries for you! github.com/xssdoctor/grap…