Ashif_(Ai)

@XploitAsh

eJPT || eWAPTXv2 || eCPTXv2 || C|EH || Security Researcher || BugBounty Hunter || Penetration taster

Joined July 2022

140Posts 3Followers 76Following

Ashif_(Ai) reposted

chux

@chux13786509

Nov 5

Hackers 🔥 An easy — but very realistic example you’ll actually find in the wild 🎯 Did you catch the vulnerability here? 🪲 How would you exploit it? 💥

chux13786509's tweet image. Hackers 🔥
An easy — but very realistic example you’ll actually find in the wild 🎯
Did you catch the vulnerability here? 🪲
How would you exploit it? 💥

Ashif_(Ai) reposted

H4x0r.DZ 🇰🇵

@h4x0r_dz

Oct 28

CVE-2025-55752 Apache Tomcat possible RCE if PUT is enabled 🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡 This is like saying i can extract your data from db if sql query is enabled

h4x0r_dz's tweet image. CVE-2025-55752 Apache Tomcat possible RCE
if PUT is enabled 🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡🤡
This is like saying i can extract your data from db if sql query is enabled

Ashif_(Ai) reposted

0x0smilex

@assa2940

Oct 23

Tip:Google dork is still alive!!🔥 payload used:<svg><animate onbegin=alert(1) attributeName=x dur=1s> Source:portswigger.net/web-security/c… #BugBounty #bugbountytips #cybersecurity #googledorks #xss

assa2940's tweet image. Tip:Google dork is still alive!!🔥 payload used:&lt;svg&gt;&lt;animate onbegin=alert(1) attributeName=x dur=1s&gt;
Source:portswigger.net/web-security/c…
#BugBounty #bugbountytips #cybersecurity
#googledorks #xss

Ashif_(Ai) reposted

#bugbountytips ❌ Stop Doing These 10 Bug Hunting Mistakes ... And revise your methodology if : 1. You spend 2 days or less per program 2. You run automated tools on each URL and wait for unique results 3. You don't scan servers' open ports 4. You don't register an account in…

silentgh00st's tweet image. #bugbountytips
❌ Stop Doing These 10 Bug Hunting Mistakes ...
And revise your methodology if :

1. You spend 2 days or less per program
2. You run automated tools on each URL and wait for unique results
3. You don't scan servers' open ports
4. You don't register an account in…

Ashif_(Ai) reposted

X

@TheMsterDoctor1

Jul 30

Autoswagger: A command-line tool designed to discover, parse, and test for unauthenticated endpoints using Swagger/OpenAPI documentation. GitHub: github.com/intruder-io/au…

TheMsterDoctor1's tweet image. Autoswagger: A command-line tool designed to discover, parse, and test for unauthenticated endpoints using Swagger/OpenAPI documentation.

GitHub: github.com/intruder-io/au…

Ashif_(Ai) reposted

chux

@chux13786509

Jul 26

HACKER’S most basic — yet powerful — trick: 💥 AUTHENTICATION BYPASS 💥 via SQL injection Still works in 2025. Still crazy effective. What’s your go-to payload? 👇 Here are a few of mine: ' OR 'chux'='chux ' OR IF(1=1, SLEEP(5), 0)-- ⏱️ This weird looking payload got me A LOT…

chux13786509's tweet image. HACKER’S most basic — yet powerful — trick:
💥 AUTHENTICATION BYPASS 💥 via SQL injection

Still works in 2025. Still crazy effective.

What’s your go-to payload? 👇
Here are a few of mine:
' OR 'chux'='chux
' OR IF(1=1, SLEEP(5), 0)-- ⏱️

This weird looking payload got me A LOT…

Ashif_(Ai) reposted

chux

@chux13786509

Jul 25

🚨 Hackers & Bug Hunters! By combining Katana, LinkFinder, Arjun, and Burp Suite, I uncovered hidden API endpoints — including ones under /dev/ — and exploited: ✅ Mass Assignment ✅ API Excessive Data Exposure ✅ IDOR (Insecure Direct Object Reference) These tools are gold when…

chux13786509's tweet image. 🚨 Hackers &amp; Bug Hunters!
By combining Katana, LinkFinder, Arjun, and Burp Suite, I uncovered hidden API endpoints — including ones under /dev/ — and exploited:
✅ Mass Assignment
✅ API Excessive Data Exposure
✅ IDOR (Insecure Direct Object Reference)
These tools are gold when…

Ashif_(Ai) reposted

Muhammad Waseem

@wgujjer11

Jul 25

Alhamdolilah Released BackupFinder ❤️ Big thanks to all contributors for making BackupFinder awesome! @infosec_au @coffinxp7 @intigriti @GodfatherOrwa For Wordlists @assetnote and for chaining with tools @pdiscoveryio Github : github.com/MuhammadWaseem… #OpenSource #BugBounty

wgujjer11's tweet image. Alhamdolilah Released BackupFinder ❤️
Big thanks to all contributors for making BackupFinder awesome! @infosec_au @coffinxp7 @intigriti @GodfatherOrwa For Wordlists @assetnote and for chaining with tools @pdiscoveryio
Github : github.com/MuhammadWaseem…

#OpenSource #BugBounty

Ashif_(Ai) reposted

Cyber Detective💙💛

@cyb_detective

Jul 22

Enter email to check if it is connected to some PGP key (it can then be used to gather information in document archives, leak databases, forums, etc). keys.openpgp.org Tip by @DoingFedTime

cyb_detective's tweet image. Enter email to check if it is connected to some PGP key (it can then be used to gather information in document archives, leak databases, forums, etc).

keys.openpgp.org

Tip by @DoingFedTime

Ashif_(Ai) reposted

LeakIX

@leak_ix

Jul 21

sharepoint.pwned.json gist.github.com/gboddin/bf6ff3…

Ashif_(Ai) reposted

Dark Web Informer

@DarkWebInformer

Jul 21

Telegram Scrapper 2.0: A powerful Python script that allows you to scrape messages and media from Telegram channels using the Telethon library. Features include real-time continuous scraping, media downloading, and data export capabilities. GitHub: github.com/robertaitch/te… Major…

DarkWebInformer's tweet image. Telegram Scrapper 2.0: A powerful Python script that allows you to scrape messages and media from Telegram channels using the Telethon library. Features include real-time continuous scraping, media downloading, and data export capabilities.

GitHub: github.com/robertaitch/te…

Major…

Ashif_(Ai) reposted

Dark Web Informer

@DarkWebInformer

Jul 20

Web Check: All-in-one OSINT tool for analysing any website GitHub: github.com/lissy93/web-ch… Link: web-check.xyz

Ashif_(Ai) reposted

N$

@nav1n0x

Jul 6

Discovered a very interesting path based SQLi yesterday. Injected: /‘XOR(if(now()=sysdate(),sleep(8),0))XOR’111/ → No delay /page/‘XOR(if(now()=sysdate(),sleep(8),0))XOR’111/test.test triggered delay. Same payload, different results. Here's why👇 1/4 #BugBounty #SQLi #WebSec

nav1n0x's tweet image. Discovered a very interesting path based SQLi yesterday. Injected: /‘XOR(if(now()=sysdate(),sleep(8),0))XOR’111/ → No delay
/page/‘XOR(if(now()=sysdate(),sleep(8),0))XOR’111/test.test triggered delay. Same payload, different results. Here's why👇 1/4 #BugBounty #SQLi #WebSec

Ashif_(Ai) reposted

Akash Ghosh

@myselfakash20

Jun 30

Bug bounty is not just about finding bugs You need to understand what’s not meant to be seen. Here’s a usefull JS ENUMERATION to break into buried endpoints, logic, and secrets. 👇 A thread for the bug-bounty hunters #BugBounty #JavaScript #Recon #BurpSuite #websecurity

myselfakash20's tweet image. Bug bounty is not just about finding bugs
You need to understand what’s not meant to be seen.

Here’s a usefull JS ENUMERATION to break into buried endpoints, logic, and secrets.

👇 A thread for the bug-bounty hunters
#BugBounty #JavaScript #Recon #BurpSuite #websecurity

Ashif_(Ai) reposted

Pratik Dabhi

@impratikdabhi

Jul 10

💾 SQLi Tips for Modern Apps • Always check JSON body params • Test GraphQL queries for injections • Try time-based payloads (SLEEP()) • Bypass WAFs with encodings or comments • Don’t ignore errors in logs or responses 🧩 SQLi still lives—in new places. #BugBounty #SQLi…

Ashif_(Ai) reposted

JS0N Haddix

@Jhaddix

Jul 1

Lookout later this week for some giveaways!

Arcanum Information Security

@arcanuminfosec

Jul 1

All the cool kids will be here... will you? arcanum-sec.com/training/red-b…

Ashif_(Ai) reposted

Gospel

@4osp3l

Jun 27

Broken Access Control via Hardcoded Bearer Token in Public JS File medium.com/@nnouh4967/bro…

4osp3l's tweet card. بِسْمِ اللَّـهِ الرَّحْمَٰنِ الرَّحِيمِ، وَالصَّلَاةُ وَالسَّلَامُ عَلَىٰ الْمَبْعُوثِ رَحْمَةً لِلْعَالَمِينَ ﷺ

Broken Access Control via Hardcoded Bearer Token in Public JS File 💥

Source: medium.com

Ashif_(Ai) reposted

CaptinSHArky(Mahdi🇹🇳)

@SalhiMahdi72759

Jun 26

The best writeup i read related to Chaining Vulnerabilities medium.com/@ahmdhalabi/th… medium.com/@Hx0_0h4nf1/ho…

SalhiMahdi72759's tweet card. بسم الله والصلاة والسلام على نبينا المجاهد الشهيد

How could I chain with one or more bug to get my first simple ATO ?

Source: medium.com

Ashif_(Ai) reposted

Godfather Orwa 🇯🇴

@GodfatherOrwa

Jun 21

SQL Injection Payload i was able to locate a SQL injection very hard to exploit , with digging I successfully got it with the sleep payload ''||(select 1 from (select pg_sleep(6))x)||' ==> i added as well to my SQL wordlist happy hunting ♥ #bugbountytips #bugbountytip…

GodfatherOrwa's tweet image. SQL Injection Payload

i was able to locate a SQL injection very hard to exploit , with digging I successfully got it with the sleep payload

''||(select 1 from (select pg_sleep(6))x)||'

==&gt; i added as well to my SQL wordlist

happy hunting ♥
#bugbountytips #bugbountytip…

Alriejau

@Alriejau22339

⚡️

@InfosecZone

Refactor Security

@refactorsec

xssdoctor

@xssdoctor

Felix Arntz

@felixarntz

Muhammad Waseem

@wgujjer11

Nikhil Mittal

@nikhil_mitt

Altered Security

@AlteredSecurity

Engr Shahid Hussain 🇸🇩

@cybarx14

Archer

@jatav_ravi

Google VRP (Google Bug Hunters)

@GoogleVRP

Bilal

@iran_news_tv

Bug Bounty Village

@BugBountyDEFCON

Chris Duggan

@TLP_R3D

Arcanum Information Security

@arcanuminfosec

ZeroZenX

@zerozenxlabs

LeakIX

@leak_ix

Yunus Emre Öztaş

@ynsmroztas

Smukx.E

@5mukx

ReconOne

@ReconOne_bk

$L3t_M3_S010_it's profile picture. #Cybersecurity #HTB{rastalabs,offshore, cybernetics} #OSCP #OSCE3 | try harder & play harder is my believe. i will be number 1 . i promise 👹$