Samet Yiğit

@xelcezeri

Aramakla bulunmaz lâkin bulanlar arayanlardır.

三月 2023 加入

843帖子 289关注者 1千正在关注

你可能会喜欢

@Cy5un

Samet Yiğit 已转帖

Dark Web Informer

@DarkWebInformer

年11月23日

🚨🇹🇷 Alleged Mall Logistics Data Breach Exposes Android Source Code

Samet Yiğit 已转帖

Always thoroughly examine your targets' .js and .js.map files; these files can always provide you with great information about your target. 🥳👍 My tool: github.com/ynsmroztas/JSM… #DevTools #JsMap #bugbountytip #bugbountytips #InfoSec #recon

ynsmroztas's tweet image. Always thoroughly examine your targets' .js and .js.map files; these files can always provide you with great information about your target. 🥳👍
My tool: github.com/ynsmroztas/JSM…

#DevTools #JsMap #bugbountytip #bugbountytips #InfoSec #recon

Samet Yiğit 已转帖

Ahmed Elheny

@Ahmex000

年11月6日

I did it 4 times. Also, think about how you do fuzzing EX 1: GET /DIR/sens/01567777 => GET /DIR/sens/0156FUZZ (4) Since most large IDs usually start after a large number (if sequentially), therefore GET /DIR/sens/FUZZ (8) It takes a lot of time & most are actually empty.

Ahmex000's tweet image. I did it 4 times.
Also, think about how you do fuzzing

EX 1: GET /DIR/sens/01567777 =&gt;
GET /DIR/sens/0156FUZZ (4)

Since most large IDs usually start after a large number (if sequentially), therefore
GET /DIR/sens/FUZZ (8) It takes a lot of time &amp; most are actually empty.

kimo

@itsQatada

年11月6日

tip : when testing for idor and enumerating IDs, let the intruder finish the work, some results can be misleading, in my case, a lot of IDs showed 502 response code, but I left the intruder finish the work and got multiple valid IDs

itsQatada's tweet image. tip : when testing for idor and enumerating IDs, let the intruder finish the work, some results can be misleading, in my case, a lot of IDs showed 502 response code, but I left the intruder finish the work and got multiple valid IDs

Samet Yiğit 已转帖

Mahmuud Ayman

@_0xhero1

年11月7日

الحمدلله Found exposed AWS keys in a public repo report triaged on @Bugcrowd . Using Github Dork: org:Target aws_access_key_id

Samet Yiğit 已转帖

Janlele91 🇻🇳

@janlele91

年11月9日

Just published the very first writeup on my biggest P1 bounty 1️⃣ Check it out: medium.com/@bugbounty0901… #bugbounty #oauth2

janlele91's tweet card. Hi — I’m janlele91, an ethical hacker and pentester based in Vietnam, currently working at Viettel Cyber Security (VCS). I also hunt on…

OAuth Authentication Bypass leading to PII disclosure

来源: medium.com

Samet Yiğit 已转帖

Harss25

@Harsh25NN

年11月9日

Just Got Rewarded at @intigriti 🤑$$$$ Tip:- Fuzz the endpoints/path of one domain to other domains. mno[.]abc[.]com/logs -> 403 xyz[.]abc[.]com/logs -> 200 #intigriti #bugbounty #cybersecurity #bugreport #bounty #reward #hackerone #bugcrowd

Harsh25NN's tweet image. Just Got Rewarded at @intigriti
🤑$$$$

Tip:- Fuzz the endpoints/path of one domain to other domains.

mno[.]abc[.]com/logs -&gt; 403
xyz[.]abc[.]com/logs -&gt; 200

#intigriti #bugbounty #cybersecurity #bugreport #bounty #reward #hackerone #bugcrowd

Samet Yiğit 已转帖

xploiterr

@_xploiterr

年11月10日

Hi All, Published my writeup on recent engagement and "Why You Should Always Take Your Shot" Read it here: medium.com/@xploiterr/why… #BugBounty

Why You Should Always Take Your Shot

来源: medium.com

Samet Yiğit 已转帖

Muhammed

@muh404med

年11月10日

Payload : 1%20and%20if(1%3d1%2c%20sleep(5)%2c%20false)%20--

Muhammed

@muh404med

年11月10日

{فَرِحِينَ بِمَا آتَاهُمُ اللَّهُ مِن فَضْلِهِنَ} Found SQL Injections bug in a public program with 1000+ reports ودا فيديو كامل للريبورت لاي حد سواء ديفوبلر او سكيورتي Video : youtu.be/Hp7qUr9PVXI #ItTakesACrowd #bugbountytips #bugbounty #bugcrowd #hackerone

muh404med's tweet image. {فَرِحِينَ بِمَا آتَاهُمُ اللَّهُ مِن فَضْلِهِنَ}

Found SQL Injections bug in a public program
with 1000+ reports

ودا فيديو كامل للريبورت لاي حد سواء ديفوبلر او سكيورتي

Video : youtu.be/Hp7qUr9PVXI

#ItTakesACrowd #bugbountytips #bugbounty #bugcrowd #hackerone

Samet Yiğit 已转帖

Jayesh Madnani

@Jayesh25_

年11月13日

Scored a $5,000 bounty today. I’ve only started messing around with AI in my workflow THIS week. Normally I’d spend hours trying to escalate certain bugs - the kind that takes a lot of digging and escalation and I'd usually end up moving away from it considering the ROI. But this…

Jayesh25_'s tweet image. Scored a $5,000 bounty today. I’ve only started messing around with AI in my workflow THIS week. Normally I’d spend hours trying to escalate certain bugs - the kind that takes a lot of digging and escalation and I'd usually end up moving away from it considering the ROI. But this…

Samet Yiğit 已转帖

InfoSec Community

@InfoSecComm

年11月13日

🚨 New Writeup Alert! 🚨 "Privilege Escalation From Guest To Admin" by Mado is now live on IW! Check it out here: infosecwriteups.com/c3d2eb357dd1 #bugbounty #privilegeescalation #hacking #bugbountytips #infosec

InfoSecComm's tweet card. Privilege Escalation Guest user escalates To full project access after project visibility is switched to Public

Privilege Escalation From Guest To Admin👑

来源: infosecwriteups.com

Samet Yiğit 已转帖

محمود كروش 🇵🇸

@MahmoudKroush33

年11月14日

While testing for XSS, I came across a hidden input with an injectable parameter. It was a challenge to confirm, by using normal attributes . Try this payloa and congrats if it pops! "+oncontentvisibilityautostatechange=alert(document.cookie)+style=content-visibility:auto+x="

MahmoudKroush33's tweet image. While testing for XSS, I came across a hidden input with an injectable parameter. It was a challenge to confirm, by using normal attributes . Try this payloa and congrats if it pops!
"+oncontentvisibilityautostatechange=alert(document.cookie)+style=content-visibility:auto+x="

Samet Yiğit 已转帖

Hasan Sheet

@hasansheet

年11月14日

I didn’t suddenly start finding criticals. I just changed my mindset. A month ago, I decided to focus only on P1s. Mediums still get reported, but they’re not the goal. When you aim for criticals, you’ll find mediums, but when you aim for mediums, crits stay out of reach.

hasansheet's tweet image. I didn’t suddenly start finding criticals.
I just changed my mindset.
A month ago, I decided to focus only on P1s.
Mediums still get reported, but they’re not the goal.
When you aim for criticals, you’ll find mediums, but when you aim for mediums, crits stay out of reach.

Samet Yiğit 已转帖

soloboy

@alial1shan

年11月14日

I published a write-up about a chain of three client-side vulnerabilities that @m3hradd and I discovered, which led to a one-click account takeover. blog.soloboy.me/chain-of-three…

alial1shan's tweet card. Hello, hackers. Last year, Mehrad and I discovered an account‑takeover...

Chain of Three Client-Side Vulnerabilities Leads to One-Click Account

来源: blog.soloboy.me

Samet Yiğit 已转帖

zack0x01

@zack0x01

年10月25日

#BugBounty isn’t just about testing for bugs , it’s about testing your limits 💪 You’ll get blocked by firewalls, restrictions, duplicates, or “informative” reports… but you get back up and keep going. I’ve had moments when I thought, “I’m done, I should just give up on…