Ved Parkash

5.9K posts

Ved Parkash banner
Ved Parkash

Ved Parkash

@v3d_bug

Curious to Learn

हरियाणा, भारत 🇮🇳 Inscrit le Kasım 2019
935 Abonnements1K Abonnés
Ved Parkash retweeté
🇷🇴 cristi
🇷🇴 cristi@CristiVlad25·
Good resource for a quick search for assets in scope through public BBPs across some of the big platforms. recon.bugtraceai.com
English
1
4
33
2.3K
Ved Parkash retweeté
Bug Bounty Center
Bug Bounty Center@BugBountyCenter·
Browser extensions for bug bounty hunters: Wappalyzer (Chrome/Firefox) HackTools (Chrome/Firefox) HackBar (Chrome/Firefox) FoxyProxy (Chrome/Firefox) Cookie-Editor (Chrome/Firefox) CORS Everywhere (Firefox) CYFARE Reconner (Firefox) DotGit (Chrome/Firefox) EndPointer (Chrome/Firefox) FancyTracker (Chrome/Firefox) HTTP Header Live (Firefox) Link Gopher (Firefox) Retire.js (Chrome/Firefox) Shodan (Chrome/Firefox) TruffleHog (Chrome) WaybackMachine (Chrome/Firefox) SecurityHeaders[.]io Analyzer (Chrome) OWASP Penetration Testing Kit (Chrome) Js/CSS/HTML Beautify (Chrome/Firefox) Mitaka (Chrome/Firefox) BuiltWith (Chrome/Firefox) ModHeader (Chrome/Firefox) Requestly (Chrome/Firefox) Open Multiple URLs (Chrome/Firefox) User-Agent Switcher (Chrome/Firefox) Drop the ones I'm missing or the ones you find most useful in your workflow #BugBounty #BugBountyTips #WebSec #AppSec #Cybersecurity
English
1
44
212
6K
Ved Parkash retweeté
7h3h4ckv157
7h3h4ckv157@7h3h4ckv157·
How to Hack AI Agents & Application by @NahamSec, inspired by @rez0__ (Follow Them for more) 📍 🧵 👇🏻
7h3h4ckv157 tweet media
English
4
125
656
20.7K
Ved Parkash retweeté
Faiyaz Ahmad
Faiyaz Ahmad@thehacktivator·
Don’t waste time chasing expensive AI tools. If you can’t build it, you don’t really understand it. That’s where most beginners go wrong. Everyone wants to use AI in cybersecurity, but very few actually learn what’s happening behind the scenes. They rely on tools, copy payloads, and stay stuck. So I tried something different. I fine-tuned a local AI model from scratch and trained it to generate smarter XSS payloads using cross-referenced datasets. No APIs. No cost. Just a simple setup that actually helps you think beyond basic payloads. If you’re serious about learning the real side of bug bounty, this is where you should start. Watch here: youtube.com/watch?v=P1tazh…
YouTube video
YouTube
Faiyaz Ahmad tweet media
English
1
8
45
1.9K
Ved Parkash retweeté
Ved Parkash retweeté
CryptoCat
CryptoCat@_CryptoCat·
Source to Sink: Improving LLM Vuln Discovery 🔥 youtu.be/bxwEZMhqeR0
YouTube video
YouTube
English
1
28
162
13.1K
Ved Parkash retweeté
Nicolas Krassas
Nicolas Krassas@Dinosn·
pentest-ai - 6 Claude Code subagents for offensive security research (engagement planning, recon analysis, exploit methodology, detection engineering, STIG compliance, report writing) 0xsteph.github.io/pentest-ai/
English
10
105
476
23.9K
Ved Parkash retweeté
shakquraa
shakquraa@shakquraa·
DOMLogger++ is changing how client-side bugs are hunted — no more guessing, just real data flow visibility. 🔍⚡ From DOM XSS to prototype pollution chains, this tool exposes what traditional debugging misses. If you’re serious about client-side security, this isn’t optional — it’s essential. 🧠💥
shakquraa@shakquraa

x.com/i/article/2019…

English
0
8
39
2.7K
Ved Parkash retweeté
Hossam A. Mesbah 🇵🇸
A simple vulnerability in postmessage CTI, Been a while since my last bug bounty tip 😂 Not something new, but honestly I liked it Application is integrates with various integration including salesforce, Shopify etc... for example window.opener && window.opener.postMessage({ name: e, value: t }, "*"); window.parent && window.parent.postMessage({ name: e, value: t }, "*"); The app is also missing X-Frame-Options or can be embedded, and cookies are still sent in that context because of weak SameSite settings, an attacker can be able to iframe the page and directly receive users’ PII from those messages. Combined with missing X-Frame-Options and weak SameSite behavior, an attacker could iframe the page and receive the data directly by sending an link containing the exploit below to the user and get all PII or anything in the trusted postmessage. #bugbountytips #bugbounty #bugcrowd
Hossam A. Mesbah 🇵🇸 tweet mediaHossam A. Mesbah 🇵🇸 tweet mediaHossam A. Mesbah 🇵🇸 tweet media
English
2
21
187
6.8K
Ved Parkash retweeté
Het Mehta
Het Mehta@hetmehtaa·
JWT Security Resources 1. JWT Introduction - jwt.io/introduction 2. JWT Attacks - portswigger.net/web-security/j… 3. OWASP JWT Cheat Sheet - cheatsheetseries.owasp.org/cheatsheets/JS… 4. JWT Vulnerabilities Guide - pentesterlab.com/blog/jwt-vulne… 5. JWT Best Practices - curity.io/resources/lear… 6. Exploiting JWT - intigriti.com/researchers/bl… 7. JWT Attacks Writeup - infosecwriteups.com/attacks-on-jso… #CyberSecurity #JWT #WebSecurity #BugBounty
English
1
97
313
11.2K
Ved Parkash retweeté
Intigriti
Intigriti@intigriti·
Exploiting BAC vulnerabilities! 🤠
Intigriti tweet mediaIntigriti tweet mediaIntigriti tweet mediaIntigriti tweet media
English
2
18
118
5.9K
Ved Parkash retweeté
shakquraa
shakquraa@shakquraa·
JavaScript Analysis Checklist for Bug Bounty Hunters Stop scrolling endpoints and start reading JavaScript — that's where the real bugs hide. 🧠 1. 🔍 Find All JS Files Check source code, DevTools, and subdomains Don't ignore old or unused files 2. 🧵 Beautify & Read Properly Use DevTools or a JS beautifier Understand the flow — don't just grep 3. 🔗 Extract Endpoints Look for /api/, /v1/, /internal/, etc. Identify hidden or unused routes 4. 🧠 Identify Parameters Query params, JSON keys, headers Focus on user-controlled input 5. 📡 Trace Data Flow Map where input goes → which sinks Monitor DOM, eval, innerHTML, fetch, postMessage 6. ⚠️ Look for Dangerous Sinks eval(), innerHTML, document.write postMessage, setTimeout, Function() 7. 🧪 Check for DOM XSS Map sources → sinks Test payloads in identified parameters 8. 🧬 Prototype Pollution Look for merge, extend, deep object operations Check __proto__, constructor, prototype 9. 🔐 Secrets & Keys API keys, tokens, internal endpoints Hardcoded credentials can be a goldmine 10. 🌐 Third-Party Integrations Review external scripts Assess trust boundaries and data sharing 11. 🧱 CSP & Security Controls Check if CSP is implemented Attempt bypass techniques 12. 🔁 Replay API Calls Modify requests in Burp Suite Test for auth issues, IDOR, rate limiting flaws 13. 🧩 Look for Logic Flaws Missing validation Hidden features or debug flags 14. 📂 Source Maps (.map) Can reveal original source code Often expose additional endpoints 15. 🔄 Follow the App Flow Login → dashboard → key actions Think like a user, not a scanner 📌 Tools give you files. 🧠 JS understanding gives you bugs. #bugbounty #infosec #websecurity #hacking #javascript
English
1
16
107
4.4K
Ved Parkash retweeté
bugcrowd
bugcrowd@Bugcrowd·
$1,000,000 in bug bounties came down to one decision: pick a program and stick with it 👨‍💻😮‍💨 HX007, a hacker in the Bugcrowd community, made over $750K on a single program. Not by knowing more than everyone else. By knowing one target better than anyone else. 🔖 The longer you work a program, the more you understand the dev team behind it. Their patterns, their blind spots, the bugs they keep missing. It stops feeling like hunting and starts feeling like collaboration. When nothing's clicking, HX007 switches to a VDP, racks up some P1s, and comes back with his confidence rebuilt. 💡 More advice from HX007 and why he hunts on Bugcrowd: bugcrowd.com/blog/how-i-hac…
bugcrowd tweet media
English
7
22
205
11K
Ved Parkash retweeté
Intigriti
Intigriti@intigriti·
Master broken access control vulnerabilities! 😎 A thread! 🧵👇
Intigriti tweet media
English
4
80
564
24.5K