0xmust4fa

@RahmatQurishi @Bugcrowd The best like always 🤍

I earned $750 for my submission on @bugcrowd bugcrowd.com/h/{id: "rahmatqurishi"} #ItTakesACrowd Bug-type: idor

@agent_num_48 @voorivex با singlarity برو dns rebinding انجام بده نتیجه میگیری

@313MMustafa @voorivex لول 25 رو میتونی هینت بدی؟

و بالاخره بعد کلی تلاش و هینت و AI و... 😮‍💨 @voorivex با این دو لیول آخر پوست شدم ولی دمت گرم آقا

@soda688541 @M_mahdii_R @voorivex طبق همین چیزی که گفتم بری جلو میشه ولی اگر نتونستی بیا پی وی بهت بگم

@M_mahdii_R @313MMustafa @voorivex دقیقا منم همین داستانو دارم 🫠

@M_mahdii_R @voorivex داداش پایین درخواست signin Role رو اضافه کن کنار پسورد و بعدش کوشش کن بایپس کنی اگر نشد بیا پی وی

@313MMustafa @voorivex داداش لول 30 چجوری زدی، انقدر با jwt ور رفتم سرگیجه گرفتم😐

@F1NiX404 @voorivex @hmakdev Do have any hint for 30???

As always, an absolute masterpiece. Thanks to the GOATs @voorivex & @hmakdev

@F1NiX404 @voorivex @hmakdev Nice doing!!!

یالله... ساعت ۲ شب رسیدیم به اینجا😎 مغزم داره می ترکه ولی دوست دارم ادامه بدم...👋💪 @voorivex دست خوش آقا

@RahmatQurishi @Bugcrowd Best wishes Rahmat Jan 👌🤍

I earned $750 for my submission on @bugcrowd bugcrowd.com/h/{id: "rahmatqurishi"} #ItTakesACrowd Bug: privilege escalation

My week and all duplicates😆 #bug #hackerone #hacking #bug_bounty

@RahmatQurishi @Bugcrowd Wish you more big successes Rahmat jan 🤍👌

I earned $200 for my submission on @bugcrowd bugcrowd.com/h/{id: "rahmatqurishi"} #ItTakesACrowd

@RahmatQurishi @Bugcrowd Best wishes for you Rahmat Jan 🤍

I earned $1,500 for my submission on @bugcrowd bugcrowd.com/h/{id: "rahmatqurishi"} #ItTakesACrowd it was admin account takeover team changed the severity from p1 to p2😒

ازین هفته راضیم با وجود مشکلات که داشتم 🙂 Let's keep it up...

@RahmatQurishi 👌💚👏

6 months hacking on HackerOne, Proud to be ranked #1 Top Hacker from Afghanistan in 2025 🇦🇫 #BugBounty #HackerOne #CyberSecurity

@jusxing @Hacker0x01 👏👌💚

2025 summary on @Hacker0x01 1- Ranked 43rd globally for highest critical reputation (27 Critical, 37 High) 2- 130 reports Average bounty: $1k (122 BBP, 8 VDP, 20 duplicates) 3- Top reported weaknesses: •IDOR / Access Control: 40+ •XSS: 40+ •Auth Bypass: 10 4- Ranked #1 in my main program

🚨 CORS Exploit Unlocked  Trusted origin + creds = Admin API Key stolen 😎  📚 PoC & write-up:  🔗 github.com/0xmust4fa/port… #CORS #BugBounty #WebSecurity #InfoSec #EthicalHacking #0xmust4fa #PortSwigger #WebSecurityLabs

@nischalxdp @Hacker0x01 👌👏

Yay, I was awarded a $500 bounty on @Hacker0x01! hackerone.com/nischalxd Tip: Some apps use custom headers that are sometimes disclosed in response headers, JS code, docs, etc. If these headers are unkeyed, they can lead to a simple CP-DoS. #TogetherWeHitHarder #BugBouty

3 SSTI labs → 3 RCEs. 💥 {{7*7}} → Handlebars {{#with}} chains → rm morale.txt PortSwigger owned. Full writeups:github.com/0xmust4fa/Inje… #SSTI #BugBounty #Infosec #Hacking

@aysanhain @bitati8 👏👏👌💚

خب ایونت 30 روزمون تموم شد🏁 یسری تجربه ها داد و کلی جا برای بهتر شدن داریم مرسی که دنبال کردین @bitati8 instagram.com/reel/DS0RFGYjR…

7 Labs. 7 RCEs. 0 Excuses. 💀 Just cleared the PortSwigger File Upload series, including the Expert-level Race Condition! From metadata injection to breaking blacklists, it’s all about the bypass. Repo updated with the full writeups. github.com/0xmust4fa/Inje… 🏹 #BugBounty #RCE