Ronin

Sometimes I fucking hate bug bounty.

@ByteM3Now Appreciate you!🙌

@Roninxgh Yk it!💪🏽

Favorite bug chain of the year: Broken Access Control in Comment Mentions → Stored XSS → CSP bypass → Notification code execution → Domain-wide token → Tenant-wide account takeover. Sometimes the smallest features hide the biggest bugs. Should I write a full write-up?

@r00t_ak I’ll share it here soon!

@Roninxgh Yeah waiting for your writup...

@ar3za12 I’ll share it soon

@Roninxgh why not

@r00t_ak I’ll share it soon

@satar_nz I’ll share it soon

@Roninxgh Damn🔥 It's gonna be a fire writeup

@mahdi_dev1 Thanks 🙌

@Roninxgh Woooow you are amazing 🔥

@mosab_4_u Thanks , working on it. It’ll be out soon

@Roninxgh Congratulations 🎉👏 and any write ✍️ up

Two bounties from a WAF bypass that took zero new payloads. Just a different place to put the old one. #xss

Why it works: signature matching runs per input. Neither half matches a rule on its own, so nothing fires. The browser doesn’t care where the bytes came from, it just parses the finished output. WAF sees input. Browser sees output.

The WAF blocked every payload I tried. But two user-controlled fields were rendering side by side in the same response, so I split the payload across both. Half in one, half in the other. Each part looked harmless. The browser put it back together.

@mhdagusprbdi @safe_mode01 It’s on the way.

@Roninxgh @safe_mode01 Any Write up?

Just got paid $2,000 for a single SSRF. 🩸 It started with a simple “fetch this image” endpoint. A few requests later, I had access to internal APIs that were never meant to be exposed. Big thanks to my mentor, @safe_mode01 , for the continuous guidance and support. 🙏

@Sniff_crypto @safe_mode01 Working on it 😄 Write-up coming soon.

@Roninxgh @safe_mode01 Where is write up

@AatankBadb16659 @MiniMjStar @safe_mode01 Soon 👀 I’ll drop the full write-up.

@Roninxgh @MiniMjStar @safe_mode01 Give some more context bro

@mahdi_dev1 @safe_mode01 Thanks❤️🤝

@Roninxgh @safe_mode01 Continue bro❤️... Mentoring on top

@Sniff_crypto @safe_mode01 No. Private

@Roninxgh @safe_mode01 Public program ?

@Mhiztabjay @safe_mode01 Thanks🤝

@Roninxgh @safe_mode01 Congratulations man

@Harshva97597668 2000$ Pinterest

How much you earned from your first bounty? Mine=$1000