ismail

How I hacked a famous transportation company and accessed every driver's PII. The Bug: IDOR/Improper Access Control. The injection point is in the header after using a 'CURL' request. 🧵 Thread #bugbountytip #bugbountytips #hackerone #infosec #bugcrowd

@Saoud_Maryout @Hacker0x01 How do you know the Private Key is valid ?

ع الصبح كده 🥱 @Hacker0x01

@Atomsmade I just created a wordlist containing possible userid

@_ismailu What was the payload used for brute forcing the authdriveid. Was it self made word list?

How I hacked a famous transportation company and accessed every driver's PII. The Bug: IDOR/Improper Access Control. The injection point is in the header after using a 'CURL' request. 🧵 Thread #bugbountytip #bugbountytips #hackerone #infosec #bugcrowd

@MiteshValvi12 I mean JWT token

@_ismailu Sir can you tell me what is the authtoken: bearer****

@DomaXploit Thanks

@QWERTYRBG here x.com/_ismailu/statu…

@_ismailu Congo bro write up??

Alhamdulillah I just got one of the unique high IDOR ever found resolved. In one of the famous multinational transportation company The bug let me access to thousands of drivers pii (address, transactions, account balance e.t.c ) #BugBounty #bugbountytips

@ahmed_ah206 x.com/_ismailu/statu…

@_ismailu Assalam u alaikum brother can you tell how you find it , JazakAllah khairan ♥️

4 and after fuzzing 20 different "authdriverid" BOOM 😯 i got access to different user pii. i realized some users are inactive that is why i got blank information.

3 i was like what's the use of "authdriverid" in the request and what if i change it . i changed the "authdriverid" but it returned with blank information.I thought it was not vulnerable . but i said let me brute force the "authdriverid" .

@CyberScanDev Thanks

@_ismailu Nice find🥳

@haq1b @levomoramide Okay

@_ismailu @levomoramide cek dm my brother

Alhamdulillah I earned my first four digit bounty Bug : dependency confusion lead to RCE #bugbounty

@bhargavkalla8 Sure

@_ismailu Bro need your help can you accept my dm

Alhamdulillah JavaScript reading is always worthy I Hope it will triage #BugBounty

@heretoreadbugs Thanks bro

@_ismailu Good job brother. I hope you achieve more like this

@Arourmohamed01 Here's medium article @alex.birsan/dependency-confusion-4a5d60fec610" target="_blank" rel="nofollow noopener">medium.com/@alex.birsan/d…

@_ismailu any good resource for dependency confusion