Dat Pham 🇻🇳

I am proud to be a part of it 😁

You can now scan for #react2shell in @Burp_Suite. To enable, install the Extensibility Helper bapp, go to the bambda tab and search for react2shell. Shout-out to @assetnote for sharing a reliable detection technique!

Congrats🇻🇳squad's good win with 2nd highest score in the 1/8 finals of the #AmbassadorWorldCup, secure a spot in the Elite Eight round at Prague, 🇨🇿! 🔥Flysec has a great hacking experience in AWC 1/8 finals being in Top 1 of Report Leaderboard! Fighting for semi-final spot!

@JubaBaghdad No, nothing is needed except the private user’s user ID.

@datph4m curios why the bounty was low, is there any limitation?, like unpredictable video IDs?

With this report, $3,500 was the final reward I received. Clearly, its severity was not just medium.

TikTok has a private program where they mention that: "Private posts and .... is usually high-critical." Yes, initially, I reported this issue through that program. After they reviewed it, they transferred my report to the main program (TikTok) and downgraded it to medium.

I was able to view all videos of any private account on TikTok. In this report, the Confidentiality level is rated as LOW. The reason provided by the TikTok and H1 mediation team: "The attacker cannot guarantee that every video they steal contains sensitive information."

@hugopicanzo @disclosedh1 It’s just a UserID; anyone can find it.

@datph4m @disclosedh1 Yeah I would say pretty critical. Can I ask if it was a regular numerical IDOR or more complex?

TikTok disclosed a bug submitted by @datph4m: hackerone.com/reports/2868084 #hackerone #bugbounty

@hugopicanzo @disclosedh1 All videos, even revealing interactions and analyzing video data.

@disclosedh1 @datph4m Was there enumeration of the video IDs?

@h4x0r_dz @disclosedh1 They did not provide a reason why. However, this is the response from the H1 Mediation team:

@disclosedh1 @datph4m why this one not High ?

@696e746c6f6c They always tried to downgrade the severity to avoid paying a bounty large. I decided to leave the program after this report.

I discovered an endpoint that allows retrieving all videos from a private TikTok user, and he consider the confidentiality impact to be Low. #bugbounty #hackerone

@indept01 @tiktok_us yes they are not transparent

3/ Compared to the report that earned the $8,000 reward, the private video disclosure issue was more severe. However, they managed to downgrade it to a medium severity level and fixed it within 24 hours.

1/ Last month, I was awarded $8,000 for identifying a user privacy-related issue.

2/ I can’t disclose much, but a TikTok employee has confirmed it.

TikTok has a private program. If you’re part of this program, It can be seen in the program’s policy that video disclosure is considered Critical. I initially reported the issue there, but they transferred it to their public program and downgraded the severity to Medium.

I just published Tale of Zendesk 0 day and a potential 25K $ bounty link.medium.com/ZfnWePRg9Nb #bugbounty #bugbountytips

For three consecutive years, I’ve held a position as one of TikTok’s top hackers – I’m proud to contribute to securing the platform and ensuring safety for its global community of users. Thanks @tiktok_us @Hacker0x01 #togetherwehitharder newsroom.tiktok.com/en-us/cybersec…