ali alhassoun
431 posts
الحمدلله❤️
حصلت على شهادة Certified Web Exploitation Specialist (CWES)
من @hackthebox_eu
#CWES
Yay, I was awarded a $7,500 bounty on @Hacker0x01! hackerone.com/torious #TogetherWeHitHarder
If there are two layers to partnership, normally get in the first layer and then attempt CRUDs on second-layer endpoints.
#bugbountytips
English
Quick Shots In One Day at @Hacker0x01 (:"
Privilege Escalation :
1 . After removing the user, I found that the JWT can still be used for up to 2 days after the user has been revoked
2 . Unprotected .JSON Endpoint allowed me to Access Earning History and Pending payments
English
Wait programs accept jwt not getting revoked on logout?
If that’s the case @BugBunny_ai is sitting on a lot of these
ali alhassoun@deepvvm
Quick Shots In One Day at @Hacker0x01 (:" Privilege Escalation : 1 . After removing the user, I found that the JWT can still be used for up to 2 days after the user has been revoked 2 . Unprotected .JSON Endpoint allowed me to Access Earning History and Pending payments
English
@T4T4R1S @PentesterLab ماعملت الا الواجب واهم شي انك استفدت ياحبيبي
العربية
@deepvvm @PentesterLab شهر جميل بسببك يا هندسه
شكرا 🤍🤍🤍
العربية
I vibe coded a tool that fetches your 𝗛𝗮𝗰𝗸𝗲𝗿𝗢𝗻𝗲 programs' 𝗔𝗻𝗱𝗿𝗼𝗶𝗱 scope, downloads the APKs via 𝗮𝗽𝗸𝗲𝗲𝗽, and decompiles them with 𝗷𝗮𝗱𝘅 — all in one go.
github.com/0xbartita/h1-a…
#hackerone #bugbountytips #android
English
ETSY uses a lot of integers.... go get those #bugbounty payouts people! Holler here when you find a bug.
#bugbountytips Actually buy and sell a product to open up more buttons to push and APIs to call! Duh 😜
English
