@SysTrack40 @Hacker0x01 its a cool hat ngl, i've been wearing it since months
English
kymu
467 posts
kymu
@kymu___
just like to hack and review code الحمدلله
Algeria Katılım Temmuz 2024
227 Takip Edilen623 Takipçiler
I don't think I've ever been this excited about a hat before. lol.
Does this mean I'm a hacker now?
Thanks @Hacker0x01
English
kymu retweetledi
That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉
TrendAI Zero Day Initiative@thezdi
Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
English
@rudradas01 "this time i dont even know the details about the finding, just blindly submit and learn about the report later"
this is bad :/
any Ai user is required to know and validate what his hacking bot found, otherwise you're causing more triage delay for other hard working hunters
English
Received the first bounty payout for a browser vulnerability today. It was awarded the maximum bounty allocated for a critical issue and has now been fixed.
It took some time, but I'm glad the impact was eventually understood correctly.
I hope to start writing about this case soon. In the meantime, a small unrelated article should be published next week!
zhero;@zhero___
can merely visiting a website lead to cross-site data exfiltration from any site without user interaction? a ""minimal"" PoC has been validated, successfully exfiltrating, as a demonstration, the victim’s gmail address report submitted, hoping to provide more details soon
English
kymu retweetledi
An XSS I found in Elementor was disclosed yesterday, here's the writeup!
cryptocat.me/blog/research/…
English
kymu retweetledi
kymu retweetledi
Every JWT writeup online covers 2–3 attacks and stops.
I got tired of jumping between 40 blog posts, so I wrote the whole thing. All in one place.
rmrf.tips/en
#infosec #appsec #bugbounty #websec #jwt
English
kymu retweetledi
Chained CSPT into full account takeover using a 2FA bypass technique I hadn't seen used in bug bounty before.
whoareme.com/blog/cspt-acco…
English
kymu retweetledi
The #FCSC2026 ended today, and my write-ups are now available here:
mizu.re/post/fcsc-2026… 🚩
I'm really happy with the challenges I managed to create this year! It would be too long to list everything, so here's a little teaser 👇
1/2
Kévin GERVOT (Mizu)@kevin_mizu
This year again, with @BitK_ and @_Worty, we've made the Web challenges 🚩 The CTF is solo and lasts 10 days, if you have some time, please give it a look 😁 Even if you're not doing Web challenges, there are challenges in various categories, you should find something you like!
English
kymu retweetledi
Small bug bounty writeup from one of my findings from the past - even back then having a carefully crafted list of non resolving starbucks hostnames was essential (shameless ad: argosdns.io). Writeup:
argosdns.io/blog/how-i-got…
Background of hackerone.com/reports/500468
English
kymu retweetledi
Race conditions in OAuth flows can still happen in custom implementations. Here's how to find it:
During the token exchange, the server is supposed to treat an authorization code as single-use. If you race the token endpoint by sending parallel requests with the same code simultaneously, vulnerable implementations may issue multiple valid access tokens and some won't properly revoke all of them.
Tools like Turbo Intruder or even a simple multi-threaded script sending concurrent requests to the callback URL with different tokens may trigger it.
Further reading here: blog.avuln.com/article/4
English
@hamidonsolo getting a crit in h1 has nothing to do with your cert status
it's like saying i saved someone with injuries from death why the university doesn't give me the doctor diplomate?
irrelevant
English
I owe Hack The Box an apology.
I was wrong for expecting a cert after scoring 100 points and having a Critical 9.8 validated on a real company through HackerOne.
Clearly I should have spent more time on report formatting instead of finding actual vulnerabilities.
My bad HTB. I'll do better. won't happen again
Patrickbatman@hamidonsolo
HackerOne accepted my Critical 9.8 vulnerability on Netlify. That's real work, real impact. Meanwhile Hack The Box won't give me the cert because my final report "doesn't meet their standard." or just didn't wanna to give me the cert while i achived 100pnts passing score. Brother, a real company validated the finding as CRITICAL. But HTB's exam says I'm not good enough? Certs are a scam i highly not recomend buying or passing them now as they are just useless with what ai is capable of doeing right now. The real exam is the field. and also tell me in the comments if you had similar experience . in the past
English
@habiba_not @intigriti I think you don't get it
Just because they posted about it
Doesn't mean it will be always accepted
It depend on program rules
Just like session fixation and stuff like that which are also bugs
Yet they are in the out of scope most of the time
English
@intigriti u wrote a blog about 2FA bypass tricks, yet marked one as out of scope. 2FA is an extra security layer credentials are expected in an ATO scenario. The issue is a flaw in the 2FA flow itself, not access to the victim’s device. So how is this considered physical access
Habiba0x00@habiba_not
2FA bypass via reset password , I think intigriti doesn’t have enough money to pay for bounties
English
@habiba_not @intigriti Our scenario needs physical access or compromised Gmail to get the reset password link
2FA is meant for cases when your credentials in test.com is stolen
Valid or not, the triager is following the program rules and doing his job, intigriti is not responsible
English
@K3S3l7 @intigriti I don’t agree because 2FA is just an extra layer not a one time pass , intigriti itself wrote a blog about bypassing it and all of them after writing ur cred step , additionally I saw a lot of accepted reports about any way of bypassing it because the issue is not ATO
English
انا جبت الثغرة بتاعة GraphQL هي هي تقريباً بس متقبلتش مش عارف ليه
كنت بقدر أعمل accounts زي ما انا عايز من غير rate limit
DestroyerX@ide9x
صباح الخير 🌼 Not VDP
العربية