TommyBoy

The bug bounty cinematic universe

@BadAt_Computers @Wrexham_AFC Congratulations!

Saturday was a hell of a day. Found a bug, got engaged and @Wrexham_AFC won their game. Couldn’t have asked for a better Saturday !

Been working on a new tool for bug bounty hunters and will be looking for some testers in the near future, message me if you are interested! chaoticrecon.com

@the_IDORminator All I see is an application working as intended

By the way, I didn't get paid for this, it was a duplicate. The first of several issues with this company. I logged 3 bugs, not sure I got paid for any, and never went back. When companies have SSRFs like this they don't fix, its a warning sign. Run.

SSRF - Internet to Internal #CyberSecurity Try to find the internal domains for targets using tools like crt.sh, shodan, censys, etc. Once you have some domains, blast them into any params you suspect may be susceptible. This one allowed total internal network access from internet. As a side note, don't forget to check any JS files on your target for domains the files reference. Often times, the dev/uat/preprod environment paths are in there, as well as other internal paths (docker, kube, etc) as well as which cloud provider is being used (azure, aws, goog, etc). As you work longer on a single target, you really get to know it...

Happy New Year to all who celebrate 🎉

At times I've considered other avenues of cyber to get into as things were going poorly. Not so much in the finding bugs part but more on the getting compensated side. Ultimately I feel like I'm where I'm supposed to be here, so it's time to lock in and pop off in 2026. LFG

Pretty shit bug bounty year for me. I don't submit a high quantity of bugs, because I still get hung up on the outcome of reports. But to end on a positive: -Found my first crits -Was nominated for LHE (didn't get in) -Learned a lot of Android Hacking, hoping to capitalize.

Restart the router, save the holidays

Sanitizers may allow <https://> thinking it's an Markdown autolink. But if it's rendered as raw HTML instead of an anchor tag, it becomes a XSS vector. In this PoC, the browser creates a custom https: tag and parses the URL components as HTML attributes. storage.googleapis.com/nowaskyjr/xss-…

Please come watch my first talk tommorow at NahamCon!

I stayed on @Hacker0x01 fought my way out of the negative signal state, and when I finally got back positive, I request meditation or some help, I get ignored for months if I ever get a response :D

Yes, it is a BS bug, but it really didn't warrant an N/A imo. There was an issue, it was pointed out, it was actually fixed by Shopify but obviously had no security impact. Should've been informational. Took months to get out of negative signal as at the time I duped a lot.

When i was new here i didnt know anything (~2 years) I submitted a similar bug to @Shopify Obviously not worth a bounty, but the Shopify triager N/A'd my bug and my account on @Hacker0x01 was in the toilet for months. Basically started in the negative immediately.

@hacker_ Really put those stories to bed...

@0xTeflon @WorstWursts no yours would be a grift 100%

@WorstWursts @tommyboyhacking Or my course

@WorstWursts well ofc that would be different

@tommyboyhacking Unless its my course

@hanzceo - nope i wish - because im a dingus who didn't consider that - not sure what repo you're referring to

@tommyboyhacking - emulator on linux? - why not save a backup - is repo open or nah

just nuked my only working rooted android emulator set up AMA

First lesson to any aspiring Android hackers: Never Wipe System Data on your rooted device

the amount of times i had failed to get this all running properly, finally happy i had it all running, then just nuked it CHRIST