Kanishk Dadhich

Hello x, posting after a longtime cause I was sick 🤕 But I am back baby

Many beginners skip the windows exploitation. And that a real issue

I usually don't show my payouts, but sometimes you have to appreciate the journey. Every bounty is proof that consistency beats luck.

4/4 💡 Don't focus only on code execution. Unsafe deserialization can also lead to: • Authentication bypass • Privilege escalation • Session tampering • Business logic abuse • Object injection Learning how serialization works is a valuable skill for every bug bounty hunter.

3/4 🧪 Quick triage: → Find the serialized blob → Decode it (Base64/Hex) → Identify the serialization format → Fingerprint the framework/libraries → Trace whether user input reaches the deserializer Understanding the data flow is the key.

1/4 🎯 Insecure Deserialization — the bug that turns "just data" into critical impact. If an app deserializes user-controlled input (cookies, hidden fields, API payloads) without proper validation, attackers may manipulate application objects, leading to severe security issues.

@YuvrajSwami0 Hahaha 🤣 inr

@whotfbunny Bro $2k or 2k INR ?

Trading is so fuck man I made a big loss. How can I learn? is there any free material you guys know

@YuvrajSwami0 2k rupees in crypto. That was fuck moment bro

@whotfbunny How much bro ? In which market?

I am working with my last brain cells now I need a break. I need vacation.... 😤

Today I look back to my tryhackme account. And it doesn't give me nostalgia. I want my old thm UI 😭

@Sachinsaud777 You should try further escalation

@whotfbunny By manipulating the response, I was able to see the admin function only and to use that function. I need the valid session of admin. Only able to see the function is a big or not? (Noo PII or other leakage)

Advance bug bounty tip 1/9 🧵 Most bug bounty hunters stop at: "I can access this endpoint." Advanced hunters ask: "What happens if I chain three legitimate actions in an illegitimate sequence?" ↓

9/9 The best findings aren't in the documentation. They're hidden inside assumptions nobody wrote down. Read the state machine. Then ask: "What happens if I skip a step?" #BugBounty #AppSec #CyberSecurity #API #GraphQL #OWASP #BOLA #BFLA #HackerOne

8/9 When testing, stop looking at endpoints in isolation. Map: • Objects • Roles • State transitions • Cross-service interactions • Trust boundaries That's where high-impact reports usually emerge.