mssoffsec @mssoffsec

Proud Indian 127.0.0.1 Joined September 2019

Tweets

2K
Followers

280
Following

2K
Likes

7K

mssoffsec @mssoffsec

2 days ago

@ahmetdotrun @Hacker0x01 Bro is blasting cloudfalre Bugbounty program 🔥🔥

0 0 1 158 0

View Details

mssoffsec @mssoffsec

2 days ago

@GodfatherOrwa Will be waiting for your comeback man ...

0 0 1 186 0

View Details

I found an unauthenticated lookup where a phone number returned: - Full name. - Date of birth. - Home address. Phone numbers are public enough to collect and structured enough to enumerate. Paid $2,500. People argue that a record identifier is “not guessable.” That does not help when the identifier is a phone number printed on profiles, invoices, signatures, and breach lists. Thx @bugcrowd #ItTakesACrowd #CyberSecurity #BugBounty

6 10 202 6K 41

View Details

𝗗𝘀𝗼𝗸𝗲𝗩🧑‍💻 @DsokeyyV

5 days ago

Real-world scenario [4]: (A Journey of Limited Path Traversal To RCE) #CTF #bugbounty #bugbountytips #bugbountytip

2 9 103 5K 29

View Details

termireum @termireum

2 months ago

No username. No password. Just a header. How a simple oversight led to a $3,000 authentication bypass. medium.com/@0xalr/no-user…

2 28 297 18K 198

View Details

Medusa @medusa_0xf

2 months ago

Just got rewarded with $3500 on @Hacker0x01 🐍✨

21 10 483 11K 57

View Details

André Baptista @0xacb

a year ago

Have you checked out @hadriansecurity's subwiz? It's a recon tool that uses ML to predict and resolve subdomains👇

3 54 255 16K 243

View Details

VIEH Group @viehgroup

2 months ago

Source Map Exposure -> Hidden Endpoint Discovery POC -> 1. Found JavaScript source map file (.map) 2. Downloaded original unminified source code 3. Identified hidden API endpoints 4. Discovered internal application logic Learning -> 1. Remove source maps from production 2. Review frontend code before deployment #BugBounty #CyberSecurity #BugBountyTips #InfoSec

1 4 48 3K 40

View Details

Nick Mykhailyshyn 🇺🇦 @whoareme33

2 months ago

I earned a $22,500 bounty from Airbnb using a custom Opus 4.7 workflow built with MCP and Skills. It feels like bug bounty hunting has changed forever

33 53 1K 65K 614

View Details

Preben @prebenve

3 months ago

Found a cool bug at Meta. From misconfigured Grafana instance to R/W access on 507 private Meta repositories. Wrote up the full chain here: sectricity.com/blog/misconfig… $157k bounty awarded by @metabugbounty

23 129 818 71K 620

View Details

Muhammad Saqib Arif 🇵🇰 @saqibarif98

2 months ago

Account Takeover using SSO Logins by Rikesh Baniya medium.com/p/account-take…

2 23 196 12K 179

View Details

obscaries ❘ AppSec @obscaries

3 months ago

This article on JavaScript analysis for pentesters is a solid walkthrough of: • endpoint extraction • hidden routes • dangerous DOM sinks • framework-specific attack surfaces • client-side recon methodology Worth reading if you're into client-side bug bounty hunting: kpwn.de/posts/javascri… #bugbounty #websecurity #javascript #infosec #appsec #pentesting

7 66 242 11K 287

View Details

mssoffsec @mssoffsec

3 months ago

Lets check will my luck works out :)

Ben Sadeghipour @NahamSec

3 months ago

Super excited to release our latest Broken Access Control (BAC) Masterclass on @hackinghub_io with 2 hours of content and almost 20 labs. I'm giving away 3 free seats to anyone who comments, reposts, and replies to this post. Drop a 🔥 below! More info 👉🏼 hhub.io/BAC2026

169 134 370 20K 116

0 0 0 45 0

View Details

skull @brutecat

3 months ago

StubZero: $148,337 RCE in Google Cloud Production brutecat.com/articles/googl…

16 174 770 90K 441

View Details

Suresh Aydi (xploiterr) @_xploiterr

3 months ago

Organization Takeover via IDOR ($3,700) medium.com/@xploiterr/fro… #BugBounty

4 27 239 10K 153

View Details

bronxi @hbenja_m

3 months ago

I loved this article by @iamgk808. Read it, it’s inspiring, and it’s honest about the time and effort involved. Honestly, it inspired me. Thanks for writing it, Ganesh! 😎 infosecwriteups.com/from-failure-t… #bugbounty #cybersecurity

2 21 293 11K 207

View Details

Divyansh Sharma @divyansh2401

3 months ago

Yay, I was awarded a total of $5,500 in bounties on @Hacker0x01! hackerone.com/eliteoffensive Vulnerabilities Found: 1. Privilege Escalation (Trial User → Platform Admin) 1. While reading the site's JavaScript files, I found an API endpoint and noticed it accepted an "author" parameter in the request body. 2. The JS hinted that the "author" value was used to identify who the request belonged to — and that this value needed to be an admin's email for certain actions. 3. I collected 15–20 employee emails through public sources (OSINT). 4. I tested them one by one as the "author" value. One matched a platform admin account, and that request was accepted. 5. Using that admin's email as "author" along with my own account ID, I changed my account "plan" from "trial" to "internal". The request went through, and my role was updated. 6. Root cause: the endpoint was authorizing the request using a value from the request body instead of the role from the user's authenticated session. 2. SSRF → Cloud Metadata Credential Exposure 1. The app had a feature that fetched user-supplied URLs from the server side. 2. Confirmed by pointing it at a public echo service — the response showed a cloud server IP, not mine. The server was making the request. 3. The URL filter blocked the metadata service IP in its standard dotted form, but didn't normalize alternate representations. Converting the same IP to its decimal form bypassed the filter cleanly. 4. From there, the standard two-step metadata flow worked: first request returned a session token, second request used that token to return temporary instance role credentials. 5. Root cause: block-list URL filtering without IP normalization. A single canonicalization step on the resolved address would have caught this. 3. IDOR Exposing 285,000+ Customer Invoices The invoice download endpoint used sequential IDs with no ownership check. Changing the ID returned other customers' invoices. 4. IDOR Enabling Cross-Tenant Audit Log Manipulation A "log move" endpoint trusted client-supplied IDs, which allowed moving log entries across tenant boundaries and tampering with audit history. 5. Unauthenticated Path Traversal A public endpoint accepted file paths without sanitization, allowing partial file reads across the platform with no authentication required. Key lessons: → Never authorize based on request-body fields. Use the session/JWT role. → URL-fetch features need allow-lists, and must normalize alternate IP forms. → Sequential IDs are fine; missing ownership checks are not. → "Unauthenticated" doesn't mean "untrusted input is safe." #bugbounty #securityresearcher #ethicalhacker #cybersecurity #vulnerability #penetrationtesting #securityaudit #digitalsecurity #tech #innovation #hackerone #freelance #freelancer #pentester #ssrf #idor #privilegeescalation #pathtraversal #appsec #infosec #TogetherWeHitHarder #bugbountytips

15 49 475 15K 322

View Details

Godfather Orwa 🇯🇴 @GodfatherOrwa

3 months ago

* Create your own AI scanner * Create website for that AI * Offer it for Sale/Subscription * create a X profile for the AI * Start Posting Old bounty’s photos with posts like (found this by this @ai, I spend 10$ and I got rewarded 10K$) Story Of This Days 😤 Not #bugbouny 🫣