Webdev, bug hunter
Joined November 2017
- Tweets 363
- Following 944
- Followers 811
- Likes 3,613
48 Photos and videos
Some books worth reading, doing bug bounty:
bergee.it/blog/books/
amzn.to/4lW9T0b - "Bug Bounty Bootcamp"
amzn.to/4uVwqO - "Real-World Bug Hunting"
amzn.to/4sCSk85 - "Hacking APIs"
amzn.to/4sCSk85 - Black Hat GraphQL
#BugBounty
1
1
7
426
Two criticals I found inside one zip uplaod functionality. Have a nice read and Merry Xmas
bergee.it/blog/two-crits-one…
#bugbounty #bugbountytips
1
30
217
11,323
My first CVE. Insecure deserialization and PHP objects injection in WP "Doubly" plugin. Thanks @wordfence . #cve
1
6
336
Today, thanks to @NahamSec I bought pretty solid VPS at @Hostinger for 2 years. It is Black Week deal so for $4,79 per month you got parameters as in the screenshot. I need it for bug bounty and hosting so if you need one here it is: shorturl.at/w2bYM
#BugBounty #deal
1
5
314
Dear bughunters. Have you ever heard about self-RCE? I did. I found RCE via command injection and the company said that it is self-RCE as the filesystem is isolated with some chroot and this RCE affects only the user's files. What do you think?
#BugBounty #bugbountytips
253
bergee.it/blog/waf-bypass-an…
The new write-up on credentials theft with XSS and Google Analytics.
#bugbountytips #BugBounty #bugbountytip
2
2
299
Wbijaj na konferencję największej społeczności ITsec w Polsce!
✅ 4 ścieżki / ~40 praktycznych prezentacji, wiedza absolutnie z pierwszej ręki i bez ściemy
âś… Pokazy hackowania na ĹĽywo
✅ Jakość i niepowtarzalny klimat gwarantuje Sekurak
âś… 20 paĹşdziernika w Krakowie:
hackingparty.pl/
8
35
3,367
I do recommend reading this blog. Good stuff.
blog.voorivex.team/
#BugBounty
1
4
256
How to read the files on server with zip files. The short story of zip symlink attack:
bergee.it/blog/how-two-dolla…
Have a nice reading
#bugbounty #bugbountytip #bugbountytips
3
48
228
10,491
I found the crit on self-hosted program. Reading files on filesystem with unzipping the symlinks. Writeup soon.
#bugbountytips #bugbounty #bugbountytip
3
13
1,001
How to get paid for subdomain takeover without taking over the domain... :)
bergee.it/blog/subdomain-tak…
#BugBounty #bugbountytips
1
5
244
As Google wanted to close my developer account due to inactivity, I created this simple Dad Jokes app
play.google.com/store/apps/d…
It is not so fast and easy to publish an app today. Pure Kotlin. No frameworks.
#jokes #android #dev #Entertainment
2
211
This is brilliant extension for chrome to take frames of YT movie as screenshot. This way I can extract many useful tips and tricks from YT presentations regarding bug bounty.
#BugBounty #bugbountytips #Extension #YouTube
chromewebstore.google.com/de…
222
Good old SQL injection bugs are still here and there. My latest post on hacking one big company for fun and !profit.
bergee.it/blog/how-i-hacked-…
#bugbounty #bugbountytips #bugbountytip
9
55
2,224
5
4
67
3,797
Here is the latest writeup on accessing the admin panel and leaking some sensitive info:
bergee.it/blog/accessing-adm…
#bugbountytips #BugBounty
27
155
6,674