Published in InfoSec Write-ups·PinnedPushing yourself through hard hunting days: A bug hunter’s perspectiveToday I am going to talk about the period when you don’t find bugs for several days, weeks or even months. This talk is going to be non-technical and completely related to mental health. I will try explaining it as simple as possible. During our bug bounty days, specially when…Infosec4 min readInfosec4 min read
1 day agoA great weekend hack(worth $8k)This post is a writeup of my recent findings on Synack which got me $8k for 5 bugs, on a single day. So, I was hacking on a program which was in QR period(QR period is a specific time defined by Synack where researchers with best reports are rewarded), and…Hacking3 min readHacking3 min read
Published in System Weakness·Oct 9The prerequisites: Things you need to learn before getting into Web hacking/bug bountiesBug bounties or web hacking is something which fascinates a lot of people. I mean, who doesn't want to earn money that also while hacking stuff! But it doesn’t that easy as it sounds like. …Hacking5 min readHacking5 min read
Published in InfoSec Write-ups·Jun 6Hacking Nginx: Best waysNginx is being used in the wild since a while now. We all have seen NGINX name somewhere while coding/hacking. NGINX has always been a target for hackers/bug bounty hunters due to a lot of misconfigurations in it, and as a security researcher/bug bounty hunter, hacking a web server always…Bug Bounty5 min readBug Bounty5 min read
Published in InfoSec Write-ups·Mar 6Going beyond the surface: Vulns that pay wellThese days bug bounty hunters have been finding many low-hanging fruits and a lot of them want to go beyond those bugs. This blog is for those who want to find some well-paid bugs which need a little more observation and time. I have put my methodologies and ideas to…Bug Bounty5 min readBug Bounty5 min read
Dec 27, 2021Weapons in my quiver: Tools and extension I use in bountiesAs this blog already describes, I will be putting some info about tools and extensions which I use daily in my bounties. For an early reminder, there is no new or self-created tool mentioned here and all the tools/extensions are well known. …Bug Bounty5 min readBug Bounty5 min read
Nov 14, 2021The Implementation plan for hacking: What not to do and whereHey guys, I hope you all are doing well and having fun in hacking. It’s been a while I posted any blog here. Didn’t quite get the idea what to write on, so it took some time. However, I came up with this topic and if it works well, you…Bug Bounty5 min readBug Bounty5 min read
Published in InfoSec Write-ups·Sep 19, 2021Chaining bugs for better bountiesChaining some low level bugs to a higher level is always fun and challenging at the same time and best thing is you get higher reward if you do it successfully. I had always an idea to write a blog on it but I was waiting for some personal scenarios…Bug Bounty5 min readBug Bounty5 min read
Published in InfoSec Write-ups·Aug 12, 2021WAF bypasses: Tearing down the wallBefore we go deep into the ACTUAL bypasses section, It’s really important to understand what is a WAF(Web application firewall) and it’s types. Hi guys, welcome to this new blog and here, we are talking about WAFs which is considered as one of the biggest enemies of hackers. Well, it…Bug Bounty6 min readBug Bounty6 min read
Published in InfoSec Write-ups·Jul 2, 2021How Gopher works in escalating SSRFsWe all know about HTTP and HTTPS but how many of us have seen Gopher in wild? The one we use a lot in bypassing and escalating Server side request forgeries. Well, believe me or not, Gopher was conceived in 1991 as one of the Internet’s first data/file access protocols…Bug Bounty5 min readBug Bounty5 min read
