bug bounty noob | I also play alot of poker.
Kingdom of Bullshit
Joined September 2009
- Tweets1.5K
- Following119
- Followers102
- Likes64
Dreams of Tragedy retweeted
The great Norm Macdonald (d. 2021) would have turned 67 today. A true comedian's comedian.
Macdonald never hid his admiration for the legendary Rodney Dangerfield, whom he called his comedy idol. In a 2011 interview, he fondly recalled Dangerfield's 1996 Weekend Update cameo on Saturday Night Live, describing it as one of the highlights of his time on the show. For Macdonald, sharing the desk with his hero was a dream come true.
Dreams of Tragedy retweeted
I go deep into all 5 phases + reporting + advanced tricks (JS bundle reading, mobile API testing, bug chaining) in the full writeup:
#BugBounty #CyberSecurity #OSINT
osintteam.blog/my-complete-h…
Dreams of Tragedy retweeted
Most "bug bounty for beginners" guides tell you WHAT to test.
Almost none tell you HOW to actually find something.
I wrote down my full 5-phase process — the one I actually use on every target 🧵
Dreams of Tragedy retweeted
Pro tip for SSRF!
Blocking 127.0.0.1 does not necessarily account for every representation a parser may resolve as loopback. Depending on the parser, that can include case variations of localhost or shorthand forms such as 127.1.
Compare validation, normalization, DNS resolution, and the final request.
Explore the Academy SSRF labs 👇
portswigger.net/web-security…
Dreams of Tragedy retweeted
Daniel @RealKidPoker Negreanu wants to win so badly🤯
#Poker #OnlinePoker #WSOP #PokerClips #PokerListings
Dreams of Tragedy retweeted
Can you change the response without changing the cache key?
In Repeater, add 👇
X-Forwarded-Host: cache-test.example
Then compare the response.
If the header changes the response but the cache does not include it in its key, it is an unkeyed input.
When that altered response is cached, later requests with the same cache key can receive it too.
Find the ignored input in the free labs 👇
portswigger.net/web-security…
Dreams of Tragedy retweeted
I’ve built a Hold'em + Omaha solver:
- Flops to 0.1% in 2 seconds
- Card bunching (GTO Wizard doesn't have it)
- Node-locking across all rivers, river reports
- NLHE + PLO
It's in free beta, so try it and tell me how to make it more useful to you: zenosolver.com
Dreams of Tragedy retweeted
🚨 RCE on WordPress Core: CVE-2026-87902
Here’s an overview of this critical bug:
Dreams of Tragedy retweeted
Hunting for INFORMATION DISCLOSURE
web.archive.org/cdx/search/c…
To find it more effectively:
curl -G "web.archive.org/cdx/search/c…" --data-urlencode "url=*.target.com/*" --data-urlencode
"collapse=urlkey" --data-urlencode "output=text" --data-urlencode "f1=original" > output.txt
To download it: du -h output.txt
To search for sensitive filename in the output:
cat output.txt | uro | grep -E '\.xls|\.xml|\.json|\.sql|\.pptx|\.zip|\.tar|\.tgz|\.docx|\.yaml|\.config|\.yml|\.cache
|\.backup|\.gz|\.bak|\.api|\apikey|\.key|\.dmg|\.iso|\.img|\.png|\.pub|\.md|\.md5|\.sh|\.db|\.bin|\.server|\.crt|\.rar
|\.rar|\.node|\.ini|\.asc|\.dll|\.log|\.secret|\.exe|\.pem'
When you get a file and you get an error 404, copy it and go to "web.archive.org" and paste the url in the search bar then look for the back snapshot.
cc @lostsec_
Dreams of Tragedy retweeted
Are you seeing a 403 when you access this:
GET /api/v2/admin/users ❌
You can try bypassing it by accessing an older API version:
➡️ GET /api/v1/admin/users
➡️ GET /api/admin/users
➡️ GET /api/V2/admin/users
➡️ GET /api/v2/admin/users with X-API-Version: 1
➡️ GET /api/v2.0/admin/users
➡️ GET /api/beta/admin/users
What else will you try? 👇
Dreams of Tragedy retweeted
Sick of getting crushed by the aggro reg?
This one concept will destroy him
A thread: