MSc Advanced Computer Science | Pentester | OSCP | OSWE | CRTO | CRTP| Bug Bounty Hunter #kaeferjaeger
Joined April 2011
- Tweets223
- Following83
- Followers1.3K
- Likes265
Pinned Tweet
Got a $12,000 bounty on @Hacker0x01! hackerone.com/kun_19 #TogetherWeHitHarder
My highest single bounty ever 🙂 And…it was a mobile bug 📱
Unfortunately can‘t share any details, but Android permissions used across multiple apps of the company can be an issue ;)
Last month I attended my first @HackerOne Live Hacking Event. Some honest thoughts:
✅ Finally meeting the German hacking community IRL. Until now mostly virtual. The in-person connection hits different.
✅ Target, scope, triage team and program people all on-site? Perfect setup
nothing like the quiet focus at home.
Still: collaboration led to a genuinely cool bug I wouldn’t have found alone @_m1tZ @_lauritz_ .
The usual bug bounty highs and lows. Including that moment where you watch others drop High/Critical after High/Critical (@marcolivermunz) while
Tobi Weißhaar retweeted
🚨 ZERODAY: ImageMagick 🚨
Our autonomous pentester pwn.ai just dropped multiple zeroday chains in ImageMagick that achieve RCE and File Leak from a single .jpg or .pdf file, bypassing EVERY security policy (Default, Limited, AND Secure). 🤯
💥 Affects Ubuntu, Debian, WordPress & millions of servers globally. Happy Monday and Happy Hunting! 🥰
pwn.ai/blog/imagemagick-from…
Took a long break from bug bounty hunting but feels good to know muscle memory is still there 😅
Got a $800 bounty on @Hacker0x01! hackerone.com/kun_19 #TogetherWeHitHarder
Thrilled to announce the start of a new chapter @codewhitesec 🙂 Thank you for the welcome package 🙃
Yay, I was awarded a $900 bounty on @Hacker0x01! hackerone.com/kun_19 #TogetherWeHitHarder #bugBounty
Cross-Site attacks become very rare with the latest browser security mechanisms but found a cross-site web socket hijacking vulnerability recently. If you want to know how..
..to exploit it in 2025 I recommend
blog.includesecurity.com/202…
First experience with the @SamsungMobile Bug Bounty Program. Takes a looong time to get rewarded and the reward was not as expected…but anyways what stays is a CVE for Samsung (Browser App) 😅 Thanks @_m1tZ for the collab!#bugBounty #hacking
nvd.nist.gov/vuln/detail/CVE…
Tobi Weißhaar retweeted
🪲 Bug bounty disclosure: account vulnerability
Here's how @_kun_19 highlighted a security gap in Shopify Collabs 🧵
Got a $500 bounty on @Hacker0x01! hackerone.com/kun_19 #TogetherWeHitHarder
Exploited an Intent Redirection in a mobile app. It's a kind of equivalent to an Open Redirect in web apps.
🧵
4
67
2,496
...I created an own Facebook OAuth Client in Facebook's Developer Portal and started the activity with the appropriate OAuth config. The victim is now prompted to log in via Facebook and after doing that, the OAuth victim's authorization code is sent to my web server due to...
1
2
280
Got a $6,000 bounty on @Hacker0x01!
Hmm…seems SQL injections are still a thing 🙃
hackerone.com/kun_19 #TogetherWeHitHarder
Tobi Weißhaar retweeted
Shopify disclosed a bug submitted by @_kun_19: hackerone.com/reports/167973… - Bounty: $800 #hackerone #bugbounty
One of my reports to @ShopifyEng was disclosed. ATO with some preconditions that must be met, but maybe interesting for you 😉 #BugBounty @Hacker0x01
hackerone.com/reports/167973…
