Trying to make Internet a safer place 👨🏼💻 by helping companies find security loopholes.
Andhra Pradesh, India
Joined June 2020
- Tweets1.5K
- Following260
- Followers9.4K
- Likes1.5K
Pinned Tweet
“LIVE HACKING EVENT” powered by @BugTroopers and hosted by @iitroorkee & @divyasampark on March 7th and 8th followed by Rewards, Goodies and more..!
**Limited participation only.**
Register now docs.google.com/forms/d/e/1F…
#bugtrooper #bugbounty #lhe #iitroorkee #ethicalhacking
3 AM findings be like:
1. Login to 2FA account
2. System will request 2FA code but allows backend request to fetch API secret of that account.
3. Go to API documentation, use API secret key. Do anything you want on 2FA activated account 😂
#bugbounty #api #2fa #bugcrowd #hacking
If you are having a bad day. I’m trying to convince some security analyst of a crypto based platform why CSRF attack to update any targeted users password on production shouldn’t be “Accepted Risk” 😂😂
Don’t know what to say 😅
#bugbounty #crypto #bounty #ethicalhacker
9
73
6,587
While I’m waiting months to get first response on my P1 reports on other programs.
@zomato program accepted my critical in just 20 mins man ❤️ 🔥
Really kudos to the @zomato security team 🫡🫡
#bugbounty #critical #zomato
11
185
8,565
What happened to @Bugcrowd reported 3 confirm P1 reports over a month now and no single response till date 😢.
Never experienced this before on bugcrowd.
12
42
4,109
If you are good with OT or ICS security testing. I have an excellent opportunity for you. Reach out to me.
Referrals are also most welcome. Thanks!
#cybersecurity #ics #bugbounty #pentesting #otsecurity #security
1
788
Thanks @theXSSrat : )
A CVE with your name on it is forever. 🏆 Congrats @sunilyedla2 — SQLi in the wild and officially credited as reporter. Take the credit you earned this time! 😄🐀
1
10
2,620
I found the “CVE-2025-52895” for a SQL Injection and forgot to take the credit for more than a year 😂
I got it now!! 🥳 ❤️
github.com/frappe/frappe/sec…
#bugboubty #cve #security #aisecurity #pentesting #frappe #sql
I’M BACK! 💵 Got 5600 USDT in bounties for cool and simple bugs in a crypto based company. Vulnerabilities are still out there just invest good amount of time.
#bugbounty #usdt #crypto #bugtrooper #aisecurity
Sunil Yedla retweeted
Guest Speaker Announcement - Tech Talk + Live Hacking Event 🚨
We’re thrilled to announce @3ncryptSaan as Guest Speaker for a tech talk at our Live Hacking Event organized by @iitroorkee and powered by @BugTroopers
#bugbounty #bugtrooper #iitroorkee #ihubdivyasampark #hack
Sunil Yedla retweeted
IHUB DivyaSampark × Bugtrooper presents a 2-Day hands-on Ethical Hacking experience on 7–8 March 2026
📍 IIT Roorkee – Greater Noida Extension
🔐 Ethical Hacking
💻 Bug Bounty
🏆 Rewards & Certificates
Register Now!
tinyurl.com/mtw64fhj
#LiveHacking #CyberSecurity
I wasn’t active in Bugbounty since very long time but the amount of love and support the bug bounty community is showing towards the live hacking event is overwhelming ❤️ As I always say stay kind with each other 😇 @BugTroopers
#lhe #bugbounty #iitr #bugtrooper #security
Sunil Yedla retweeted
🚨 Live Hacking Event – This March 🚨
Bugtrooper is gearing up to host a live hacking event this March, bringing together security researchers, real-world vulnerabilities, and hands-on hacking.
#bugtrooper #bugbounty #infosec #lhe linkedin.com/posts/bugtroope…
Sunil Yedla retweeted
This Hacker (@0xTeflon) made $70,000 from a public bug bounty program with a simple bug!
youtu.be/uW7COsIKTXM
2FA bypass:
1. Login request path: /api/v1/… -> redirect to 2FA page
2. Manipulate path to: /api/v2/… -> Access token disclosed in response
3. Use “access token” and send request to disable 2FA endpoint
4. 2FA disabled. Now login and get full access.
#bugbounty #bugbountytip
2FA bypass:
1. 2FA activated on main domain
2. Found subdomain : embed.<target>.com
3. Logged in to subdomain with same creds
4. After login to subdomain option to redirect to main domain.
5. Full access to main domain without entering 2FA
#bugbountytips #BugBounty #2fabypass
Always check for ID’s disclosed in response:
1. Found a json POST request without user ID to fetch user information in the response
2. Adding new parameter “user_id”:<victims ID> in the request body
3. Victims full PII details fetched in response
#bugcrowd #bugbountytips
