Founder @YogSec | Helping Businesses Secure Their Websites | #BugBounty & #OSINT Tips - https://xitter.gq/t.co/ZemJJyfFSq | Goodness 😇
Meerut, India
Joined November 2024
- Tweets1.9K
- Following342
- Followers683
- Likes2K
Pinned Tweet
Join my Telegram channel for regular tips on SQLi, XSS, IDOR, enumeration & business logic bugs.
Telegram Channel: t.me/bugbountyusa
#CyberSecurity #BugBounty
WebVerse Pro's BowBuy is an interesting easy lab where a new-member $300 welcome credit is applied through a check-then-act race, so firing about 15 concurrent redeem requests all pass the check and each adds $300, stacking the balance past an item's price and rendering the flag on the order confirmation page.
Lab URL: webverselabs-pro.com/labs/bo…
#WebVersePro #RaceCondition #TOCTOU #BusinessLogic #WebSecurity #Pentesting #CTF #InfoSec #EthicalHacking
Abhinav Singwal retweeted
🛡️ Apple to Scan for Every Photo and File Shared Through a Public iCloud Link for Harmful Content
Details: cybersecuritynews.com/apple-…
Apple will begin checking photos and files shared through public iCloud links for harmful content with version 27.3 or later of iOS, iPadOS, macOS, and visionOS. The policy covers items shared using “Anyone with the Link,” including photos stored in iCloud Photos and files held in iCloud Drive.
Apple outlined the change in a support document published November 3, 2026. Apple is not announcing checks of every private photo or file stored in iCloud. Its notice targets content that users make available to anyone holding a sharing link.
The separate “People you choose” option, which limits access to invited or approved users, is not described as part of these checks.
#CybersecurityNews #iOS27.3
Abhinav Singwal retweeted
🚨 Ransomware Alert 🚨
Meduza Locker ransomware group has added 8 new victims to their dark web portal.
. MSN 🇺🇲
. National Directorate of Taxes and Customs (Dian) 🇨🇴
. Vinit Gloves Manufacturing Private Limited 🇮🇳
. Jay Ace Technologies Limited 🇮🇳
. Kde 🇲🇦
. Laval University 🇨🇦
. Hirsch, Gaugier & Khan (Hirschinjurylaw) 🇺🇲
. Interativa Plásticos (Interplast) 🇧🇷
Check live subdomains fast with Httprobe
cat subdomains.txt | httprobe
Join Bug Bounty USA Telegram channel for regular tips: t.me/bugbountyusa
#Httprobe #BugBounty #Recon #KaliLinux #WebSecurity
My Red-Team-Tools repo curates C2 frameworks and adversary simulation resources for real engagements.
GitHub: github.com/yogsec/Red-Team-T…
#redteam #pentesting #cybersecurity #infosec #github
Scarcity Bias Awareness 🔥
A message can say: "Only 2 spots left at this price! Register now with your card details before it's gone forever."
🔴 Limited time and limited stock are pressure tactics, not perks. Scarcity shuts down careful thinking. Walk away, verify the offer independently, and never rush to enter payment details.
More tips on my Telegram channel: t.me/bugbountyusa
#ScarcityBias #SocialEngineering #CyberSecurity #InfoSec #ScamAlert #FraudPrevention
Find SendGrid Keys in JavaScript with grep
Example:
grep -aoE "SG.[A-Za-z0-9_-]{22}.[A-Za-z0-9_-]{43}" target.js | sort -u
For more tips join Telegram channel t.me/bugbountyusa
#bugbounty #googledork #recon #infosec #ethicalhacking #javascript
OSINT Tip: Google Dork for Finding Exposed Job Postings and Recruiter Contacts
site:URL ("job" OR "careers" OR "hiring") intext:"@URL"
This short OSINT dork finds job and careers pages on a target domain that expose recruiter names and contact emails. It is useful for identifying staff and mapping hiring contacts during recon.
For more tips join Telegram channel t.me/bugbountyusa
#OSINT #GoogleDorks #Recon #JobPostings #InfoSec #RecruiterContacts #PeopleSearch #InfoGathering
900+ Hacking Tools, All in One Place
Looking for a single stop for ethical hacking tools? This repo gathers 900+ of them across 50+ categories, spanning network security, cloud, malware analysis, hardware hacking, and red/blue team tooling. Handy reference for security folks at any level.
GitHub Repo: github.com/yogsec/Hacking-To…
#Cybersecurity #EthicalHacking #PenTesting #InfoSec #RedTeam #BlueTeam #OSINT #SecurityTools
API Penetesting Tip: API Version Downgrade for Auth Bypass
Look for:
Multiple API versions exposed (/v1/, /v2/, /v3/, /beta/, /internal/) where older versions lack auth checks or security patches present in newer ones.
Test by replaying authenticated requests against older versions with lower or no privileges; try path variations (/v2/→/v1/, /v2/→/v0/, /api/v3/→/api/v2/), deprecated routes still live, and beta endpoints with debug output.
If accepted, it may enable auth bypass, privilege escalation, data exposure, or access to deprecated vulnerable functionality.
For more tips join: t.me/bugbountyusa
#BugBounty #APISecurity #VersionDowngrade #AuthBypass #InfoSec
MITRE ATT&CK Learning Tip
Use "Purple Teaming" to close the loop: Reading techniques isn't enough. Run a technique in a lab (Atomic Red Team), check if your Blue Team detects it, then improve the rule and re-run. This attack-detect-fix cycle is how ATT&CK becomes real skill instead of theory.
Practice: Pick one technique, execute its Atomic test, measure detection, tune the rule, re-run until it's caught. One closed loop beats ten pages read.
For more tips join our Telegram channel: t.me/bugbountyusa
#MITREATTACK #ThreatHunting #InfoSec #BlueTeam #TTPs
Privacy tip for cybersecurity professionals: Sanitize before you share. Metadata in screenshots, documents, and PCAPs can leak internal hostnames, usernames, IPs, and infrastructure details. Strip EXIF, redact sensitive fields, and scrub artifacts before posting to tickets, vendors, or public channels. Adversaries mine your "harmless" screenshots.
📲 Telegram: t.me/bugbountyusa
#cybersecurity #privacy #Metadata #OPSEC #RedTeam #InfoSec
CVE-2026-111501
Dell OpenManage Enterprise improper restriction of excessive authentication attempts. An unauthenticated attacker with adjacent network access could exploit this to launch phishing attacks. Affects versions prior to 4.8.0. CVSS 5.4 Medium. CWE-307.
nvd.nist.gov/vuln/detail/CVE…
#CVE #Dell #OpenManage #Authentication
Bug Bounty Tip: JSON Web Token Algorithm Confusion via Payload Fuzzing
Look for:
JWT tokens in cookies or Authorization: Bearer headers
Test payload: change alg from RS256 to HS256 and sign with the public key as HMAC secret
If the server accepts the forged token, it may indicate JWT Algorithm Confusion, enabling authentication bypass and account takeover.
For more tips join our Telegram channel: t.me/bugbountyusa
#BugBounty #JWT #PayloadFuzzing #InfoSec
Bug Bounty Tip: Open S3 Bucket via Payload Fuzzing
Look for:
Asset references in JS/HTML like target-assets.s3.amazonaws.c… and s3:// paths
Test payload: GET target-assets.s3.amazonaws.c…
If it returns a ListBucketResult with file keys, it may indicate an Open S3 Bucket, enabling sensitive data exposure or source code disclosure.
For more tips join our Telegram channel: t.me/bugbountyusa
#BugBounty #S3Bucket #PayloadFuzzing #InfoSec
Social Engineering Awareness 💡
An attacker can say: "Hi, I'm from the HR department. We're processing year-end bonuses. Please confirm your bank account number and salary details to receive your payment."
More tips on my Telegram channel: t.me/bugbountyusa
#SocialEngineering #CyberSecurity #InfoSec #ScamAlert #Phishing
Cybersecurity Lab - SadServers "Constanta"
Jumping Frog is a medium cybersecurity lab in classic CTF form: a message sits in /home/user3/secret.txt, and you're logged in as admin with no sudo. The goal is to copy that message into /home/admin/solution.txt, which means getting past the permission boundary between your account and another user's files.
Lab URL: sadservers.com/scenario/cons…
#SadServers #CTF #InfoSec #EthicalHacking #HackLabs #Pentesting #Linux #CyberSecurity #PrivilegeEscalation #CaptureTheFlag
ALT Cybersecurity lab by sadservers
Bug Bounty Tip: JSON Hijacking via Response Signals
Look for:
Legacy JSON endpoints returning arrays to GET. Check if responses are wrapped or protected by X-Content-Type-Options
Test payload: <script src="target.com/api/user/data">. An array response readable via a script tag confirms the risk
For more tips join our Telegram channel: t.me/bugbountyusa
#BugBounty #JSONHijacking #PayloadFuzzing #InfoSec
Bug Bounty Tip: HTTP Method Bypass via Verb Signals
Look for:
Admin routes, API endpoints, and access-controlled actions. Check if only GET is blocked while other verbs slip through
Test payload: swap GET for POST, PUT, or X-HTTP-Method-Override: PUT. A successful action confirms the bypass
For more tips join our Telegram channel: t.me/bugbountyusa
#BugBounty #MethodBypass #PayloadFuzzing #InfoSec