18 | Bug Bounty Hunter | Security Researcher
Bangalore
Joined January 2022
- Tweets799
- Following531
- Followers3.4K
- Likes1.9K
we got a 1 click ATO on chatgpt(.)com just via a normal shared chat link.
tl;dr html preview in chat -> postmessage -> MathLive -> xss
gpt-5.6 sol 🐐
Mukul Goyal retweeted
Found a 1-click account takeover via postMessage. No phishing, no fake login page, just one click and a full-access token.
Wrote up the full breakdown and also gave the whole site a little revamp while I was at it.
naaaash.github.io/posts/oaut…
Mukul Goyal retweeted
Just wrapped up an amazing IPC with @amazon in Amsterdam! 🇳🇱🚀
Our team - @H4cktus, @jayesh25, @itz_mg_ & I - came 1st on the leaderboard, finding ~80 vulnerabilities from medium to critical 💪
Also grabbed some bonus awards:
🏆 Most critical issues on an asset
💥 Most impactful bug on an asset
🎤 Show & Tell
Big thanks to @Hacker0x01 & the organizers for an awesome event! 🙌
Had so much fun working on this one xD
Yay, @jayesh25 , @itz_mg_ , @_naaash_ and I were awarded a $25,000 bounty on @Hacker0x01!
#TogetherWeHitHarder
Yet another most impactful bug of the event! Got to hack on some really interesting pieces of scope this time and learned a ton in the process. Grateful to the epic team, @Hacker0x01 & @amazon for making it all possible.
Had an amazing time hacking @amazon at @Hacker0x01’s in-person event with @naaash, @jayesh25, and @itz_mg_! We secured first place on the leaderboard and reported the most impactful bug of the event. Huge thanks to both Amazon and HackerOne for organizing such an awesome experience, already excited for the next one! 👀
Had a lot of fun hacking zoom during the campaign - one of the best bug bounty programs out there!
Thanks to @Hack_All_Things and @Zoom for making this one so rewarding.
The D-Day Campaign top contributors results are in! Congratulations freesec on being the top report submitter! Thanks to all for your participation. DM me your shipping address on Zoom chat to receive promised @Zoom swag!
Mukul Goyal retweeted
450 google searches without getting banned.
CLI program releasing tomorrow for my github sponsors after a bit of polishing. No exploit/proxies being used here btw.
Full video: youtube.com/watch?v=Mrv4KZzJ…
Had the chance to participate in this amazing event and bagged the awards for second place (ofc right behind @zseano's epic team), the most impactful report of the event (and honestly, my career xD), and S&T! Shoutout to my teammates @_naaash_ and @jayesh25 for the epic collab!
28 researchers. 9 days. 45 valid critical or high severity issues uncovered.
@amazon's first-ever In-Person Challenge brought together top security researchers to test its systems.
A HackerOne Challenge is more than just a bug bounty—it’s an invite-only, time-bound offensive testing program focused on finding high-impact vulnerabilities fast.
Here’s what this one produced:
👀 222 vulnerability submissions triaged by a dedicated HackerOne pod
💪 129 valid issues: ~60% of all submissions!
💥 12 critical & 33 high-severity findings
🧠 The opportunity for in-house teams to observe researchers’ reconnaissance & attack methodologies firsthand—gaining a deeper understanding of potential security issues
This is what modern, proactive security looks like.
Mukul Goyal retweeted
It's a black day for India.
May the Innocent Souls Rest in Peace.
#Pahalgam
Mukul Goyal retweeted
Banana for scale.
Thx for the bugs @itz_mg_ @iustinBB @zseano @JonathanBouman @fransrosen @avlidienbrunn @gr3pme and everyone else who participated in our Seattle event!
Mukul Goyal retweeted
Calling all Indian hackers for an LHE !
With @Hacker0x01 I am organizing a Live Hacking Event - Chandigarh 1st Edition.
Open to all skill levels - beginner to advanced. Grab this opportunity to Learn, Hack and Collaborate.
Apply here by March 5th, 2025:
h1.community/events/details/…
Mukul Goyal retweeted
Wrote a blog for people who are unable to start/finish tasks or often make decisions that harm them in long-term 🫂
s0md3v.github.io/blog/get-li…
