T3po@T3PO0

I hack stuff (legally)

Joined July 2025
1 Photos and videos
DAY 2: I learned that the API i've tested was secure but the only noteable result was numerical coercion by adding "e0" at the end of my user ID in the X-User-ID header it resulted in the backend showing my own user informatio...
1
30
just yesterday i thought that any digit change would result in a 401 for example: Yesterday: attacker user ID: X-user-ID: 123 (200 STATUS OK) victim ID: X-User-ID: 124 (401) NOW: Attacker user ID: X-User-ID: 123e0 (200 status) Victim ID X-User-ID: 124e0 (401 status code)
23
Day 1: TESTING What did you learn about the program ? I learned that my tests so far on the endpoint results in multiple 401 codes and the only thing left to test is the header to try and bypass this and get a valid bug. the header in question does not accept any character...
1
15
other then a number at the start and changes to the last digit are what trigger a 401 or 200 status code: 1. normal ID format but victim ID X-User-ID:123 (401) 2. special character ID (array bypass) X-User-ID: [123,124] (401) 3. capitalization of header (401 ) and other tests
1
13
Plan for following day is research some Header bypasses to try and achieve an IDOR
6
DAY 3: I have started working on the graphQL endpoints and found nothing of value hit a road block but after some consultation with AI it deduced it would be a time waste to continue on queries that lead to that road block DAY 4 Plans: Recon on new domain
11
DAY: 2 so far i completed the reconissence and all the cataloging required for the API all that is needed now for DAY 3 is to start testing all the API i have found. TIP: create a booklet command which extracts JS files that contain certain key words like "admin" "/api" etc etc
11
DAY 1: on a new bug bounty program so far the work for today consisted of Recon: subdomains , parameters and API endpoints goal for day 2: 1. read JS files 2. catalog APIs TIP: Try manual subdomain search on GOOGLE,BING and YANDEX it has lead me to unique subdomains.
1
50
#BugBounty #bugbountytip #hackerone #bugcrowd
49
> currently waiting for a support ticket related to a program > understood it was a quiet day due to time constraints > realized that i have such a narrow work load that i do not have other tasks to complete which move the needle related to the program to complete
1
11
i am looking for tasks i can preform that fit into two catogories. 1. skill deepening tasks 2. program understanding tasks e.g skill deepening tasks can be reconissence technique research, writeups etc e.g program understanidng could be api doc reading etc
1
8
what are your tasks that you preform? #bugbountytips #BugBounty #securityreasearch #cybersecurity
35
We take phishing seriously here. Last month, 40% of our company clicked on a fake link I sent them promising "Free Pizza." Disappointing. So I leveled up the simulation. This morning, I went to the sales department wearing a ski mask. I physically stole three laptops and threw them out the window. When they screamed, "Who are you?", I didn't answer. Because hackers don't answer questions. Now everyone is locking their workstations. Sometimes the best training is lived experience.
65
253
5,897
289,012
T3po retweeted
0b1d1@_0b1d1
21 Nov 2025
41
62
788
41,544
39 Cybersecurity News Resources that will Keep You Updated 💻 github.com/NafisiAslH/Knowle… #infosec #cybersecurity #bugbountytip
3
84
209
Really good extractor tool for Bug Bounty what extentions do you guys use?
4
I don't think people talk enough about how important note taking is and how to effectively take notes, is there a template for bug bounty note taking somewhere #BugBounty #hackingtips #bugbountytips
8
T3po retweeted
$mit@Fabrikat0r
18 Aug 2025
🕵️‍♂️ Calling fellow Bug Bounty hunters who consume daily blogs, articles, talks, and research There’s too much surface-level content out there -finding the meaningful gems is hard. I’m starting a closed group (currently me & @4osp3l) Retweet + comment “Interested” if you want in
140
84
201
18,674
Load more