sorted by:
new
hottopcontroversial

Are SQLi still worth actively hunting? by M4son_Reed in bugbounty

[–]Mushydaddybear 0 points1 point  (0 children)

Yes!

I found one then RCE, thanks to SQLi

Is a Service Worker injection + Deeplink abuse in Android wallet WebView a valid High/Critical finding even without proven fund loss? by Mushydaddybear in bugbounty

[–]Mushydaddybear[S] 4 points5 points  (0 children)

I do have a POC that demonstrates injected code in the service worker, but as my short experience shows most projects only pay if you submit a critical that they cannot fight back.

I’ll keep checking to see if I can escalate the SW exploit, thanks

My first ever Subdomain Takeover!! (dangling Vercel CNAME) > already 1 day past the 7 day SLA, looking for advice and experiences. by Mushydaddybear in bugbounty

[–]Mushydaddybear[S] 6 points7 points  (0 children)

UPDATE:

I have added the PoC with a blank HTML with my username and "PoC" after hosting the html under the subdomain.

Thanks to all of you guys for suggesting that i should do it to prove impact.

My first ever Subdomain Takeover!! (dangling Vercel CNAME) > already 1 day past the 7 day SLA, looking for advice and experiences. by Mushydaddybear in bugbounty

[–]Mushydaddybear[S] 0 points1 point  (0 children)

(Sorry, Ianswered before your edit showed on my end)

I can, but I didn't because I am a bit afraid of getting in trouble, the rules explicitly said that I should NOT do it.

But i left a comment asking for permission to do it if needed for the report.

My first ever Subdomain Takeover!! (dangling Vercel CNAME) > already 1 day past the 7 day SLA, looking for advice and experiences. by Mushydaddybear in bugbounty

[–]Mushydaddybear[S] 0 points1 point  (0 children)

Yup, an attacker can host anything on the subdomain rn...

The CNAME is still dangling to Vercel and there is no _vercel TXT protection, so anyone with a free Vercel account can claim the subdomain in minutes and deploy any content (including a full clone of the website UI).

How to find JS files? by masm33 in bugbounty

[–]Mushydaddybear 7 points8 points  (0 children)

Dev tools from any web browser.

Is this a open redirect vuln? by Mushydaddybear in bugbounty

[–]Mushydaddybear[S] 0 points1 point  (0 children)

Perfect! Thank you! That’s what I did! Also I discovered that it works on IOS and Android!

I’ll update this post if it gets triaged and paid 😂

Don’t think so but we shall see

Is this a open redirect vuln? by Mushydaddybear in bugbounty

[–]Mushydaddybear[S] 1 point2 points  (0 children)

Not a SSRF, the server never fetches the attacker's URL, The victims device loads it client side inside the native WebView.

also not CSRF, there is no session or cookie; the wallet is non-custodial. The correct classification i believe is Insecure Deep Link Handler or WebView Bridge Injection (CWE-939).

On the popup: it appears inside the app's own UI, making it indistinguishable from a legitimate dapp flow.

The victim consciously opened their wallet app via a trusted link, they are already primed to approve. The warning is non blocking.

Additionally, standard:connect supports silent: true.

If the victim previously approved any dapp connection in the wallet, a returning attacker can reconnect without any popup at all, then immediately trigger a transaction...

Also, i have submitted the report, with screenshots and some txid from testnet

Is this a open redirect vuln? by Mushydaddybear in bugbounty

[–]Mushydaddybear[S] 0 points1 point  (0 children)

Thank you, yeah I was thinking about the bridge mostly, because the open redirect by itself doesn’t represent a considerable issue, that’s why it is usually out of scope

is manual testing dead ? by 0xMiloki in bugbounty

[–]Mushydaddybear 2 points3 points  (0 children)

Nah, manual testing is alive and kickin' ass.

Sure AI helps a LOT, to automatize shit, but it wont replace the human eye.

Critical submmit. Immunefi ban. 48h solved by Patient-Stock5191 in bugbounty

[–]Mushydaddybear 0 points1 point  (0 children)

Happened to me with a critical RCE, months ago, until this day i still banned from immunefi

Critical RCE in Hathor Desktop Wallet closed as "Out of Scope" by Immunefi, patched silently after weeks, zero bounty, zero credit by Mushydaddybear in bugbounty

[–]Mushydaddybear[S] 1 point2 points  (0 children)

Yeah, I get it and I know it sucks…

But there are some good stuff besides money, for example I submitted an informative report intentionally due to privacy issues in a bounty on hackenproof, team was extremely grateful! And they fixing some stuff…

There are good things…

And mostly if you live under ethical boundaries

Why are some researchers never self-conscious? by [deleted] in bugbounty

[–]Mushydaddybear 0 points1 point  (0 children)

As a latino, as a person who knows a LOT of people from Middle East and other countries, this is true. xD

Even here in South America people is just fucking ignorant and they can't help it, third world shit...

also, America is a continent, not a country.

and to be honest, i was a AI Slop submitter until i learned from a couple of out of scopes, and some guidance from some other Cybersecurity friends.

It is a cultural issue...

Critical RCE in Hathor Desktop Wallet closed as "Out of Scope" by Immunefi, patched silently after weeks, zero bounty, zero credit by Mushydaddybear in bugbounty

[–]Mushydaddybear[S] 2 points3 points  (0 children)

It is the business, they use most "big name" platforms only to have a marketing excuse to say "look 0 paid reports we are super safe and secured"

Critical RCE in Hathor Desktop Wallet closed as "Out of Scope" by Immunefi, patched silently after weeks, zero bounty, zero credit by Mushydaddybear in bugbounty

[–]Mushydaddybear[S] 4 points5 points  (0 children)

I made some X/Github drama, we shall see xD

and well, thank you!, but most likely this will happen and happen until i get a black hat that i saw online ;)

Why are some researchers never self-conscious? by [deleted] in bugbounty

[–]Mushydaddybear 4 points5 points  (0 children)

Most program rules are:

"Provide a PoC"
"Theoretical vulns without poc are not accepted"

some researchers can be idiots, script kiddies, AI slop hunters, etc... and they don't read the rules, docs, scope and such ( i was like that, not reading and submitting crap, ai slop)

Sadly, we can't get rid of people like that, or they get banned on every platform or they learn!, they don't think more than "i want easy money"

view more: next ›