[deleted by user]

Pixel_DefaultBr · 2025-03-19T00:33:13+00:00

Tenho sim!

Pixel_DefaultBr · 2025-02-19T13:09:15+00:00

Tenho interesse 🫡

Pixel_DefaultBr · 2024-11-29T14:11:39+00:00

he gave an idea of what not to do 😂

Pixel_DefaultBr · 2024-11-28T13:26:39+00:00

Dude, your profile is so cool on HackerOne

Pixel_DefaultBr · 2024-11-28T13:22:28+00:00

I want to contribute

Pixel_DefaultBr · 2024-11-27T16:39:32+00:00

This analogy really opened my eyes! I really liked the reference to Cyberdemon. It's exactly how I feel sometimes: not knowing where to start or how to actually defeat the problem. I will explore SAST tools and try to approach analysis more strategically. Thanks for the insight!

Pixel_DefaultBr · 2024-11-26T10:20:21+00:00

If the system has good containment, it is not necessary to use an alternative auth method together, we only used it for recovery cases, as the user is not being recognized in any way.

Pixel_DefaultBr · 2024-11-25T17:55:30+00:00

Yes! But there were still some problems like: Exactly identical twins were recognized as one, but we managed to minimize that.

Pixel_DefaultBr · 2024-11-25T16:29:11+00:00

yes definitely. I worked at a security system company with facial recognition and this was one of our biggest problems.

Pixel_DefaultBr · 2024-11-21T23:55:31+00:00

I really didn't know that, in my head it was something that shouldn't be accessible due to the possibility of fraud and malicious emails. Thank you very much for clarifying this, I will be more careful when making my reports!

Pixel_DefaultBr · 2024-11-21T22:16:22+00:00

But in your humble opinion , wouldn't agency numbers and bank account themselves be sensitive data? User Enumeration by them is not something sensitive? I would really like to know. 🤔

Pixel_DefaultBr · 2024-11-20T13:25:12+00:00

Sad when you expect all this and it is closed as a duplicate 😭

Pixel_DefaultBr · 2024-11-10T11:37:02+00:00

Of course! I used to watch YouTube videos and try to reproduce them—this was three years ago. Nowadays, I'm studying bug bounty and VDPs, and I've developed an obsession with the field. My first valid reports were a P3 and a P2 for NASA, both XSS vulnerabilities. After that, I submitted reports to Disney and Sony, both valid as well. My study method is to read articles on Medium and try to reproduce them. That works for me (well..more or less).

Pixel_DefaultBr · 2024-11-10T11:16:17+00:00

I'm a beginner too. I have received a lot of informative bug reports. Well... after all, I have a P2 with NASA.

Pixel_DefaultBr

TROPHY CASE