The story how I found RCE in Citrix (CVE-2019-19781)

#bugbounty #shellshock

Check out Easy Hack manual from PT SWARM #pentest #bugbounty

Just got my swag pack from Synack Red Team for participation in Hacker Hangout Europe! #bugbounty #Synack

Night of the Hunt Synack Red Team #BugBounty #Synack

Leveled up to 0x05! через Synack Red Team #BugBounty #Synack

➡️Default creds for #redteam Cisco: cisco:cisco Citrix: nsroot:nsroot Dell iDRAC: root:calvin Juniper: super:juniper123 pfSense: admin:pfsense SAP: SAP*:06071992 Tomcat: tomcat:tomcat UniFi: ubnt:ubnt Weblogic: weblogic:weblogic1 Zabbix: Admin:zabbix #ptswarmTechniques

Found my tweet from 2017

coolest swag from Synack Red Team Synack #bugbounty #1337 #hacking #pentest

Just found GraphQL broken access control leading to administrator credentials disclosure. Here's how to avoid: 1) Implement Proper Authentication & Authorization mechanisms 2) Disable Introspection & field suggestion if API is not for public use #pentest #bugbounty #hacking

Apache Struts 2 OGNL Injection (CVE-2013-2251) leading to Remote Code Execution. Found this one today during a Pentest. #bugbounty #hacking #pentest #struts #burpsuite

Atlassian Confluence Remote Code Execution through OGNL Injection. CVE-2023-22527 #atlassian #bugbounty #hacking #pentest #confluence

New Ivanti XXE seems promising (CVE-2024-22024) #pentest #bugbounty #synack #hackerone #ivanti

Check out my new blog post on RCE through Grafana 🔥 medium.com/@konqi/exploit… #pentest #bugbounty #bugbountytip #hacking #grafana

Yay, I was awarded a $500 bounty on HackerOne! hackerone.com/konqi #TogetherWeHitHarder Kinda back to H1. next step is to get clear badge

Fresh one. Leakage of payment gateway API credentials through Access Control Violation in GraphQL. #hacking #pentest #bugbounty #vapt #hackerone #owasp

Heading to the airport on a Georgian bus. Free wi-fi & default router credentials are included 😏 #wifi #defaultcredentials

Just published a new blog post on escalating open redirect to account takeover. medium.com/@konqi/from-op… #bugbounty #pentest #Hacking