আসসালামু আলাইকুম, আজ এই পোষ্টটি লিখার কোন ইচ্ছা ছিল না বাট লিখতে বসলাম কিছু প্রশ্নের উত্তর দিতে ও সিন্যাক নিয়ে অনেকে জানতে চেয়েছেন সেই সম্পর্কে লিখতে । অনেকে হইত আমার গত পোষ্টটি https://www.facebook.com/groups/vorhelpcenter/permalink/691994155058387/ পরেছেন । এই পোষ্টটির কিছু বিষয় নিয়ে তাদের গ্রুপের কিছু পোষ্ট দেখলাম যেগুলার screenshot

তো পোষ্টগুলাই দুইটা জিনিস কমন তা হল -

  1. শেয়ার আইপি
  2. সিন্যাকে চাকুরী

যদি আমার গত পোষ্টটি পড়েন তাহলে সম্পূর্ণ পোষ্টে কোথাও আপনি এমন একটি লাইন খুঁজে পাবেন না যেইখানে আমি শেয়ার আইপি নিয়ে কোন কথা বলছি । তাহলে বার বার পোষ্টে শেয়ার আইপি কথাটি উল্লেখ করে তিনি বা তাহারা কি প্রমাণ করতে চায়…


Hello Fellow Hackers!

I am sitting in my room for last 3 days due to corona virus outbreak world wide and feeling really bored . So I thought why not do a write-up what I promised really long ago 🤭. Few months back in My Tweet I shared a way to bypass XSS WAF & Character limitation what I found on a private bug bounty site. Today I will share more technical details about that bypass . Hope you guys will enjoy it 😇

Back in 2019 I was testing a web application what allows a user to create a…


Hi readers ,

At 1st Eid Mubarak to all . May Allah bring you joy, happiness, peace and prosperity on this blessed occasion. Wishing you and your family on this happy occasion of Eid! Eid Mubarak! So on this blessed occasion I thought let’s share one of my finding as Eid bonus 😜 !

From title you may came to know this is a write-up about XSS WAF bypass using UNICODE . So let’s give you a small idea about the application I was testing . There was a option called Save for later what saves items in your account…


Hi readers ,

Today I will write about a XSS Vulnerability I reported to postnl.nl bug bounty Program .

Vulnerable Endpoint :- http://realestate.postnl.nl/?Lang=

To test a normal Reflected XSS I Input “><xsstest> in the Lang parameter and in source it was reflected properly inside META tag like below :-

<meta name="language" content=""><xsstest>" />

Looks simple right ? Then wait a little :’) . Then I Inputted “><img src=x> and I got :-

Surprise you nigga 🥳🥳🥳

I tried with many HTML tags and I got 2 points here :-

  • Any Valid HTML tag is not allowed .
  • I can created any attributes here .


Hi guys ,

This is Prial Islam a security researcher from Bangladesh . This is a old finding of mine adding into my blog . Recently I disclosed a POC on How I was able to get all vine users sensitive Information including Phone no/ IP Address / Emails and Many more what was reported to twitter and they patched it and rewarded me 7560$ . Those who missed it you can get the Orginal Report Here .

Today I am going to disclose another Information Disclosure vulnerability what was reported by me to Twitter Security team in their Bug…


Hello readers,

This is Prial Islam a security researcher from Bangladesh . This is a old finding of mine adding into my blog .

Today I will write about a Critical IDOR vulnerability that will lead to Information Disclosure what allowed me to get any Vine user’s sensitive information including Ip address/phone no/email .

I reported this bug to Twitter Security team in their Bug Bounty Program in Hackerone and they Rewarded me with a amount of 7560$ for this report .

$$$$ + Blog post permission 😾 😇

Vine has issued a statement regarding this vulnerability on their Vine blog Post here and also Hackerone mentioned…


Hi readers ,

Today I will write about Subdomain takeover . It’s a common Security issue what is actually developers mistake when they left a Unused/unclaimed 3rd party Service DNS CNAME record for a subdoamin of theirs and Hackers can claim those subdomains with the help of external services it pointing to what could lead to serious issues . You can learn more about Subdomain takeover from detectify blog .

While testing flock.com I got a domain flock.co what is under flock company . So I stared looking at it’s subdomains and got subdomain newdev.flock.co . …


Hi readers ,

I am a Cyber Security Researcher from Bangladesh . Again I am here to share a Security issue I found on WeTransfer . WeTransfer have a paid bugbounty program under Zerocopter . So I start testing their sites . While I was bruteforcing wetransfer.com with DIRB script I got some directories what was redirecting users to Medium Publication link . Those directories looks like :-


Description

zerocopter.com is a bug bounty platform for Ethical hackers just like Hackerone . In zerocopter reports user can use Markdown . Users are also allowed to give external links in reports . If a user click on External link in reports then it takes the user to a external warning page like below screenshot :-

But I was able to bypass the external warning page and redirect a user to a external link without any warning page .

Markdown :-

<http:1249723505> 
[Click Me](http:1249723505)

Note :- In above markdown 1249723505 this is ip of google.com [ 74.125.68.113


Hi readers ,

I am a Cyber Security Researcher from Bangladesh . This is my 1st write-up and also I am not good at XSS so forgive all mistakes .

Recently I was testing a private site and in that site users can add their personal information . I noticed a Input there named Secret Key which allows user to process payments and store transaction information to an application.

So I input a Normal payload :-

“><img src=x onerror=prompt(document.domain)>

and it got filtered and the page source was like :-

<input type="text" id="****" name="****" value="">&lt;img img" class="form-control" rel="gp" data-size="20" data-character-set="a-z,A-Z,0-9">

Prial Islam Khan

A teenager boy with passion of Breaking Security .

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store