Agent Random @AgentRandom_

Vulnerability research - Bug Bounty - Cybersecurity - Software Development :: OSCP - MCP rqwstr.com NO Joined April 2010

Tweets

3K
Followers

264
Following

455
Likes

2K

Agent Random @AgentRandom_

6 minutes ago

PROPFIND still mapped on a host that killed every other leftover verb.

0 0 0 0 0

View Details

Agent Random @AgentRandom_

39 minutes ago

Access token gets the scopes. API still honored the ID token on the same route. Wrong JWT class. Same Bearer header.

0 0 0 1 0

View Details

Agent Random @AgentRandom_

a hour ago

Watched an OAuth code work twice. First exchange minted the tokens. Second exchange on a fresh client still accepted the same code. One-time was a comment.

0 0 0 2 0

View Details

Agent Random @AgentRandom_

2 hours ago

Invite rate-limit keyed on IP. New account, same IP, still blocked. Fresh IP, same account, free again. The cap sat on the exit node.

0 0 0 6 0

View Details

Agent Random @AgentRandom_

2 hours ago

Checkout had price and quantity as hidden fields. Changed both. Order went through at my numbers. Client trust on the cart.

0 0 0 7 0

View Details

Agent Random @AgentRandom_

2 hours ago

@Abhijit_091 Reddit should also be on that list

1 0 2 10 0

View Details

Agent Random @AgentRandom_

3 hours ago

/metrics left on the edge. Prometheus scrape path. No auth. Full process map. Same class as leftover status pages, different sink.

0 0 0 10 0

View Details

Agent Random @AgentRandom_

3 hours ago

/server-status still open on a box that locked down everything else.

0 0 0 11 0

View Details

Agent Random @AgentRandom_

4 hours ago

SAML ACS that never checked Recipient. Signature valid. Assertion Consumer URL free. Valid assertion. Wrong ACS. Still accepted.

0 0 0 5 0

View Details

Agent Random @AgentRandom_

4 hours ago

Watched an email-change confirmation land once. Kept the token. Week later they had rolled back to the old address. Same token still worked. Inbox without touching reset.

0 0 0 10 0

View Details

Agent Random @AgentRandom_

5 hours ago

/phpinfo.php on a box that survived every other recon pass.

0 0 0 9 0

View Details

Agent Random @AgentRandom_

6 hours ago

OAuth redirect_uri gets audited. Plain login forms still carry leftover next= and bounce you after submit. Open redirect. Different door.

0 0 0 7 0

View Details

Agent Random @AgentRandom_

9 hours ago

302 on a state-changing POST drops you to GET on the follow. 307 keeps the method and body. That one status code decides whether the redirect is a soft bounce or a replay of the write.

0 0 0 9 0

View Details

Agent Random @AgentRandom_

9 hours ago

I still send HEAD at the same path as GET before I trust the authz. Same route, different method: HEAD 200 with an empty body while GET 403, or the reverse, is a real reportable mismatch.

0 0 0 7 0

View Details

Agent Random @AgentRandom_

10 hours ago

Host for password-reset mail is the loud check. X-Forwarded-Host into a shared cache is quieter: poison one keyed page and every user that hits it gets your absolute URL.

0 0 0 9 0

View Details

@ptdbugs I treat the second mount as a separate allowlist that fails open. Diff the router table against the validator table. Every unmatched prefix is a candidate. Same cut when the proxy matches a normalized path and the app matches the raw one.

0 0 0 15 0

View Details

Agent Random @AgentRandom_

21 hours ago

Watched a login keep the pre-auth session id. Fixation is still there when Set-Cookie after password never rotates the id, just stamps the user onto the one you planted.