Accidental hacker | Pentester @hacker0x01 | Ex: @AppSecure @pentabug
*Confidential*
Joined March 2016
- Tweets1.9K
- Following588
- Followers3.1K
- Likes18.2K
Pinned Tweet
Had a really fun time hacking @amazon in Goa ๐ด
Teamed up with @H4cktus, @Jayesh25 and @itz_mg_ and we ended up 1st on the leaderboard ๐
Picked up a bunch of bonuses too:
๐ Pwnership: Eventwide Most Impactful Report
๐ง Dive Deep: Most Creative Bug
๐ฅ Most Impactful Issue on a Specific Asset
๐ฅ Most # of Critical Issues on a Specific Asset
๐ค Show & Tell
Big thanks to @Hacker0x01 for organizing this ๐
Photo dump from the chaos ๐
Avi retweeted
Solved! Chrome debugger was enabled and allowed access via http://localhost:9222/json. This allowed exfiltrating data from other users whosoever was hitting this headless chrome browser - more info here - chromedevtools.github.io/devโฆ
Thanks everyone for the tips :)
Found a 1-click account takeover via postMessage. No phishing, no fake login page, just one click and a full-access token.
Wrote up the full breakdown and also gave the whole site a little revamp while I was at it.
naaaash.github.io/posts/oautโฆ
A little late to the party, but 2025 was an absolute blast ๐ฅโจ
Some random highlights from the year ๐
๐ Took part in Adobeโs Live Hacking event in March, teamed up with @surajdisoja, and won the Most Impactful & Creative Bug
๐ Got invited to Amazon IPCs across Seattle, Vegas & Amsterdam and our team (@jayesh25, @H4cktus, @itz_mg_) finished 1st on the leaderboard at every event
๐๏ธDid my first-ever Show & Tell, which was a super fun (and slightly nerve-wracking ๐) experience
๐ฅ Submitted a solid number of bugs too (~60 High/Critical ๐
)
๐ฎ๐ณ Ended the year in the Top 10 leaderboard in India
โ๏ธ Travelled way more than I ever had before
Huge thanks to @HackerOne and @H1LeoW for making all of this possible๐
I rambled quite a lot with @AseemShrey ๐
Go check it out ๐
In this episode of Hacker to Hacker, I sit down with Avinash (@_naaash_) ,an โaccidental hackerโ whose journey into cybersecurity is anything but ordinary.
A full-time bug bounty hunter, winning live hacking events, and earning six figures in payouts.
Link below ๐
Avi retweeted
Can you compromise a multi-billion dollar company via /health?
hacktus.tech/can-you-compromโฆ
#infosec #cybersec #BugBounty #bugbountytips
Avi retweeted
Had a great start of the day with @_naaash_ ๐ฅ
We spoke for over 1.5 hours - full of raw, behind-the-scenes stories from the bug bounty world.
โ๐ฉ๐๐ ๐๐๐๐๐๐ ๐๐ ๐๐๐๐ ๐๐๐๐๐๐ : ๐๐๐๐๐โ๐ ๐ ๐๐๐๐๐, ๐ ๐๐๐๐๐๐๐, ๐๐๐
๐ ๐๐๐๐๐๐๐๐.โ
๐ฆ๐ผ๐บ๐ฒ ๐๐ฎ๐ธ๐ฒ๐ฎ๐๐ฎ๐๐:
- Started hacking, to afford a better laptop for YouTube videos in college 1st year.
- Had over 30 backlogs ( I didn't even know , you could've that much :))
- First bounty: โฌ250 on a fluke WordPress CORS bug, felt his knees go weak seeing the payout email.
- Uses ๐ง๐จ ๐๐ฎ๐ญ๐จ๐ฆ๐๐ญ๐ข๐จ๐ง, just Burp, browser, and human intuition.
- โIf youโre not first, youโre lastโ : Speed matters in live hacking events.
- Community collaboration is a force multiplier
- Worked as a pentester, saved up for a year expenses before jumping full-time into bug bounties.
๐๐ถ๐ด๐ด๐ฒ๐๐ ๐ฎ๐ฑ๐๐ถ๐ฐ๐ฒ:
โFind someone who complements your skill set; it will amplify your growth.โ
Episode drops soon on HackingSimplified YT Channel. Link in the tweet below.
#BugBounty #hackingsimplified
Avi retweeted
Hello all, I was laid off by #amazon and looking for a new position. I'd like to transition to vCISO or security lead work, help an org establish or extend the #Security or #BugBounty program, or architect systems to better secure business processes.
Https://linkedin.com/in/brakโฆ
Avi retweeted
Been a while since I wrote a blog post, so here is a funny one about how I was able to leak more than 5M user PII data using a really simple trick :) Enjoy!
hacktus.tech/how-a-fixed-idoโฆ
#BugBounty