Currently working on Lups AI | Founding Engineer | Founded: @Carnagebot @MinterSuite
Dubái, Emiratos Árabes Unidos
Joined July 2015
- Tweets591
- Following254
- Followers992
- Likes313
Recently I've been working with marketing agencies and automating their internal processes.
I was able to help reduce churn for a successful marketing agency and gave them better business insights.
You can read more about it here:
alexvec.github.io/posts/redu…
Alex retweeted
Honestly what a time. And it's crazy to me that reselling is still profitable to this day... Still remember the days when we were using open source PHP scripts to generate Adidas ATC links...
This scene has taught me more than any master degree or corporate job possibly could. We were building and iterating faster than the engineering teams of the brands we were botting and the companies responsible for their infrastructure - at a fraction of the team size.
Nothing will beat the rush of deploying a last minute update to thousands of users or being the only bot hitting a drop.
The sheer amount of ingenuity required from devs of this community to find ways to beat the competition and get the slightest edge was just crazy and led to some insane finds from bypasses to undocumented APIs to admin tokens... the list goes on.
And to see some great talent go on to build even greater things is just amazing. I'm not surprised in the slightest way.
Alex retweeted
Easy $400K+ success by Minter Suite with Zereborn
We cleared 20% + of this drop ALONE 💎
Like & RT for a free 1 SOL giveaway. Ends in 24 hours ⏰
Highly recommended for beginners and experienced hunters! This podcast is a gem 💎
It's official, my team, trick or hack me, has placed between the first top 8 teams in the HackerCup 2023 by @Bugcrowd !
With 40 teams participating, this is a huge achievement and I'm stoked to give the best I can in this Round 2 🥳
#bugbounty
November has been my best month in Bug Bounty hunting. $4200+ in rewards and many lessons!
I changed my strategy to two key points:
- Collaborating really helps
- Stick to ONE or TWO programs and go deep on them.
Read more about it here: alexvec.github.io/posts/nove…
#bugbountytip
Hackean la web de CCOO con write-up incluido.
El nivel de seguridad es de una HackTheBox easy, les faltó incluir la flag de root.txt y se llevan el premio 😂
El atacante de la web de @CCOO, aka 'farlopa'...ha publicado una guia con los pasos que realizó para aprovechar las vulnerabilidades en el diseño e implementación de su web....
Veremos que pasa con los datos de los afiliados..
farlopa.noblogs.org/mariscad…
#defaced #cibercrimen #hackeo
I earned $1,300 for my submission on @bugcrowd bugcrowd.com/alexvec #ItTakesACrowd
IDOR -> High /P2 impact bounty
Yet another record as single bounty payment! 🐞
#BugBounty
My first High/P2 vulnerability found!
After some days receiving over 10+ dupes on P3s and some other P3s being assesed, I finally found a high impact vulnerability on a target.
s/o @Bugcrowd triaging team for being so smooth.
#bugbounty #CyberSecurity
Alex retweeted
Ok fam. I’m giving away TWO free tickets to my course which takes place in two/three weeks.
All you have to do to win is like, retweet this tweet, and reply with “tbhmlive.com!”
I’ll pick winners next week!
If you haven’t seen my course, check out the link!
Alex retweeted
thanks! i use my own tool for JS monitoring :-)
check out @alex_vec blog post about monitoring JS files alexvec.github.io/posts/moni…
I earned $50 for my submission on @bugcrowd bugcrowd.com/alexvec #ItTakesACrowd
First time searching for bugs in BugCrowd!
#bugbounty #cybersecurity #appsec
Monitoring JS files for Bug Hunting! 🐞
Today I want to share an interesting method of finding potential bugs, leaked secrets or sensitive information from websites, by monitoring its client-side JavaScript files.
alexvec.github.io/posts/moni…
#BugBounty #pentesting #appsec
Passing the Offensive Security Certified Professional (OSCP) with 110/100 points, here's how I did it!
I wrote a detailed post on my blog explaining my journey through the OSCP!
alexvec.github.io/posts/perf…
Alex retweeted
Answering my web #AppSec interview question from the other day!
Question 55: What is formula injection and how might it be exploited?
Formula injection, also known as "CSV Injection" occurs when an attacker can insert Excel-like formula (e.g. =1+1) into an application's CSV export functionality. Since most CSV files are opened in an Excel-like program, the formula will execute instead of displaying the raw data.
This can be exploited by including a malicious formula which executes OS commands, for example the following which opens notepad.exe:
=cmd|'/C notepad'!A1
Other exploits can include data exfiltration via clickable links or DNS lookups.
Formula injection is a relatively controversial vulnerability, since the actual exploitation takes place entirely on the victim's computer, and not within their browser (like XSS). In addition, multiple warning popups generally appear when a user opens a document containing executable payloads, and the user must "willingly" enable their functionality.
#InfoSec #Cybersecurity #BugBounty #Hacking