SSRF Isn’t Always Hidden in Parameters (Case 1 — Leading Slash) ====> GET /SSRF-server HTTP/1.1 Host: app (Case 2 — Without the Leading Slash) ====> GET SSRF-server HTTP/1.1 Host: app At first glance, the difference is just one character: /. When your done from subdomain enum, use this tip over intruder Happy hunting bros ❤️ #BugBounty #SSRF #WebSecurity #CyberSecurity #Pentesting #BugBountyTips

All my friends in India Positive Hack Talks soon in Goa By @PTsecurity_EN / @ptsecurity For all who interested in cybersecurity talks , amazing talks Totally completely free Now you can apply , if you have a nice talk you can apply as well All from here phtalks.pt.community/goa?fbc… Or you can chat directly to @amoshkov #Cybersecurity #bugbounty #infosec #goa

My First Article, if you like it retweet ♥, ill do more ♥

A Google API key is not always just a Low or Informational finding. The Story of Submitting some P1s in the last months by the same method Sometimes the real impact is in what you can do with it. For example, with Firebase / Google Identity Toolkit, a leaked key may allow account creation directly through the API: curl -sk -X POST \ "identitytoolkit.googleapis.c…" \ -H "Content-Type: application/json" \ -d '{"email":"[email protected]","password":"Test12345!","returnSecureToken":true}' Now imagine the application trusts users based on the email domain and does not properly verify ownership. In that case, you may be able to create an account using an organization email, receive a valid auth token, and access parts of the application that were supposed to be limited to internal users. At that point, this is no longer about an "exposed Google API key". The impact can become unauthorized registration, authentication bypass, internal access, sensitive data exposure, or even full access to the application depending on how the backend handles authorization. So before marking a Google API key as Low, always check what the key actually allows you to do. The key itself may be Low. The impact behind it may not be. #bugbountytips #bugbountytip #infosec #Bugbounty