Tarun mahour (@sratarun) header
Tarun mahour (@sratarun) profile picture

Tarun mahour

@sratarun

Cyber security researcher and Bug bounty hunter

 India
Joined September 2016
  • Tweets867
  • Following1K
  • Followers2.4K
Tarun mahour retweeted
Feng Xue (@s0what) profile picture
Feng Xue
@s0whatOct 24
POC github.com/Percivalll/php2sh…
GitHub - Percivalll/php2shell-wordpress-rce: php2shell WordPress RCE proof of concept (PHP 8.3.35 /...

GitHub - Percivalll/php2shell-wordpress-rce: php2shell WordPress RCE proof of concept (PHP 8.3.35 /...

php2shell WordPress RCE proof of concept (PHP 8.3.35 / WordPress 7.1.2) - Percivalll/php2shell-wordpress-rce

github.com
Feng Xue (@s0what) profile pictureFeng Xue
@s0whatOct 23
Wordpress universal RCE by Percivalll #PHP2Shell
3
25
2
175
20,754
Run iOS 27 full screen in browser on Web UI no extra apps needed. Control everything all in one place remotely from Chrome, like never before. - github.com/doronz88/pymobile…
Image from Md Ismail Šojal 🕷️ (@0x0SojalSec)
3
46
1
333
25,959
Burp Suite Secret Finder - Burp Suite Extension To Discover Apikeys/Tokens From HTTP Response⚡️ > github.com/m4ll0k/BurpSuite-… #bugbounty #cybersec #bugbountytips
Image from Md Ismail Šojal 🕷️ (@0x0SojalSec)
17
105
373
27,304
Use NextJS? Recon ✨ A quick way to find "all" paths for Next.js websites: DevTools->Console console.log(__BUILD_MANIFEST.sortedPages) javascript​:console.log(__BUILD_MANIFEST.sortedPages.join('\n')); Cred = linkedin.com/in/0xsojalsec?u… #infosec #cybersec #bugbountytips
Image from 👑 OFJAAAH → ofjaaah.com (@ofjaaah)
9
195
1,066
50,169
Nice list of non-latin alphabet payloads by @Yass1nMohamed github.com/yassinmohamed1111…
superxss/README.md at main · yassinmohamed1111/superxss

superxss/README.md at main · yassinmohamed1111/superxss

Just A list Of Some Multilingual XSS Payloads and other weird ones i made - yassinmohamed1111/superxss

github.com
30
126
9,632
الحمد لله♥️ I got my first 2 bounty rewards from Standoff365 (1 public, 1 private). Still got accepted reports pending, including a High severity in the platform itself! Great experience with their professional and respectful teams. 🔗 standoff365.com/en-US/profil… #infosecurity
Image from Mustafa Adam Gamaraldin Abdalla 🇸🇩♥️ (@wadgamaraldeen)
Image from Mustafa Adam Gamaraldin Abdalla 🇸🇩♥️ (@wadgamaraldeen)
Image from Mustafa Adam Gamaraldin Abdalla 🇸🇩♥️ (@wadgamaraldeen)
Image from Mustafa Adam Gamaraldin Abdalla 🇸🇩♥️ (@wadgamaraldeen)
8
6
107
4,857
Tarun mahour retweeted
Anton (@therceman) profile picture
Anton
@therceman2 Jul 2025
Bug Bounty Cheat Sheet File Upload Extension Splitting
Image from Anton (@therceman)
3
81
2
454
30,693
blog.sicuranext.com/breaking… by: @AndreaTheMiddle very nice article
1
8
32
1,327
Replying to @WazirXIndia
@WazirXIndia @NischalShetty Blocking ₹1 crore of users' funds due to a platform hack is unacceptable. We trusted WazirX with our money, and this breach of security is infuriating. Demand immediate action and transparency. When will our funds be released? #
2
1
300
<p oncontentvisibilityautostatechange="alert(/FirefoxOnly/)" style="content-visibility:auto">
3
25
2
138
46,182
Tarun mahour retweeted
Bipin Jitiya (@win3zz) profile picture
Bipin Jitiya@win3zz14 Jan 2024
Authorization Bypass vulnerability in POST SMTP Mailer, a WordPress plugin with over 300,000+ active installations PoC: github.com/UlyssesSaicha/CVE… Blog: wordfence.com/blog/2024/01/t… Security Advisory: nvd.nist.gov/vuln/detail/CVE…
Image from Bipin Jitiya (@win3zz)
3
78
1
321
21,294
Tarun mahour retweeted
pikpikcu (@pikpikcu) profile picture
pikpikcu@pikpikcu29 Jun 2023
After several tries of Bypass Xss payload and it worked. Payloads: "*alert(1)*"
Image from pikpikcu (@pikpikcu)
Image from pikpikcu (@pikpikcu)
6
101
2
438
56,750
Bug-Bounty-Wordlists #bugbounty #bugbountytip #wordlist github.com/YaS5in3/Bug-Bount…
GitHub - YA551N3/Bug-Bounty-Wordlists

GitHub - YA551N3/Bug-Bounty-Wordlists

Contribute to YA551N3/Bug-Bounty-Wordlists development by creating an account on GitHub.

github.com
1
35
1
124
Tarun mahour retweeted
sudi (@sudhanshur705) profile picture
sudi@sudhanshur70521 Mar 2021
I just published How I made it to Google HOF? As always feedbacks are appreciated and I hope you will like it. link.medium.com/uclliOnaOeb
How I made it to Google HOF?

How I made it to Google HOF?

Heyyy Everyoneeee,

link.medium.com
12
75
2
242
Web Application Pentest Checklist by "Chintan Gurjar" @ADITYASHENDE17 @udit_thakkur @manas_hunter @sillydadddy @udit_thakkur @InfoSecComm
Image from Tushar Verma 🇮🇳 (@e11i0t_4lders0n)
12
187
2
400
Tarun mahour retweeted
Amit Dubey (@AmitMDubey) profile picture
Amit Dubey@AmitMDubey2 Sep 2020
CloudFlare XSS - <a/href=j&Tab;a&Tab;v&Tab;asc&NewLine;ri&Tab;pt&colon;&lpar;a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;(1)&rpar;> #xss
52
1
119
Tarun mahour retweeted
Kathan Patel (@KathanP19) profile picture
Kathan Patel@KathanP1931 Aug 2020
I have made a Golang tool to check reflecting params from URLs, useful for Finding XSS. It Similar to kxss by @TomNomNom but few more features. Thank you @z0idsec for Helping me with the code. github.com/KathanP19/Gxss #bugbountytips #bugbountytip #bugbounty
Image from Kathan Patel (@KathanP19)
5
144
2
378
A vector to bypass some WAFs, by @SeguridadBlanca <x/onmouSeenter=window[`\x61\x6c\x65\x72\x74`]`1337`
58
2
139
gf examples for bug bounty hunters:- Download gf:- github.com/tomnomnom/gf . gf secrets :- github.com/dwisiswant0/gf-se… gf patterns:- github.com/1ndianl33t/Gf-Pat… Gf pattern's all in one json file:- github.com/LORDCYBERGOD/Alli…
GitHub - tomnomnom/gf: A wrapper around grep, to help you grep for things

GitHub - tomnomnom/gf: A wrapper around grep, to help you grep for things

A wrapper around grep, to help you grep for things - tomnomnom/gf

github.com
1
80
1
173
Tarun mahour retweeted
HAHWUL (@hahwul) profile picture
HAHWUL
@hahwul19 Aug 2020
⁦by @KathanP19⁩ - JSFScan.sh: Automation for javascript recon in bug bounty. 😎👍 github.com/KathanP19/JSFScan…
1
30
84
Load more