Sign in Subscribe

Inderjeet Singh

How I fuzz and hack APIs?

Hello Hackers, In this post, I will explain how I fuzz APIs for bugs. This blog is more about how to understand your API and then about what tools I use and where to fuzz? 1. Understanding the API 2. Where to fuzz and how to fuzz? Understanding the API?

How I Pwned 10 Admin Panels and got rewarded 8000$+?

Hello Hackers, I am Inderjeet Singh aka encodedguy. Today, I will share one of my recent findings where I pwned 10 admin panels and the team rewarded me with $8000+. Background I was invited to a private HackerOne challenge this month. The total bounty pool for this challenge was $15K.

Exploiting GraphQL Aliases

Introduction GraphQL is an API query language that allows developers to write clean code, and get as much data as they want from a single query. GraphQL uses a single endpoint like /graphql or /api/graphql and HTTP method can be POST or GET. It have queries to read data

Reverse Whois - Increase Attack Surface Area

* Introduction to Whois * Whois Flow * What is Reverse Whois? * Reverse Whois Flow * Tools * 100 domains or 84615 domains? Introduction to Whois Whois, is used to query domain names, IP addresses, and ASN (autonomous system numbers or IP blocks) for their registered information. In simpler terms, if a user owns a

My Favourite 10 Shodan Dorks

If you don't know what is Shodan, I would say just go to shodan.io first. It is one of the best search engines for hackers.

Hacker's Guide to Directory/Endpoint Enumeration

Directory enumeration is when the hacker tries to find more public or hidden/private directories. The root directory of a web server starts from /var/www/<site>. https://rashahacks.com is hosted at /var/www/rashahacks.com

Privacy Violation In Chat System

Introduction/ Background Here’s the write-up for the report I wrote 3 months ago on a Private Program on Hackerone. The bug was present in the chat system where the app is keeping the personal data of the users even after deletion. Privacy Violation Privacy Violation means wrongful disclosure,

Change Any User Profile Details On Disney

The Walt Disney Company started its program on Hackerone in March 2022. Last week, I reported 3 highs and 1 critical on their program. This is the story of an IDOR report due to improper authorization. Authentication and Authorization Authentication: When a user logs into a site or app, this

Ethical Hacking Roadmap and Resources

Hi, I am Inderjeet Singh. A bug bounty hunter, ethical hacker, penetration tester, and also a cybersecurity investigator privately. I have 2 years of experience now, and with this article, I will share a pathway that anyone can follow to get into the subspace of ethical hacking. The RoadMap 1.