In one of my recent pentest, I was able to hack their zimbra webserver which is used to handle their emails. Once logged in, I was able to read all their private emails, get organization details and lot of other sensitive data!



Here's how i did that:

1. Their main application was created on angular. So by reading the source code, I identified some internal api endpoints.

2. Upon sending the request to these api endpoints, I was able to grab the credentials for webserver.

3. Enumerated all subdomains to find their mailing server and tested the creds

4. Got access to the portal!!!! (Sample picture attached for reference)



Tip: Always keep a close look at the source code, You might find something juicy there😉

See you all tomorrow!

See you all in about 30 mins!

Join with this link: https://lab.securzy.io/c/securzy-events/bug-bounty-all-about-ssrf

Hi everyone, I hope you enjoyed the session! Once again, Thank you so much for the love and support💪

Regarding recording, Unfortunately, I don't think you will be able to get it unless you are a pro member on Securzy

We have already posted about it to aware you all that you may not get the recording for free. However, Given the love and support by you all, We will definitely plan to launch another session soon in the near future!

Hi Everyone! Apologies for the delays in video uploads. I am actually at my hometown and been really busy because of some personal reason. But finally got some time to work on a new video and trust me, You will definitely like it!!! It will be very useful when you are hacking modern apps developed in node, python etc

Keep learning & Keep Hacking!

Releasing soon!!!

How Dependency Confusion Exposed Millions: The Hack Every Developer Should Know











Ever heard of Dependency Confusion? It’s a clever way attackers can exploit package managers to infiltrate systems—and it’s a serious threat to software supply chains.

In my latest video, I break it all down: what it is, how it works, and how you can protect yourself. There’s even a live demo to make it super easy to follow.

If you’re into bug bounty hunting, ethical hacking, or just want to level up your security knowledge, this one’s for you.

Check it out and let me know what you think!


Video Link: https://www.youtube.com/watch?v=7ZcRNvmRz6E

Thinking on creating some videos on iOS Pentesting. Let me know what you all think

Hi everyone! Hope you all are having a great day! For the past two days, I have been creating a challenge based on my recent findings in a web app pentest which was highly secured. The video of it will be releasing soon on our official channel. However, For anyone who is going to solve the challenge, their name will be mention on our new video

Target: http://portal.bepractical.tech
Credential:
username: local
password: bepractical

Hint: We already have two videos on this topic already..maybe you can use it for reference😉

You can send us the report at: business@bepractical.tech

Last date to submit the report: 13th December 2024

Also, Please use http instead of https

Just wanted to let you all know that stored xss is now a known issue. Your goal is to find other vulnerabilities on the application

Let me rephrase the challenge for you all: Can you create more than 3 dashboard using your local account?

Website: http://portal.bepractical.tech
Username: local
Password: bepractical

Just finished shooting & editing of our next video! It will be releasing at 6pm IST today! Hope you all like it❤️

Hi everyone, hope you all are doing well. I wanted to share something intriguing that I recently uncovered. There’s a vulnerability lurking in applications that most people completely overlook. It’s subtle, sneaky, and has the potential to cause significant damage if exploited—but hardly anyone talks about it.

Check out the video and let me know—have you ever encountered something like this? I’d love to hear your thoughts.
Video Link: https://www.youtube.com/watch?v=p7XxFeqNDko



#cybersecurity #bugbounty #bugbountytips #ethicalhacking #informationsecurity #privacy #security

Hi everyone, Thank you so much for showing your support on this latest video.. By far it is ranked at number 1 video in terms of views & engagement

I worked 7 days on this video creating lab, video editing etc and I couldn't express my happiness seeing that all the work paid off! Once again, Thank you for your support💪

Keep hacking, Keep learning and we will meet in another video with something more interesting

-Faiyaz

Hi everyone, Just given a recent talk on "Consequences of insecure coding practice" at Google's dev fest organised in Patna, Bihar, India

And now with this, My journey of 2k24 has reached to a nice ending! 😇