bebiks (@bebiksior) / X

bebiks

674 posts

bebiks

@bebiksior

breaking stuff and building hacker tooling @CaidoIO

Żywiec, Poland

Joined December 2020

Pinned
bebiks
@bebiksior
Dec 1, 2025
Releasing the first beta version of HTTPWorkbench 🚀 It's a full rewrite of ssrf[.]cvssadvisor[.]com, which was originally built for SSRF testing, but I ended up using it way more for quick PoC pages hosting and testing stuff The new version is built around that: PoC builder,
4.9K
bebiks
@bebiksior
Nov 28, 2023
First ever SQL injection rewarded :-D
90K
bebiks
@bebiksior
Nov 12, 2023
I'm excited to announce the release of my SSRF Utility tool (still open to name ideas, DM me :)). It's for bug hunters to discover and exploit SSRF vulns. Inspect incoming HTTP requests with full control over HTTP response. ssrf.cvssadvisor.com #bugbounty
54K
bebiks
@bebiksior
May 16, 2024
Yay, I was awarded a $18,000 bounty on @Hacker0x01! hackerone.com/bebiks #TogetherWeHitHarder
hackerone.com
HackerOne profile - bebiks
- https://x.com/bebiksior
13K
bebiks
@bebiksior
Nov 28, 2023
Replying to @bebiksior
While digging into a web app, I spotted a request with `&sort=DESC` in my proxy. It raised a flag since SQL can sort using `ORDER BY DESC`. Threw in a simple ', and the server threw a 500 Internal Server Error. Went deeper, and tried `DESC LIMIT 1 --` and got a single result.
15K
bebiks
@bebiksior
Nov 19, 2023
Exactly one year ago, I stumbled upon bug bounties for the first time and got @NahamSec udemy course. Within a week, I discovered my first ever valid XSS bug. Now, one year later, I've crossed 1k reputation points. Very grateful for many great writeups - learned a lot from them.
19K
bebiks
@bebiksior
Apr 29, 2024
CaidoReflector v1.0 is out! :D github.com/bebiksior/Caid… Automatically look for paramater reflections in the HTTP response. Currently it supports GET and POST requests with query string body (json is not supported yet).
13K
bebiks
@bebiksior
Oct 23, 2023
Yay, I was awarded a $2,500 bounty on @Hacker0x01! hackerone.com/bebiks #TogetherWeHitHarder
hackerone.com
HackerOne profile - bebiks
- https://x.com/bebiksior
6.2K
bebiks
@bebiksior
Apr 9, 2024
🤯
9K
bebiks
@bebiksior
Dec 2, 2023
First ssrf.cvssadvisor.com changes :D - Instances are now hosted on the c5.rs domain. (ID.ssrf.cvssadvisor.com still works without DNS callbacks) - Shortened Instance IDs to 8 characters. - DNS callbacks are now shown in the requests tab. - You can now
17K
bebiks
@bebiksior
Mar 23, 2024
EvenBetter v2.1 is out!! github.com/bebiksior/Even… Changelog: - Quick SSRF: Quickly create new SSRF testing instance and view interactions on the new sidebar page. Now supports `ssrf.cvssadvisor.com` and `interactsh.com` - Quick Decode Enhancement: You can now edit
GIF
GIF
16K
bebiks
@bebiksior
Oct 3, 2023
The first bug in October got triaged & rewarded. It's on a public program on H1, will try to disclose it :-)
9.2K
bebiks
@bebiksior
May 16, 2024
Replying to @bebiksior and @Hacker0x01
just a reminder: it's important to remember that there are times when things slow down. The first few months of 2024 were super tough for me in terms of bug bounties, I was super unmotivated and was feeling pretty rough. It's all part of the game, so staying persistent is key :D
3.5K
bebiks
@bebiksior
Sep 28, 2023
I earned $4,000 for my submission on @bugcrowd bugcrowd.com/bebiks #ItTakesACrowd Stored XSS :)
3.2K