Instagram story viewer> @viral_codes> Posts

Viral Codes | Cyber Security | Tech | Coding boy |

@viral_codes

91.6K

followers

413

following

I find vulnerabilities before attackers do
Red Team | Exploits | Secure Coding
Learn hacking the right way

POSTS STORIES REELS TAGGED

Download All

We found critical security vulnerabilities in 𝗜𝗻𝗱𝗶𝗮’𝘀 𝗜𝗻𝗰𝗼𝗺𝗲 𝗧𝗮𝘅 𝗽𝗼𝗿𝘁𝗮𝗹,𝗔𝗽𝗼𝗹𝗹𝗼 𝗛𝗼𝘀𝗽𝗶𝘁𝗮𝗹𝘀, 𝗨𝗠𝗔𝗡𝗚 also affecting 𝗘𝗣𝗙𝗢 𝘀𝗲𝗿𝘃𝗶𝗰𝗲𝘀 with some of the issues having the potential to expose highly sensitive financial and personal information belonging to 𝗺𝗶𝗹𝗹𝗶𝗼𝗻𝘀 𝗼𝗳 𝘂𝘀𝗲𝗿𝘀.

What started with curiosity and trying to understand how these systems worked eventually led to some of the most impactful security research I’ve worked on.

Along with Akshay I had the opportunity to responsibly report these vulnerabilities and work with the respective organizations toward getting them fixed.

The research also received coverage from TechCrunch, The Hindu, BOOM, 𝗮𝗻𝗱 𝘀𝗲𝘃𝗲𝗿𝗮𝗹 𝗼𝘁𝗵𝗲𝗿 𝗺𝗲𝗱𝗶𝗮 𝗼𝘂𝘁𝗹𝗲𝘁𝘀, which was genuinely exciting to see, especially knowing that the work reached a much wider audience.

A lot of learning, late nights, and plenty of trial and error went into these discoveries. Grateful for the experience.

Still learning. Still breaking things. 🇮🇳🔐

Special thanks to Aroon Deep Hera Rizwan Jagmeet Singh

#CyberSecurity #SecurityResearch #EthicalHacking #BugBounty #ResponsibleDisclosure Infosec India taken in Bengaluru,Karnataka by @viral_codes

43

0

a month ago

𝗜 𝗪𝗮𝘀 𝗙𝗶𝗹𝗶𝗻𝗴 𝗠𝘆 𝗧𝗮𝘅𝗲𝘀 𝗪𝗵𝗲𝗻 𝗪𝗲 𝗙𝗼𝘂𝗻𝗱 𝗮 𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗕𝘂𝗴 𝗶𝗻 𝗜𝗻𝗱𝗶𝗮’𝘀 𝗜𝗻𝗰𝗼𝗺𝗲 𝗧𝗮𝘅 𝗣𝗼𝗿𝘁𝗮𝗹 🇮🇳

I was filing my income tax return for the first time when I noticed a PAN number being sent in one of the requests.

As usual, I had Burp Suite running in the background. I changed the PAN to a friend's PAN and sent the request again.

And yeah, it worked. I got his data.

That simple test turned into a much bigger investigation. Akshay and I found an 𝗜𝗗𝗢𝗥 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗶𝗻 𝗜𝗻𝗱𝗶𝗮’𝘀 𝗜𝗻𝗰𝗼𝗺𝗲 𝗧𝗮𝘅 𝗲-𝗙𝗶𝗹𝗶𝗻𝗴 𝗣𝗼𝗿𝘁𝗮𝗹 that could potentially expose highly sensitive taxpayer information.

The portal had 𝟭𝟯𝟱𝗠+ 𝗿𝗲𝗴𝗶𝘀𝘁𝗲𝗿𝗲𝗱 𝘂𝘀𝗲𝗿𝘀, so what initially looked like a simple bug had a pretty serious potential impact.

We reported the issue, worked through the disclosure process, and later confirmed that it had been fixed.

I wrote about how we found it and what happened next.

Full story 👇( link in the story)
https://vaghelaviral.medium.com/how-we-found-a-critical-bug-in-indias-income-tax-portal-that-put-135m-users-sensitive-data-at-6fda13f5a2bd

#CyberSecurity #BugBounty #WebSecurity #IDOR #ResponsibleDisclosure by @viral_codes

22

0

a month ago

🧠 What is AI Jailbreaking?

It’s the process of tricking an AI model into:

bypassing safety rules
leaking restricted info
generating harmful or unauthorized outputs

Sometimes with nothing more than clever prompts. by @viral_codes

11

0

5 months ago

Most people connecting AI tools right now
have no idea what MCP is doing under the hood.

And that’s exactly the problem.

You’re giving AI:

access to APIs
access to databases
access to internal tools

…without thinking like an attacker. by @viral_codes

14

0

5 months ago

Never make these mistakes while working with JWT by @viral_codes

7

1

5 months ago

Most devs think SQL Injection is “basic”
→ That’s exactly why it still works.

Attackers don’t need zero-days.
They need lazy input handling.

If your app builds queries like this:

"SELECT * FROM users WHERE username = '" + input + "'

You already lost.

💀 One payload = full database exposure taken in Banglore karanataka by @viral_codes

13

1

5 months ago

Day job: breaking things. Night job: building them

#CyberSecurity #RedTeam #opensource #programminglife #softwareengineering by @viral_codes

18

0

a year ago

While knowing your IP address isn't a magic key for hackers, understanding the risks and taking precautions is crucial for online safety. by @viral_codes

30

0

a year ago

Java is dead? Nah… kinda immortal. ☕🔥

✅ Why people still love Java
👉 Massive community, StackOverflow is basically your group chat
👉 Write once, run anywhere, the universal party guest
👉 Strong typing, catches your 3AM mistakes
👉 Enterprise flex, looks good on LinkedIn
👉 Scales everywhere, from tiny gadgets to big banks

❌ Why people roast Java
👉 Too wordy, even “Hello World” feels like an essay
👉 Startup time, grab coffee it’s still loading
👉 Eats RAM, like that roommate who never buys groceries
👉 Not “cool” with startups, feels overdressed at a rave
👉 Endless updates, each release is a new accent of the same language

#Java #ProgrammingHumor #CodeLife #Developers #SoftwareEngineering #TechCommunity #CodingMeme #BackendDev #TechHumor #100DaysOfCode #ProgrammerLife #TechJokes #CodingLife #FullStackDeveloper taken in Bengaluru,Karnataka by @viral_codes

101

1

a year ago

If an attacker write any malicious comment in the codebas such as create a tasks.json file which is being used in vscode and then ask ai to build the task, it will execute any remote command provided in the json file

#AIsecurity #PromptInjection #RedTeam by @viral_codes

38

0

a year ago

📌 Prompt Injection is the “phishing” of AI.
It’s not about hacking code, it’s about hacking trust.

💬 Have you tried breaking an AI before? Drop your wildest prompt below 👇

#PromptInjection #AIHacking #CyberSecurity #RedTeam #JailbreakAI #EthicalHacking #AIsecurity #Pentesting #PromptEngineering by @viral_codes

26

0

a year ago

Cyber threats are evolving fast, phishing emails look real, deepfakes are everywhere, and malware is smarter than ever. Protect yourself and your business. Stay vigilant, update your defenses, and don’t take the bait. by @viral_codes

10

1

a year ago