winli

Bug Hunter, CTF player, Cyber Enthusiasts.

[PHYR3WALL 🇺🇲 @phyr3wall]

I've been building my AI-powered offensive security harness for the past few weeks. It's successfully solved every active HTB box (minus the insane machines). To help others learn and build alongside me, I'm giving away your choice of a 1-Month Claude Pro subscription or 1-Month HTB VIP+.
Follow -> Like -> Retweet to enter

[winli @0xBug07]

@ChiRai_rai @BugBountyDEFCON @PentesterLab @hackthebox_eu @secsystemd @censoredHacker @t0mvic @King0Root Thanks @ChiRai_rai, got the DM

[Bug Bounty Village @BugBountyDEFCON]

The winners of our latest @PentesterLab & @hackthebox_eu giveaway are in!

3 months Pentester Lab licenses:

@secsystemd
@0xBug07
@censoredHacker
@t0mvic
@King0Root

1 Year VIP HackTheBox
@ChiRai_rai

Congrats to the winners! If you didn't win, don't be too sad, there's more to come so stay tuned for more epic giveaways! 🎉

[winli @0xBug07]

@BugBountyDEFCON @PentesterLab @hackthebox_eu @secsystemd @censoredHacker @t0mvic @King0Root @ChiRai_rai Thanks @BugBountyDEFCON

[winli @0xBug07]

@BugBountyDEFCON @hackthebox_eu @PentesterLab I wanted to learn code review and PentesterLab has a very good resource on that and for trending AI red teaming also HTBs learning path which covers fundamentals of AI red team. Let's see, Luck matters or Hard work is the only key in infosec.

[Bug Bounty Village @BugBountyDEFCON]

Time for another giveaway!

We will pick 6 winners to win one of the following:

1x Annual VIP @hackthebox_eu Licence
5x @PentesterLab 3 Month Licences

To enter:
1️⃣ Follow us @BugBountyDefcon
2️⃣ Like this post ❤️
3️⃣ Re-tweet this post 🔁

Giveaway open until Monday June 15th! GOOD LUCK!

[1024 Cyber Services @1024Cyber]

When a single ID fails, a pair might pass. IDOR bypasses can be that simple 🔥

- Victim's ID: 5200
- Attacker's ID: 5233

GET /api/users/5200/info → Access Denied ❌
GET /api/users/5200,5233/info → Bypassed ✅

#bugbountytips #PenetrationTesting

[Darshan Naik @darshanhackz]

Thick Client Pentest Article is up

Go and checkout :

https://t.co/VMSyFOA6Y9

[winli @0xBug07]

@TheSecOpsGroup Agentic AI

[The SecOps Group @TheSecOpsGroup]

📈 𝗧𝗵𝗲 𝗡𝗲𝘅𝘁 𝗘𝘃𝗼𝗹𝘂𝘁𝗶𝗼𝗻 𝗼𝗳 𝗔𝗜 𝗣𝗲𝗻𝘁𝗲𝘀𝘁𝗶𝗻𝗴 𝗶𝘀 𝗛𝗲𝗿𝗲 👉 𝗖𝗲𝗿𝘁𝗶𝗳𝗶𝗲𝗱 𝗔𝗴𝗲𝗻𝘁𝗶𝗰 𝗔𝗜 𝗣𝗲𝗻𝘁𝗲𝘀𝘁𝗲𝗿!

𝗚𝗜𝗩𝗘𝗔𝗪𝗔𝗬 𝗔𝗟𝗘𝗥𝗧 🎁 𝙒𝙚’𝙧𝙚 𝙜𝙞𝙫𝙞𝙣𝙜 𝙖𝙬𝙖𝙮 𝟯 𝙁𝙍𝙀𝙀 𝘾-𝘼𝙜𝘼𝙄𝙋𝙚𝙣 𝙚𝙭𝙖𝙢 𝙫𝙤𝙪𝙘𝙝𝙚𝙧𝙨 🎉 𝙏𝙤 𝙥𝙖𝙧𝙩𝙞𝙘𝙞𝙥𝙖𝙩𝙚:
👍 𝙇𝙞𝙠𝙚 𝙩𝙝𝙞𝙨 𝙥𝙤𝙨𝙩
🗨️ 𝘾𝙤𝙢𝙢𝙚𝙣𝙩 “𝘼𝙂𝙀𝙉𝙏𝙄𝘾 𝘼𝙄”
♻️ 𝙎𝙝𝙖𝙧𝙚 𝙩𝙝𝙞𝙨 𝙥𝙤𝙨𝙩

🔽 𝗔𝗯𝗼𝘂𝘁 𝗲𝘅𝗮𝗺:
The 𝗖𝗲𝗿𝘁𝗶𝗳𝗶𝗲𝗱 𝗔𝗴𝗲𝗻𝘁𝗶𝗰 𝗔𝗜 𝗣𝗲𝗻𝘁𝗲𝘀𝘁𝗲𝗿 (𝗖-𝗔𝗴𝗔𝗜𝗣𝗲𝗻) is a hands-on certification focused on testing candidate’s understanding of the fundamental concepts related to Agentic AI and GenAI application security.

💸 𝗨𝗻𝗹𝗼𝗰𝗸 𝘆𝗼𝘂𝗿 𝗮𝘁𝘁𝗲𝗺𝗽𝘁 𝘄𝗶𝘁𝗵 𝟴𝟬% 𝗱𝗶𝘀𝗰𝗼𝘂𝗻𝘁 𝗰𝗼𝗱𝗲: AGENTIC-80

🔁 𝗛𝗼𝘄 𝘁𝗵𝗲 𝗘𝘅𝗮𝗺 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲𝘀 𝗬𝗼𝘂 (𝗔𝘁𝘁𝗮𝗰𝗸 𝗙𝗹𝗼𝘄) 🔁
Identify AI Agent Behavior → Analyze Decision-Making → Interact with Tools → Discover Vulnerabilities → Exploit Weak Points → Perform Multi-Step Attacks → Goal Manipulation → Tool Abuse → Prompt Injection

👀🎥 𝙒𝙖𝙩𝙘𝙝 𝙩𝙝𝙚 𝙗𝙚𝙡𝙤𝙬 𝙫𝙞𝙙𝙚𝙤 𝙛𝙤𝙧 𝙢𝙤𝙧𝙚 𝙞𝙣𝙛𝙤𝙧𝙢𝙖𝙩𝙞𝙤𝙣
Grab the opportunity today:
https://t.co/htt02sZvVI

#CyberSecurity #AgenticAI #AISecurity #Pentesting #RedTeam #Infosec #AppSec #EthicalHacking #CyberDefense #AI #SecurityTesting #CyberAwareness

[HackingHub @hackinghub_io]

Can you read the configuration? How?👇

[pwn.ai @pwn_ai]

🚨 ZERODAY: ImageMagick 🚨

Our autonomous pentester https://t.co/zHUcIkHqvr just dropped multiple zeroday chains in ImageMagick that achieve RCE and File Leak from a single .jpg or .pdf file, bypassing EVERY security policy (Default, Limited, AND Secure). 🤯

💥 Affects Ubuntu, Debian, WordPress & millions of servers globally. Happy Monday and Happy Hunting! 🥰

https://t.co/nNAvFAvPOx

[winli @0xBug07]

@Ky0toFu @yeswehack Please post a write-up of this

[Suyash Sharma @SuyashS91823422]

I earned $xxxx for my submission on @bugcrowd https://t.co/8GBItcviHD
#ItTakesACrowd
Bug Type- 2x Reflected XSS
Tip: use DuckDuckGo dorks as same as google dorks , you will get new endpoints

[obscaries ❘ AppSec @obscaries]

“Stop relying on Google alone — real recon starts where search engines get uncomfortable.”👇💀

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

Here are 50 essential bug bounty techniques for your 2026 methodology:

Subdomain Takeover (CNAME Verification)

BOLA / IDOR (Broken Object Level Authorization)

BFLA (Broken Function Level Authorization)

JWT Algorithm Confusion (RS256 to HS256)

JWT None Algorithm Bypass

HTTP Request Smuggling (CL.TE / https://t.co/bZhb51d6DG)

Blind SSRF via DNS OOB (Out-of-Band)

Cloud Metadata Exfiltration (169.254.169.254)

Prompt Injection (LLM/AI Chatbots)

RAG Data Leakage (AI Vector DBs)

Race Conditions (Turbo Intruder)

Mass Assignment (Hidden JSON Parameters)

Prototype Pollution (Client & Server Side)

GraphQL Introspection Querying

GraphQL Batching Attacks

SSTI (Server-Side Template Injection)

Second-Order SQL Injection

Blind XSS in Admin Panels

Web Cache Poisoning (Unkeyed Headers)

Favicon Hash Asset Discovery

JS Source Map Reconstruction

Google Dorking for Sensitive Docs

GitHub Secret Scanning (.env / .git)

S3 Bucket Misconfiguration (Public Write/Read)

Firebase Database Rule Enumeration

OAuth Redirect URI Manipulation

Cross-Site Leakage (XS-Leaks)

CORS Misconfiguration (Origin Reflection)

PostMessage Data Theft

CSP Bypass via JSONP Endpoints

Insecure Deserialization (Object Injection)

XML External Entity (XXE) Injection

Local File Inclusion (LFI) via Wrappers

Command Injection via Metadata (ExifTool)

Dependency Confusion (NPM/PyPI)

Open Redirects (SSRF Entry Points)

Password Reset Token Leakage (Referer Header)

MFA Workflow Bypass (Response Manipulation)

OTP Brute-forcing (No Rate Limit)

Parameter Pollution (HPP)

Price Manipulation (Negative Quantities)

Coupon Code Brute-forcing

Virtual Host Fuzzing (VHost Discovery)

Wayback Machine URL Mining

Exposed Docker/K8s API Endpoints

Email Change Account Takeover (ATO)

Verbose Error Page Info Leakage

Dangling Markup Injection

Remote Code Execution (RCE) via File Upload

IDN Homograph Attacks

#BugBounty #BugBountyTips #Infosec #CyberSecurity #Hacking #EthicalHacking #RedTeaming #WebSecurity #Pentesting #Programming #AI #LLM

[Secfortress @Secfortress]

https://t.co/PPnnpaEXwb

Got blocked by cloudflare while using burp proxy, this subreddit helped!!

[HackingHub @hackinghub_io]

Keep your eyes peeled on these endpoints. 👀

/login ➡️ authentication bugs
/reset-password ➡️ATO
/upload ➡️ RCE
/api/v1/user/1001 ➡️ BOLA
/search?q=query ➡️ Injection bugs
/view?file= ➡️ SSRF
/admin ➡️ internal access

Which endpoint have you found the most bugs on? 👇

[NullSecurityX @NullSecurityX]

CVE-2026-20841 - Windows notepad.exe RCE

#BugBounty #CyberSecurity