Iliya Valaei

[Iliya Valaei @0xbleetz]

5/5

But I still think the most important part is steering them, deciding which paths to explore, providing them with the external capabilities they need, checking their results, and feeding that back into the next step.

[Iliya Valaei @0xbleetz]

1/5

Had to take a break from bug bounty about 10 months ago because of some things going on in my life. Over the past month, I’ve been trying to get back into hunting.

[Iliya Valaei @0xbleetz]

4/5

These are some of the findings from the past month. Ngl, AI agents handled around 90% of the process, from discovery to exploitation.

[Iliya Valaei @0xbleetz]

@alvandyhamed @voorivex دستخوش

[Iliya Valaei @0xbleetz]

@voorivex ❤️❤️❤️

[Iliya Valaei @0xbleetz]

@FarzadSec @voorivex 🔥🔥🔥🔥

[Iliya Valaei @0xbleetz]

@Muntrive @Hacker0x01 I had a similar case that took me a month, three disclosed reports, and even a research paper just to explain what OAuth and one-click ATO are—only for it to be triaged as Low. Before that, they even insisted I self-close the report to avoid damaging my reputation.

[Iliya Valaei @0xbleetz]

@Kian_mehrr @voorivex 🔥🔥🔥

[Iliya Valaei @0xbleetz]

@Muntrive @voorivex 🎉🎉🎉

[Iliya Valaei @0xbleetz]

@omidxrz 🔥🔥🔥

[Iliya Valaei @0xbleetz]

Result:
payload from attacker origin executes on https://t.co/IX1scAV6ka.
can be used to bypass WAFs more conveniently since there is no malicious payload in the URL.

[Iliya Valaei @0xbleetz]

Found a neat XSS trick chaining two primitives: `javascript:` scheme + `https://t.co/d7nClKB4Q5`

[Iliya Valaei @0xbleetz]

Chaining both:

[Iliya Valaei @0xbleetz]

@h3sam تعریف از خود نباشه...

[Iliya Valaei @0xbleetz]

@debu8er @voorivex 🔥🔥🔥

[Iliya Valaei @0xbleetz]

@Kian_mehrr @DanialXray @voorivex 🔥🔥🔥