MadMaxx

Keep calm and hack the planet.! Cybersecurity Analyst. Spread love, not malware.

[Vishal Vishwakarma @rootxvishal]

Day 30 / 30 — HUNTERS WORTH FOLLOWING

If you want to think like a pro, surround yourself with them.

→ @NahamSec — methodology + live recon
→ @Jhaddix — author of The Bug Hunter's Methodology
→ @stokfredrik — high-energy hunter (STÖK)
→ @InsiderPhD — beginner-friendly + API hacking
→ @rez0__ — researcher + AI security
→ @hakluke — tool creator + recon king
→ @TomNomNom — author of half the tools we use
→ @PortSwigger — research team behind Burp
→ @intigriti — platform + CTFs
→ @Bugcrowd — platform + content
→ @d0nutptr — top hunter, smart writeups
→ @_zer0pwn — quiet, lethal

If this series helped repost the day that hit hardest. See you next series. 🎯

#bugbountytips #infosec #bugbounty #infosec

[Nick Mykhailyshyn 🇺🇦 @whoareme33]

I earned a $22,500 bounty from Airbnb using a custom Opus 4.7 workflow built with MCP and Skills.

It feels like bug bounty hunting has changed forever

[Xavier Rivera @XavierRiveraX]

Google Chrome is rolling out device-bound session credentials to all users. Session cookies get cryptographically tied to your device, so stolen cookies can't be replayed from a different machine. Attackers who exfiltrate your cookie database get nothing usable.

[Coffin @lostsec_]

Finally, the members-only YouTube video article is out. Hope this helps everyone who couldn’t get the membership.
https://t.co/nRXePyRfsl

[Rahmat Qurishi @RahmatQurishi]

all easy bugs , just reading js files, copying endpoints, and throwing them into repeater😅

[Tom Dörr @tom_doerr]

Curated collection of OSINT tools for cybersecurity and research

https://t.co/ScfibjdP6n

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

lof web apps that are built by AI, it have .md and mostly 🔥
so any app you test, JSP / PHP / ASP

Add for fuzzing the extensions
ffuf -w /wordlist -u .com/FUZZ -e .md,.db,.txt,.xml,.sql,.7z,.zip,.tar.gz,.env

it will take some time, but it will be back with very good results♥

[Jayesh Madnani @Jayesh25]

Bug Bounty Tips: Extract API Endpoints and Construct Complex HTTP Requests from JavaScript Files Using AI

Stuck analyzing complex JS files while manually hunting on a target and can't figure out how to construct those GET/POST requests? 🤯 No fancy tools needed!

👉 Quick tip: Copy the JS file from your Chrome Dev Console, save it locally, and upload it to ChatGPT. Use this prompt:

"Could you read this JavaScript file and help me construct GET/POST endpoints?"

Then, ask for specific requests like:

"Can you help me construct the API request for getUserDetails with a raw HTTP example based on the JavaScript file uploaded?" and other similar questions based on the functionality you're looking into within the JavaScript source code.

You’ll be amazed by the results as ChatGPT constructs these complex GET/POST requests with parameters based on the AI code review—making what seemed impossible at first glance possible! 🚀

Once you have this information, you can start manually testing the endpoints with your cookies to test for IDORs, SQLi, CSRF, Privilege Escalations, XSS, etc.

#BugBountyTips #SourceCode #Infosec #HackerOne #BugCrowd 🕵️‍♂️🎯

[chux @chux13786509]

🚨 Hackers, this series is for you - Lethal SSRF 🚨
Coming with a short series of advanced SSRF exploitation ⚡️
The first part is now available on Injected 💉
Happy Hacking 🔥
https://t.co/CQmfFHlr0u

[Mehul Panchal @CyberMehul]

SSTI Tip: "IDENTIFY"

[chux @chux13786509]

Nice 🔥
Gotta say that the WordPress vulnerability CVE-2025-3616 just brought me some great findings just by searching at Fofa:
body="/wp-content/plugins/greenshift-animation-and-page-builder-blocks/" && asn="YourTarget"

[Oluwatobi Mustapha @Tobi_Msp]

IP address in 6 minutes.

[MadMaxx @0xCCFFF]

@elonmusk So you guys still call it Twitter?

[MadMaxx @0xCCFFF]

Prefer not to login with Facebook on other services. If you lose your facebook account, you'll loose your other services too. It's pretty hard to get it back. A reminder to have separate username and password for each of the apps and services you use. It's inconvenient, but worth

[Emad Shanab - أبو عبد الله @Alra3ees]

“Finding subdomains that are hidden in the cloud.” by loyalonlytoday https://t.co/hjctS3wUBt

[MadMaxx @0xCCFFF]

@UK_Daniel_Card Hmm.. now I wonder what the real answer might be.

[MadMaxx @0xCCFFF]

@chux13786509 Eyeballing over the code, found LFI in 10 seconds

[MadMaxx @0xCCFFF]

@hatab1_ What did they respond?

[MadMaxx @0xCCFFF]

@PentesterLab Thanks. This is very true.

[MadMaxx @0xCCFFF]

@e11i0t_4lders0n Any good disclosed h1 report that you can link here?