2MB4A

Am nothing

[🇷🇴 cristi @CristiVlad25]

source maps are hiding gems

[2MB4A @2MB4A]

I take medium membership to read this guy articles, a so good hunter.
Thanks man

[Coffin @lostsec_]

The Ultimate SSRF Guide is here!

From discovery to Exploitation and filter Bypasses, everything you need to hunt SSRF vulnerabilities, from zero to hero.
https://t.co/6wcC7oBfZa

[Gospel @4osp3l]

I found this interesting "403 Forbidden" Bypass; through "Microsoft-Azure-Application-Gateway/v2"

1. Accessing the URL returns "403 Forbidden"

2. Appending the query "?x=.js", successfully bypasses the Azure restriction leading to direct access to the restricted resource.

[Harley Kimball @infinitelogins]

Simon Koeck (@soeckly) earned $90,000 from Google after finding a DevSite vulnerability that let him run commands on Google's servers.

The attack came down to 3 security mistakes that chained together.

1. A secret exposed in a session cookie

Google's DevSite stored a pickled OAuth object inside a Flask session cookie, including its `client_secret`.

The cookie was signed, but not encrypted. That means users couldn't modify it without invalidating the signature, but they could still decode and read its contents.

So the researcher decoded the cookie and extracted the `client_secret`.

2. The same secret was used to sign cookies

Normally, servers use a private key to sign session cookies so they can detect tampering.

But DevSite used that exposed `client_secret` to derive its cookie-signing key.

With the secret in hand, the researcher could now forge his own session cookies with valid signatures that Google's servers would accept.

3. Google used Python's `pickle` to deserialize cookie data

`pickle` lets Python save objects as data and reconstruct them later. The problem is that loading malicious pickle data can execute arbitrary code.

DevSite used `pickle` to restore an OAuth flow object from the session cookie.

Since the researcher could forge valid cookies, he could replace the original pickled object with a malicious payload.

Here's how the full attack worked:

1. Decode the session cookie and extract the `client_secret`.
2. Use that secret to derive the cookie-signing key.
3. Forge a valid session cookie containing a malicious pickle payload.
4. Send the cookie to DevSite and trigger the OAuth callback.
5. DevSite validates the cookie signature, deserializes the pickle, and executes the payload.

To prove RCE, he made Google's server execute a command that delayed its response by a few seconds. The response times matched the delays.

The takeaway:

Three issues combined into one critical vulnerability:

- Secret exposure → The signing key could be derived.
- Key reuse → An attacker could forge trusted session cookies.
- Unsafe deserialization → Forged data could execute code on the server.

#BugBounty tip: Decode session cookies when testing applications. Signed doesn't mean encrypted, and sensitive information inside a cookie might be enough to compromise the mechanism protecting it.

Full write-up 👇
https://t.co/Y57EhByL6v

[𝐤𝐣𝐮𝐥𝐢𝐮𝐬 @ethical_h4ck3r_]

File upload extension bypass new method🔥

in media upload section you can upload files like: .png .jpg .txt

but if you upload any php file it block: .php .jpg.php .php7 .shtml

Bypass: ".php " (just add a simple space after .php)

CC: @darkshadow2bd
#bugbountytips #bugbountytip

[Muqsit 𝕏 @mqst_]

AI in Web3 Security: Build Your First Bug-Hunting Agent

Blog: https://t.co/9Fo9LOXQAs

Author: @asen_sec

[Parsa @skydesperados]

6 months ago I found these vulnerabilities across several companies and earned $15K in bounties
I haven’t hunted on web apps in a while and I really miss it
Hope my writeup helps other hunters

Broken access control on Next js server actions
https://t.co/FZYNkvuZlx

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

🐛 Bug Bounty Writeup

• One Random Search Led Me to Exposed PDFs During a Bug Bounty Hunt: https://t.co/qCH4Hyhscy
• $18,000 for a Serialized String in a Cookie: PHP Object Injection to Remote Code Execution: https://t.co/nbkSae6183
• How I found a Zero-Click Account Tack over via password rest link: https://t.co/0c0ft75Al4
• A one-tap token drain in Unstoppable Wallet, and the $20 bug bounty it earned: https://t.co/8nMImdQLXv
• I Read HackerOne’s New Report So You Don’t Have To. Here’s the One Number That Matters.: https://t.co/9mjPFo4LTh
• Bypassing Login with SQL Injection: PortSwigger Lab Walkthrough.: https://t.co/c1zSY09F1s
• Security Misconfiguration : OWASP Top 10 (2025) — A02: https://t.co/KMmKCO78Dr
• My First Blockchain Bug Bounty Investigation: What a Duplicate Report Taught Me About Security…: https://t.co/i3j4NgJouB
• RECON Part 1: Finding Subdomains — How a Hardcoded Password Got Me $$$$: https://t.co/HJxUUPrU6m
• I found a secret door into an admin panel — and got paid $1350 for it: https://t.co/dxuleI0DHw

[zack0x01 @zack0x01_]

Most people can collect a subdomain list. Almost nobody knows what to do with it.

I dropped new video about: the entire recon process my AI hackbot runs on its own, and how that data actually turns into findings.

https://t.co/OlbIEfAhYA

#bugbounty #hacking

[Harley Kimball @infinitelogins]

I found a critical unauthenticated SQL injection that earned a $4,000 bounty. The WAF blocked most SQLi payloads, but I turned HTTP 500 errors into a data extraction channel.

The exploit came down to 3 things:

- SQL injection: A public API passed user input directly into BigQuery SQL.
- WAF bypass: Keyword filtering missed BigQuery scripting techniques.
- Error-based extraction: Detailed database errors exposed query results in HTTP 500 responses.

Here's how I chained all three together:

1. Find the injection

A public analytics endpoint accepted JSON input.

Adding a single `'` to a parameter returned:

`500 → Syntax error: Unclosed string literal`

The error also revealed Google BigQuery was the backend.

2. Build a boolean oracle

The WAF blocked keywords like `UNION`, `SELECT`, `AND`, and `OR`.

But BigQuery scripting constructs like `IF` and `ASSERT` still worked:

`IF TRUE THEN ASSERT FALSE; END IF;` → 500

`IF FALSE THEN ASSERT FALSE; END IF;` → 200

This let me ask the database true/false questions and read the answers from HTTP status codes.

3. Turn the 500 error into an output channel

This was the biggest breakthrough because blind SQLi normally requires guessing data one character at a time using those true/false responses.

But BigQuery supports:

`RAISE USING MESSAGE = 'hello'`

This deliberately throws a database error containing `hello`.

Because the API exposed database error details, the response included:

`500 → ... hello ...`

Now imagine replacing `hello` with a database query result.

The database includes that result in its error message, and the API returns it.

Instead of guessing characters, I could retrieve an entire value in one request.

4. Bypass the WAF using BigQuery's own features

The WAF blocked `EXECUTE IMMEDIATE`, which runs dynamically constructed SQL.

But this worked:

`EXECUTE/**/IMMEDIATE`

The SQL parser understood it, while the WAF's keyword matching didn't.

Another blocked keyword was `INFORMATION_SCHEMA`, used to enumerate tables and columns.

The bypass was:

`REVERSE('AMEHCS_NOITAMROFNI')`

BigQuery reconstructs `INFORMATION_SCHEMA` at runtime.

Using that reversed string in a dynamic query let me access database metadata without sending the blocked keyword literally.

5. What this unlocked

Using those techniques, I was able to:

- Enumerate datasets, tables, and columns
- Query tables unrelated to the original analytics endpoint
- Retrieve customer records, names, and addresses
- Access operational records containing personal identifiers and contact information
- Read sensitive fields that another API intentionally redacted

#BugBounty tip:

When a WAF blocks SQLi, don't just try random payloads. Understand the database dialect, what the WAF filters, and whether verbose errors leak data.

Sometimes a `500` isn't just an error. It may be your output channel.

[2MB4A @2MB4A]

@infinitelogins Amazing finding

[Simon @soeckly]

I got $90,000 for a RCE in Google.
https://t.co/cjm7ZaNMeq

[Intigriti @intigriti]

🔁 Most hunters overlook GitHub as a recon surface, but it often holds more sensitive data than the target itself! 🧐

As developers keep pushing secrets, internal endpoints, and configuration files to public repositories every single day, and most of it never gets noticed or properly removed! 🤠

Our beginner-friendly guide walks through GitHub dorking from scratch, with practical search filter, and step-by-step examples! 😎

Read it now! 👇
https://t.co/v0IR0gglyf

[Damian Strobel @damian_89_]

Rarely I post bug bounty tips anymore but this small gem is unknown to most ;)

[2MB4A @2MB4A]

Don’t touch on our yandex 😪
We need yandex dorking

[Whale News Daily @WhaleNewsDaily]

NOBODY is telling you what just happened to Russia's internet.

Ukraine hit Yandex, Russia's Google, twice in two days.

One strike shut down the hub with 2 of Russia's 3 Al supercomputers.

The second knocked out Yandex's biggest data center.

Apps went dark. Russian Railways' website went down.

And this came days after Trump made a deal to buy
Russian diesel.

The war just moved from oil to data.

Turn on notifications. Russia will hit back🚨🚨

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

My First Article, if you like it retweet ♥, ill do more ♥ https://t.co/dQWkEaZw8j

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

From JavaScript Analysis To UUID Pattern Exploration Revealed a Critical IDOR!
https://t.co/ZJmg34Of6G

#bugbounty #bugbountytips #bugbountytip

[Ha$h1m @mrhashimamin]

1. `/createuncommittedpurchaseorder` has an IDOR, but it's a 32-character UUID.

2. Complete the purchasing process and there's another IDOR, which is used to retrieve this long UUID xD

For more details: https://t.co/lwhiCGC6eo

#BugBounty #bugbountytips #hackerone

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

IDOR to Content Spoofing: Hijacking Brand Trust via a Simple UUID Swap
https://t.co/LzSfrW9lzG

#bugbounty #bugbountytips #bugbountytip

[asbawy @0d_Asbawy]

Don’t rush to report.

A UUID IDOR looked informative at first. Dug deeper, found an endpoint leaking valid IDs, chained both, and it became critical.

Full writeup: https://t.co/6RKQqCTnSd

#BugBounty #IDOR #hackerone