Alejandro

0-0

[BRute Logic @BRuteLogic]

JWT Auth Bypass TestBed

https://t.co/qoYUYTxduT

Test your skills: 18 main tests with variations.

A proprietary tool with 40+ techniques for Brute One will be available this week to spot all these cases in the wild in a matter of seconds.

https://t.co/ThMs09G3Hp

[Preben @prebenve]

Found a cool bug at Meta.

From misconfigured Grafana instance to R/W access on 507 private Meta repositories.

Wrote up the full chain here:
https://t.co/LYQ0prc68d

$157k bounty awarded by @metabugbounty

[dawgyg - WoH @thedawgyg]

https://t.co/wdbyohjQ5A

[Harsh Jaiswal @rootxharsh]

CVE-2026-44574: Middleware auth bypass via internal query params.

Next.js uses internal query params nxtP<param> and nxtI<param> to pass resolved dynamic route params from routing to route modules. they're never stripped from external requests, leading to middleware bypass in dynamic routes.

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

$170k in Bypasses: The Vercel React2Shell Challenge by @S1r1u5_

https://t.co/pcGvoHnJ0X

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

There's an Intent in the APK that pre-fills Gemini's chat input. Justin used this to build a fake captcha app where victim taps 5 times, intent fires on tap 3, tap 4 or 5 lands on the "Send" button: delivery solved, 2FA code is now in Gemini's context.

SMS tool requires manual confirmation before sending = dead end. But phone tool doesn't. But a raw call leaks nothing except that the call happened. So how can we encode data inside audio? We needed a way to exfiltrate that data.

The answer was usin dial strings, appending tones directly to the number Gemini dials so they play on the receiver's end. Gemini accepts this syntax, read the code via notifications, encode it into a dial string, call the attacker.
Attacker records the tones and decode them.

We reported this at Google Bugswat Tokyo and got over 9K USD with the $1337 bonus for "Most Creative Bug".

Read the full writeup here: https://t.co/7ycNc0yNux

[Zed Attack Proxy @zaproxy]

Combine the Encode/Decode/Hash add-on with CyberChef operations in ZAP Encode/Decode Scripts for flexible encoding, decoding, and hashing in your testing workflow.
https://t.co/rWE63GTDtw
#zaproxy #appsec #cyberchef

[Zed Attack Proxy @zaproxy]

https://t.co/rhR9IGrQ5w
#zaproxy #owasp #appsec

[Abdallah @d3doxp]

In this write-up, I detail how I escalated info/P4 into P1 and avoided brute-force 36^11 for UUIDs by exploiting typical human behavior.

https://t.co/C2qAUB14iZ

[STÖK ✌️ @stokfredrik]

🔥Boom #nahamcon2025 17-18/12

Hey! let’s hang out together on Thursday, it’s Nahamcon so we are going to check out some cool talks from cool people that talk about cool stuff (like ai and haxx). So figured it would be fun if we all do it together. Il be there, @NahamSec will be there, the chat and the fam will be there, heck I recon most of the bounty community will be there, maybe even some builders and breakers? So I hope that you will join us too, free on YT and Twitch.
Thursday, boom.

https://t.co/q1KcoYUqeh

[Bambu Lab @BambulabGlobal]

We’re truly proud to collaborate with MakeGood on such a meaningful and beautiful project.

At Formnext, MakeGood showcased their 3D-Printed Toddler Mobility Trainer (TMT) - a low-cost, open-source device designed to support independence, coordination, and social development for young children with mobility challenges. And now it’s available for free from the organization’s website and from MakerWorld. No advanced equipment is required - a Bambu Lab A1 is enough!

If you’re interested in this beautiful project, you can learn more on our Bambu Lab Blog:
https://t.co/INaSXehKBY

[YesWeHack ⠵ @yeswehack]

Want to target bugs that few hunters are looking for? 👀

GraphQL is one such bug. Be unique and start looking for bugs that others aren't seeking!

Check out our guide 👇

#BugBounty #BugBountyTips

https://t.co/gigaM3Dtwu

[Zed Attack Proxy @zaproxy]

New ZAP blog post - read how @DEOXYRIBOSE404 is enhancing ZAP with AI for Bug Bounty Hunting
https://t.co/DeE4tgn49b

[Intigriti @intigriti]

Found a possible injection point, but WAF is preventing you from executing JS code? Time to obfuscate your payload! 🤠

JS-DOMestify is a simple tool that helps convert any JS code to browser-runnable code with only ASCII characters and minimal, non-intrusive symbols. 👀

Check it out! 👇
https://t.co/JYqPh7nBfQ

[Bour Abdelhadi @BourAbdelhadi]

New release of rep+ is out 🚀

You can now open DevTools on a second screen and capture requests from ALL your tabs, not just the inspected one.

Global visibility. Multi-origin testing. Zero setup.

Update &amp; enjoy 😎

[PortSn1ffer @DEOXYRIBOSE404]

I’m hyped about what I’m building right now😀

Burp & Caido put automation behind paywalls, so I turned to OWASP ZAP — free, open, scriptable — and wrapped it inside my own MCP (Model Context Protocol) proxy layer.

Then I wired everything together:

⚡ ZAP → handles active/passive scanning
⚡ Custom MCP Proxy → routes traffic + injects AI logic
⚡ Node.js service → handles orchestration + payload generation
⚡ Python modules → normalize data, parse responses, detect anomalies
⚡ LLM engine → learns from HTB, PortSwigger Academy, exploit writeups
⚡ Custom ruleset → auto-mutates payloads & attack patterns

Now the system doesn’t just test endpoints.
It watches. It remembers. It improves.
Every scan sharpens the model.
Every failure becomes a new technique.
Every successful exploit becomes part of its instinct.
I’m not building a scanner.
I’m training a hunter.
#BugBounty #CyberSecurity #AI #Hacking #AppSec

[PentesterLab @PentesterLab]

Research to read this week: Android, Django, MCP…
🤖 https://t.co/dSb8fg8YwA
🐍 https://t.co/xKAP5yqYgI
🌽 https://t.co/G0DWM42oCi
🤖https://t.co/FO2EVgkMRK
🧑🏻‍💻 https://t.co/TxEP2WjRUv
#PentesterLabWeekly

[Mobile Hacker @androidmalware2]

Account takeover in Android app via JavaScript bridge

A misconfigured addJavascriptInterface + flawed domain validation + javascript:// trick, enabled full cookie exfiltration via WebView.
Exploit chain: JSB dispatcher → file access handler → bypass via newline injection

[Ben Sadeghipour @NahamSec]

👀👀👀

[daoud youssef @daoud_youssef]

a new write-up on how to pentest NextJs framework apps
Enjoy
#security_tips_with_daoud
https://t.co/BxX6lGspQu