Amnx

breaking. learning. evolving.

[s1r1us @S1r1u5_]

On July 25, we hacked OpenAI.

Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc.

We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵

[Amnx @Amnxsec]

@Kimanongoh

[Jafar Abo Nada @Jafar_Abo_Nada]

"$250,000+" - Quarter million dollars. One program.
Here's what nobody tells you.

Here's the full breakdown from my @Atlassian journey on @Bugcrowd:

~ 400 reports submitted:

~ 240 paid reports
~ 80 duplicates
~ 70 N/A

Every duplicate and N/A was a lesson, not a loss.

No automation. No recon tools. Just deep manual research, consistency, and an obsession with understanding how Atlassian products work at their core.

Atlassian runs one of the most professional and well-managed bug bounty programs out there. A huge shoutout to their security team for taking every report seriously. and a special thanks to Mike for building a company that genuinely invests in security.

What made the difference?
→ I stopped hunting broad, started going deep
→ I treated Atlassian attack surface like a full-time research project
→ I documented everything, even the rejections
→ I came back to closed reports and found bypasses

One program. One mindset. $250K+.

The specialization strategy wins every time.

#BugBounty #InfoSec

[Amnx @Amnxsec]

@lostsec_ WTF☠️

[Patrickbatman @hamidonsolo]

https://t.co/NuMsNBPIoz

[zseano @zseano]

It’s time to lock in. If you’re struggling with bug bounties, spend the next few weeks finding a target you personally enjoy. Bigger the scope the better! Then focus on them everyday for the entire year. Aim to hack 2-3 hours minimum a day. You’ll learn lots and find bugs.

GL!

[Amnx @Amnxsec]

@tabaahi_ @TallForNxthing @Yassineaboukir At first i thought, it's him😅

[Mohsin Khan @tabaahi_]

Thread about hunting on the main application 🧵
1. Check the login process
- Do they allow signup with email or Google etc
- Do they allow you to signup with the @company email
- what is the content-type of the signup/login page
- when you enter valid cred, on which page you

[3NVZ | Robert S. @YourFinalSin]

My Setup "When I Started" vs "Now" lol
It was a good year.

[Amnx @Amnxsec]

@YourFinalSin inspiring 🫡

[Amnx @Amnxsec]

- Being honest with myself: the last 43 days weren’t executed the way I planned.
- Too much learning, too little real hunting.
- Exams are finished and went very well.
- Illness and poor execution slowed things down — noted and accepted.
#BugBounty #100DaysOfHacking

[Amnx @Amnxsec]

43/100 — #HuntingArc ⭕

🥷 Hunting → 0h
📑 CyberStudy → 2h
✅ Good Habits → 7/8
Quick update: pausing hunting and cyber study for a few days due to exams. Not stopping just shifting focus temporarily. if I get any gap time, I’ll try to hunt in between.

[Amnx @Amnxsec]

https://t.co/DeINShFYi6️-️-recon-techniques-nobody-talks-about-d37fcaebf560

https://t.co/XAx4Wk1UYF

https://t.co/FdsY63hxgw

https://t.co/kTQ7WQ6hxj
#BugBounty #infosec

[Amnx @Amnxsec]

42/100 — #HuntingArc ⭕

🥷 Hunting → 0h
📑 CyberStudy → 5.5h
✅ Good Habits → 8/8
- Read some amazing write-ups
https://t.co/WELwtMjQRv

[Amnx @Amnxsec]

40-41/100 — #HuntingArc ⭕

🥷 Hunting → 2h
📑 CyberStudy → 1h
✅ Good Habits → 7/10
#BugBounty #infosecvpn

[Amnx @Amnxsec]

39/100 — #HuntingArc ⭕

🥷 Hunting → 0h

📑 CyberStudy → 1h

✅ Good Habits → 3/10

#BugBounty #infosec

[Amnx @Amnxsec]

38/100 — #HuntingArc ⭕

🥷 Hunting →0h
📑 CyberStudy → 1:5h
✅ Good Habits → 7/10

#BugBounty #infosec

[Amnx @Amnxsec]

37/100 — #HuntingArc ⭕

🥷Hunting →0h

📑 CyberStudy →5h

✅ Good Habits → 7/10

#BugBounty #infosec

[Amnx @Amnxsec]

36/100 — #HuntingArc ⭕

🥷 Hunting → 0h
📑 CyberStudy → 7h
✅ Good Habits → 7/10

- For the last tow days i am refining my techniques and methodology Reading & watching lots of resources

#BugBounty #infosec