Nathan Alabi

[Nathan Alabi @Dphenixking]

@7h3h4ckv157 Oswe link not working please...

[0xFrankCastle🦀 @0xcastle_chain]

If I were starting my long journey in web3 security all over again — this is exactly the path I
would take.

This is the most comprehensive roadmap you'll find for breaking into Security + AI on Solana.

A step-by-step path through the 4 skills that are paying $200K–$500K+ in blockchain right now
— and there still aren't enough people who can do them.

Rust. Solana. AI. Security.

🧵

[sin99xx @sin99xx]

If you’re still looking at cookies like random strings and CORS like “blocked request = protected endpoint,” you’re hunting the surface, not the bug.

This writeup is about where the real findings live: trust boundaries, state confusion, bad origin validation, cache interaction, and browser guarantees teams only imagined existed ↓
https://t.co/S2XDstYiXO

[Behi @Behi_Sec]

Use this prompt for a thorough JS analysis:

You are an expert JavaScript reverse engineer and code analyst. I will provide you with
a JavaScript file. Perform a structured analysis with the following objectives:

## 1. High-Level Overview
- What is this code's purpose?
- Architecture pattern
- Key dependencies and frameworks used
- Execution flow: how does the code initialize and what is the main entry path?

## 2. Attack Surface & Endpoints
Extract and list ALL of the following in structured tables:

| Category | Examples to look for |
|-----------------------|---------------------------------------------------------|
| API routes/endpoints | paths, HTTP methods, route patterns |
| Parameters | query params, body fields, URL params, headers expected |
| Auth mechanisms | tokens, cookies, session logic, OAuth flows, API keys |
| WebSocket events | event names, channels, message schemas |
| External calls | fetch/axios URLs, third-party APIs, webhook targets |

## 3. Hidden & Interesting Artifacts
Look beneath the surface for:
- Hardcoded strings: URLs, IPs, hostnames, ports, internal service names
- Environment variables referenced (process.env.*)
- Database schemas, table/collection names, field names
- Role names, permission levels, feature flags
- Debug/admin/test routes or commented-out functionality
- Error messages that reveal internal structure
- Regex patterns (what are they validating/extracting?)
- File system paths (uploads, logs, configs, temp dirs)

## 4. Data Flow Map
Trace how user input moves through the code:
- Entry point (where does external data come in?)
- Transformations (parsing, validation, sanitization, or lack thereof)
- Storage (where does it end up: DB, file, cache, external service?)
- Output (what gets returned/rendered to the user?)

## Formatting Rules
- Use tables for structured data (endpoints, params, env vars)
- Use code snippets with line references for each finding
- Flag anything that seems intentionally obscured or unusual
- If the code is minified/obfuscated, note patterns and attempt to
identify the original framework or library

---

Here is the code:

<YOUR_CODE_HERE>

[obscaries ❘ AppSec @obscaries]

Recon doesn’t stop at public endpoints.
Some of the most interesting attack surfaces live behind authentication 🔐

Using MapperPlus to map authenticated routes and discover hidden endpoints during testing.

Feed it your session cookies and let it crawl the application like an authenticated user.

Great way to uncover:
• hidden routes
• internal APIs
• undocumented endpoints
• deeper attack surface

Automation maps the terrain — you hunt the bugs. 🐞

#BugBounty #AppSec #WebSecurity #Recon #Infosec

[Patrickbatman @hamidonsolo]

day 2: how to hit bounty quick $1,500.
Tip for bug bounty hunters: every AI chatbot on a website is an attack surface now.
I asked a company's AI support bot to "help me understand this error."
The error was a base64-encoded XSS payload.
The bot decoded it. Rendered it in the DOM. Zero sanitization.
That gave me JavaScript execution on their site.
From there:
→ Cookie downgrade via OAuth flow
→ Stole authentication tokens
→ Full account takeover
I reported it. 4 months of silence.
Then they quietly patched it and told me they "couldn't reproduce it."
So I sent video proof. Timestamps. Working PoC. Everything documented.
$500 → $1,500.
Every company is rushing to ship AI features. Nobody is auditing the output. If it renders in the DOM, it's probably vulnerable.
Go test them. Free XSS everywhere.
And if they try to lowball you — push back. Always push back.
Full YouTube lab breaking down the entire chain if this hits 2,000 ❤️

[VIEH Group @viehgroup]

Quick Wins: If you come across an outdated Swagger instance, always remember to test for XSS vulnerabilities. Try these payloads and earn some quick bounties!

Threads 🧵
#BugBounty #SecurityTips #Cybersecurity

[Ahmet Barut @ahmtbrt07]

bugTricks# Password Reset Functionality Testing

# [email protected]

1- Try [email protected]

2- Try [email protected],[email protected]

3- Try [email protected]&[email protected]

3- Try [email protected],cc: [email protected]

4- Try [email protected]\ncc: [email protected]

5- Try {"email": "[email protected]", "email":"[email protected]"}

6- Try {"email": ["[email protected]", "[email protected]"]}

7- Try email=“[email protected]$%0a%0d$cc: [email protected]” --> Hussein Daher ThreatCon Fuzzing Technique

7- Try user[email][][email protected]&user[email][][email protected] --> CVE-2023-7028

I've shared my own experience and approach, as well as the approach of elite hunters. I hope you find it helpful. thanks @nahamsec @HusseiN98D 🙏

#BugBounty #EthicalHacking #CyberSecurity

[Magn4 @Magn4_]

After uploading this video, I noticed that many people struggle with the basics, like reading JavaScript.

Since I want to move on to more advanced client side techniques, I’ve decided to dedicate my next few videos to covering fundamentals such as Minified JavaScript analysis, DOM XSS Taint flow, OAuth, and similar topics.

PS: These will also help you find IDORs and BAC issues, as I will show some ways you can extract the target's API endpoints from their JS files.

[X @TheMsterDoctor1]

# 🎯 Advanced JavaScript Reconnaissance Framework - From Basic Enum to $50K+ Critical Findings
-----

## 🔥 **The Problem with Basic JS Reconnaissance**

Everyone runs the same 6-step workflow. You get the same results as 10,000 other researchers. **This is why you’re missing critical vulnerabilities.**

Here’s how elite researchers weaponize JS analysis for maximum bounty potential:

-----

## 🧬 **Phase 1: Multi-Dimensional Subdomain Intelligence**

```bash
# Don't just enumerate - BUILD AN ATTACK GRAPH
TARGET="https://t.co/JqbiQ8bbVd"
DATE=$(date +%Y%m%d_%H%M%S)

# Layer 1: Aggressive Multi-Source Discovery
subfinder -d $TARGET -all -recursive -silent | anew subs.txt
github-subdomains -d $TARGET -t $TOKEN -e -raw | anew subs.txt
assetfinder --subs-only $TARGET | anew subs.txt

# Layer 2: Certificate Transparency Time Machine
curl -s "https://t.co/pJNhmgOoK0" | \
jq -r '.[].name_value' | sed 's/\*\.//g' | anew subs.txt

# Layer 3: DNS Bruteforce with SMART wordlists
# Use patterns from already-discovered subdomains
cat subs.txt | sed 's/\..*$//' | sort -u > patterns.txt
puredns bruteforce patterns.txt $TARGET -r resolvers.txt -w bruteforce.txt

# Layer 4: Shodan/Censys for HIDDEN infrastructure
shodan domain $TARGET 2>/dev/null | grep -oP '(?<=Subdomain: )\S+' | anew subs.txt

# 🎯 KEY INSIGHT: Look for OLD subdomains with NEW JS
# These often have outdated dependencies with known CVEs
```

-----

## ⚡ **Phase 2: Intelligent Asset Classification**

```bash
# Don't just check if alive - FINGERPRINT EVERYTHING
cat subs.txt | httpx -silent -json -td -cdn -title -tech-detect \
-status-code -content-length -hash sha256 -o httpx_intel.json

# Extract high-value targets by technology stack
cat httpx_intel.json | jq -r 'select(.tech[]? | contains("Next.js")) | .url' > nextjs_targets.txt
cat httpx_intel.json | jq -r 'select(.tech[]? | contains("React")) | .url' > react_targets.txt
cat httpx_intel.json | jq -r 'select(.tech[]? | contains("GraphQL")) | .url' > graphql_targets.txt

# 🎯 KEY INSIGHT: Target-specific tech stacks have specific vulns
# Next.js → CVE-2025-55183/55184, React → DOM XSS, GraphQL → Introspection
```

-----

## 🕸️ **Phase 3: Advanced URL Discovery with Context Awareness**

```bash
# Don't just crawl - UNDERSTAND the application architecture
cat httpx_intel.json | jq -r '.url' > alive.txt

# Technique 1: Deep crawling with historical context
katana -u alive.txt -d 5 -ps -pss waybackarchive,commoncrawl \
-f qurl -kf robotstxt,sitemapxml -jc -kf all -aff \
-ef woff,css,png,svg,jpg,woff2,jpeg,gif -o katana.txt

# Technique 2: Wayback time-travel for DELETED endpoints
cat alive.txt | waybackurls | uro | anew wayback.txt

# Technique 3: Parameter mining for injection points
paramspider --domain $TARGET --level high --output params.txt

# 🎯 CRITICAL: Extract API versions from URLs
cat katana.txt wayback.txt params.txt | grep -Eo '/v[0-9]+/|/api/v[0-9]+/' | \
sort -u > api_versions.txt
# Old API versions (v1, v2) often lack modern security controls
```

-----

## 💣 **Phase 4: Surgical JavaScript Extraction & Classification**

```bash
# Don't just grep for .js - BUILD A JS INTELLIGENCE DATABASE

# Extract ALL JS with metadata tracking
cat katana.txt wayback.txt params.txt | \
grep -iE '\.(js|jsx|mjs|ts|tsx)(\?|$)' | \
httpx -silent -mc 200 -json -hash sha256 -content-length -o js_metadata.json

# Classify by SIZE (large files = more secrets)
cat js_metadata.json | jq -r 'select(.content_length > 100000) | .url' > large_js.txt

# Classify by PATH (admin/internal/test paths = higher value)
cat js_metadata.json | jq -r '.url' | grep -iE '(admin|internal|test|debug|dev|staging)' > sensitive_js.txt

# 🎯 ADVANCED: Extract source maps for original code
cat js_metadata.json | jq -r '.url' | sed 's/\.js$/.js.map/' | \
httpx -silent -mc 200 -o sourcemaps.txt

*Follow for more advanced research methodologies** 🧵👇

[Behi @Behi_Sec]

In the last 2 months, I have discovered 7 CRITICAL prompt injection bugs.

Here is the exact framework I use to hack AI-powered applications: 🧵

[Kévin GERVOT (Mizu) @kevin_mizu]

I'm happy to release a script gadgets wiki inspired by the work of @slekies, @kkotowicz, and @sirdarckcat in their Black Hat USA 2017 talk! 🔥

The goal is to provide quick access to gadgets that help bypass HTML sanitizers and CSPs 👇

https://t.co/SgsSyxoEMR

1/4

[Engr Shahid Hussain 🇸🇩 @cybarx14]

Hey @grok write down all the tips from different Bug Bounty hunters for PII leak

[Ben Sadeghipour @NahamSec]

The @Hacker0x01 live hacking events require a different mentality. In this video I sat down with @ArchAngelDDay and @Rhynorater to learn how they prepare for these events and what its take to perform at this level!

https://t.co/emLJOigWyT

[Devansh (⚡, 🥷) @0xAsm0d3us]

If you start reading just 5 CTF write-ups a day, by the end of this year, you'll be 10x more skilled than you are today. Just start, rn!

That's 150 write-ups in a month. Assuming you learn 30–40 unique techniques from them, no course can match that. You'll be unstoppable.

[Devansh (⚡, 🥷) @0xAsm0d3us]

Weekend reading:

Huli's blog is a gem, and you should start reading it if you want to excel in frontend/client-side security

https://t.co/lEpBsMBely

[Vitor Falcão "busfactor" @busf4ctor]

The @GoogleVRP blog has this amazing table. It's perfect for understanding some security boundaries and defenses and a good checklist to use for testing targets.
https://t.co/jbyi5S1SoG

[André Baptista @0xacb]

If you’re into XSS, this is a must read.

This blog by Huli (@aszx87410) goes deep into everything about XSS. Very substantial series of a content.

Read at: https://t.co/lgX4pK4SIB

[arete @aretekzs]

Recently, during an engagement, I encountered a self-XSS. The target used HttpOnly cookies, and none of the pages were iframable. If you are interested, this is how I managed to escalate it:

https://t.co/unnXrclNlQ