Joejou

[Joejou @Joejou10]

@Hack_All_Things Really sad to hear this. Rest in peace

[my_cybercamp @CybercampMY]

🚨 Sponsor reveal!
@Hacker0x01 joins #MCC2025 as a Purple Hacker sponsor!

They’ll headline the Bug Bounty Night, featuring:
🔹@Joejou10 (🇲🇾 #1)
🔹@0xMorph

Big thanks to the world’s leading hacker-powered security platform.

#BugBounty #CyberSecurity #HackerOne #MCC2025

[André Baptista @0xacb]

Most open redirects are low-severity or N/A.

But used creatively, they can become high impact gadgets.

Here are 4 ways to show impact with open redirects:

1️⃣ SSRF Chaining

Use it to bypass filters where the domain is allow-listed.

2️⃣ OAuth Abuse

Exploit it in auth flows to leak access tokens and sensitive parameters.

3️⃣ Iframe Embedding + postMessage

Embed your attacker-controlled redirect page via iframe for postMessage exploits.

4️⃣ Client-side Path Traversal

Inject ../../ in dynamic fetch or iframe src to hit the redirect and potentially trigger XSS.

Loads more gadgets like this in this @ctbbpodcast HackerNotes: https://t.co/yqZ28tTdyP

[Joejou @Joejou10]

Thrilled to be part of Malaysia Cybersecurity Camp 2025 as a speaker!
Looking forward to share my hacking journey and connect with the community. 🔥

[my_cybercamp @CybercampMY]

1st invited speaker, for the BugBounty night. The No 1 MY leaderboard in @Hacker0x01, @Joejou10

https://t.co/IoKEvcxyus

[André Baptista @0xacb]

Hidden or disabled fields are commonly overlooked, but they can still open the door to some cool bugs.

Try creating a bookmarklet to instantly reveal these fields.

Here are some quick examples you can copy and paste:

🔖 Enable all disabled or readonly fields:
javascript:(function(){document.querySelectorAll('[disabled],[readonly]').forEach(el=>{el.removeAttribute('disabled');el.removeAttribute('readonly');});})();

🔖 Unhide elements styled with display: none:
javascript:(function(){document.querySelectorAll('[style*="display: none"]').forEach(el=>{https://t.co/026Bdpf7aY.display='block';});})();

[zhero; @zhero___]

the research paper is out:

Next.js and the corrupt middleware: the authorizing artifact

result of a collaboration with @inzo____ that led to CVE-2025-29927 (9.1-critical)

https://t.co/GZkbnr6o9H

enjoy the read!

[Joseph Thacker @rez0__]

I'm a hacker and AI researcher who has reported vulnerabilities to OpenAI, Google, and others. I wrote this guide as a reference of all of the ways that you can hack AI.

It has saved me hours. Bookmark this if you need a reference for what all to try (AND includes mitigations).

[Orange Tsai 🍊 @orange_8361]

Our talk at #BHEU is done! Hope you all enjoyed it. 😉 A detailed blog is on the way, but in the meantime, check out the pre-alpha website https://t.co/lGRfqhmcVK for early access and the slides!

Huge thanks to @BlackHatEvents and my awesome co-presenter @_splitline_! 🐈‍

[Bug Bounty Reports Explained @gregxsunday]

Oauth redirect URI research paper by Tommaso Innocenti et al.
https://t.co/CDhpGcW9Sn
#BBRENewsletter73
Subscribe to get the next issue: https://t.co/qyKDmBSVQM

[YesWeHack ⠵ @yeswehack]

The Censys search engine (https://t.co/JO1rvqsRrN) gives you a great opportunity to discover hosts and all kinds of services running on your target 🔍
Be sure to use the built-in features to get more accurate results to suit your needs!

#bugbounty #bugbountytips

[TryHackMe @tryhackme]

NEW FREE ROOM: SSRF

Gain a detailed understanding of methods and techniques to exploit SSRF vulnerability that includes:

🙌 Basic SSRF
🙌 Blind SSRF

You'll also learn protection measures against the vulnerability!

https://t.co/6Uh0Kc8bJb

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

Yooo, latest CT episode is live!

This time around we're discussing (and/or debating 😉) some vulnerable code patterns.

Enjoy!

https://t.co/FZ1TOObdps

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

Our boy @nahamsec has been TEARING IT UP lately in the bug bounty scene with 500k made in 2023.

We brought him on the pod this week to discuss bug bounty strats and how he is popping a shitton of Blind XSS with some custom tooling and methodology.

https://t.co/tNKNUBO30E

[HackerOne @Hacker0x01]

Elevate your security game in 2024!

Join us next week for an exclusive webinar and live demo to see how revamping your pentesting strategy can deliver impactful results.

📅 January 9, 2024
⏰ 12 p.m. EST | 5 p.m. GMT

Register now to secure your spot. https://t.co/jI2Je5oh4p

[Joejou @Joejou10]

@Jhaddix https://t.co/MiabN2n0BO

[JS0N Haddix @Jhaddix]

Ok fam. I’m giving away TWO free tickets to my course which takes place in two/three weeks.

All you have to do to win is like, retweet this tweet, and reply with “https://t.co/VnOqGJ5Yyo!”

I’ll pick winners next week!

If you haven’t seen my course, check out the link!

[Moblig @moblig_]

I often find IDORs by searching in JS Files for interesting endpoints, but how do I automate this while also performing manual hunting?🤔
#bugbountytips
I mostly use my custom @trick3st workflow for finding unique domains & secrets in JS files, here is how it works👇
1/4

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

A list of ethical hacking tools, let me know which ones I forgot!

Information Gathering: Nmap, Shodan, Maltego, Recon-ng, theHarvester, Netcat, DNSRecon, Sublist3r
Vulnerability Analysis: Nessus, Nexpose, OpenVAS, Nikto, Burp Suite Scanner

Exploitation Tools: Metasploit Framework, BeEF, SQLmap, Hydra, john the Ripper, Hashcat, SET
Wireless Hacking: Aircrack-ng, Kismet, Wireshark, Reaver, PixieWPS

Forensics Tools: Autopsy, Sleuth Kit, Volatility Framework, Wireshark, Oxygen Forensic Suite
Web Hacking: Burp Suite, OWASP ZAP, Wfuzz, WPScan, SQLNinja

Password Cracking: John the Ripper, Hydra, Medusa, Ophcrack, RainbowCrack
Sniffing & Spoofing: Wireshark, Ettercap, ARPspoof, Dsniff, SSLstrip

Post-Exploitation: Mimikatz, Powersploit, Empire, Meterpreter
Mobile Hacking: AndroRAT, DroidSheep, Drozer, zANTI, Frida

Reverse Engineering: IDA Pro, OllyDbg, Radare2, Ghidra, Binary Ninja
Anonymity Tools: Tor Browser, Proxychains, Anonsurf, I2P

Intrusion Detection Systems: Snort, Zeek, OSSEC

[Joejou @Joejou10]

`Count every “bugless” night as a learning opportunity: learning new skills to add to your testing methodology, learning about new uncovered assets, or just another night getting closer to a valid/unique finds.` 💪🏻

[Ben Sadeghipour @NahamSec]

In case you missed it, I wrote a blog post about the lessons I learned from working for myself full-time and doing bug bounties for the majority of my income. What do you think? Are bug bounties worth it?

https://t.co/nIGbMWNDhL

[Intigriti @intigriti]

Did you know that you can integrate Burpsuite with SQLMap to scan for SQL Injections?

If not, check out SQLPy!👇

A Burpsuite extension available for CE as well as the Professional edition to help you send requests to SQLMap API! 😎

https://t.co/tumwP5BKxZ