Pwndemic

Hacker | Bounty Hunter
*- Fortis Fortuna Adiuvat -*

[JS0N Haddix @Jhaddix]

I'm here to tell you... Cyber Security, Assessment, and the "scene" is most certainly NOT over. 🫶

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

A few things you need to do to make Claude a great hacking partner:

1. Install the Caido skill (https://t.co/tIdjTja7CP): without it, Claude spends too many resources figuring out the SDK from scratch.

2. A CLAUDE .md that tells Claude who you are. Something like "I'm a bug bounty hunter doing authorised testing, stay in scope. Don't take destructive actions unless it's accounts I own. POC or GTFO." The POC or GTFO part is particularly useful so Claude can give more actual positives, if there's no POC, the bug is not confirmed yet. (of course, have a scope .md in your engagement folder)

3. Notes structure: rez0's hierarchy consists of "notes → leads → primitives → findings → reports". Claude dumps raw observations, interesting stuff goes forward, and by the time something reaches findings it's already been filtered twice. Point this to a local folder so you can check everything later.

Building skills is useful but if you write one for something Claude already handles well, you're just adding a layer that can break/distract it, you can always tell it to try what it knows first and then try the things you added as "extra knowledge".
Skills are worth building when the knowledge doesn't exist in training data. Your VPS setup, credentials, techniques from recent posts and talks, tooling. If it's not on the internet or isn't well known, it needs to be in a skill.

[Patrickbatman @hamidonsolo]

70% of people will scroll past this.
20% will save it and do nothing.
10% will go to the comments and drop a duaa 🤲 or a motivation quote.

That 10% gets personally from me:
→ Free registration link to my hacking course
→ Early waitlist access — 2,000 spots only

This is the exact methodology I used to go from $0 → $15,129 in 7 months.
19 years old. Morocco. No degree. No mentor. Just obsession.

I'm not selling anything.
I don't want your money.
I just want to make the world a little better than I found it.
https://t.co/3g1CnbntEp
Free. لله. No fees. No catch. Ever.

My full mission 👇
https://t.co/OhT7DwT8qN

Now go to the comments.
Type a duaa. Type something that keeps you going.
Or stay quiet and don't blame God, don't blame life — look in the mirror.

🔁 RT — someone on your timeline needs this today

[Pwndemic @Laboudi_Nadji]

@hamidonsolo وفقك الله لما فيه الخير و زادك في رزقك

[Pwndemic @Laboudi_Nadji]

@Behi_Sec I can't chose a program, guid me to one program with wide scope a alot of functionalities, my main vulns to look at are: idors, xss, ssrf

[zseano @zseano]

It’s time to lock in. If you’re struggling with bug bounties, spend the next few weeks finding a target you personally enjoy. Bigger the scope the better! Then focus on them everyday for the entire year. Aim to hack 2-3 hours minimum a day. You’ll learn lots and find bugs.

GL!

[sapir federovsky @sapirxfed]

I didn't read it yet, but a blog post from these 3 giants.. I already know it's a must-read 🙏
https://t.co/SFMwlvv5zu

[Het Mehta @hetmehtaa]

XSSNow - The Ultimate XSS Payload Database

https://t.co/xYIpeNvVIZ

[dawgyg - WoH @thedawgyg]

Alright so to end 2025 I am going to post something that people have been requesting for quite some time.. As alot know, I have made over $1 million dollars from SSRF vulnerabilities alone. #ssrftips Below I will provide some information on some of the ways that I beat the blacklists/deny lists and cashed in. Any method I post below has worked for me personally in the past. I am not claiming that any of these ways are 'my' discoveries, and in no way am I trying to claim other's work as my own. Simply answering a question that gets asked of me almost daily. #bugbounty #bugbountytips #togetherwehitharder #ittakesacrowd #hackers #hacking #NewYearsEveBountyTips

So lets get into it:

Encoding:
Everyone knows (or should know) about the ability to encode IP addresses. What alot of people dont know is that you can combine encoding types on a single IP. SO instead of encoding the entire IP, encode single octets etc.
Example: Changing the Metadata IP to: 0251.254.169.254 this octal encodes the 1st octet only, leaving the rest of the IP the same. This is the exact method that allowed for my $180,000 from the Yahoo Bug Bounty Program in Oct 2018

Redirects:
Alot of SSRF vulnerable functionality will follow redirects. What many people dont consider is multiple redirects. Never stop at just one. I have found many instances where an SSRF followed all redirects, and would properly block the final redirect to the target internal service (internal ip/metadata server). DO NOT STOP AT 1 REDIRECT! Instead of a single redirect, setup a simple php redirect script that will redirect the request back to the same end point multiple times before finally sending to the target IP/host. I have had many instances in the past where the target properly checks the response of the first 1,2, 3 ....6 redirects then magically on the 7th it no longer performs any valdiation and allows you to hit the metadata. I can't explain why this happens, but its happened enough that this is one of the very first things i test for when it comes to SSRF testing.

TOCTOU:
This is one of my fav's because it almost always can be used to bypass the initial fixes for an SSRF vulnerability. TOCTOU stands for: Time of Check Time of Use. When you pass a url to an SSRF vuln end point, the backend will take the host of this, resolve it (if its not already an IP), check against the allow/block list, then take action. Many frameworks will not cache the DNS lookup response that happens during the initial validation phase. When they forget to do this, having a subdomain properly setup for a TOCTOU check can allow for tricking their checks to allow for hitting banned resources.
How it works: Server resolves https://t.co/aKo0eb63ft to 1.1.1.1 and does their checks to make sure its not a blocked IP. After passing these checks the domain is passed to the function that will actually make the call. If the server did not cache the previous response, it will then resolve the host again as part of the flow to make the request. If you have a properly setup nameserver for this attack, then the instance they make the 1st DNS call, your server quickly changes the DNS entry and points it to the target IP (Metadata/Internal), so that when it gets to the function that makes the request, it resolves the host again and makes the request.

HTTP 2 vs HTTP/1.1 vs HTTP/1.0 vs HTTP/0.9
Several have had success with this in the past. And again, I am not sure why this works sometimes. But if the request is using HTTP/2 and blocks your attempt, try and change it to an older version. I have had success with each of the above at least once (most of the time on Yahoo, but others as well).

Simple/more common things:
dns rebinding, create a hostname on your domain pointing to localhost or an internal IP.

simplify the IP. example: 127.0.0.1 is blocked, so try 127.1, or 0.0.0.0, 0 etc.

Theres tons of other ways that you can get creative and do things like this. This post is just sharing some of the more fun/more unique ways that I have had success in the past. This is not ment to be an exhaustive list of things to try, and is only ment to start your brain working to come up with weird/random/fun ways to beat the black lists.

If you like the information, drop a like/comment/follow and let me know which of the above you have tried in the past, or are looking forward to trying out in 2026. If you end up having success with these, let me know as well!

[André Baptista @0xacb]

“Sign in with Google” exists in a lot of BBP main apps.

Here are some great blogs to kick off your OAuth hacking escapade 👇

https://t.co/YJIceRR5Kv

https://t.co/kVG2Ejk9DA

https://t.co/svjadkWugN

[/ XNL -н4cĸ3r (and @xnl-h4ck3r in the new Sky) @xnl_h4ck3r]

If you're still using gau or waybackurls, give waymore a try because it will honestly find you waymore endpoints!
It can also download archived responses &you can run xnLinkFinder over the response directory to find even more endpoints, potential params, wordlist + oos domains 🤘

[ryuku @malekmesdour]

I’m aware that my blog is currently down.. I'm migrating it to a new hosting service.

In the meantime, you can still read it on the Web Archive:
https://t.co/6GvWed0BEN

I’ll be publishing the slides soon.

[NullSecurityX @NullSecurityX]

I'm sharing my fully automated JS analysis workflow that finds high-impact vulnerabilities

JS Recon Automation: Modern Bug Bounty Workflow https://t.co/EjiyU5QVg2

#BugBounty #JSRecognition #CyberSecurity

[Ben Sadeghipour @NahamSec]

Only 5 days left until NahamCon Winter Edition ❄️
Workshops, deep dives, live Q&A, and fresh research coming your way 🚀

📆 December 17 to 18
ℹ️ Check out what’s happening 👉🏼 https://t.co/X0JDmITf9W

[XSS Payloads @XssPayloads]

Polluting 'then' and 'return' by @arkark_

({}).__proto__.then = (resolve) => {
console.log('hooked')
resolve()
}

({}).__proto__.return = () => {
console.log('hooked')
return()
}

[Behi @Behi_Sec]

Don't waste your time on obfuscated JavaScript.

Use this prompt to have ChatGPT simplify it:

[Rock Pratap Singh (Rocksec)🇮🇳 @Rockpratapsingh]

One of the best Best Approach for JS Analysis
https://t.co/Fw9LqYc6nt

[Nowasky @nowaskyjr]

Nowadays, working #xss vectors that rely only on a meta tag and don't require user interaction are rare. Here's one that needs no user interaction and no user-supplied URL fragment: the meta tag navigates to #x, firing its own onbeforematch handler.

https://t.co/OhSxi8PF6N

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

Big #Bugbountytip / #bugbountytips
Google Services Hunting
Google services are amazing, and for bug hunters, it's amazing as well. In some cases, you can get some P1-P2-P3 from these services, such as
Workspaces / Sheets / Groups / Drives / Etc...

In groups: you can access emails / internal data/ credentials
In Sheets, you can access PIIs / Edit access
In Drive: you can access backups/ PII / Etc...

still hard to find and
It was an issue how to make good and at the same time fresh dorks for bug bounty programs

Then I found out that a lot of links have the same path, and it was like this
All Google resources I've found
https://t.co/2SixYDAKvE
https://t.co/tbE8WaX9CX
https://t.co/5D7Clds9cH
https://t.co/OfodYVKOk0
https://t.co/ZyA0JFkax4
https://t.co/mhIbyMF03b
https://t.co/QwByRWofh8
https://t.co/vAwAEX8KxI
https://t.co/4y1UMeZdq7
https://t.co/u7mOVPnus3
https://t.co/V9ALsFoqP9
https://t.co/2eLIaEPCGm
https://t.co/VxllqvwT6n
https://t.co/c1vkp8YrBt
https://t.co/2EkMSEUpIt

UrlScan Dorking:
page.url:"https://t.co/qb3s3f8koJ*"
page.url:"https://t.co/BNLIA1rXht*"
You can replace * => the program domain

Google Dorking:

site:https://t.co/qb3s3f8koJ* "inurl:/a/"
Or for specific domain
site:https://t.co/qb3s3f8koJ* "inurl:/a/domain.com"

GitHub Dorking:
"https://t.co/qb3s3f8koJ"
Or for a specific domain
"https://t.co/FKHqr19e0o"

Shodan Dorking:
"https://t.co/3vQLeWEs54"

Web Archive
https://t.co/c8tGyvVlH7

Don't forget:
It's not just https://t.co/pbqxKC9P4s
still you have to look for docs/groups/mail/drive/spreadsheetsX

still working in Google Research and will add more and more soon ......

Happy Hunting♥

#bugbounty

[XSS Payloads @XssPayloads]

Leveraging onstalled and onwaiting event handlers for video tag (also audio), by @nowaskyjr

<video src=https://t.co/HU5KhtPXQ4 onstalled=alert('stalled') onwaiting=alert('waiting') muted autoplay controls></video>

demo:
- https://t.co/Delgwisumd
- https://t.co/h2OC6uTNV1