Perce

CTF player | Bug Hunter | Ex infosec student at @EsnaBretagne

[Blaklis @Blaklis_]

I really hope that bug bounty platforms (cc @Bugcrowd @HackerOne @intigriti @yeswehack) will apply their 0day usual policies and will reject the farming of php2shell that is coming very soon.
Don't add to the triage fatigue, please

#BugBounty

[Hippie @hiippiiie]

I made a fun little game: ZeroDay Tycoon 🐛

Start as a broke bug bounty hunter, survive triage and your worst enemy (Duplicate), and build a cybersec empire.

100% free, plays in your browser.

👉 https://t.co/ShNSNPBk3Z
💬 discord : https://t.co/Zo9XzpB9Z1

[Lupin @0xLupin]

We're building Depi Red Team.

Zero to a validated exploit in 3m 56s. Depi does the recon and validation, the red teamer builds the exploit locally on top.

We also used Bug Bounty as a sandbox for our research and got XX,XXX$ bounties with it ;D

Our team went from hours or days to minutes on the hardest exploits.

I need help from Red Teamers and get some feedback. DM me what's missing or let's jump into a call ;D

[Kévin GERVOT (Mizu) @kevin_mizu]

Recently, I've been looking at DOMPurify again, trying to find ways to bypass 3.x.x after browsers started encoding attrs during serialization.

I ended up with a nice ≤3.2.6 Safari default-configuration bypass using only SMIL tags/attrs :D

Details 👇
https://t.co/EMfsjlXUem

[Vulnotes @vulnotes]

It's official: Vulnotes is live 🎉
The platform for your entire pentest engagement
✍️ Visual report editor
🔁 Built-in review workflow
📤 Export to docx, pdf, csv..
🤖 AI: screenshots → findings, translate, rewrite
🔌 API + MCP

👉 https://t.co/1XhBsTSGw0

[Perce @PerceSecu]

Big thanks to @yeswehack for the LHE, solid event and great people all around. And thanks to @PUMA for having us. Already hyped for the next one 🙌

[YesWeHack ⠵ @yeswehack]

Final score: bugs found, hackers crowned 👑

🥇 @Vozec1 and @_Worty
🥈 swdb
🥉 @PerceSecu
🩸 First Blood: @TheLaluka and p4st1s
💥 Biggest Impact: @Vozec1 and @_Worty

Check out the final leaderboard of our #LiveHackingEvent with @PUMA: https://t.co/VUThV3zRVX

[Kévin GERVOT (Mizu) @kevin_mizu]

I'm happy to release the first version of my DOMLogger++ plugin for @CaidoIO! 🔎

It improves the browser extension in several ways:
• Persistent, per-project storage
• Temporary session recording
• AI support
• Stack trace reconstitution
• ...

👉 https://t.co/tj72KXjAN9

[Vulnotes @vulnotes]

Our new website is live 🎉
Check out https://t.co/1XhBsTS8Gs and let us know what you think:
https://t.co/Vt2UVM1oNY

[sysxplore @sysxplore]

Linux running in a PDF file via a RISC-V emulator compiled to JS

[shubs @infosec_au]

@assetnote @SLCyberSec My work on the novel SSRF technique that landed a critical payout at a Live Hacking Event: https://t.co/CTSTEtKiD1

[Profundis.io @profundisio]

Big update: Subdomain enumeration now uses separate quotas for each plan!

This means MORE data for the same price. Plus, our free tier still lets you discover hundreds of subdomains monthly - no payment required.

Check out the documentation https://t.co/ga1cJcupLK

#bugbounty

[Noobosaurus R3x 🦖 @NoobosaurusR3x]

Guillaume Chouquet, fondateur et directeur de l'ESNA, viré de sa propre école par l'@Formation_bzh !!!
Je suis consterné et en colère.
C'est affligeant de prendre une telle décision quand on sait tout ce que le bonhomme a fait pour l'école et les alternants !

[Kévin GERVOT (Mizu) @kevin_mizu]

This is still v1, there's lots to improve and many gadgets to add.

If you'd like to contribute or have any feedback, please don't hesitate to reach out 😁

4/4

[Kévin GERVOT (Mizu) @kevin_mizu]

Each library page includes:

* Affected versions
* A short description
* Root cause of the gadget
* Related links
* Credit to the discoverer
* And even a preview button to play with the gadget live!

3/4

[Kévin GERVOT (Mizu) @kevin_mizu]

The wiki lets you filter gadgets by browser, tags, attributes, CSP, and timing, making it as easy as possible to find interesting vectors (at least I hope so!) 🔎

2/4

[Kévin GERVOT (Mizu) @kevin_mizu]

I'm happy to release a script gadgets wiki inspired by the work of @slekies, @kkotowicz, and @sirdarckcat in their Black Hat USA 2017 talk! 🔥

The goal is to provide quick access to gadgets that help bypass HTML sanitizers and CSPs 👇

https://t.co/SgsSyxoEMR

1/4

[Geluchat @Geluchat]

Today was my last day as a pentester at Bsecure, and it feels a bit surreal. After a three-year journey of hunting on the side, I’m finally ready to go all-in as a full-time bug bounty hunter.
To celebrate this milestone, I've written an article sharing the full story. It’s a transparent look at the path that got me here: the wins, the lessons, the real financial numbers, and my honest advice for anyone considering this adventure.
You can read all about my journey from pentester to full-time hunter here: https://t.co/g7yRBJDs1Y

[Sicarius @ElS1carius]

There we go, after 3 years of work, endless nights of dev and a truckload of coffee. We are finally releasing the biggest project we've done in our entire life.

I hope you will like it !

[Kévin GERVOT (Mizu) @kevin_mizu]

DOMLogger++ v1.0.8 is now out and available! 🎉

This update includes several UX improvements, such as syntax highlighting and new shortcuts. Major changes have been made to custom types and several annoying bugs have been fixed 🚀

👉 https://t.co/sPjJmtdDeZ

[Kévin GERVOT (Mizu) @kevin_mizu]

I'm very happy to finally share the second part of my DOMPurify security research 🔥

This article mostly focuses on DOMPurify misconfigurations, especially hooks, that downgrade the sanitizer's protection (even in the latest version)!

Link 👇
https://t.co/Hg1MkqVuGw

1/2