Small win: a $4,500 bounty this week β and honestly it was low-hanging fruit
The find was easy, but it came out of autobb, the recon automation pipeline I've been building. Always satisfying when your own tooling does the work.
Open source here: https://t.co/pESGFpYsAP
English writeup of autobb β my open-source perimeter recon pipeline for bug bounty.
Recent: harvesting subs/links from saved responses, scope-wide DNS perms, TLS/CNAME/PTR enrichment, stale rescans, ffuf in the alert flow.
https://t.co/nKb3CP7CnJ
my blind XSS fired out of scope
inside the target's outsourced SOAR/SIEM provider π
the cybersecurity company rewarded me directly
first time ever. the payload finds its own way home π―
#bugbounty#blindxss#infosec
π€ Open-sourced AutoBB Analyst β autonomous #bugbounty agent.
Vibecoded on a weekend amid the #AI hype. Doesn't just summarize scans β actually pentests targets via Claude Code, reports only verified findings, keeps its own wiki.
https://t.co/AsRsVoZM2F
#infosec#pentest
Freaking good redirect validation bypass payload:
http://attacker[.]com\@test[.]com
The backslash will be normalized to a slash by the browser and result in the OR. I see this issue a lot.
(Obviously [.] is not a part of the payload, it prevents X from turning it into a link)
@hakluke π Check out PathBuster, the powerful web path scanner! π
Scan multiple hosts simultaneously, prevent false positives with the -ac argument (automatic calibration of filtering) π―
https://t.co/7ryZS0IKh8
If you want to build some bugbounty automation - check out mine autobb project, maybe it will suit your needs. https://t.co/26dHU1vGhs #bugbountytip#bugbounty
Checkout my alternative to the @pdnuclei passive mode. I created it because of:
1) nuclei process raw: request - false positives
2) nuclei process dsl matchers - most of takeover templates not work at all
3) sometimes nuclei fires non-existent matches
https://t.co/QSp87IVbuc
I got almost $1k for one found phpinfo file π€―, because that file leaked some very sensitive environment variables. Always carefully check all the information you find #bugbountytips
Finally, the second time I passed the exam and received my OSCP certificate, it was a difficult path, primarily due to the fact that I am a Russian citizen. At this time AD set was more difficult, I even couldn't find initial foothold, but made all standalone targets #oscp
The most difficult thing for me in passing the #oscp certificate is payment. I couldn't pay with Turkish MC, I only found one crypto startup on blackhat forums that makes suitable virtual cards. All these sanctions are hitting people who are already against Putin.
Just now I've send a report for pen-200 #OSCP exam (first attempt). I totally did full AD set (40 pt) and 2 non privileged reverse shells (20 pt), with labs report (10pt) I must pass it π