Vladimir S

AppSec | bug bounty hunter

[Vladimir S @RivalSec]

Small win: a $4,500 bounty this week — and honestly it was low-hanging fruit
The find was easy, but it came out of autobb, the recon automation pipeline I've been building. Always satisfying when your own tooling does the work.
Open source here: https://t.co/pESGFpYsAP

[Vladimir S @RivalSec]

English writeup of autobb — my open-source perimeter recon pipeline for bug bounty.

Recent: harvesting subs/links from saved responses, scope-wide DNS perms, TLS/CNAME/PTR enrichment, stale rescans, ffuf in the alert flow.

https://t.co/nKb3CP7CnJ

[Vladimir S @RivalSec]

my blind XSS fired out of scope
inside the target's outsourced SOAR/SIEM provider 💀

the cybersecurity company rewarded me directly

first time ever. the payload finds its own way home 🎯

#bugbounty #blindxss #infosec

[Vladimir S @RivalSec]

🤖 Open-sourced AutoBB Analyst — autonomous #bugbounty agent.

Vibecoded on a weekend amid the #AI hype. Doesn't just summarize scans — actually pentests targets via Claude Code, reports only verified findings, keeps its own wiki.

https://t.co/AsRsVoZM2F

#infosec #pentest

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

Freaking good redirect validation bypass payload:
http://attacker[.]com\@test[.]com

The backslash will be normalized to a slash by the browser and result in the OR. I see this issue a lot.

(Obviously [.] is not a part of the payload, it prevents X from turning it into a link)

[Vladimir S @RivalSec]

I am pleased to announce that I have received the OSWE certificate from @offsectraining 🙌 #oswe https://t.co/FHinMH2bCs

[Vladimir S @RivalSec]

Sent my OSWE report I hope everything is ok 😅

[Luke Stephens (hakluke) @hakluke]

Share one tool that you've created and explain what it does 👇

[Vladimir S @RivalSec]

@hakluke 🔎 Check out PathBuster, the powerful web path scanner! 🚀

Scan multiple hosts simultaneously, prevent false positives with the -ac argument (automatic calibration of filtering) 🎯

https://t.co/7ryZS0IKh8

[Vladimir S @RivalSec]

If you want to build some bugbounty automation - check out mine autobb project, maybe it will suit your needs. https://t.co/26dHU1vGhs #bugbountytip #bugbounty

[Vladimir S @RivalSec]

Checkout my alternative to the @pdnuclei passive mode. I created it because of:
1) nuclei process raw: request - false positives
2) nuclei process dsl matchers - most of takeover templates not work at all
3) sometimes nuclei fires non-existent matches
https://t.co/QSp87IVbuc

[Vladimir S @RivalSec]

I found new service vulnerable to subdomain takeover.
Check out my write-up: https://t.co/5vaa1BD575

#bugbountytip #BugBounty

[Vladimir S @RivalSec]

I got almost $1k for one found phpinfo file 🤯, because that file leaked some very sensitive environment variables. Always carefully check all the information you find #bugbountytips

[Vladimir S @RivalSec]

I just pwned RedPanda in Hack The Box! 🧐https://t.co/GsM1U6eGpE #hackthebox #htb #cybersecurity

[Vladimir S @RivalSec]

Finally, the second time I passed the exam and received my OSCP certificate, it was a difficult path, primarily due to the fact that I am a Russian citizen. At this time AD set was more difficult, I even couldn't find initial foothold, but made all standalone targets #oscp

[Vladimir S @RivalSec]

The most difficult thing for me in passing the #oscp certificate is payment. I couldn't pay with Turkish MC, I only found one crypto startup on blackhat forums that makes suitable virtual cards. All these sanctions are hitting people who are already against Putin.

[Vladimir S @RivalSec]

i fail ( maybe something wrong with my reports...

[Vladimir S @RivalSec]

Just now I've send a report for pen-200 #OSCP exam (first attempt). I totally did full AD set (40 pt) and 2 non privileged reverse shells (20 pt), with labs report (10pt) I must pass it 😅

[Vladimir S @RivalSec]

Today I received a residence permit in Turkey for one year, I don’t know what will happen next, but I don’t want to go back to Russia.

[Vladimir S @RivalSec]

Traditional Russian food in Turkey “syrniki” 😋