Chakravarthi

[skull @brutecat]

Not everyone who reports to Google Cloud VRP does a writeup, but critical bugs still show up in CVEs and release notes

Made a tool that aggregates both so you can see the types of bugs getting found in GCP

https://t.co/S8C6q67r2N

[Yassine Aboukir 🐐 @Yassineaboukir]

“Bug bounty is dying” is noise.

Lock in. Make money. Use AI to 10x your output. If it eventually dries up, you’ll have enough capital to start that biz or enough experience to land a job.

Simple as that.

[Rohan.exe 🖤 @roohaa_n]

Made approx 50k this month using both manual and AI
from @Hacker0x01 and @Bugcrowd this month

https://t.co/feI2UlQp6M
https://t.co/svZeVKDxg8

#BugBounty

[Google VRP (Google Bug Hunters) @GoogleVRP]

GCP VRP Secrets? 🤫 Hear from the program leads! Michael Cote (https://t.co/VjIdRHlest) & Darby Hopkins (https://t.co/o2KlsXJaIP) join @ctbbpodcast to talk shop: killer report tips, program insights & boosting your bounty game on Google Cloud.

🎧 https://t.co/zvNKm7N2mm

#GoogleVRP #BugBounty #CloudSecurity #GCP

[Google VRP (Google Bug Hunters) @GoogleVRP]

Our Google Cloud VRP researchers don't miss! 🔥 Check out @terminatorLM's latest Looker research uncovering 9 novel cross-tenant vulns in Looker.

See how it was done: 👇

[Patrickbatman @hamidonsolo]

I made close to $10,000 from bug bounties this month. I'm 19. Still in engineering school.

Here's what I didn't show you.

I found a Critical RCE — Remote Code Execution via path traversal on a company's server. The kind of bug that pays $5,000-$20,000.

Duplicate. Someone found it 12 days before me.

$0.

Same work. Same skill. Same report. Wrong timing.

That's one of dozens. For every bounty I post, there are 15+ reports that got:

→ Duplicated
→ Marked informative
→ Ignored for months
→ Closed as "not applicable"
→ Lowballed after months of follow-ups

But you know what I do when that happens?

I wake up. No emotion. No hate. I open Burp Suite. Next target. Next report.

Because if I don't, someone else will. Every day I take off is a day someone else dupes me on the next find. So I show up. Even when I don't feel like it. Even when it hurts.

Bug bounty is not "find bug, get paid." It's find 50 bugs, fight for 6, get duped on some of your best work, get ghosted on others, and still show up the next morning.

The $10K months are real. But behind every mountain is a hundred steps nobody sees.

If you're starting out and getting duped and rejected — that IS the path. You're not doing it wrong. You're doing it.

Keep going.

[Google VRP (Google Bug Hunters) @GoogleVRP]

Want to see what top-notch security research looks like?

Look no further than @j_domeracki's latest research, a standout contributor to the Google Cloud VRP! 🪲💪

https://t.co/lEsYWZuQMf

[Google VRP (Google Bug Hunters) @GoogleVRP]

Want to see what elite security research looks like? 🌟 @omer_asfu, one of Google Cloud VRP's best, dropped a cross-tenant finding: CVE-2025-13292 (https://t.co/79YhC1kJst)

[Chakravarthi @RulerWhitehat]

@GoogleVRP @omer_asfu It is really nice that the VRP team reposts these kinds of writeups. So many great research findings go under the radar, and this helps everyone in the community learn and get better. Fantastic work, @omer_asfu

[JS0N Haddix @Jhaddix]

Day TWO of FIVE days of celebrating our 2 year ARCANUM-VERSARY! @arcanuminfosec

3rd Giveaway = FOUR seats to our new course by @the_IDORminator "Zero to [BAC] Hero" !

👍 1 Like = 1 Entry!
♻️ 1 Share = 2 Entries!

Winners announced 1/21! Syllabus link below 👇

[Google VRP (Google Bug Hunters) @GoogleVRP]

New to hacking? Curious how to break things? 🕵️‍♂️✨

Google CTF Beginner's Quest 2025 is LIVE! 🚀

Tackle challenges crafted to get you started. Sign up, join the fun, and secure your spot on the leaderboard! 🏆

👇

https://t.co/dBiEIG8lIb

[Google VRP (Google Bug Hunters) @GoogleVRP]

Interested in the security of AI Agents 💁🛡️?

Then you've likely heard of "prompt injection", but do you know what "task injection" is? If you're curious, check out our latest post for a description and some real-world examples we discovered.

https://t.co/pWdDGX6M0W https://t.co/P8ndgCXtH1

[the_IDORminator @the_IDORminator]

Check out my work history... I started with a lawn mower and working at an ice cream shop.

High School Jobs:
-Mowing Lawns ($10-$20/yard)
-Printing Vinyl at a Sign Shop ($5/hr)
-Ice cream Shop ($6/hr)
-Video Rental Store ($6.50/hr)
-Retail Electronics Sales ($8.25/hr)

Jobs while in College:
-Retail PC Repair Shop ($10.25/hr)
-Private PC Repair Shop(s) ($14/hr)
-Video store manager ($15/hr)
-County Mapping Department (unpaid intern)
-Research Institute (unpaid intern)
-Surveying Company (unpaid intern)

Post-graduate Jobs:
-GIS Analyst ($17/hr)
-Web Developer ($21/hr)
-Nuclear Power Plant Operator ($33/hr)
-Satellite Imagery Analyst ($35/hr)
-GIS Administrator ($43/hr)
-Penetration Testing Roles ($50 to $150/hr)
-Part-time Hacker ($500 to $1000+/hr)

I do have a B.S. and M.S. in geographic information systems, but they had zero impact in the thing I ultimately ended up being good at and that paid the best. Back then, you had to have a college degree. I don't think they matter now. Not much. Hacking is a trade skill.

When I think about targets now, If I'm going to hack in a given week, I start by saying... OK... what does this target pay for a critical, and is that high enough? Does it seem like a good program, with a good reputation, and is there enough scope open to where the bounty program doesn't seem like a gimmick for marketing purposes only? Then I say, this is how much time I have to hack this week, do I think I can find at least one critical bug in that time period? (maybe that's 10 hours) If I'm leaning towards yes, I dive in. If I get bad vibes after one report, I dive back out. Peace, moving on.

If we look at T-Mobile, paying $35K or $55K for some bugs, the last two $35K bugs I managed to get rewarded for (the last time I hacked which was October) represented about an hour of testing each. I think the reports took longer to write than the bugs did to find. But that was because I already knew the target and I had spent a lot of time on it. It was just a matter of coming back at an already known target with a completely different mindset. I talk about this in the up-coming course. (not the exact bugs of course but this idea of committing to a program/target and how to think)

[Chakravarthi @RulerWhitehat]

@tabaahi_ Same here bro..By the time we wake up we are completed 3.30 hours of work for that day 😆

[the_IDORminator @the_IDORminator]

Let's talk manual testing for IDORs. I have pasted a payload from a redacted T-Mobile API below. It does not have a bug (that I am aware of) on it, I want to use this for educational purposes because its a great teaching opportunity.

A: This is a URI path parameter representing an organization ID. You need to tinker with this.

B: The request does not ask for URI parameters, but what if you give it some anyway and something changes?

C: Changing things like usernames or ID values in cookies can result in behavioral changes.

D: Play with the Authorization Bearer token. Does it check signature? Can you change data in it and it still works? If so... very bad. Is it even using the token, or does it use a cookie instead?

E: Its saying this is "upgrade-app". What does that mean? What are other values? What does changing it do?

F: This is the organization ID. Its the same as in the URI path. If you change both at the same time, does it work? If you change one but not the other, does it work? Are they checked against each other?

G: What does this header mean? It has a JWT format in it? Tinker.

H: The API type is declared. Can it be changed? If so, can we alter the backend destination? Hrmm.

I: Why is my email address in a header? Can I change it to someone else's? Does it check it?

J: IDP type, interesting. What are the other values it accepts?

K: You get the idea by now, the app name needs to be tinkered with. What does it do?

L: Oh look, my user ID. I wonder if its validated against the organization in the URI or header, or payload body?

M: My user ID again. What happens if I change M but not L, or L but not M, or change both, or leave both, or one blank, or null?

N: Account number. Is this validated against org, user, neither, both?

O: OrgID again, also in F and A. 3 places. Are all 3 checked? Is only 1 checked? Are any checked? Why is life so hard?

If you take nothing else away from this, understand the complexity in possible combinations/permutations of potential testing for a SINGLE POST on a SINGLE API end point. This is the way.

Oh, yea, and you have to check every single one for SQLi, SSRF, and code execution. Duh. 🤣

#hacking #bugbounty #infosec

[the_IDORminator @the_IDORminator]

Let's do interactive #bugbounty learning. Path-based IDORs. Fun!

You visit a webpage with your browser, which should be Firefox, at https://www[.]place[.]com/user/12345.

The webpage forces a client request to
https://api[.]place[.]com/api/v3/users/12345

This request responds with JSON about that user, to populate into your Firefox web browser. Its sensitive PII.

Let me break down my thought process here.
1] The first thing I do with this in less than 5 seconds, is try the number 12344 in the path. Iterate a bit, make sure you get 401/403s back. If not, you probably are looking at someone else's PII. Yay, GG.

2] I try to change the path to /v1/, /v2/, /v4/. Remove it entirely too. Sometimes different API versions are less secure. Those still in development, older ones, etc.

3] Then I run parameters at the end like ../api/v3/users/12345?userId=12344.
I try every parameter from the JSON response(s). Did the response change? If it changed the parameter did something. Investigate. (Intruder here)

4] I search JS files for "/api/v3/users" or keywords in the path to find where and how the API path was built, or where there may be other API paths. This is usually in the JS. Sometimes there are deprecated, hidden, or admin APIs laying there. Then I try all of those. Pivot pivot pivot.

5] I usually try appending ?, /, #, and/or URL encoded versions of each of these to the end of the API path. Sometimes that results in a bypass. One time I bypassed the security on thousands of APIs using a trailing slash due to ... well... bad code. This trick also works good when the mitigation was a WAF block.

6] Traverse backwards down the API. Check /api/v3/users/, /api/v3/, /api/, -- fuzz for obvious swagger or API schema paths. Add extra slashes, it looks cool. ///api//v3//users///// . Who knows right?

7] Throw a single quote in there, /12345'. Did it blow up? Add another quote in there, /12345'' - did it un-blow up? Might be SQLi. Don't try XSS, XSS is stupid.

8] Fuzz the words "users". What else could be there?

9] Sometimes APIs reserve keywords, like "ALL". Try things like /users/all instead of /users/12345. Run the US Websters Dictionary through that path. Watch case sensitivity, if it uses lower, its probably always lower. So dont send uppercase stuff to a lowercase API.

10] If none of this worked, I'm probably on another API at this point. Less than 10 minutes gone.

What else would you do?

[the_IDORminator @the_IDORminator]

I opened this profile as a means to keep communications open (in the event anyone finds it). After 1709 total bugs logged on just @Bugcrowd, I'm generally retiring from the bug bounty scene. Feel free to drop me a DM here if you ever need a manual penetration test, or want real world advice on bug bounty that you probably won't get from AI.

The #bugbounty field can be very rewarding, if you manage to mentally survive it long enough to find financial freedom. Given that ~65%+ of my bugs logged were IDORs, as something of a tribute and meme, I have been reborn - "the IDORminator".

From generating live $1-million dollar VISA cards with the payload {"points"=-1000000}, to dumping countless SSN's with super complex attacks like id=123 -- its been a wild ride.

May the 12345 be with you!
--"ZwinK" (the IDORminator) 😜

[Chakravarthi @RulerWhitehat]

@rohsec @volklub take care bro...

[JS0N Haddix @Jhaddix]

After seeing an INCREDIBLE response at Wild West Hacking Fest for our new recon preso, we decided to do a FREE 4-hour workshop!

Join us Dec 8th!

https://t.co/nII2OU2DTV

[Chakravarthi @RulerWhitehat]

@Masonhck3571 take care bro..get well soon