SecurityReapers

Bug hunter at H1/bugcrowd/Synack/YWH

[SecurityReapers @SecurityReapers]

In May this year , I, along with @M_Zeeshan899, found our biggest bug with our biggest bounty on @Hacker0x01. The bug was quickly fixed and awarded with a bounty of 76500$ .

The bug was similar to what nahamsec has explained in his video https://t.co/gjAvlLz0aD

[SecurityReapers @SecurityReapers]

@supr4s @yeswehack Me too 🥳🤑🤑🤑

[SecurityReapers @SecurityReapers]

Just got a reward for a high vulnerability submitted on @yeswehack
https://t.co/VerImkj86U #YesWeRHackers

💰💰💸💸

[SecurityReapers @SecurityReapers]

@zonduu1 Sure mate

[SecurityReapers @SecurityReapers]

@M_Zeeshan899 @intigriti @StijnJans @lennaert89 @intigriti

[Tib3rius @0xTib3rius]

Just heard about HackerOne allegedly training an AI pentesting agent on private bug bounty reports.

Which is great news.

I’ve always wanted to be part of something bigger than myself.

Like a dataset.

I logged into the platform to review one of my old private reports.

The one with the 47-step reproduction chain and the custom Burp extension I wrote at 2:13am.

It now feels less like a finding.

More like a contribution to the collective.

Some people are upset that private reports might be used to train an AI.

I prefer to think of it as mentorship.

I walked so the model could run automated recon at scale.

That’s legacy.

The platform says it’s trained on years of proprietary exploit intelligence.

Which sounds suspiciously like “stuff we already did.”

But I appreciate the rebrand.

I used to be a hacker.

Now I’m pre-training data.

Career growth.

I checked my dashboard to see if I get royalties.

There is no royalties tab.

But there is a leaderboard.

I assume the AI is climbing it.

I hope it enjoys the hoodie.

A few researchers are worried this devalues human work.

I disagree.

My work has never been more valuable.

It’s now infinitely reusable.

Like a zero-day sourdough starter.

I submit vulnerability reports.

The AI absorbs them.

The AI pentests the same targets next quarter.

Somewhere in there is synergy.

Or recursion.

Hard to tell.

I asked support if the AI will be submitting duplicate reports based on patterns it learned from mine.

They said the system is designed to enhance signal.

I respect that.

Nothing enhances signal like automation replaying my exact payloads at machine speed.

I’ve decided to lean into this.

From now on, I will optimize my reports for model readability.

Clear headings.

Concise PoCs.

Structured exploitation paths.

If I can’t win the bounty, I can at least improve the weights.

This is what scale looks like.

The future of bug bounty is continuous, AI-driven testing powered by historical exploit intelligence.

Which is a very elegant way of saying:

“Remember that bug you found? It found you back.”

I’m proud to be part of the ecosystem.

Even if the ecosystem is now pentesting itself.

Submitting my next report tonight.

For training purposes.

[SecurityReapers @SecurityReapers]

@jobertabma @NahamSec @stokfredrik @Hacker0x01 securityreapers

[SecurityReapers @SecurityReapers]

@melardev Hey mate
Can you check dm?

[SecurityReapers @SecurityReapers]

@intruderhex @YogoshaOfficial Hey bro , may i dm you about yogosha.

[₦฿₭ - Paw / Pwn / Purr @nbk_2000]

🎉There's a new #ReconRoyale King in town🎉
Congrats👑@UsmanMansha420👑Couldn't have gone to a nicer human!
May your rule be long and fluffy🐾

[SecurityReapers @SecurityReapers]

@nbk_2000 Thanks mate 🫡 this made my day 🎉🎉

[SecurityReapers @SecurityReapers]

@nbk_2000 Thanks mate 🫡

[SecurityReapers @SecurityReapers]

@pxmme1337 Hey @pxmme1337 , thanks for making this great platform.
I think i found a bug in Wildcard checking in the validation script.
Check your dm for details.

[zhero; @zhero___]

notes on 2024, second year as a VR/bounty hunter

despite its inevitable share of injustices, it is a unique way of life that breathes freedom, based -its functioning at least- on a meritocratic system
its uncertain character can be stressful, but it is what makes it so addictive

[SecurityReapers @SecurityReapers]

@nbk_2000 Thanks mate 🫡

[SecurityReapers @SecurityReapers]

🐬 Wrapped up 2024 with 92 vulnerability reports on @Hacker0x01 along with @M_Zeeshan899 ! Proud to have identified 15 critical issues and helped secure the digital ocean. Here's to more hunting in 2025! 🚀 https://t.co/9wvjiWw0u9

#hackerone #BugBounty #infosec

[SecurityReapers @SecurityReapers]

@nbk_2000 @_Ali4s_ @e1abrador And about umbrella , c99 and dnsdb,
Have you bought a subscription for all of these or do you just use trial and web versions ? Such as umbrella is around 90$ which i checked .

[SecurityReapers @SecurityReapers]

@nbk_2000 @_Ali4s_ @e1abrador Which wordlists do u use for bruteforcing, permutations, and resolvers ?

[SecurityReapers @SecurityReapers]

@nbk_2000 @_Ali4s_ @e1abrador Riskiq/passiveTotal is now part of microsoft xdr which is very expensive and community one is not available, did you buy the whole xdr or is there any cheaper option which i couldn't find?
Also what is avros , can you share URL?
And umbrella is cisco umbrella, right?
#RR_AMA

[SecurityReapers @SecurityReapers]

@nbk_2000 Thanks mate 🫡