AAraAp

ctf-player

[N45HT @N45HTOfficial]

$3,700 Anthropic Bug Bounty 🤑

[CVE-2026-55607] Claude Code: unsandboxed code execution from prompt injection via .git worktree confusion by Metnew 🤯🔥

👨‍💻 Metnew (x/v_metnew)
🔗 https://t.co/dtsVm6ad2X
🔗 https://t.co/rQlO6X6Ive
🔗 https://t.co/Se8VjhMlzS

[Athul 🇮🇳 @Athul_m_s]

403 to SQLi💥
@Bugcrowd
#BugBounty #bugbountytips

[hiddendomy @IamGokulesh]

#bugbountytip

A publicly exposed Firebase configuration allowed unauthorized data uploads.

Firebase configuration allowedunauthorized data uploads.

Command:
curl "https://t.co/9XcpnVOrz5" -XPUT -d '{"POC":"POC"}

#bugbounty #bugbountytips #bugbountytip #bugcrowd #hackerone

[Densel @luckyhacker43]

✈️ Critical Account Takeover (ATO) via Broken Access Control 🤯🔥

Real-world bug bounty write-up showing how a critical flaw led to full account takeover.

📖 Read the research below.

📲 More bug bounty write-ups & cybersecurity content:
https://t.co/FeMz53HSN0

[Vivek | Cybersecurity @VivekIntel]

⚙️ n8n CyberSecurity Workflows - 100+ Security Automation Blueprints

A collection of 100+ cybersecurity workflow ideas for n8n covering Red Team, SOC, DFIR, Threat Intelligence, AppSec, DevSecOps, Cloud Security, and Security Operations.

Includes automation playbooks for IOC enrichment, threat intel ingestion, phishing triage, vulnerability management, attack surface monitoring, subdomain reconnaissance, SAST/DAST pipelines, cloud security auditing, incident response, and SOAR-style workflows using tools like Nmap, Nuclei, ZAP, Semgrep, Trivy, VirusTotal, Shodan, MISP, Splunk, Elastic, CrowdStrike, AWS, Azure, and GCP.

🔗 https://t.co/hg3ulWUJvi

#CyberSecurity #n8n #SecurityAutomation #SOC #DFIR #AppSec #DevSecOps

[Web Security Academy @WebSecAcademy]

If you're manually exploiting a SQLi, one of the most important parts is figuring out how many columns you're dumping.

There are many methods, but using ORDER BY is particularly efficient!

[Aircorridor @_aircorridor]

IP Camera Hacking: The FFmpeg Tool for Streaming Camera Video

With IP cameras all over the world, who ever has access to these cameras will have a leg up on reconnaissance and data on the target:
https://t.co/dLS980H8dm
@three_cube @DI0256 @IamSmouk @co11ateral

[Densel @luckyhacker43]

🚨 Google Tag Manager + CSP = XSS? 🤯🔥

A common CSP setup recommended for Google Tag Manager can open the door to XSS attacks. Bug hunters and pentesters should know this trick. 👀

🔍 Read: https://t.co/ruSV0cgCD4

💎 More bug bounty tips & writeups:
👉 https://t.co/FeMz53HSN0

[Densel @luckyhacker43]

Blind SSRF Leads to Internal Service and IP Discovery with Multiple Security Impacts by Mohamed M Mourad 🤯🔥

👨‍💻 Mohamed M Mourad (in/mohamed-m-mourad)
🔗 https://t.co/TjGLBidDFE

Stay connected:
🔗 Join team 👉https://t.co/FeMz53HSN0

[Clandestine @akaclandestine]

CVE-2026-42530 NGINX RCE

[BRute Logic @BRuteLogic]

The Crypto Layer Bug Bounty Misses

Every bug bounty hunter tests for SQLi, XSS, IDOR, auth bypass.

Almost nobody tests the crypto layer.

Not because it's hard. Because nobody showed them where to look.

The server doesn't hand you the key. It leaks math through its behavior.

A timing delta. A Content-Length difference of three bytes. A distinct HTTP status code on bad padding.

That's the oracle. The oracle exists before you exploit it.

CVE-2025-22150 undici, the HTTP client behind Node.js fetch, insufficient randomness in session token generation. Every modern Node.js app is a candidate. One curl captures the token. UUIDv1 structure exposes MAC address and timestamp. The Iterate step enumerates a ±1 second window, 10 million 100ns ticks. The Take step hijacks the session.

BREACH turns HTTP compression into a CSRF token extractor. The oracle isn't in the app: it's in Nginx, running silently at the proxy layer. Most hunters check "does the app use compression" and move on. The oracle is already there.

Padding oracle: one malformed ciphertext, one status code difference. Byte by byte, the plaintext surrenders. Then you forge the admin token and fire it.
That's LIT. Leak. Iterate. Take.

This work covers 4 attack families. 21 CVEs. 5 chapters. Padding oracles. Compression oracles. PRNG seed recovery. Hash length extension.

Every technique has a LIT-labeled PoC. Every command tested on Ubuntu 24. No theory without payload. No placeholder code.

Three original detection primitives named here first: Oracle Classifier, Compression Oracle Probe, Signature Surface Probe. No existing scanner packages these as standalone pre-flight checks.

Most hunters walk past this every day.

Full breakdown in the replies.

[VIEH Group @viehgroup]

Browser Extension Token Theft -> Account Takeover

POC ->

1. Installed a browser extension with excessive permissions
2. Extension accessed authenticated web sessions
3. Session tokens were extracted from browser storage
4. Attacker reused tokens to access accounts

Learning ->

1. Review extension permissions carefully
2. Avoid storing sensitive tokens in accessible browser storage

#BugBounty #CyberSecurity #BugBountyTips #InfoSec #BrowserSecurity

[Densel @luckyhacker43]

Cloudflare WAF Bypass Leading to Reflected XSS via SVG Injection by Md Saikat 🤯🔥

👨‍💻 Md Saikat (x/0x_Saikat)
🔗 https://t.co/dVT5NcuDuU

🔗 Join team 👉https://t.co/FeMz53HSN0

[Densel @luckyhacker43]

Privilege Escalation via IDOR Allows Unauthorized User Injection 🤯🔥

🔗 https://t.co/vANPlMaI8C

🔗 https://t.co/FeMz53IqCy

[Densel @luckyhacker43]

Blind SSRF Leads to Internal Service and IP Discovery with Multiple Security Impacts by Mohamed M Mourad 🤯🔥

👨‍💻 Mohamed M Mourad (in/mohamed-m-mourad)
🔗 https://t.co/TjGLBiebvc

Stay connected:
🔗 https://t.co/FeMz53IqCy

[BRute Logic @BRuteLogic]

JWT Auth Bypass TestBed

https://t.co/qoYUYTxduT

Test your skills: 18 main tests with variations.

A proprietary tool with 40+ techniques for Brute One will be available this week to spot all these cases in the wild in a matter of seconds.

https://t.co/ThMs09G3Hp

[Intigriti @intigriti]

HaE by @VulkeyChen is a Burp Suite extension that automatically highlights and extracts sensitive data patterns across your HTTP traffic using customisable regex rules! 🤠

Check it out! 👇
https://t.co/uixAyfXcvM

[Thierry @0x7hierri]

IDOR.

Enumerated teams api. /api/v1/teams to collect uuids of the members.

Then iterated UUIDs:

https://api.[reduced].com/api/v1/uuid

Accidentally got super sdmin details as well.

[Coffin @lostsec_]

@WebSecAcademy advance version here: https://t.co/e5cNIzHomH

[VIEH Group @viehgroup]

Password Reset Token Leak -> Account Takeover

POC ->

1. Requested password reset link
2. Reset token appeared in URL parameters
3. User visited a third-party page afterward
4. Token leaked via the Referer header

Learning ->

1. Never expose sensitive tokens in URLs
2. Use short-lived, one-time reset tokens

#BugBounty #CyberSecurity #BugBountyTips #InfoSec