Roronoa

Ancora imparo 🛌

[Roronoa @_jayesh_7]

Reached level 4 🫣.

[Adrian Siefer @vfxacs]

Just scored a reward @intigriti 2055 USD :O Still 22 pending bounty, Source code analysis is great if you got the right Workflow! Built your own dedicated System and you will make a fortune in 2027.

https://t.co/chKistxaOK #HackWithIntigriti

[🇷🇴 cristi @CristiVlad25]

How I'd start bug bounty hunting in 2026.

[trial @mainteemoforfun]

Myself and @OriginalSicksec , bagged over 6OK-ish $ bounties from this technique in bug bounties, and based on the current supply chain attacks I wanted to share some thoughts

Note: english not my mother tongue so article is enhaced by AI, but content is not an AI slop I promise

https://t.co/C1b80E5FHt

[🇷🇴 cristi @CristiVlad25]

learn to find IDORs, through real world examples

https://t.co/xwjGOD3uP4

[Roronoa @_jayesh_7]

@hakluke @zseano

[Roronoa @_jayesh_7]

@CristiVlad25 Cool vids

[HackerContent @hacker_content]

Back in 2021 @Hakluke wrote a "how to hack APIs" blog for @Detectify. It ended up being one of the most must-read pieces if your starting out with Bug Hunting or Ethical Hacking, but APIs have changed a lot since then: GraphQL, AI-generated endpoints, all of it.

So Luke rewrote the whole thing for 2026.

Check it out👇

[Shad0w @Itx_Shad0w]

This is by far the Best Write-up on DOM-XSS by @intigriti
https://t.co/yxEIFIhP3t

[Mayur Salve @MayurSalve333]

Bug bounty not just give me the freedom , it completes my dreams too.
All thanks to Bug bounty, hacking and infosec community 🥂❤️

[Roronoa @_jayesh_7]

@NahamSec Yess

[zseano @zseano]

this is a banger

https://t.co/lO6BP967l3

[YesWeHack ⠵ @yeswehack]

Want to sharpen your IDOR, stored XSS and information disclosure skills? 🧠 The hunters who topped our 2025 leaderboards for these bugs – @XelBounty, @Chackal__, @drak3hft7 – shared their best-practice tips 👇
https://t.co/uhs59KkXWG

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

My First Article, if you like it retweet ♥, ill do more ♥ https://t.co/dQWkEaZw8j

[Roronoa @_jayesh_7]

@UrbanLits @pranjalsoni_ Lmao

[Parsa @skydesperados]

6 months ago I found these vulnerabilities across several companies and earned $15K in bounties
I haven’t hunted on web apps in a while and I really miss it
Hope my writeup helps other hunters

Broken access control on Next js server actions
https://t.co/FZYNkvuZlx

[Brute @BRuteLogic]

unKover v1.3 is out.

Download
https://t.co/D9AvN9F4Lh

Catching 403/401 now, and the 2 new testbed cases:

1. Parser Confusion (breaker + static ext)
2. RFC 7239 Forwarded Header Trust

Test it on
https://t.co/Dn719hCXJi

Don’t let a 403 or 401 stop you.

[Roronoa @_jayesh_7]

@theXSSrat Me×♾️

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

Most beginners hunt IDOR wrong. They change one ID, see nothing, and move on.

Here's the 15-minute playbook I actually use:

1. Make TWO accounts (A and B). Always.
2. With A, create everything you can: profile, order, file, invoice, message.
3. Proxy the traffic and note every ID: numeric, UUID, slug, even IDs inside JSON bodies and headers.
4. Replay A's requests using B's session cookie/token. Does B read or edit A's data?
5. Test every verb: GET works, but try PUT, PATCH, DELETE too. Devs often only protect one.
6. Look at the boring stuff: export, PDF download, share links, API v1 vs v2, mobile endpoints.
7. Report it with 2 requests: A's object, then B accessing it. Show impact in one sentence.

UUIDs are not protection. If you can find them (in other responses, emails, shares), you can exploit them.

Practice this today on a free lab: https://t.co/jLmNLzsTlZ

Want to go deeper? Uncle Rat's Pentesting Paradise is the natural next step (discount applies via the link): https://t.co/Gqmxzg3ZUf

What's the weirdest IDOR you've found?

[0xor0ne @0xor0ne]

How to use LLMs for vulnerability research by @ZephrFish (Andy Gill)

MCP: https://t.co/MT4LbPOVGU
Harness: https://t.co/Boa1uD5BQu

#infosec #llm

[0xrudra @0xrudrapratap]

Whoever created this, huge respect.

https://t.co/irzpBY0QWA