AsciiHusky

Don't know much but I know how to 'Quit Vim'

[Abhishek @aacle_]

Everyone is using Claude Code in their bug hunting.

Almost nobody is using it well.

10 habits that separate "I tried AI" from "AI found bugs I'd have missed."

Thread 🧵

[Sirat Sami (analyz3r) @siratsami71]

Last night i used dnsgen which is a great tool for subdomain permutation, but the features was limited and it was really slow, so i thought i have to create a tool by myself for same purpose,
https://t.co/vwfbXUYtQ6

#bugbounty

[Ks7 @ks7X01]

this is really an interesting attack,should be kept in mind.
another attack similar to this is:
1.send the req to change UR email to emA,save the otpA
(race condition): again send a req to change ur email to emB , on another request past the otpA to verify emB
**can be scaled**

[Sayaan Alam @ehsayaan]

Around 7 years ago, I started in security with pure curiosity and a lot of trial & error.

Today, I got to share that journey on a podcast with @SynackRedTeam 🎙️

Grateful for every opportunity that shaped this path.

🎙️Listen on Spotify: https://t.co/GepUSHmGdz

[H4x0r.DZ @h4x0r_dz]

RCE in vim via crafted file.

[AsciiHusky @AsciiHusky]

@siratsami71 @Hacker0x01 Try Substack
Link: https://t.co/Yh1UGQHG28

[Faiyaz Ahmad @thehacktivator]

Don’t waste time chasing expensive AI tools. If you can’t build it, you don’t really understand it.

That’s where most beginners go wrong.

Everyone wants to use AI in cybersecurity, but very few actually learn what’s happening behind the scenes. They rely on tools, copy payloads, and stay stuck.

So I tried something different.

I fine-tuned a local AI model from scratch and trained it to generate smarter XSS payloads using cross-referenced datasets.

No APIs. No cost. Just a simple setup that actually helps you think beyond basic payloads.

If you’re serious about learning the real side of bug bounty, this is where you should start.

Watch here: https://t.co/OQ5xmPUFTl

[Anas Almizani @x6vrn]

i wrote a blog about the art of xs-leak attacks, i did a deep dive into chromium source code for an xs-leak oracle, have fun 😄

https://t.co/hID6fse7re

[Ganesh kumar @iamgk808]

From failures to $32,000 — I’ve shared my complete bug bounty journey.
The write-up also includes the PoC for a GitLab IDOR bug.

https://t.co/ymad1a5TPo

#bugbounty #pentesting #bugbountytip #cybersecurity #hackerone #ethicalhacking #reports #bounty #bugbountytips

[Bug Bounty Community Bangladesh @bbcbd_official]

🚨 Registration Open – @Hacker0x01 Bug Hunt 2026 (Qualifiers Round) 🇧🇩

The wait is over! Registration for the HackerOne Bug Hunt 2026 – Qualifiers Round is now live and will remain open till 25th October.

🔗 Register here: https://t.co/TfXnHe5HYa

#HackerOne #BugHunt2026

[Meydi @mehdiparandin]

Just found an interesting behavior in Firefox that can be used for XSS:
If a response lacks the Content-Type header, Firefox renders it as text/plain.
But if the URL ends with an extension like .html, Firefox treats it as that.
#bugbounty #bugbountytips

[André Baptista @0xacb]

This @bishopfox tool is next level! 🚀

Eyeballer uses AI to analyze screenshots and sorts them into categories based on appearance, including:
👀 Old-looking pages,
👀 Login pages,
👀 404 responses
👀 Web apps
👀 Parked domains

Get your eyeballs around this👇

[A L I @Ali_4fg]

$2,500 Bounties in GraphQL Hacking!

Started learning GraphQL security in Feb and picked a HackerOne program—luckily, it was all GraphQL! Found multiple bugs, including two high-severity ones which I wrote about.
Read here: https://t.co/m7YOM8z4Wo

[Mayowa omolabi @i_am_mayor_]

How SSRF Leads to RCE in a .NET Application https://t.co/Cc2VVIjhGW

[Mohit Mishra @chessMan786]

Introduction to ARM Assembly

[Arika @Arikalabs]

Master x86-64 Assembly by Building a GUI from Scratch – The Ultimate Hands-On Learning Experience! (🔗👇)

[HAHWUL @hahwul]

Dalfox v2.10.0 has been released! It uses way less CPU while XSS scanning even faster than before.

https://t.co/0ODNAHt54c

#DAST #Security #BugBounty

[zhero; @zhero___]

the research paper is out:

Next.js and the corrupt middleware: the authorizing artifact

result of a collaboration with @inzo____ that led to CVE-2025-29927 (9.1-critical)

https://t.co/GZkbnr6o9H

enjoy the read!

[zhero; @zhero___]

Authorization Bypass in Next.js Middleware - CVE-2025-29927

research paper soon!

[Dimitar Tsvetanov @cvetanovv0]

Want to improve your security skills?

One Bug Per Day by @GalloDaSballo helps you learn a new vulnerability every day. A must-have resource for security researchers and developers 👇
https://t.co/zppxDqYf5I