Baikuya

Penetration Tester | Software-Dev | CTF Player | OSCP | EMAPT | EJPT

[Baikuya @Baikuya3]

@thedawgyg Is Codex/GPT 5.5 better for bug Bounty in your opinion?

[Baikuya @Baikuya3]

@thedawgyg @mattjay @AnthropicAI I did the same as you and I sometimes get blocked when I try to create weaponized PoC scripts to exploit stuff in Webapps. It's super annoying

[Baikuya @Baikuya3]

@xct_de Have a good time :)

[s1r1us (mohan) @S1r1u5_]

seems twitter missed the ExploitBench paper? few observations:

we finally got good data on Mythos security capabilities and it's very impressive.

Mythos got full exploit chain on 18/41 v8 n-days, while gpt 5.5 only got 1 and open source models are mostly useless.

[Baikuya @Baikuya3]

Is opus 4.7 now better for Bug Bounty/ code review to looking for vulnerabilities than opus 4.6? I'm still using opus 4.6 since the inital feedback on opus 4.7 was so bad

[Baikuya @Baikuya3]

I did some research in Grav CMS. Obviously I also used AI, but Claude missed this bug:
https://t.co/Z8iitrXmBA

This is now CVE-2026-42613, which may lead to unauthenticated RCE.

But Claude found some really nice SSTI chains that also lead to RCE, but this is not public yet. :)

[Baikuya @Baikuya3]

@LiveOverflow I agree. For some companies AI may be a short term winner, but it eventually bite them in the ass.
Comanies should treat it as a tool nothing more

[Baikuya @Baikuya3]

@hackthebox_eu Is this post ragebait? The code has at least 2 Syntax errors, and makes no sense.
I think I know what you are trying to show but there are many parts missing.

[Peter Girnus 🦅 @gothburz]

Someone found an RCE on my website yesterday.

CVE-2025-55182.

React2Shell.

I don't have a bug bounty program.

I never asked for a security assessment.

I woke up to a DM: "Hey I found a critical vulnerability in your site. I only ran the exploit to verify it worked. Here's my PayPal for the bounty."

Bounty?

I checked my logs.

Forty-seven requests to my RSC endpoint.

Something, something ... Prototype pollution payloads.

They used the GitHub script.

The one with 2,000 stars.

The one that runs id automatically "for verification purposes."

They spawned a shell on my production server.

uid=1001(nextjs) gid=65533(nogroup)

They took a screenshot.

They posted it on Twitter.

"Popped a Shell on a Live Website 🚀💀 #BugBounty #CVE-2025-55182 #YOLO"

They got 84781 likes.

My customers' data was on that server.

I asked them to delete the screenshots.

They said "I removed the domain name, you should be thanking me."

Thanking them.

For unauthorized access to my production infrastructure.

For running arbitrary commands on systems I own.

For posting proof of exploitation for clout.

They called it "responsible disclosure."

I called my lawyer.

They called me "ungrateful."

I called the FBI.

Now they're in my DMs explaining that "this is how the industry works" and I "don't understand pen testing."

A pen what?

I understand it perfectly.

I understand that running https://t.co/C6kmBequB5 against random websites isn't research.

I understand that "I removed the identifying info" doesn't undo the unauthorized access.

I understand that #BugBounty doesn't apply when there's no bounty program.

I understand that finding my site on Shodan doesn't constitute authorization.

Their followers are defending them now.

"Presumption of innocence."

"You don't know if it was authorized."

"The screenshots were redacted."

Three hundred people are calling me a bootlicker for reporting a crime.

Someone said I should be grateful they didn't deploy a cryptominer.

The bar is underground.

I just wanted to run a small Next.js app.

I didn't ask to be someone's proof-of-concept.

I didn't consent to being their "first"

I didn't sign up for an unscheduled penetration test from a stranger with a GitHub account.

There is no safe harbor for spraying public exploits at random websites.

There is no legal protection for "I was just verifying the vulnerability."

There is no ethical framework where unauthorized prototype pollution is a favor.

But sure.

Thank you for your service.

You found a CVE that was already public.

Using a tool someone else wrote.

Against a target that never authorized you.

And you posted about it on main.

For likes.

Hero.

[Baikuya @Baikuya3]

@KHIZER_JAVED47 I've seen that often on Rails Apps. I think it's a buildin feature. Also .pdf works as well

[Baikuya @Baikuya3]

@_RastaMouse The hardmode challenges are fun

[Baikuya @Baikuya3]

@vxunderground @cyberwarfarelab This is a comment :)

[Baikuya @Baikuya3]

@dhn_ @ATeamJKR @codewhitesec Why test locally. It needs to run in the target.

[Baikuya @Baikuya3]

@frycos That was a reply greate post. I would be also interested how you approch big codebases like the library

[Baikuya @Baikuya3]

@steventseeley Would you share how you bypassed it? I only see one very limited way

[Baikuya @Baikuya3]

@PR0GRAMMERHUM0R The guy who made this smoked crack. I have no other explaination for this Java ranking

[Baikuya @Baikuya3]

@Dinosn The attack surface looks really limited regarding this post:
https://t.co/3oriiE7nQu

[Baikuya @Baikuya3]

@Cyber78678 @Burp_Suite Is this a new era disrespect to tag the company from which you pirated their software ?
If you make money with their software just pay them man. They also need to pay the Dev's, Support, Staff....

[Baikuya @Baikuya3]

@vinopaljiri I really wish I found this like 3 weeks ago for a CTF Challenge :D

[Baikuya @Baikuya3]

@intigriti https://t.co/QjLQ5vXHOi