bliss

[Abhishek @aacle_]

My favorite bug class right now: **argument injection.** 🎯

Jellyfin had an unauthenticated endpoint that could turn FFmpeg into a file reader.

📍 `/Videos/{itemId}/stream`

An unvalidated query parameter was passed straight into FFmpeg.

The trick wasn't `;id` or shell injection. ❌

It was an `-vf drawtext` filter that made FFmpeg render `[/]etc[/]shadow` into the video response. 👀

✅ No shell needed
✅ No semicolon
💀 Just argument injection.

[bliss @blissfullxp]

map target, assets, tech, functions, js, params, cs & ss controls, csp, ai for specific :
/rce -> file upload, /xss -> JS file, /oauth -> login flow

[𝐤𝐣𝐮𝐥𝐢𝐮𝐬 @ethical_h4ck3r_]

For first time i found a SQL Injection On **sitemap.xml** endpoint 😎

target[.]com/sitemap.xml?offset=1;SELECT IF((8303>8302),SLEEP(9),2356)#

sleep payload
[1;SELECT IF((8303>8302),SLEEP(9),2356)#] = 9s

Credit: @GodfatherOrwa
Happy Hunting. ❤️

#bugbountytips #bugbountytip

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

Quick tips from episode 191

- If you see a chatbot on an app, read the JavaScript for query parameters that feed it and anything that submits them on load. If a prompt runs straight from the URL, your injection goes from something the victim has to type to something that fires when they open your link.

- Markdown images rendering only from the app's own CDN is a limit on where data can go. Ask what you control on that origin or anywhere else on the same root domain: a request handler you can reach there is enough to take the data directly.

- Per-user assets behind a cache, avatars and thumbnails among them, can carry data out even when you never see the response. If the victim's agent requests a path, that path is now cached, and when you request it later a cache hit tells you they asked for it. Give each character of a secret its own path, and you read it back one position at a time.

- Give herdr(.)dev a try if you run several agents at once, or even if you just want a tmux alternative. It's UI is mobile friendly if you use something like termius and has status indicators for LLM agents.

[𝐤𝐣𝐮𝐥𝐢𝐮𝐬 @ethical_h4ck3r_]

add this XSS payload to your wordlist

url=%26%2302java%26%23115cript:alert(document.domain)

Credit: @GodfatherOrwa

Happy Hunting ❤️
#bugbountytips

[Coffin @lostsec_]

DORK: intext:@"yahoo|gmail|outlook|hotmail".com (filetype:xls OR filetype:csv OR ext:xlsx OR ext:txt OR ext:sql) site:*.gov
----------------------------------------------------------
Not gonna lie, this single google dork I made has given me SO much exposed PII from self-hosted programs and some .gov, .edu, .int and .mil domains.

Use it for BBP targets. If it helps you find something interesting, come back here on X and thank me.

Also, make sure you run this on Bing. Google has fixed/changed some search operators so it will not work.

[André Baptista @0xacb]

Been testing the IDOR trick where you wrap the identifier in an array, in Node JS.

You are 123, victim is 124.
{"user_id": [124, 123]}

The ORM doesn't pick the first element. Sequelize and Mongoose turn it into WHERE id IN (124, 123) and can write both rows.

[VIEH Group @viehgroup]

FROM INTERNET
1)I Thought DHL Was Just Static – Then I Found Multiple IDORs
https://t.co/79NRtKDadb

2)Closing the AI Security Gap
https://t.co/PEV32pqNUN

3)SSRF Hunting Methodology: From Entry Point Discovery to Internal Network Access
https://t.co/0URbMIQgcs

4)Web fuzzing for hackers
https://t.co/L8IB2YWash

5)Baby HackTheBox Writeup
https://t.co/CMGWic8pSG

6)How an Unsanitized “Filter” Input Nuked a SaaS Unicorn’s Database for a $7,000 Bounty
https://t.co/SXRpwBWdGd

7)From Unauthenticated Upload to Stored XSS: Breaking a Production S3 Upload Flow
https://t.co/r9PgYSRcmw

8)Authentication vs. Authorization: How a Misconfigured OAuth Chain Led to an Auth Bypass
https://t.co/XsPOvg0H4S

9)How a “Delete Account” Button Became a $12,500 Nuke for an Entire User Database
https://t.co/0W4T6GBb21

10)I Analyzed HackerOne’s 100 Biggest Payouts Ever.
https://t.co/iFvfrMbUSX

#bug #bugs #bugbounty #bugbountytip #bugbountytips #hacking #hacker #ethicalhacking #ethicalhacker #ethicalhackers #cybersecurity

[Silenz @silenz404]

WAF blocking /wp-login.php? Encode a char.
`/%77p-login.php` and `/wp-login%2ephp` → 200, login page fully served. WAF matches the raw path, origin decodes it. Always fuzz blocked paths with %-encoding🔓 #bugbounty #bugbountytips

[XIII Lumiere @uMdaliWethu]

1/
Got my first paid valid on HackerOne.

$1,000 for an unauthenticated Prometheus metrics endpoint that was exposing way more than it should have in production.
Here’s the short version + what I learned.

[Nitin Gavhane @NitinGavhane_]

📂 BUG BOUNTY
┃
┣ 📂 Recon
┃ ┣ 📂 Subdomain Enumeration
┃ ┣ 📂 Asset Discovery
┃ ┣ 📂 Port Scanning
┃ ┣ 📂 HTTP Probing
┃ ┣ 📂 DNS Enumeration
┃ ┗ 📂 Tech Detection
┃
┣ 📂 Web
┃ ┣ 📂 IDOR
┃ ┣ 📂 XSS
┃ ┣ 📂 SSRF
┃ ┣ 📂 SQLi
┃ ┣ 📂 CSRF
┃ ┣ 📂 SSTI
┃ ┗ 📂 File Upload
┃
┣ 📂 API
┃ ┣ 📂 API Discovery
┃ ┣ 📂 BOLA
┃ ┣ 📂 Authentication
┃ ┣ 📂 Authorization
┃ ┣ 📂 Rate Limiting
┃ ┗ 📂 Mass Assignment
┃
┣ 📂 Auth
┃ ┣ 📂 OAuth
┃ ┣ 📂 JWT
┃ ┣ 📂 Sessions
┃ ┣ 📂 MFA
┃ ┗ 📂 Account Takeover
┃
┣ 📂 Automation
┃ ┣ 📂 Recon Automation
┃ ┣ 📂 Nuclei
┃ ┣ 📂 Custom Scripts
┃ ┣ 📂 Asset Monitoring
┃ ┗ 📂 Workflow Orchestration
┃
┣ 📂 Burp Suite
┃ ┣ 📂 Proxy
┃ ┣ 📂 Repeater
┃ ┣ 📂 Intruder
┃ ┣ 📂 Extensions
┃ ┗ 📂 Match & Replace
┃
┣ 📂 Cloud
┃ ┣ 📂 AWS
┃ ┣ 📂 Azure
┃ ┣ 📂 GCP
┃ ┣ 📂 S3
┃ ┗ 📂 Misconfigurations
┃
┣ 📂 Reporting
┃ ┣ 📂 Validation
┃ ┣ 📂 PoC
┃ ┣ 📂 Impact
┃ ┣ 📂 Severity
┃ ┗ 📂 Report Writing
┃
┗ 📂 Growth
┣ 📂 Writeups
┣ 📂 CVE Research
┣ 📂 New Attack Surfaces
┣ 📂 Workflow Optimization
┗ 📂 Continuous Learning

The goal isn't to use more tools.

It's to build a workflow where every step feeds the next.

Recon → Discover → Test → Validate → Report

That's bug bounty orchestration.

#BugBounty #CyberSecurity #AppSec

[DestroyerX @ide9x]

Yay, I was awarded a $250 bounty on
@Hacker0x01! https://t.co/1FhwPFQuEN #TogetherWeHitHarder

they take 5 Months to Reward me 🫠

Tip:
api/v1/internal... ❌ 403
api/v1%2finternal... ✅200 OK

#BugBounty #HackerOne #WafBypass #CyberSec #bugbountytip #bugbountytips

[VIEH Group @viehgroup]

Session ID Reuse -> Privilege Escalation

POC ->
1. Obtained a low-privileged session ID.
2. Tested the same session ID against another API.
3. The API accepted the session without re-authentication.
4. Access to a higher-privileged interface was possible.

Learning ->
1. Bind session IDs to the correct authentication context.
2. Never reuse session tokens across privilege boundaries.

#BugBounty #CyberSecurity #BugBountyTips #InfoSec #WebSecurity

[VIEH Group @viehgroup]

CSS Injection -> Sensitive Data Leak

POC ->

1. Found user-controlled CSS being rendered by the application.
2. Confirmed the input could influence CSS selectors or styles.
3. Used CSS behavior to infer sensitive page content.
4. Exfiltrated the inferred data through controlled requests.

Learning ->

- Never allow untrusted users to inject CSS into sensitive pages.
- Treat CSS injection as a potential data-leak primitive, not just a visual issue.

#BugBounty #CyberSecurity #BugBountyTips #InfoSec #WebSecurity

[VIEH Group @viehgroup]

Web Cache Poisoning -> Stored XSS

POC ->

1. Found an unkeyed request header reflected in a cacheable response.
2. Confirmed the response was stored by the web cache.
3. Injected a payload into the reflected value.
4. Verified the poisoned response was served to subsequent visitors.

Learning ->

- Identify inputs that affect a response but are ignored by the cache key.
- Never cache responses containing unsanitized attacker-controlled input.

#BugBounty #CyberSecurity #BugBountyTips #InfoSec #WebSecurity

[Kanishk Dadhich @whotfbunny]

🎯 Advanced Bug Bounty Tip: Hunt Web Cache Poisoning via Unkeyed Inputs

CDNs/caches often key on the URL + a few headers — while ignoring others like:

→ "X-Forwarded-Host"
→ "X-Original-URL"
→ "Accept-Language"

If the origin reflects an unkeyed input into the response, you may be able to poison the cached response for other visitors.

🔎 Workflow:
1️⃣ Find a reflected/unkeyed input with Param Miner
2️⃣ Confirm it’s unkeyed using random cache-busters
3️⃣ Inject a controlled payload, e.g. "X-Forwarded-Host"
4️⃣ Test for impact such as poisoned redirects or XSS
5️⃣ Verify the poisoned response is served to subsequent requests sharing the cache key

One overlooked header can turn a low-impact reflection into a mass-impact vulnerability.

#BugBounty #AppSec #WebCache #WebSecurity #CyberSecurity

[Michael Bargury @mbrg0]

it gets worse. using Claude in Chrome? xss is making a comeback! welcome back to the 90s!

[Kanishk Dadhich @whotfbunny]

🎯 Advanced Bug Bounty Tip: Don't just fuzz endpoints — fuzz the state.

Most hunters test parameters in isolation. The real bugs often hide in sequence-dependent logic.

Examples:
→ Trigger a password reset, then call the verify endpoint out of order.
→ Start a multi-step checkout, skip step 2, and jump straight to step 4.
→ Reuse a JWT issued for one workflow (e.g. email verification) against an endpoint from a different workflow.

In 2026, race conditions + broken state machines are often more rewarding than blindly hunting simple IDORs.

💡 Tool tip: Burp Suite's Turbo Intruder is still massively underused. Use "queueRequest()" to script out-of-order request sequences instead of relying on manual Repeater tabs.

The highest-impact bugs usually aren't:

«"Is this endpoint vulnerable?"»

They're:

«"What happens when I use this endpoint in a way the application never expected?"»

#BugBounty #AppSec #CyberSecurity #WebSecurity #Pentesting #BurpSuite #TurboIntruder #BugHunter

[Root Vuln @rootvuln]

Found SSRF on an API endpoint that converts HTML to PDF. Uploaded HTML with an external stylesheet link, and the server actually fetched it — confirmed via OOB callback. Also tied to a known CVE in the outdated library it's using. Reported responsibly 🛡️
#infosec #bugbounty #SSRF

[Nitin Gavhane @NitinGavhane_]

JavaScript Recon → Valid HTML Injection

1/7
Most bug bounty hunters stop after finding interesting JavaScript files.

Here's the methodology I followed. 👇

#BugBounty #JavaScript #AppSec