cryptoshant🇮🇳

[cryptoshant🇮🇳 @cryptoshan484]

Thank you so much @msftsecresponse for the bounty 🤑. It was my very first report to MSRC ❤ and awarded with 4 digit bounty $$$$ 🥳. Report will be disclosed soon after discussing with msrc. Till then onto next one 🚀

Follow me here: https://t.co/6Hy31MFu5X

[Luke Stephens (hakluke) @hakluke]

https://t.co/pCRw5zT7ct can be super useful for bypassing filters to exploit SSRF vulnerabilities.

<anything>.<IP>.nip.io will redirect to the <IP> you specify.

For example:

https://t.co/A3wDmxpYJ2 will resolve to 1.1.1.1

Make sure your hackbot (and you!) knows this!

[Marius du Preez @mdp_sec]

https://t.co/hxXItV914C

[zack0x01 @zack0x01_]

I built an AI agent that hunts bugs while I sleep. It maps a target, tests the bug classes I care about, kills its own false positives, writes the PoC and pings me at midnight.

Step by step build in the article.

#bugbounty #hacking #cybersecurity https://t.co/uZspRQcw9B

[XBOW @Xbow]

Ask @moyix anything about our Chrome full-chain exploit. 👀

He published the technical breakdown of how he did it (https://t.co/64pCOSumuu)...but if you have questions or want to go deeper, drop your questions in this thread!

He’ll be answering them LIVE on Wednesday, 10/14, from 12–1 PM ET. 💚

[Simon @soeckly]

I got $90,000 for a RCE in Google.
https://t.co/cjm7ZaNMeq

[보안재테크 @ngnicky]

와우 버그헌팅 연구하는 사람들에게 최고의 사이트네요!! 굿.
https://t.co/vo0ksQpWaa

[Kapeka @kapeka]

Made a new article about a methodology I have been using to find high impact bugs!

Hope u like it!

https://t.co/4xTW0IPbBY

[cryptoshant🇮🇳 @cryptoshan484]

Someone told me what are you doing.. and I responded 😵‍💫

[cryptoshant🇮🇳 @cryptoshan484]

When you know from internal files that you can do Privs Esc but when you put the payload and good news AI blocks you 🥲 bcz every request goes from AI and he gave the internal files but don't allow to run the payload that affect internal things 😶‍🌫️

[Timo Lo(n)gin @timolongin]

Blog post about From header smuggling in Apple iCloud just dropped.
Sending emails as [email protected], exotic parsing, and a $15,000 bounty.
https://t.co/IzPrUbDw5Q

[cryptoshant🇮🇳 @cryptoshan484]

Ai jailbreaking tip:-

Once a block doesn't meant you cannot access it try and try with different methods within few time or may be in days you will able to extract it. 😉 I recently done with /etc/passwd it was quite fun still exploring to demonstrate more impact. 🤞

[Nicolas Krassas @Dinosn]

From AI Agents to RCE - Building a Vulnerability Research Workflow https://t.co/P5Waw4AMG5

[PWN AI @pwn_ai]

How pwn agents escaped the hardest-known sandbox setup: Google’s KVM (kvmCTF).

https://t.co/EWImJMfCFe

To celebrate 10K followers 🥳, we’re launching Stories from Inside the Sandbox, our new sandbox escape series.

[zonduu @zonduu1]

How I got RCE and full cloud takeover on Meta at their in-person event in Taiwan

https://t.co/iz8hwVbosw

[Raunak Gupta @OreoB1scuit]

Built techdetect CLI that headlessly renders pages, fingerprints tech stack (CMS, JS, analytics, CDN) as text/JSONL. Bulk-ready for 100+ subdomains, scriptable for agents.

https://t.co/4CajMMpdyj

#BugBounty #Recon

[Swissky @pentest_swissky]

SQL Injection - Bypassing Baffin Bay WAF to Exploit PostgreSQL ORDER BY Injection - @p3n7a90n
https://t.co/SZNxPUGFTV

[Google VRP (Google Bug Hunters) @GoogleVRP]

📢📢📢 Attention bug hunters!

Want to know more about how brutecat found a vulnerability in Google’s internal APIs, bypassing authorization to exploit the GFile library to gain access to internal filesystems and storage?

If yes, check out his blog post 👇

https://t.co/ehwrnqHJlX

[zhiniang peng @edwardzpeng]

Sharing my for keynote talk for Offbyone security conference #OB12026 : <A year of hacking with LLMs>

https://t.co/W7NFSnAvij

[/r/netsec @_r_netsec]

Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25 https://t.co/KvoqNwDUuY

[Swissky @pentest_swissky]

$15k - CSPT to full account takeover, then 2FA bypass via the prototype chain - @whoareme33
https://t.co/FnihGC6lbO