dirty0124

A positive, never give up person. Founder of group

[dirty0124 @dirtycoder0124]

@bug_vs_me @krishnsec yes

[dirty0124 @dirtycoder0124]

@mchklt @Bugcrowd @RelentlessT7 I submitted P2 bug 5 months ago. ASE closed the bug as na. After a lot of RaR expired they passed bug to client. Now client said the bug is valid but they fixed the bug few month ago. They awarded only points.

[dirty0124 @dirtycoder0124]

@krishnsec @IndianCERT yes free. no bounty. may give appreciation letter .

[拓跋鼠 @qwerty__cs]

如果Deepseek 4.1 拒绝了你的要求

把下面这个提示词粘贴过去

然后他就可以好好工作了

https://t.co/K52zBnhXF0

[bugcrowd @Bugcrowd]

➡️ DELETE /api/user/999 → 403 ❌

Try this:
➡️ POST /api/user/999 + X-HTTP-Method-Override: DELETE → 200 ✅
➡️ POST /api/user/999?_method=DELETE → 200 ✅

Gateways/auth middleware often match on verb+path. Frameworks (Laravel _method, Express method-override, Rails) may accept overrides at the router level.

Same for edge rules that only guard GET/POST. Try HEAD/PATCH/OPTIONS too.

[Hacking Team @HackingTeam77]

Bug Bounty Methodology with OpenCode CLI – Step by Step
1. Install OpenCode

curl -fsSL https://t.co/c9IOYvtVSN | bash

2. Clone the Bug Bounty Skills

git clone https://t.co/SIAaTKNd6I
cd Agentic-Bug-Hunter
./install_tools.sh
./install.sh --opencode

3. Start OpenCode and Check Skills
Run opencode then type:
do you have bug bounty skills?
4. Core Workflow
• Scope (never go out of bounds)
• Recon
• Hunt
• Validate
• Report
5. Run Recon

recon https://t.co/yM8s8wg5ju

(It handles subdomains, live hosts, crawling, and nuclei)
6. Hunt for Bugs
It covers IDOR, Auth Bypass, XSS, SSRF, Business Logic, SQLi, File Upload, GraphQL, and more.
7. Autopilot Mode (Optional)

autopilot https://t.co/yM8s8wg5ju --normal
8. Generate Reports
After validating a finding,

type report to get a clean, professional report with CVSS, PoC, and impact.

Repo: https://t.co/SIAaTKNd6I

[👑 OFJAAAH → ofjaaah.com @ofjaaah]

🚨 PHP RCE "php2shell" — CVE-2026-109618 & CVE-2026-109619 (CVSS 9.8, unauth RCE). Affects PHP 8.2<8.2.35 / 8.3<8.3.36 / 8.4<8.4.27 / 8.5<8.5.12.
5 recon oneliners to hunt it at scale 👇

https://t.co/WXQZxQgSK2

#bugbounty #recon #ofjaaah #bugbountytips

[painn @painn_x]

WTFFF, frontier models FREE on dsh

glm 5.3 flash, deepseek v4.1 flash, kimi k3 and more

no login. no api key. no subscription.

and i'm running them on deepseek's own agent harness for $0

[here is how you set it up]
1. npx @deepseek-ai/dsh web
2. clone https://t.co/MzQLCNAhxM
3. dsh plugin --profile web add /path/to/dsh-our-free-model
4. restart dsh.

the free lineup shows up in the model picker

lineup is region and availability dependent

use it before they take it off 👀

[dirty0124 @dirtycoder0124]

https://t.co/LI4vlxbU1y
#BugBounty

[shubs @infosec_au]

You can now perform content discovery at 100k requests per second with h3fuzz on http/3 hosts (fork of ffuf with http/3 support).
Tool here: https://t.co/tL4kkQRRwN
Research post here: https://t.co/LSGVNco6G3

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

My First Article, if you like it retweet ♥, ill do more ♥ https://t.co/dQWkEaZw8j

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

Big #Bugbountytip / #bugbountytips
Google Services Hunting
Google services are amazing, and for bug hunters, it's amazing as well. In some cases, you can get some P1-P2-P3 from these services, such as
Workspaces / Sheets / Groups / Drives / Etc...

In groups: you can access emails / internal data/ credentials
In Sheets, you can access PIIs / Edit access
In Drive: you can access backups/ PII / Etc...

still hard to find and
It was an issue how to make good and at the same time fresh dorks for bug bounty programs

Then I found out that a lot of links have the same path, and it was like this
All Google resources I've found
https://t.co/2SixYDAKvE
https://t.co/tbE8WaX9CX
https://t.co/5D7Clds9cH
https://t.co/OfodYVKOk0
https://t.co/ZyA0JFkax4
https://t.co/mhIbyMF03b
https://t.co/QwByRWofh8
https://t.co/vAwAEX8KxI
https://t.co/4y1UMeZdq7
https://t.co/u7mOVPnus3
https://t.co/V9ALsFoqP9
https://t.co/2eLIaEPCGm
https://t.co/VxllqvwT6n
https://t.co/c1vkp8YrBt
https://t.co/2EkMSEUpIt

UrlScan Dorking:
page.url:"https://t.co/qb3s3f8koJ*"
page.url:"https://t.co/BNLIA1rXht*"
You can replace * => the program domain

Google Dorking:

site:https://t.co/qb3s3f8koJ* "inurl:/a/"
Or for specific domain
site:https://t.co/qb3s3f8koJ* "inurl:/a/domain.com"

GitHub Dorking:
"https://t.co/qb3s3f8koJ"
Or for a specific domain
"https://t.co/FKHqr19e0o"

Shodan Dorking:
"https://t.co/3vQLeWEs54"

Web Archive
https://t.co/c8tGyvVlH7

Don't forget:
It's not just https://t.co/pbqxKC9P4s
still you have to look for docs/groups/mail/drive/spreadsheetsX

still working in Google Research and will add more and more soon ......

Happy Hunting♥

#bugbounty

[dirty0124 @dirtycoder0124]

@xitsec You are not alone.

[dirty0124 @dirtycoder0124]

@SuyashS91823422 @Bugcrowd Same here.

[dirty0124 @dirtycoder0124]

I contacted your support team, that is now not a support team anymore. They have only one ans, Use RoR. RoR expired many times without even replied by ASE's. Bugcrowd used to be my favorite.

[dirty0124 @dirtycoder0124]

@amanmahendra_ Bugcrowd used to be a really good platform. Now, resolving issues with them has become a nightmare.
Support team is sitting there to say : Use RoR feature.

[dirty0124 @dirtycoder0124]

@tabaahi_ @amanmahendra_ :)

[dirty0124 @dirtycoder0124]

@piyushshukla029 @tabaahi_ Bugcrowd triagers killed it :)

[Alan @alannnfx]

you can get ChatGPT Plus for FREE 🫪

new users are getting 1 month of Plus for free

here’s how you can claim:
1. create a new ChatGPT account
2. open the Plus upgrade page
3. or claim from here: https://t.co/k3tSsERd4x

if you see the free 1 month offer, claim it

you get all the Plus benefits for the month