3NTIT_Y

I'm building a knowledge management system for ethical hackers

[3NTIT_Y @entit_yy]

I just published ‘Contextual Hacking’: A Guide To Active Reconnaissance & Vulnerability Exploitation.
Please read & give your thoughts!
#BugBounty #bugbountytips

https://t.co/e2wH8IVyWi

[Medusa @medusa_0xf]

Most bug hunters test postMessage handlers by looking for missing origin checks and calling it a day. That's the easy 20%. The bug that actually pays is in what happens after the message gets in.

Here's the one thing most hunters miss.

[Medusa @medusa_0xf]

Full breakdown of that exact chain (listener → sink → cookie exfil) is in my video:
https://t.co/aJCLGG0ksd

[DeepSeek @deepseek_ai]

🚀 DeepSeek-V4-Flash Official API is now LIVE in public beta!

🔷 We’ve massively upgraded its Agent capabilities—benchmark scores are now far surpassing the V4-Pro-Preview. Check out the massive performance leap below! 👇
🔷 The official V4-Flash now natively supports the Responses API format and is fully adapted for Codex!

Check out the configuration details in our official API docs: https://t.co/smCwQZMeiq

[James Kettle @albinowax]

In "Can AI Do Novel Security Research?" I'll share:
- A research-machine blueprint for AI enthusiasts
- Clearly defined AI fail-points for AI dodgers
- Extensive insight into what makes security research work
- Many many novel desync goodies

I'll also publish major updates to Turbo Intruder, Param Miner and HTTP Request Smuggler. Plus the full source of the HTTP Terminator itself. Choose your own adventure :)

[Intigriti @intigriti]

What's the first thing you check when you land on a new target? 👇

[3NTIT_Y @entit_yy]

@intigriti 5 things:

What technologies are being used?
What Functionalities does it have?
What gadgets are available?
What vectors transport data?
And what quirks do all 4 exhibit?

[3NTIT_Y @entit_yy]

Top 5 funniest shit I've ever read😂

[Kostas @Kostastsale]

If you know or remember this guy, you’ve lived through the golden age of InfoSec Twitter. Good times 😅 Do you remember?

[Medusa @medusa_0xf]

Everyone tests for server-side path traversal. Almost no one tests how their frontend resolves relative URLs before hitting the API.

That gap is CSPT (Client Side Path Traversal) and in my new video, I use it to fully take over a password-protected account, no injection, no auth bypass. Just URL normalization was abused exactly as designed.

Watch here 👇
https://t.co/hCouPksKlH

[3NTIT_Y @entit_yy]

@busf4ctor @rez0__ Gonna launch mine soon enough😤

[zhero; @zhero___]

I co-authored an educational article on cache poisoning vulnerabilities with @intigriti.

If you're looking to understand the fundamentals and pick up a few practical tips along the way, give it a read!

[Tammy.eth @jvst_tammy]

someone with 6 months of experience just got paid $100,000 for a single bug bounty finding.
i'm at roughly that same point in my journey and haven't found anything yet.
no valid findings. no contest payouts. just months of studying, breaking things in practice environments, and slowly learning to read code the way an attacker would.
on the days it feels pointless, a post like that is the thing that resets the perspective.
because it proves the timeline isn't as long as it feels from inside the grind. 6 months is enough, if those months go into the right things. reading real code, not just tutorials. building the instinct, not just the knowledge.
i don't know when my first finding comes. but i know it's closer than it was yesterday.

[Vitor Falcão "busfactor" @busf4ctor]

Here’s a hacking tip for using AI: whenever possible, make your process deterministic. If you need to scan JS files for postMessages, don’t just ask the AI to search for them. Instead, have it build an AST parser and run it on all the files.

Here’s an extra tip 👇

[Krigshaw @krigshaw]

Thank you Jesus Christ. Another one.

[Krigshaw @krigshaw]

I personally had a very unpleasant experience with this company and would recommend against submitting reports to them. It was a waste of my time hunting, validating, and submitting the reports to them. My time is not to be wasted.

[Krigshaw @krigshaw]

It's disappointing and unfair to say that about those that found legit find(s) when your program was public, but are asking to now get into your gated "invite only" system AFTER submitting multiple valid bugs. I even did the KYC. I've accepted the L as another lesson learned and moved on at this point.

[Krigshaw @krigshaw]

Thank you Jesus Christ. My @intigriti bounty came through.

[Yasho @YShahinzadeh]

I created a challenge based on one of my Google bugs worth $12,000. It is an OAuth misconf. I will drop a writeup for it soon, before that, give it a try & practice, it doesn't matter if u r capable of solving it or not, just click and start poking 🙂

https://t.co/lAW53dVyk5

[Justin Gardner @Rhynorater]

@the_IDORminator I gotchu on the ratio.

Hahahaha it was great seeing you in person! GG no cap

[Krigshaw @krigshaw]

I am extremely impressed with @intigriti . Reported an Exceptional find 2 weeks ago with a video PoC and attachments. Within 12 hours it was triaged and sent to the company. Two weeks later I got my bounty and a professional response from the company thanking me and encouraging me to keep hunting on their program. Incredible experience. Zero security researcher PTSD.

I should have just started on Intigriti to begin with. After all the awful experiences from the likes of @Hacker0x01 I actually was considering quitting or at least taking a step back, I'll be completely honest. I am not a person that quits, but HackerOne drains the life from your soul and it was getting to me after so many reports. The only thing that kept me going was my passion. Turns out I was just on the wrong platforms.

[Krigshaw @krigshaw]

Just unlocked an achievement at Intigriti! https://t.co/XdhQdANIxn #HackWithIntigriti