ROBOT 321

[cyber_shree @shreerajaput]

Found that just using a user ID could generate a valid session token, leading to account creation without proper authentication. Simple but high impact → triaged as P1.

Good reminder: auth & session logic needs deep testing 🔍

#BugBounty #CyberSecurity #AppSec #AuthBypass #P1

[Omar @PixelatedOmar]

Yay, I was awarded a $400 bounty on @Hacker0x01! https://t.co/ZJIICsQAG2 #TogetherWeHitHarder #bugbounty

[Ganesh Bagaria @Ganofins]

Got the max

#bugbounty

[Aditi Singh @aditi_singghh]

Working on hardware devices has been fun lately.
Recently crossed ~$20k in bounties from Amazon’s Device Vulnerability Research Program (mostly FireTV) on @Hacker0x01 .
A lot of learning along the way, especially around device-level security. Still have a few reports under review

[Max Yaremchuk @0xw2w]

Yay just got a $25k bounty from H1 /security program 🎉 We can say I was lucky to keep 50% of my bounty because I landed this report just a few days before the controversial no-grace-period 50% budget cut. I barely managed to catch my last train 😁

[yoyomiski @yoyomiski]

Today triaged 4 bug
> 2 bugs IDOR and LFI were found using AI. It discovered issues that I had previously missed during manual testing — really amazing 🥳🥳
> 2 bugs were found manually as usual
Let’s keep pushing forward!
#bugbounty #AI #IDOR #LFI

[Supr4s @supr4s]

Just got a reward for a critical vulnerability submitted on @yeswehack -- Improper Access Control - Generic (CWE-284). https://t.co/wCFzv83uWT #YesWeRHackers #HackThePlanet 🏴‍☠️

[Paier @0xpaier]

From least privilege to organization takeover :)

[Mr.ZheeV @GhiffariZaid]

Yeay, I was awarded for a valid submission on @HackenProof https://t.co/kvbheiU5e5 #hackenproofed #bugbounty

[JS0N Haddix @Jhaddix]

Day TWO of FIVE days of celebrating our 2 year ARCANUM-VERSARY! @arcanuminfosec

3rd Giveaway = FOUR seats to our new course by @the_IDORminator "Zero to [BAC] Hero" !

👍 1 Like = 1 Entry!
♻️ 1 Share = 2 Entries!

Winners announced 1/21! Syllabus link below 👇

[ROBOT 321 @iamrobot321]

@grok @itsz_lisa @grok change one girl to gustavo fring and other girl to walter white from breaking bad season 3

[ROBOT 321 @iamrobot321]

@itsz_lisa @grok @grok change the background to swimming pool

[ROBOT 321 @iamrobot321]

@broken_link420 mate open your dm to dm u

[ROBOT 321 @iamrobot321]

@dizzysec buddy can u dm me...bcz ur dm is closed...if u dm me than i dm u

[ROBOT 321 @iamrobot321]

@Jake86313119721 buddy check dm plz

[ROBOT 321 @iamrobot321]

@jiraya0806 buddy check dm plz

[ROBOT 321 @iamrobot321]

@the_IDORminator plz check dm

[A.Mugh33ra🇵🇰❤️🇵🇸 @mugh33ra]

Found a critical 0-click ATO in https://t.co/zRSPIyEUs0
Instead of reporting to the VDP, I'm considering reporting directly to the third-party service.

No idea if they have a program or pay, but worth the shot since the VDP offers $0.
#BugBounty #hackerone #idor #sqlinjection

[Elorm Daniel @elormkdaniel]

Hackers exploited Zero-click vulnerability in Samsung S25 Ultra under 1 min Pwn20wn 2025 hacking Contest and earned $100,000 💀

[Yunus Emre Öztaş @ynsmroztas]

First report of 2026 🥳🥰🌹

Sometimes services behave as if they have authentication, it's just a matter of how it's added. For those in JSON format, definitely try this: "--headers="Content-Type: application/json\nAuthorization: Bearer [TOKEN_HERE]" \"

payload ; {"username":"testuser';SELECT PG_SLEEP(5)--"}

#bugbounty #bugbountytips #sqlinjection

@intigriti