iQimpz

Full-Time Bug Bounty | Christian |

[iQimpz @iqimpz]

@brutecat @rootxharsh Super nice big and well written article! Thanks!🔥

[skull @brutecat]

StubZero: $148,337 RCE in Google Cloud Production

https://t.co/m7cBnSTaj4

[Assetnote @assetnote]

Our security research team discovered a pre-authentication arbitrary file read as root in cPanel (CVE-2026-29205) — a path traversal in cpdavd that we made exploitable by abusing Dovecot's + alias handling to create attacker-controlled directory names on disk.

We've updated cpanel2shell-scanner to cover both issues. Writeup and tool in replies.

👇

[iQimpz @iqimpz]

@monkehack Geez Monke, killing it🙏

[Hazem @H4cktus]

Tomcat JMX Proxy exposed without auth?

Wrote a blog about how I got shell on a production Tomcat behind Cloudflare despite the deploy API being locked down, WAF blocking payloads, and CDN filtering template syntax.

8 dead ends. Then AccessLogValve + docBase + relaxedQueryChars + EL injection. 14 requests to RCE.

Tool + nuclei template included!

https://t.co/Ll5IkcnkDa

#bugbountytips #bugbounty

[iQimpz @iqimpz]

@monkehack @stokfredrik @StarstrikeAI Thanks sick! Congrats!

[iQimpz @iqimpz]

@ArchAngelDDay Option 1 💯. Option 2 doesn’t sound fun tbh👀

[iQimpz @iqimpz]

@_N0xi0us_ @Hacker0x01 Sheesh! Keep it up!

[sebsrt @s3bsrt]

I’ve been digging into HTTP Trailers and found some new smuggling techniques:
https://t.co/gpaIiYkSHs

[Dan Guido @dguido]

New: I'm sharing the @trailofbits Claude Code defaults. This is how we setup, configure, and use claude code:
https://t.co/aEIXdpCztt

[spaceraccoon | Eugene Lim @spaceraccoonsec]

Vulnerability-spoiler-alert has detected its first two live “negative-days” in Grafana! CVE-2025-41117 (XSS) and CVE-2026-21722 (Privesc) are still unpublished right now, but is detectable via commits in the open-source repo. That’s at least 1 hour early. PoCs and more at https://t.co/Tom5BRqpKA

[PortSwigger Research @PortSwiggerRes]

Voting is now live for the top ten web hacking techniques of 2025! Grab a coffee, browse the 61 quality nominations and cast your vote on the most creative and ground-breaking techniques:
https://t.co/srZ9GhJgSN

[Dan Guido @dguido]

.@trailofbits released our first batch of Claude Skills. Official announcement coming later.
https://t.co/vI4amorZrc

[GMO Flatt Security Inc. @flatt_sec_en]

We've published a new blog post by RyotaK @ryotkak

He discovered 8 methods to bypass safety mechanisms in Claude Code, leading to arbitrary command execution.

We recommend updating to v1.0.93 or later to fix this vulnerability (CVE-2025-66032).

https://t.co/sNu7Z9QoXk

[iQimpz @iqimpz]

@monkehack We on the same page this week! I’ve been closing those “open loops” and figuring out where AI fits into my workflows.

[Jenish Sojitra @_jensec]

Sharing my Burp Extension that earned me $200k in 2025 while API testing heavy JS-rich targets.

https://t.co/2ttRurgoPh

The tool helps find endpoints, files, internal emails, and some secrets from minified JS.

Its goal is to achieve maximum efficiency with reduced noise in results. Contributions and feedbacks are welcome.

[iQimpz @iqimpz]

@monkehack Killed it! Not suprised👌

[DirectoryRanger @DirectoryRanger]

Windows IPC Deep Dive, by @haider_kabibo
1 https://t.co/WXPXxYwT0U
2 https://t.co/vdZcjzyyyz
3 https://t.co/Xymk9LE0sp
4 https://t.co/zmAGonybBR
5 https://t.co/rUOLhwYzHZ
6 https://t.co/uKuSglYtJQ
7 https://t.co/pOmrJhf3kK
8 https://t.co/db882XQ5zo
9 https://t.co/5DomsZQ9co

[JS0N Haddix @Jhaddix]

@G0LDEN_infosec for GUNGNIR the crt log transparency monitor!

https://t.co/3XUEhOjKUL