kamalesh

[Ren @Ryrenz]

🕵️ 又发现一个 Claude Code 外挂，做漏洞赏金的人从侦察、测试到写报告，全在终端里跑完

GitHub 上 4.4K stars，MIT 许可证，需要 Python 3.10 以上。

打一个授权目标的老流程是这样的：subfinder 扫子域，httpx 探活，nuclei 跑模板，ffuf 爆目录，katana 爬链接，工具来回切，结果散成一堆文本文件，最后还得自己坐下来手写报告。这个项目把整条流程编排成 33 个斜杠命令和 9 个专用智能体，跨会话记着你上次做到哪一步，Web2 那边覆盖 26 类漏洞，Web3 智能合约 10 类。

除了独立命令行，Claude Code、OpenCode、Pi Agent 和 Codex 都能接进去；模型可以选 Claude、OpenAI、DeepSeek、Groq，也能用 Ollama 在本地跑。仓库自己写明了只能用于获得授权的安全测试，工具是中立的，打谁、有没有拿到授权，是使用者自己的事。

GitHub：https://t.co/G5HO3Q4rjE

[zack0x01 @zack0x01_]

XSS using "xss.pdf" 👀

I’ve seen a lot of people successfully find XSS by uploading a malicious PDF that gets rendered inside a PDF viewer.

But there’s another angle people often miss: data exfiltration doesn’t always require JavaScript execution.

Depending on how the PDF viewer handles interactive PDF features, an attacker may be able to trick users into submitting sensitive information through a malicious prompt or form.

I put together the PDF PoC here:
https://t.co/9MgYEL0tE1

For more technical details on portable data exfiltration:
https://t.co/UlhWc07N8J

Only test this on systems you own or have explicit authorization to assess.

#bugbounty #bugbountytips

[Aman Hasan @Aman_Hasan01]

#bugbountytips

Writups - https://t.co/qYQYmtvgyS

[Ankur Gautam @NexxelSecurity]

OpenCode + Burp Suite MCP - AI-Powered Pentesting 💀

[Yunus Emre Öztaş @ynsmroztas]

1/
Found a P2 account takeover on a bug bounty target: OAuth2 authorization code interception via custom URI scheme, with PKCE missing entirely.

Here's how to hunt this class on Android. 🧵

2/
Start in the manifest. Look for intent-filters registering a custom scheme for the OAuth callback:

<data android:scheme="myapp" android:host="oauth-callback"/>

Custom schemes are first-come, first-served on Android. Any app can claim the same one.

3/
That alone isn't the bug. The question is what protects the code in transit.

Grab the /authorize request and check for:
- code_challenge
- code_challenge_method=S256

Missing? The authorization code is a bearer secret with nothing binding it to the client.

4/
Now the chain:

1. Malicious app registers the same scheme
2. User authenticates legitimately
3. Android delivers the callback intent to the attacker's app
4. Attacker has code + a public client_id
5. Exchange for tokens → full ATO

No PKCE means step 5 just works.

5/
Runtime beats static here. Hook Intent.getData() and let the real flow run — you capture both halves as they actually happen:

- the authorize URL (proving no code_challenge)
- the callback intent (proving the code lands in an interceptable scheme)

That pairing is your entire PoC.

6/
Reporting tips that moved this to P2:

- Show the absence of PKCE params explicitly, don't just say "missing"
- Capture state in both requests — pre-empts the "CSRF protects it" objection
- Name the fix: PKCE S256 + App Links (autoVerify=true) instead of custom schemes

7/
Root cause is always the same: custom schemes were never a security boundary, and OAuth public clients on mobile need PKCE. RFC 8252 has said this since 2017.

Still shipping in production apps in 2026.

#BugBounty #InfoSec #android #AppSec #bugbountytip #bugbountytips #infosec #recon

[Aircorridor @_aircorridor]

PentestCode is an impressive tool that might significantly speed up your pentest or bug bounty hunting!

Check out an article from @co11ateral to learn how to use it:
https://t.co/vPd4og4Ipz

[I'M H4CK3R 42 @luckyhacker43]

$1,500 AI System Prompt Leak: Using this Burp Suite Configuration 🤯🔥

🔗 https://t.co/fTyq5m9eo7
Join team 👉https://t.co/cADA5DUdp5

[Rıdvan Yağlı @ridvanyagli]

🔴 Bu açığın 18.6 ile yamalanmasının ardından v12sec, PostgreSQL 18.4'teki Bidirectional RCE için PoC yayınladı.

PoC: https://t.co/pYAxzjRVvE

[rapiddns @rapiddns]

How I built an AI bug-hunting workflow — and it earned me a real bounty.
Here's how
🔗 https://t.co/1CgZTjlE3o

#BugBounty #AI #bugbountytips #security #openai #gpt

[I'M H4CK3R 42 @luckyhacker43]

The Internet Is Falling Down, Falling Down, Falling Down (cPanel &amp; WHM Authentication Bypass CVE-2026-41940) 🤯🔥

🔗 Join team 👉 https://t.co/cADA5DUdp5

🔗 https://t.co/qbvNDee5ll
🔗 https://t.co/qsiO7HQ2mb
🔗 https://t.co/ZfpCGExIwY

[I'M H4CK3R 42 @luckyhacker43]

"How I Found 3 Logic Bugs &amp; 2 Access Control Issues in One Public BB Program" 🤯🔥

🔗 https://t.co/AqDoXsAqMy

Join 👉https://t.co/cADA5DUdp5

[Muqsit 𝕏 @mqst_]

☁️ Kubernetes Security: A Comprehensive Pentesting Guide

Guide: https://t.co/wP6x88YRNT

#infosec

[Abhishek @aacle_]

I Connected Claude Code direct to Burp via MCP

one command:

```
claude mcp add burp --transport sse http://127.0.0.1:9876
```

that's literally it.

after that Claude start working by himself:

- browse my proxy history
- do auto-recon on target
- create testing todo-list
- play with requests and responses
- find bugs while i do other stuff

i just give him scope. he do the grinding. i do the thinking.

result so far: **11 confirmed bugs**

real bugs. not hallucination. i verified each one.

https://t.co/4ritanX0F4

[Coffin @lostsec_]

I completely forgot to share the tools I used in my previous video: https://t.co/l8dYOvxQ8A

you can now grab them here and start hunting for exposed Gemini API keys:

https://t.co/XCZiXaa6sC
https://t.co/5EbQOlqSvY

please use them responsibly and focus on self-hosted bug bounty programs. Happy hunting!

[Koupon @Shabosec]

@0trusts @sachin_pandey98 @lostsec_ @Olamdeen https://t.co/w49qE7ZNAe

[Aircorridor @_aircorridor]

Privilege Escalation: Getting Started with the Pack2TheRoot (CVE-2026-41651) Vulnerability to Escalate Privileges

In this article, we will explore how this vulnerability appears, how it can be exploited, and how you can defend against it.
https://t.co/fpZYBZBaPb
@three_cube

[7h3h4ckv157 @7h3h4ckv157]

THICK CLIENT PENTESTING CHECKLIST

Resource: https://t.co/nEku2sknUd

[Muqsit 𝕏 @mqst_]

🧪 iOS Pentesting: Step-by-step guide on "IPA Binary Analysis" using MobSF.

Guide: https://t.co/2aC9OK5aYQ

#infosec

[Wakedxy @Wakedxy1]

I recently identified an interesting technique to bypass file upload restrictions by manipulating the Content-Type header.

The target application enforced an image-only upload policy. Initial attempts to upload a file with a modified Content-Type such as application/html were correctly rejected. However, setting the header to application/jpeg allowed the upload to succeed, despite no validation of the actual file content.

Further testing revealed inconsistent parsing behavior. When using application/text php/jpeg, the uploaded file was assigned a .txtphp extension, indicating that the server was partially deriving the extension from the MIME type in an unsafe manner.

By refining this approach and setting the Content-Type to application/ php/jpeg, I was able to bypass the extension filtering mechanism entirely and upload a PHP file.

In this case, the impact was limited because the file was served via CloudFront, preventing remote code execution. Nonetheless, this behavior highlights weak MIME type validation and unsafe extension handling, which could lead to critical impact in different configurations.

Sharing this technique as it may be useful in similar upload validation scenarios.

[Denis Laskov 🇮🇱 @it4sec]

Hacking a stolen laptop: bypassing Windows security (BitLocker etc.) using PCI connector. 💻🔬😈🐉🎉

More details on
LinkedIn: https://t.co/doe2U0bKbH
Substack: https://t.co/ApocP0SPKX