locolocosec

Dev & Security Researcher l Loves Cooking & Football 🌿🌞

[Saurav @SauravTxt]

I earned $600 for my submission on Bugcrowd. What a way to start the month!

[Kanhaiya Sharma @krishnsec]

Crossed 17K reputation on @Bugcrowd ✅

[Nightmares @NightmaresUwUL]

Got 3000 Dollar for Dom XSS with ATO impact 😈🥰 #fy #dom #xss #vuln #hackerone #ato #cybersecurity #whitehat

[Hasan Khan @Hasan_Khan0X]

Alhamdulillah

I Earned 3250 USD for my submission on External Private Bounty Program

Thank you so much Almighty Allah

#bugbounty
#ethicalhacking
#whitehat
#apitesting
#apisecurity

[locolocosec @locolocosec]

@bug_vs_me @Hacker0x01 How are you using AI these days ?

[locolocosec @locolocosec]

@krishnsec Hi Sir, could you please share how you are using AI in your workflow? Even a short reply will guide me, thanks!

[0xHun73r @0xHun73r]

Just got awarded a bounty on HackerOne for a critical privilege escalation bug I found

#BugBounty #HackerOne #CyberSecurity #InfoSec

[Nakomahi @NakoMahi]

Let's fuel up before class. 🔥🔥

Special thanks to @debu8er and @voorivex !

[Coffin @lostsec_]

I completely forgot to share the tools I used in my previous video: https://t.co/l8dYOvxQ8A

you can now grab them here and start hunting for exposed Gemini API keys:

https://t.co/XCZiXaa6sC
https://t.co/5EbQOlqSvY

please use them responsibly and focus on self-hosted bug bounty programs. Happy hunting!

[Sicarius @ElS1carius]

I earned $10,000 for my submission on @bugcrowd https://t.co/CA89MKVB8T #ItTakesACrowd #BugBounty

Bug: Weak JWT sign key + mass assignment in the JWT -> read arbitrary customer sensitive/PII data

Fully found by Claude using @profundisio MCP

[mhmd berro (badcracker) @badcrack3r]

⚙️ @profundisio New Unified Search allows users to search across hosts, DNS, certificates, and WHOIS, with all results ranked together in a single query.

Very useful for recon during bug hunting! 🔥

https://t.co/vyvLWOJpYO

#bugbounty #bugbountytip #bugbountytips #ethicalhacking #hacking #infosec #pentesting #PenetrationTesting

[Het Mehta @hetmehtaa]

Had anyone tried Antares-1B for Security?

[Rob Hallam @robj3d3]

Easy way to set up the VPS:

(includes agent skill, props to Stefan)

[Coffin @lostsec_]

I AM BACK !
https://t.co/dKqeKsfP0g

[Sanjay @p3n7a90n]

Found an interesting ORDER BY SQLi during a pentest protected by a Baffin Bay WAF.

Used RAG MCP by @0xrudra + Claude CLI (deepseek-v4-pro) to explore PostgreSQL WAF bypass techniques.

Write-up: https://t.co/bKLEl2pD1d

#CyberSecurity #AppSec #SQLInjection #WAFBypass #PostgreSQL

[Rama @dntyk]

Jangan pernah remehin "useless" bug. Self-XSS yang biasanya diketawain (karena butuh interaksi user) aja bisa berubah jadi bounty $15.000 (Zoom).

Kuncinya adalah, chaining.

Gue nemu case di mana attacker gabungin Self-XSS sama OAuth. Gini skenarionya:
1. Korban klik link malicious (XSS jalan di domain A).
2. XSS ini kirim postMessage ke domain B (trusted domain).
3. Domain B nerima message, terus trigger OAuth login ke Zoom.
4. Pas korban login, Authorization Code-nya malah dibajak sama XSS di domain B.
5. Attacker dapet Access Token.

Hasilnya? Attacker ambil alih total, curi data, sampe bisa nyalain kamera & mic korban.

Satu bug remeh kalo digabung sama celah lain bisa jadi exploit yang mematikan.

[Chaofan Shou @shoucccc]

Kimi K3 exploited the latest Redis server with a 0day it discovered.

All it took was 27min with 32 agents.

https://t.co/ZOKA2wchLa

[Tirtha Mandal @tirtha_mandal]

I’ve been hacking on  for quite some months now, and it’s been a rewarding journey. Huge shoutout to their security team! 🙌
There are still some bugs pending for payout. The grind continues! 🚀 #BugBounty

[HackerOne @Hacker0x01]

Congrats @sagitz_ on an incredible find 🎉

[@levelsio @levelsio]

@robj3d3 Awesome man!!! Please install Tailscale immediately, then set up a Cloudflare Tunnel if you wanna host any websites

Then go to Hetzner, add Firewall, make new one, empty it (!), then it will block all inbound ports