MRCO24

[UCYBERS @UCybersX]

@kalilord788 https://t.co/OvhWB4Bwid

[Enno Rey @Enno_Insinuator]

Good series on Pwning AI Agents
Part 1: Exploiting AI Coding Agents https://t.co/XKy0WjqHFl
Part 2: RCE and Data Exfiltration https://t.co/ineERmxlFg
Part 3: Read Only Bypass https://t.co/jLfshrnrBh
Part 4: Exploiting MCP Hosts with a Malicious MCP Server https://t.co/RD4rRjiHB0

[Abhishek @aacle_]

If you're learning about LLM security, bookmark this one. 🔖

PayloadsAllTheThings - Prompt Injection

Includes:

→ Direct and indirect prompt injection
→ Jailbreaking
→ Prompt leakage
→ Payloads and examples
→ Useful references for testing

It's simple and practical; it's worth keeping it open when testing AI apps.

https://t.co/OicacWfDnZ

[X @TheMsterDoctor1]

Claude Code FREE & UNLIMITED in 2026 🤯 (No GPU, No Ollama, No Nvidia NIM)

[I'M H4CK3R 42 @luckyhacker43]

The $0 IDOR That Was Worth More Than a $12,500 P1 by Meena 🤯🔥

👨‍💻 Abhishek Meena (Aacle)
🔗 https://t.co/vIon3crIKF

🔗 Join team 👉https://t.co/cADA5DUdp5

[Pethuraj M @Pethuraj]

If you're a bug bounty hunter looking to hack new programs, this repository is worth bookmarking.

It curates bug bounty programs from companies around the world in one place.

🔗 https://t.co/amSfgXZLZy

#BugBounty #EthicalHacking #CyberSecurity

[Abhishek @aacle_]

Everyone knows HackerOne Hacktivity.

Nobody knows this repo:

reddelexc/hackerone-reports (6.4k stars).

Bug types Hacktivity doesn't: Business Logic, REST API, GraphQL, Web Cache, MFA, Auth Bypass, Mobile.

https://t.co/zmobQYk1KA

Bookmark before it disappears.

[I'M H4CK3R 42 @luckyhacker43]

Discovering hidden parameters: An advanced guide 🤯🔥

👨‍💻 blackbird (intigriti)
🔗 https://t.co/Hr6LWlbTEJ

join our telegram for more https://t.co/cADA5DUdp5

[Muhammad Saqib Arif 🇵🇰 @saqibarif98]

From Failure to $32,000: My Bug Bounty Journey https://t.co/Rk4TcaK8jq

[I'M H4CK3R 42 @luckyhacker43]

"From Default IIS Page to Critical SQL Injection" 🤯🔥

👨‍💻 Ahmad Mugh33ra
🔗 https://t.co/8tfq5xi81n
Join our channel for more, link on my bio

[Bug bounty wizard @bugbountywizard]

Practical IDOR Hunting: Real Findings From My November Reports https://t.co/xFL68JQuJz #bugbounty #bugbountytips #bugbountytip

[Intigriti @intigriti]

1️⃣ SQLTimer

SQLTimer by @c1phy is a simple, blazing-fast command-line tool to scan for time-based SQL injections!

Check it out! 👇
https://t.co/TsyL719yCX

[The Cybersecurity guy @cyber__razz]

This video contains the main methodologies attackers use to hack Wordpress websites

[雨苁-www.ddosi.org @gov_hack]

HackerOne 漏洞报告排行榜top 100 hackerone-reports
https://t.co/IfdaGW4we7

[X @TheMsterDoctor1]

Everyone keeps building scanners.
Very few are building hunters.

Lonkero is one of the first open-source tools I’ve seen that actually feels built for modern bug bounty hunting instead of 2014 web apps.

⚡ Rust-powered speed
⚡ Context-aware scanning
⚡ GraphQL + JWT + API testing
⚡ Framework fingerprinting
⚡ Smarter recon workflows
⚡ Lower false positives

This is the kind of tooling that changes how researchers work.

The next generation of AppSec tools won’t just send payloads blindly.
They’ll understand the target first.

Lonkero is moving in that direction.

Link: https://t.co/Nt3xNNtSC0

#bugbounty #cybersecurity #appsec #rustlang #infosec #hacking #redteam #bugbountytips

[Ziad Salah @Zierax_x]

New version of Grafana-Final-Scanner, with more CVEs and no false positives 🥳🥳

test it:- https://t.co/l9K3DyIYcz

#bugbountytips

[Vishal Vishwakarma @rootxvishal]

Day 5 / 30 — JAVASCRIPT FILE ANALYSIS

JS files leak endpoints, API keys, internal infra. Read them. Don't just scan.

Tools:
→ subjs — https://t.co/zPExrFNVPQ
→getJS — https://t.co/GkthKpZznx
→ LinkFinder — https://t.co/BxOXVfgh8l
→ JSluice — https://t.co/Pz235uFkaI
→ SecretFinder — https://t.co/hEI40yUaNm
→ trufflehog — https://t.co/QcB8XmPw8Z

Read the comments. Devs leave goldmines.

#bugbountytips #javascript #bugbounty #infosec #cybersecurity

[Pratik Dabhi @impratikdabhi]

“Login Page Testing Checklist: 15 Important Test Cases Every Security Tester Should Know” by Yamini Yadav_369 https://t.co/h188OXwxto

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Nicolas Carlini showed CLAUDE finding 0-DAY vulnerabilities in a live conference demo.

found the blind SQL injection in 50 minutes, stole the admin api key, then did the exact, same thing to the linux kernel😕