صفر الزمن

[صفر الزمن @non___existen]

"I don’t know how or when my soul will leave this world. But when that time comes, please don't cry for me, and don't feel sorrow. Just remember me in your prayers. THAT’S ALL I’LL EVER NEED."

[Zorv @Zorvh87]

I'm not surprised if someone earns 5-6 figs just by finding bugs through Bug bounties.

1. Ethena- $3,000,000 Pool
reward: $2,500 - $100,000 USD
https://t.co/rTpXn3Emm3

2. Sky - $10,000,000 Pool
reward: $1,000- $150k USD
https://t.co/1bQuiFhPc5

3. Kemino- $1,000,000 Pool
reward: $10k-$500k USDc
https://t.co/2hzU43iCtv

4. Origin Protocol- $1,000,000 USD
https://t.co/3qZZCQWhda

5. Metric- $500,000 USDC
https://t.co/XHcT9555sF

6. Olympus- $3,333,333 USD
https://t.co/WDDJ5vIfus

7. SSV Network- $250,000 USD
Reward: $1,500- $100k
https://t.co/nJxvjv4qgb

8. Lombard Finance- $500,000 USD
reward: $1,000- $300k
https://t.co/TMoHK28r9m

9. Hastra- $100,000 USDC
https://t.co/xe69zPlQ0s

10. Dexe Protocol - $500,000 USD
https://t.co/iSR4aqHHdA

Bug bounties trenches!

[Johann Rehberger @wunderwuzzi23]

cool, even got a bounty for this one from apple 😀

CVE-2026-64750

[seeu @seeuinscope]

My first 5-figure bounty 🥳🥳 Thank you @GoogleVRP!!

[Leeroy Jenkins @SirLeeroyJenkin]

@Meta @metabugbounty For anyone interested here's a GIF of me exploiting the RCE to exfil AWS creds to my collaborator :D

[Luke Stephens (hakluke) @hakluke]

Want your hacking agents to be more accurate, faster, and use less tokens?

Follow the same unix philosophy principles that have been around for half a century.

Let me explain 👇

https://t.co/cxsmL3rYpr

[Leeroy Jenkins @SirLeeroyJenkin]

I'm genuinely furious with how @Meta @metabugbounty has handled my security research.

On July 22, I submitted a report demonstrating a FULLY WORKING, UNAUTHENTICATED REMOTE CODE EXECUTION vulnerability in a Meta-hosted cloud service.

It took over 100 days for this report to even reach the appropriate engineering team for investigation. Over three months of waiting for a critical security vulnerability to be properly reviewed.

And the final reward? $500.

For those interested in the technical details:

The vulnerability involved unsanitized user input being concatenated into Apache Camel AS2 endpoint URIs, allowing arbitrary endpoint option injection.

I discovered that Camel's property binding mechanism allowed arbitrary Java class instantiation through #class: references. By leveraging Spring's ClassPathXmlApplicationContext, I was able to load a remotely hosted Spring configuration and instantiate java.lang.ProcessBuilder, achieving arbitrary OS command execution.

From there, I demonstrated access to AWS EC2 instance-role credentials through the instance metadata service.

This was not theoretical. I demonstrated the entire exploit chain.

AND I STOPPED THERE.

I deliberately did not use the obtained credentials against AWS APIs or investigate how much further I could escalate within their AWS environment. I had already demonstrated the impact and chose to respect the program rules.

Meanwhile, vulnerabilities involving similar levels of impact have reportedly received bounties of over $150,000.

$150,000 versus $500.

I spent significant time finding, validating, documenting, and responsibly disclosing a critical vulnerability. I provided reproduction evidence and remediation recommendations. I exercised restraint rather than pushing further into their AWS environment.

And after making me wait over three months, this is how Meta values that work?

I'm not demanding an automatic $150K payout. I'm demanding an actual, technically defensible explanation of how anyone could arrive at a $500 valuation for a demonstrated unauthenticated RCE with access to AWS credentials.

This is an insult to the independent security researchers who dedicate their time to protecting your infrastructure.

What incentive are you giving researchers to continue responsibly disclosing critical vulnerabilities when this is how you treat them?

I genuinely expected better. This experience has completely destroyed my confidence in Meta's bug bounty program.

@Meta, @metabugbounty enough with the boilerplate responses. I want an actual explanation.

[Godfather Orwa 🇯🇴 @GodfatherOrwa]

This one is so amazing, super good

as example for the bros here, if you're doing an AI scan and you're thinking that maybe there's a SQL, you can tag this for your AI to read ALL reports about SQL from this

And for sure, a lot of other cool things can be done with huntdeck

nice work mate

[Co11ateral @co11ateral]

Bug Bounty - Caido MCP

We showed how to set up Caido MCP for better manipulation with AI reasoning.

Caido is basically an alternative to Burp Suite

It automates parsing raw HTTP data, gathering fragments, and processing initial payloads, so you can focus on the bigger picture

https://t.co/cDay2Td7jE

[OlamDeen @Olamdeen]

Read “How I bypass a fixed Host Header Injection leading to Account Takeover“ by Hun33er on Medium: https://t.co/5w9vNC321H

[Crispr @crispr_x]

We have now published the PoC after the PoC. Enjoy :)

I would say it is one of the most powerful primitives for logic LPE bugs.
https://t.co/CzwktwOB1c

[POC_Crew @POC_Crew]

🔐 Let’s talk Windows security!

Bocheng Xiang (@crispr_x) & Hao Huang (@h4urek) - “TrustFall: When Windows Trusted Installer Betrays Its Trust”

#POC2026

[OlamDeen @Olamdeen]

Testing for Host header injection to Account Takeover
Used this
X-forwarded: for=Collab;by=Collab;host=Collab
The might bypass the already fixed report if not probably sanitize

[OlamDeen @Olamdeen]

This as gotten me multiple account takeover

https://t.co/5AoqY1feKb

[Damian Strobel @damian_89_]

Rarely I post bug bounty tips anymore but this small gem is unknown to most ;)

[Daily Bug Bounty Reports @Bug_Breakdown]

An $8,000 payout for looking past the usual SSRF payloads! Here is how a researcher escalated a basic SSRF into full Kubernetes infrastructure exposure just by reading the HTTP response headers,

🚨 BUG: Server-Side Request Forgery (SSRF) / Information Disclosure

THE FLAW:

• The researcher found an SSRF vulnerability but hit a wall—standard cloud metadata endpoints (AWS/GCP) and localhost payloads returned nothing useful.

• The breakthrough came from a single, overlooked HTTP response header.

• This hidden header leaked internal Kubernetes infrastructure details, including Pod IPs, workload identifiers, and internal service names.

THE EXPLOIT:

• Realizing the target wasn't a standard cloud instance but a containerized Kubernetes environment with a service mesh, the researcher pivoted.

• Using the leaked naming conventions from the header, they routed the SSRF to hit internal Kubernetes services.

• They discovered exposed internal monitoring interfaces and administrative endpoints, including one that could potentially shut down running service components.

• Instead of taking down production (which is out of bounds), they documented the exposed destructive capability, proving severe impact across Confidentiality, Integrity, and Availability.

STRATEGIC TAKEAWAY:

• Stop blindly throwing AWS metadata payloads at every SSRF.

• A failed metadata request doesn't mean the SSRF is useless; it usually means the target is using a different architecture, like Kubernetes. Always analyze the complete HTTP response, especially the headers, to fingerprint the internal network before you start firing payloads.

Link to the full write-up in the replies 👇

#BugBounty #AppSec #CyberSecurity #InfoSec #BugBountyTips #BugBountyReports

[Marius du Preez @mdp_sec]

https://t.co/KDNczjwl5K

[reмо̷̷иѕec @remonsec]

Quick tip for you today ⚡

Next.js ships a client side build manifest

usually inside /_next/static/ JavaScript chunks

This manifest contains the full list of page routes

routes that are never linked in the UI still exist in the JavaScript

Hunters have been pulling these for years

manually with scripts

now with LLMs

ship the agent with this https://t.co/E49zK5giJv

It will balance the extraction and observation

[Bug bounty wizard @bugbountywizard]

My Manual AI Recon Methodologies for Finding Valid Bugs in Minutes — by Chirag Malhotra

https://t.co/y88StQHj9Y

Join us on Telegram:
https://t.co/rpGHV3Yw7y

#bugbounty #bugbountytips #bugbountytip

[أحمد ‏ @iA7myd]

https://t.co/brafMhtu1N

[zack0x01 @zack0x01_]

💀Fuzzing tip that actually saved me hours:

Before you start, send just 2 requests:

https://t.co/PNofyKqoOu → 200 (real page)
https://t.co/LTzQoVEglq → 404 (nothing there)

That’s it. Now you know what a real response looks like vs a miss.

Then you immediately know:

- 200 + 404 → normal site, fuzz it
- 200 + 200 → catch-all, every result is fake
- 200 + 403 → WAF blocks unknown paths, you’re already slow
- 403 + 403 → just stop, everything is blocked

Two requests tell you if you’re about to waste 3 hours or get your IP banned.

Do this every time.

#bugbounty #fuzzing #infosec #webhacking