Mr Introvert

Hello world

[Nitin Gavhane @NitinGavhane_]

Dorks to Find Self-Hosted Bug Bounty Programs

Try these:

"bug bounty" "submit a vulnerability" -hackerone -bugcrowd

"bug bounty program" "security@"

"responsible disclosure" "reward" "security"

"vulnerability disclosure program" "reward"

inurl:security "bug bounty" -hackerone -bugcrowd

inurl:security-policy "bug bounty"

intitle:"Bug Bounty Program" -hackerone -bugcrowd

"Bug Bounty" "Scope" "Rewards" -hackerone -bugcrowd

"Hall of Fame" "security researchers" "bug bounty"

"security researchers" "bug bounty" -hackerone -bugcrowd

Bonus:

Search for:
"security.txt"
"responsible disclosure"
"vulnerability disclosure"
"security researchers"
"bug bounty"
"security hall of fame"

Save this for your recon workflow.

#BugBounty #OSINT #GoogleDorks #CyberSecurity #EthicalHacking #WebSecurity

[Nitin Gavhane @NitinGavhane_]

3 New GitHub Repos for Bug Bounty Recon in 2026

1. Outrider Recon

Agentic recon and attack-surface management for authorized bug bounty and security testing.

https://t.co/aqijJGx6cj

Practical tip:
Use it to turn raw recon data into prioritized, evidence-backed leads instead of manually reviewing hundreds of findings.

2. OpenOSINT

AI-powered OSINT agent with CLI, interactive REPL and MCP support.

https://t.co/FqMWPZE75v

Practical tip:
Start with a permitted email or username and use its pivots to discover related public identities and accounts.

3. BountyRecon

Program-aware reconnaissance pipeline with SQLite state management, asset tracking, JavaScript monitoring and reporting.

https://t.co/dFfClkwaFI

Practical tip:
Use it when working across multiple authorized programs so historical assets and recon results remain organized instead of getting lost between scans.

2026 Recon Methodology:

Scope
→ Passive OSINT
→ Asset Discovery
→ Infrastructure Mapping
→ HTTP/JS Discovery
→ Prioritize Attack Surface
→ Manual Validation
→ Report

The goal isn't to run more tools.

The goal is to turn recon data into better hunting decisions.

Only use these projects against assets you are authorized to test.

#BugBounty #BugBountyHunter #OSINT #Recon #CyberSecurity #InfoSec #GitHub #SecurityResearcher

[Tuhin Bose @tuhin1729]

Random 1AM question

How do you guys ensure your agent skills are updated & synced?

For example, I use https://t.co/Gh9iZxme4q as a base-line, on top of that I have my own checklist folder which consists of 60+ different vulnerability classes and their test cases + payloads curated from last 6-7 years. Plus I read a lot of articles, github repos, random writeups everyday. How do I ensure my agent is in the same page as me?

[ɐpnH @AlAssaf_H]

Papers, projects, and agent skills for LLM-based vulnerability detection and discovery.
https://t.co/vSMKLCVH53

[zack0x01 @zack0x01_]

Recon is EVERYTHING in bug bounty 🎯

Before you run a single tool, understand the app:
1️⃣ Check the business. What does it actually do?
2️⃣ Google it, browse the app like a user
3️⃣ Watch videos, read Reddit posts
4️⃣ Learn the app in and out

Then bring the tools:
- Subdomain enum: subfinder, assetfinder, findomain, https://t.co/OUKa7k6rzJ, https://t.co/N9xpqrlKOM
- Live hosts: httpx
- URLs: waybackurls, waymore
- Full chain: reconftw, or build your own pipeline

[SCR @SCR01111]

21 SYSTEM DESIGN RESOURCES TO LEARN 📌

1. System Design Concepts 101
https://t.co/5HZbs1A1wJ

2. Microservices Patterns
https://t.co/JLAVo7enu5

3. How DNS Works
https://t.co/tjXXjLL2GP

4. How JWT Works
https://t.co/81HanLJe3l

5. How Does HTTPS Work
https://t.co/pkXlaUTMJe

6. API Design Best Practices
https://t.co/MQLgMvuiUC

7. Redis Use Cases
https://t.co/F7reezVMmZ

8. Distributed Systems 101
https://t.co/Tc1wVOF3i8

9. How Message Queues Work
https://t.co/sff9LLhoaZ

10. How WebSockets Work
https://t.co/pxXHb1xRTd

11. Frontend System Design Concepts
https://t.co/3WQLh1DLn0

12. How Databases Keep Passwords Securely
https://t.co/EOctkdElWx

13. Modular Monolith Architecture
https://t.co/p4BGnBIow6

14. Saga Design Pattern
https://t.co/UImzkMUetV

15. Microservices Lessons From Netflix
https://t.co/QeQwphNIiy

16. How Consistent Hashing Works
https://t.co/whEO51kZl4

17. How Idempotent API Works
https://t.co/gJwYjK3Vw1

18. How RPC Actually Works
https://t.co/q6jOieFCC7

19. API Versioning: A Deep Dive
https://t.co/YSJqSbFZaM

20. How Bloom Filters Work
https://t.co/6TZS5PqAnR

21. How Service Discovery Works
https://t.co/IFTlHT57Tg

[Nitin Gavhane @NitinGavhane_]

Cybersecurity creators & accounts worth following:

1. @PortSwigger
2. @Hacker0x01
3. @Bugcrowd
4. @intigriti
5. @owasp
6. @tryhackme
7. @hackthebox_eu
8. @offme_official
9. @SANSInstitute
10. @rapid7
11. @pdiscoveryio
12. @nmap
13. @Burp_Suite
14. @zseano
15. @Jhaddix
16. @NahamSec
17. @LiveOverflow

Learn → Practice → Hunt → Report → Repeat.

#BugBounty #CyberSecurity #EthicalHacking #Pentesting #InfoSec #WebSecurity #BugHunter

[Pethuraj M @Pethuraj]

BUGHUNTER
AI-powered bug bounty hunting from your terminal - recon, 20 vuln classes, autonomous hunting, and report generation. All inside Claude Code.

🔗https://t.co/kYxhx7u3TE

#Cybersecurity #Bugbounty

[Co11ateral @co11ateral]

Six Tools for Bug Hunters

We shared tools that proved to work well in bug bounty. You can test them yourself and then feed them into your AI

https://t.co/05xJrE4Ids

@three_cube @_aircorridor

[Nitin Gavhane @NitinGavhane_]

📂 BUG BOUNTY
┃
┣ 📂 Recon
┃ ┣ 📂 Subdomain Enumeration
┃ ┣ 📂 Asset Discovery
┃ ┣ 📂 Port Scanning
┃ ┣ 📂 HTTP Probing
┃ ┣ 📂 DNS Enumeration
┃ ┗ 📂 Tech Detection
┃
┣ 📂 Web
┃ ┣ 📂 IDOR
┃ ┣ 📂 XSS
┃ ┣ 📂 SSRF
┃ ┣ 📂 SQLi
┃ ┣ 📂 CSRF
┃ ┣ 📂 SSTI
┃ ┗ 📂 File Upload
┃
┣ 📂 API
┃ ┣ 📂 API Discovery
┃ ┣ 📂 BOLA
┃ ┣ 📂 Authentication
┃ ┣ 📂 Authorization
┃ ┣ 📂 Rate Limiting
┃ ┗ 📂 Mass Assignment
┃
┣ 📂 Auth
┃ ┣ 📂 OAuth
┃ ┣ 📂 JWT
┃ ┣ 📂 Sessions
┃ ┣ 📂 MFA
┃ ┗ 📂 Account Takeover
┃
┣ 📂 Automation
┃ ┣ 📂 Recon Automation
┃ ┣ 📂 Nuclei
┃ ┣ 📂 Custom Scripts
┃ ┣ 📂 Asset Monitoring
┃ ┗ 📂 Workflow Orchestration
┃
┣ 📂 Burp Suite
┃ ┣ 📂 Proxy
┃ ┣ 📂 Repeater
┃ ┣ 📂 Intruder
┃ ┣ 📂 Extensions
┃ ┗ 📂 Match & Replace
┃
┣ 📂 Cloud
┃ ┣ 📂 AWS
┃ ┣ 📂 Azure
┃ ┣ 📂 GCP
┃ ┣ 📂 S3
┃ ┗ 📂 Misconfigurations
┃
┣ 📂 Reporting
┃ ┣ 📂 Validation
┃ ┣ 📂 PoC
┃ ┣ 📂 Impact
┃ ┣ 📂 Severity
┃ ┗ 📂 Report Writing
┃
┗ 📂 Growth
┣ 📂 Writeups
┣ 📂 CVE Research
┣ 📂 New Attack Surfaces
┣ 📂 Workflow Optimization
┗ 📂 Continuous Learning

The goal isn't to use more tools.

It's to build a workflow where every step feeds the next.

Recon → Discover → Test → Validate → Report

That's bug bounty orchestration.

#BugBounty #CyberSecurity #AppSec

[OffSec @offsectraining]

🚨 CVE-2026-72898: A critical unauthenticated SQL injection vulnerability in Metabase is being actively exploited.

The vulnerability affects the password-reset flow and can ultimately allow an attacker to gain administrator access to a vulnerable Metabase instance.

Our latest technical breakdown covers:
→ How CVE-2026-72898 works
→ Affected Metabase versions
→ The exploitation flow and potential impact
→ What defenders should look for
→ Mitigation steps
→ How to safely validate the vulnerability in OffSec’s Offensive Cyber Range

Read the full analysis: https://t.co/jKO2ZRFroi
Explore the lab: https://t.co/w9oIUXPUbG

#CVE #Cybersecurity #Metabase #VulnerabilityResearch #OffSec

[Pethuraj M @Pethuraj]

👨‍💻 𝐧𝐮𝐦𝐚𝐬𝐞𝐜 - The open source AI security agent.
Give your terminal the mindset of a cybersecurity professional. 🔐

🔗 https://t.co/IlJiCDxKff

#CyberSecurity #BugBounty

[Gabriel Odusanya @gabbytech01]

WEB HACKING FULL COURSE is coming to YouTube.

I’m building the channel into a proper starting point for anyone who wants to get into web hacking, ethical hacking, bug bounty hunting, and application security without jumping straight into advanced stuff they don’t understand.

The course is being structured from the ground up web foundations, Linux basics, reconnaissance, Burp Suite, vulnerability discovery, manual testing, web application security, API security, and eventually the methodology behind actually finding and validating vulnerabilities. The idea is simple: learn the fundamentals, understand what you're doing, then build the practical skills on top of them.

I don't want the channel to be another place where you just copy commands from a screen and call it hacking. I want beginners to understand why they're running a tool, what the output means, what to investigate next, and how everything connects when assessing a real web application in an authorized environment.

WEB HACKING FULL COURSE will be uploaded completely on YouTube very soon. The playlist is already live, so you can start from the beginning and follow the progression as new episodes drop.

If you're starting your journey into Web Hacking, Bug Bounty, Pentesting or AppSec, this is going to be one of the main things I'm building the channel around.

Start from zero, build the fundamentals, learn to think like a security researcher.
Then start breaking applications ethically.

The playlist is already available.

Watch it here: https://t.co/D71XreAcoN

[AISecHub @AISecHub]

https://t.co/PZm0fNuv7X

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

Free 8 hour API hacking course:
https://t.co/hR3f582OZT

I want you to succeed - at all cost so come check out my lovely live CAPIE guide

[Nitin Gavhane @NitinGavhane_]

Use my #bugbounty methodology with DeepSeek Pro in OpenCode for just $5!

Use my referral link:
https://t.co/mHPp8qiq6v

You’ll get $5 in usage credits to apply toward your Go usage limits.

#BugBounty #CyberSecurity #EthicalHacking #WebSecurity #InfoSec #Pentesting #DeepSeek

[Krishna @KrishnaMohanS30]

40 FREE & OPEN CYBERSECURITY BOOKS + RESOURCES

Stop paying for cybersecurity resources you can legally access for free.

These are legitimate open/free resources — not pirated PDFs.

1. OWASP Web Security Testing Guide (WSTG)
https://t.co/CyDVvDYl4C

2. OWASP Cheat Sheet Series
https://t.co/PuGctX750p

3. OWASP ASVS
https://t.co/64tV4Kr6fS

4. OWASP Developer Guide
https://t.co/vHxWYZBRBb

5. OWASP API Security Top 10
https://t.co/aM7GZi6bJ3

6. OWASP MASTG
https://t.co/MQJ5jWp89s

7. OWASP MASVS
https://t.co/lEOOqL0VGX

8. OWASP Proactive Controls
https://t.co/tfK7wCjnzl

9. OWASP Secure Coding Practices
https://t.co/vjtwOeZMJU

10. OWASP Threat Modeling Cheat Sheet
https://t.co/rLdW9QGmcH

11. OWASP Docker Security Cheat Sheet
https://t.co/PfogSUDgzZ

12. OWASP Kubernetes Security Cheat Sheet
https://t.co/vZeGIvH9e7

13. OWASP SQL Injection Prevention
https://t.co/36FDcBzyY5

14. OWASP XSS Prevention
https://t.co/cWSrJWdLHh

15. OWASP Authentication Cheat Sheet
https://t.co/qfZFBCqLDI

16. OWASP Authorization Cheat Sheet
https://t.co/fgfHVC5sDZ

17. OWASP Cryptographic Storage
https://t.co/Og8wuc1UGV

18. OWASP Secrets Management
https://t.co/K2QAPh3dIa

19. OWASP Logging Cheat Sheet
https://t.co/DKYgxBaoK1

20. OWASP Secure Code Review
https://t.co/JU9dzyOW4r

21. OWASP SSRF Prevention
https://t.co/WrnUVETY3g

22. OWASP File Upload Cheat Sheet
https://t.co/6rlyzVxwvE

23. OWASP Deserialization Cheat Sheet
https://t.co/CidlVOWbSd

24. OWASP TLS Cheat Sheet
https://t.co/jv9YRAsERm

25. OWASP Vulnerable Dependency Management
https://t.co/Vv0YoRInbv

26. OWASP Software Supply Chain Security
https://t.co/5igZOYpu30

27. OWASP CI/CD Security
https://t.co/QTKqivAUEq

28. OWASP Zero Trust Architecture
https://t.co/iHGs7GmiF0

29. OWASP WebSocket Security
https://t.co/3ph3hC7dgj

30. OWASP GraphQL Cheat Sheet
https://t.co/xkYkRW1xtR

31. Secure Programming HOWTO
https://t.co/fNuJqqlRIs

32. NIST Cybersecurity Framework
https://t.co/n6lL7JJJvU

33. NIST Cybersecurity Publications
https://t.co/3uxxEsXlgY

34. NIST Secure Software Development Framework
https://t.co/cqJA42trzW

35. MITRE ATT&CK
https://t.co/F2QLWxidkJ

36. MITRE D3FEND
https://t.co/gPpfID4W2K

37. CIS Controls
https://t.co/AfCBEWBewe

38. SANS Reading Room
https://t.co/hTdL6TepOW

39. Free Security & Hacking eBooks
https://t.co/CZ4tZQavlH

40. Awesome Free Cybersecurity Resources
https://t.co/O4vZ1Fdj0I

If you're serious about cybersecurity, start with:

WSTG
↓
OWASP Cheat Sheets
↓
ASVS
↓
MASTG
↓
NIST CSF
↓
NIST SSDF
↓
MITRE ATT&CK
↓
MITRE D3FEND

You don't need another expensive cybersecurity subscription.

You need good resources, hands-on practice and consistency.

Save this list.

Follow @KrishnaMohanS30 for free courses, cybersecurity resources, open-source tools and tech jobs.

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

🐀 Two things kill new hunters: testing blind, and testing the wrong bug class.

BountySkiller fixes both. Free, runs in your browser.

📚 Tool 1 — pulls every disclosed report that's actually getting paid: HackerOne hacktivity, PortSwigger, Intigriti, Project Zero, Assetnote + more. Filter by program, severity, keyword, min bounty.

🎯 Tool 2 — Hunt Buddy: paste a target profile, it tells you which bug classes you can even test, runs them, ranks the findings.

The honest part is built in: a module it can't run is marked SKIP, never reported as "clean." And it won't fire a single request outside the scope you define — it refuses to start without one.

Authorized, in-scope targets only. That's the job.
↓
https://t.co/BqHkBpGQfe

Much love <3 #bugbounty #infosec #appsec #hackerone

[0xor0ne @0xor0ne]

List of resources for learning about automotive cybersecurity

https://t.co/aWiAKoUBFx

#infosec

[Tom Dörr @tom_doerr]

Awesome OSINT Arsenal provides a one-command installation for over 750 open-source intelligence tools across 50 security categories.

https://t.co/svB2CzyjB9