Pingiskok

Web2/2.5/3 bugs. Mostly the ones auditors skip.

[Pingiskok @pingiskok]

Whitehat: "maybe just responsibly disclose after all?"

Google: sure! memory corruption — $500, controlled write — $5k.

And it's not enough to just find the bug — the PoC has to land as the right files, no harness/shell scripts/CDP, with a flawless repro on their end.

The industry itself is handing wavering whitehats a one-way ticket to "enjoy cybercrime."

[Google VRP (Google Bug Hunters) @GoogleVRP]

📣📢 Calling all Android and Chrome bug hunters 🧑‍💻🔎!

We're updating our Android & Chrome VRP programs to ensure we can continue to reward the most challenging and impactful vulnerabilities researchers find in our products. For details, 👇

https://t.co/hyZzEIampk

[Pingiskok @pingiskok]

Just paid $240 for ChatGPT Pro after @xbow called GPT-5.5 "Mythos-like hacking, open to all".

Passed KYC on https://t.co/RDV3DAVgH8. Asked Codex to deploy OpenClaw (a standard gateway utility) on infra I rent.

Result: account flagged for "high-risk cyber activity", requests throttled.

Not a pentest. Not an exploit. A deployment task.

@OpenAI @xbow what exactly is "open to all" here? cc @psawers

[Pingiskok @pingiskok]

@0xPalik @xenobyte_ ❤️❤️❤️

[Pingiskok @pingiskok]

Every JWT writeup online covers 2–3 attacks and stops.
I got tired of jumping between 40 blog posts, so I wrote the whole thing. All in one place.
https://t.co/iCSzQ4GjcS

#infosec #appsec #bugbounty #websec #jwt

[Pingiskok @pingiskok]

Yes, that's right. Thanks, I'm glad you liked the blog!
You correctly noticed the jump from part 14 to part 17. The thing is, in articles 15 and 16 I was planning to release the tooling and testing methodology, but by the time of publication I realized they weren't good enough or comprehensive enough to share with a wide audience. I didn't want them to be published in such a raw state, so I'll release them later. I'm also planning to release a single unified web tool that will cover checks for most of the issues described in the articles that can be verified offline.

[Pingiskok @pingiskok]

Great catch, you're right. In the jku/x5u article I really did focus on SSRF via HTTP(S) and cloud metadata, but I skipped file:// and other schemes, even though it's a classic. If the server uses a universal URL loader (Java URL/URLConnection, Python urllib.urlopen, PHP streams with allow_url_fopen), then jku: "file:/// etc/passwd" or x5u: "file:/// proc/self/environ" turn into clean LFI right through the JWKS parser. And what's especially interesting, this often bypasses the host whitelist, because the scheme is different and there's no host at all. Thanks for the feedback, and it's awesome that you actually read the stuff instead of just bookmarking it! ❤️ I'll add these things as a "P.S." when I'm putting out the next series of articles.

[Pingiskok @pingiskok]

@longlivedoma I think I'll get to this a bit later. Right now I'm working on another series that you should enjoy. But business logic is a veeeery broad topic, so I'll think about how to fit it into a series of articles.

[Pingiskok @pingiskok]

@xer0c @tributaryso This might be one of the best compliments I could have received. Glad it helped you!

[Pingiskok @pingiskok]

@0a_yso I'd like to clarify that all the material is written from scratch. However, the information in it was gathered from public sources and my own experience.

[Pingiskok @pingiskok]

@0a_yso Of course, 90% of it is based on other people's research. And yes, it was my mistake not to cite the sources in the articles from the start. I'm planning to fix this in the upcoming updates to the articles.

[Pingiskok @pingiskok]

@RCristio93143 Thanks bro! Access control & business logic is a massive topic - hard to cover properly even in 20 posts, but I'll try to tackle it down the line. Right now I'm finishing another series that I think you'll really enjoy - stay tuned