Khan Janny

Pizza-powered bug bounty hunter. 🍕, Co-founder @penoughcyber

[Khan Janny @reboot_ex]

@zulkarnaimx YouTube

[Khan Janny @reboot_ex]

@Bugcrowd CISO

[Harley Kimball @infinitelogins]

This week, Disclosed. #BugBounty

DEF CON 33 Badge Pre-Orders, Bug Bounty Village Agenda, HackAICon Announcement, NullCon Scholarships, Caido Acquires Shift, and more

Highlights below 👇

Full issue → https://t.co/mdiq9bXNyA

@BugBountyDEFCON opened pre-orders for a limited edition Bug Bounty Village badge in a green variant. Pre-order online and pick up in person at the con.

@CaidoIO acquired the Shift plugin, now free for users with payload crafting and HTTPQL support.

@BugBountyDEFCON released the full agenda for Bug Bounty Village at DEF CON 33.

@0xacb announced HackAICon 2025 (Sept 25, Lisbon), featuring AI, hacking challenges, talks, and networking.

@nullcon is offering Bug Bounty Hunter Scholarships for their Berlin event (Sep 4–5). Apply by July 28.

@hackenproof announced a new bug bounty program for No Ones App with rewards up to $5k per bug.

@xss0r shared 6 new @Microsoft domains now eligible for the Identity Bug Bounty program.

@yeswehack posted highlights from the live hacking event at leHACK 2025 in a recap video.

@Hacker0x01 updates their in-platform color scheme to align better with their updated marketing site.

PwnFox (via @BApp_Store) adds multi-session, color-coded testing in Burp Suite.

@garethheyes announces Custom Actions to automate request rewriting and payload generation in Burp Suite.

@fneves97 updated JXScout Pro for improved JavaScript asset navigation in VSCode.

@adce626 launched the Bug Bounty Recon Toolkit, which generates commands for 50+ tools based on target.

@KN0X55 introduced XSS Gym to train on real XSS payloads and scenarios.

@alicanact60 published a Chrome extension that restores the classic HackerOne UI.

From .git disclosure to RCE. The author details a full bug bounty chain from initial .git leak to remote code execution, with techniques and tools.

Leaking PII in Microsoft Guest Check-In. The author (Faav) shows how exposed PII and Burp Suite let them break into Microsoft buildings.

HackerOne report by @MrMax4o4 documents how a banned user retained API access to a deleted account, exposing weak access controls.

@deadoverflow_ explains a race condition in Reddit’s coin API inflating coins via parallel requests.

@medusa_0xf highlights business logic vulnerabilities that led to real payouts.

@NahamSec shows JWT mistakes that enabled account takeover and big bounties.

@amrelsagaei interviews @NahamSec on mindset, overcoming plateaus, and building a personal brand.

BePractical demonstrates exploiting zip slip on file uploads to overwrite paths.

@Magn4_ shares the story of earning his first bounty with a $100 open redirect.

@ctbbpodcast Ep.131 features live SSRF and IDOR hacks, leaked secrets, Google’s defense strategy, and community insights.

@cyb3r_dan shares an SQLi detection guide covering manual and automated techniques with practice labs.

@Bugcrowd explains how to find bugs on hardened targets by chaining smaller flaws.

@coffinxp7 publishes an advanced bug bounty recon checklist.

@intigriti introduces GitHub dorking with search patterns to uncover vulnerabilities.

@clintgibler highlights Check Point’s discovery of malware using prompt injection.

@40sp3l reminds hunters not to skip targets just because they have many reports — good bugs still remain.

@0xacb points out that Chrome’s upcoming features could open up new bypass techniques.

@njcve_ shares success at SteelCon where an authentication bypass bug was found.

@intigriti explains 3 exploitable and highly rewarded vulnerabilities in detail.

@Bugcrowd offers 5 actionable tips for beginners breaking into cybersecurity.

Full links, tools, write-ups & more → https://t.co/mdiq9bXNyA

The bug bounty world, curated.

[Khan Janny @reboot_ex]

@tomcrawshaw01 LEAK

[Penough @penoughcyber]

Defensive Cyber Security (DCS101) Details: https://t.co/8kc9zzkGnJ

📅 Application Deadline: 28 June 2024
📌 Course Fee: 9,999 BDT

💬 Apply Now: Reach us on Facebook or email at [email protected]

#penough #penoughcyber

[Khan Janny @reboot_ex]

@0x0asif @Hacker0x01 Congratulations 🤘👌

[Khan Janny @reboot_ex]

@trfjz No, this specific one was for reflected xss. There is some limitations but better than mass Fuzzing.

[Khan Janny @reboot_ex]

Context Over Fuzzing 🤘#xss

[Caido @CaidoIO]

🚀 New plugin in the Caido Store!

Introducing "JXScout" by @fneves97.

Supercharge your JavaScript analysis by ingesting requests from Caido into JXScout.

JXScout: https://t.co/fQPWrDDawO
Plugin: https://t.co/Uyu9LgE7yZ

[Khan Janny @reboot_ex]

Excited to present at UAP Cyber Siege 2025 (University of Asia Pacific) on "Exploiting Context Over Mass Fuzzing, Contextual XSS Advantage." Anticipating a great discussion.

[Khan Janny @reboot_ex]

Do you remember when you joined X? I do! #MyXAnniversary

[Khan Janny @reboot_ex]

@addydaddymc @Bugcrowd No.

[Khan Janny @reboot_ex]

Just scored a 500$ bounty for finding #XSS 😎

@Bugcrowd 🤘

[Khan Janny @reboot_ex]

🎯 Challenge Completed! 🎯

I just solved the "Challenge of the Day" on the Infinity Platform by @cyberwarfarelab
It was an amazing opportunity to test and sharpen my skills in the Red Team labs.
Looking forward to more challenges.

[Lu3ky13 ⚡️⚡️ @lu3ky13]

First bugbounty community

"🚀 We're giving away VIP memberships to 5 lucky people! 🎉 To enter, simply share this tweet and join the fun. Don’t miss out! 🌟

🔗 https://t.co/rzUFlmeQxc

#Giveaway #VIP #MackeAcademy #bugbountytips #bugbounty

[Khan Janny @reboot_ex]

@fattselimi @pwntheplanet @fattselimi update the link..

[Khan Janny @reboot_ex]

@dorkipty @intigriti @araselmir

[Penough @penoughcyber]

Discover how SIEM is the backbone of an effective Security Operations Center (SOC)! Read our latest blog: "The Essential Role of SIEM in the Security Operations Center (SOC)" on Medium now!

Read now: https://t.co/TIREAn3CaF

#SOC #SIEM #PenoughCyber #Penough #DigitalDefense

[Rasel Mir @araselmir]

Just got a reward for a vulnerability submitted on @yeswehack -- Cross-site Scripting (XSS) - Reflected (CWE-79). #YesWeRHackers

Collab with @reboot_ex vai 🔥

[Rasel Mir @araselmir]

Just got a reward for a vulnerability submitted on @yeswehack -- Cross-site Scripting (XSS) - Reflected (CWE-79). #YesWeRHackers

Collab with @reboot_ex vai 🔥