Hacked by shahanaj

Broken Link Hijacking POC

[Coffin @lostsec_]

You can also use Shodan's Certificate Transparency (CT) API to enumerate a target's subdomains directly from the https://t.co/b8sFqTyruD database.
https://t.co/6vL6HjRSmi

/api/v1/domain/{domain} ~returns the certificates that match a domain

/api/v1/domain/{domain}/hostnames ~returns all hostnames associated with a domain

[癒しの動物 @animalkyat]

マンゴーを仲間だと思ってる家のインコ見て

[𝕐o̴g̴ @Yoda4ever]

Baby giraffe patiently waiting for the rain to stop..🦒🌧️😍

[Kanishk Dadhich @whotfbunny]

Advanced bug bounty tip 🎯

Stop testing IDOR only on GET requests.
The real money is in state-changing mutations — PATCH/PUT/DELETE, and especially GraphQL mutations.

Why? Devs lock down read access carefully, then forget the same object-level checks on write/update endpoints.

Chain it: BOLA (wrong user's object) + BFLA (wrong role's action) = one mutation that lets a low-priv user modify or lock out a higher-priv account.

Test matrix for every mutation:
→ swap the object ID (BOLA)
→ swap your session (BFLA)
→ swap both

Most triagers still don't expect chained authz bugs in GraphQL. That's your edge.
#bugbounty #infosec #AppSec

[Hacked by shahanaj @rohlfingeth]

#NewProfilePic

[𝑝𝑢𝑟𝑒 @purelivn]

🌈

[Birds Colour 🕊️ @birdscolour56]

Which one are you drinking 😂🐓

[激かわ動物 @Gekikawa_Dbts]

かなりいい生活をしてるウサギを発見

[Sparrow @photon010]

He looks adopted😭

[Birds Colour 🕊️ @birdscolour56]

There something you don’t see everyday. 🦫🦩❤️

[Kirill Firsov @k_firsov]

I got permanently banned from @Hacker0x01. Account deleted. No explanation.

Years of work gone overnight. Submission history, achievements, leaderboard ranks, every contribution I made to the security and crypto ecosystems through HackerOne. Wiped, like I was never there.

[Vivek | Cybersecurity @VivekIntel]

🎯 Full Bug Bounty Hunting & Red Team Methodology 2026 — A Structured Recon Workflow

Full Bug Bounty Hunting & Red Team Methodology 2026 is an open-source knowledge repository that documents a structured workflow for web application reconnaissance and attack surface discovery. Rather than focusing on individual tools, the methodology emphasizes an intelligence-driven approach where each reconnaissance phase builds upon previous findings to progressively map an organization's infrastructure before conducting manual security testing. The guide covers the complete reconnaissance lifecycle, including passive and active subdomain enumeration, DNS brute forcing, ASN and CIDR infrastructure mapping, reverse DNS analysis, origin IP discovery, WAF-aware reconnaissance, virtual host enumeration, URL and endpoint collection, JavaScript analysis, secret discovery, directory enumeration, source code intelligence, technology fingerprinting, service discovery, automated vulnerability scanning, and subdomain takeover detection. Throughout the workflow, it demonstrates how to correlate outputs from multiple reconnaissance utilities, historical archives, certificate transparency logs, search engines, public datasets, and OSINT sources to improve visibility while reducing redundant effort. The repository also includes environment setup recommendations, curated wordlist references, API integrations, automation examples, and practical techniques for consolidating reconnaissance results into a comprehensive attack surface inventory. It serves as a practical reference for security professionals, bug bounty hunters, penetration testers, and learners seeking a repeatable methodology for authorized web application security assessments.

📌 Credit: @Cybernote9
🔗 https://t.co/JhkWif2Dzu

#CyberSecurity #BugBounty #Recon #OSINT #WebSecurity #PenetrationTesting #RedTeam #AttackSurface #EthicalHacking #ThreatIntelligence

[R1s @R1s666]

Just got a reward for a vulnerability submitted on @yeswehack -- Cross-site Scripting (XSS) - DOM (CWE-79).

If you control the scheme of location.href = param, send javascript:alert(document.domain)//.

[Kuldeep Pandya @kuldeepdotexe]

They verify your login in client-side JavaScript, never on the server. So you can walk right in.

New write-up: Client-side Authentication Bypass. 4 real cases (one led to a $4,000 SQLi):

https://t.co/XYNTSx2t6q

#BugBounty #AppSec #InfoSec #BarracksArmy

[Abhinav🇮🇳 @kalkii__]

Bug Type: JWT bypass using none alg
Severity: Critical (10.0)🔥
Reward: $3,000 🤑🤑
Tip: Always check JWT attacks, use @PortSwigger labs to learn

#hacking #security #ethicalhacking #bugbountytips #informationsecurity #cyber #bughunting #infosec #cybersecuritytips #cybersecurity

[Rahmat Qurishi @RahmatQurishi]

all easy bugs , just reading js files, copying endpoints, and throwing them into repeater😅

[hackermater @hackermater11]

Yes! P3 Triaged on Bugcrowd! 💯🤞.
Another bug in mobile scope, I'm still waiting for the customer response in this new week! 💪🍀.
🧠 Tip: Always try bypass client-side restrictions/blocks via backend API through Caido/Burp proxy interceptions.
#bugbounty #bugbountytips #hacking

[Divyansh Sharma @divyansh2401]

Yay, I was awarded a total of $5,500 in bounties on @Hacker0x01! https://t.co/unepjTWUuT

Vulnerabilities Found:

1. Privilege Escalation (Trial User → Platform Admin)
  1. While reading the site's JavaScript files, I found an API endpoint and noticed it accepted an "author" parameter in the request body.
  2. The JS hinted that the "author" value was used to identify who the request belonged to — and that this value needed to be an admin's email for certain actions.
  3. I collected 15–20 employee emails through public sources (OSINT).
  4. I tested them one by one as the "author" value. One matched a platform admin account, and that request was accepted.
  5. Using that admin's email as "author" along with my own account ID, I changed my account "plan" from "trial" to "internal". The request went through, and my role was updated.
  6. Root cause: the endpoint was authorizing the request using a value from the request body instead of the role from the user's authenticated session.

2. SSRF → Cloud Metadata Credential Exposure
  1. The app had a feature that fetched user-supplied URLs from the server side.
  2. Confirmed by pointing it at a public echo service — the response showed a cloud server IP, not mine. The server was making the request.
  3. The URL filter blocked the metadata service IP in its standard dotted form, but didn't normalize alternate representations. Converting the same IP to its decimal form bypassed the filter cleanly.
  4. From there, the standard two-step metadata flow worked: first request returned a session token, second request used that token to return temporary instance role credentials.
  5. Root cause: block-list URL filtering without IP normalization. A single canonicalization step on the resolved address would have caught this.

3. IDOR Exposing 285,000+ Customer Invoices
  The invoice download endpoint used sequential IDs with no ownership check. Changing the ID returned other customers' invoices.

4. IDOR Enabling Cross-Tenant Audit Log Manipulation
  A "log move" endpoint trusted client-supplied IDs, which allowed moving log entries across tenant boundaries and tampering with audit history.

5. Unauthenticated Path Traversal
  A public endpoint accepted file paths without sanitization, allowing partial file reads across the platform with no authentication required.

Key lessons:
→ Never authorize based on request-body fields. Use the session/JWT role.
→ URL-fetch features need allow-lists, and must normalize alternate IP forms.
→ Sequential IDs are fine; missing ownership checks are not.
→ "Unauthenticated" doesn't mean "untrusted input is safe."

#bugbounty #securityresearcher #ethicalhacker #cybersecurity #vulnerability #penetrationtesting #securityaudit #digitalsecurity #tech #innovation #hackerone #freelance #freelancer #pentester #ssrf #idor #privilegeescalation #pathtraversal #appsec #infosec #TogetherWeHitHarder #bugbountytips

[Mustafa Adam Gamaraldin Abdalla 🇸🇩♥️ @wadgamaraldeen]

Thanks To Allah❤️always and Forever♥️

Write-up :- https://t.co/bJyKHd4G8P

#AccountTakeover
#bugbountytips
#Cybersecurity
#EthicalHacking
#AppSec

[Moyin @MRM_Cyber]

Vulnerability In PayPal worth 200000$ bounty, Attacker can Steal Your Balance by One-Click https://t.co/o27xo0hQcC