roughwire

Security Engineer
I love guitar more than info security ❤️

[roughwire @roughwire]

I am not a frequent bugbounty hunter. I am a pentester with some years of experience in infosec. I started bugbounties in March2020 on weekly basis. Today I have bought this baby with my bounties. A big thanks to @Hacker0x01

[roughwire @roughwire]

What happened @OpenAI My codex started typing this garbage

[roughwire @roughwire]

@Bugcrowd ls 👨‍💻

[Aman @Amank1412]

Someone built a transparent Mario game that runs OVER IDE so can play while waiting for Copilot to write code.

[Yasho @YShahinzadeh]

It's time for sharing, this is not a simple write-up, we are sharing our methodology and reasoning, detailing how we approached and hunted the flaw, I hope you like it :]

https://t.co/MNmJyNZVBg

[payloadartist @payloadartist]

Claude wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

https://t.co/RwP6a0lOsQ (by Calif team)

[Damian Strobel @damian_89_]

Small bug bounty writeup from one of my findings from the past - even back then having a carefully crafted list of non resolving starbucks hostnames was essential (shameless ad: https://t.co/ruxCzwsAni). Writeup:

https://t.co/ChumcG0JXp

Background of https://t.co/LEy2JpUTns

[obscaries ❘ AppSec @obscaries]

ffuf just got smarter 🤖⚡

ffufai brings AI into fuzzing — smarter payloads, better endpoint discovery, less noise.

Stop guessing. Start targeting. 🎯

🔗 Source: https://t.co/PjsnllwvBV

#BugBounty #Infosec #WebSecurity #Recon

[Shad0w @Itx_Shad0w]

For years, Google API keys (AIza...) had little to no real-world impact.
But recently, many of them unexpectedly gained access to Google Gemini.

curl "https://t.co/w9AaJy4JhU"

This appears to be a widespread misconfiguration that can be hunted in the wild.

[AmirMohammad Safari @AmirMSafari]

My challenge is actually based on a bug I found in Apollo Server; in its default configuration, it uses the same blacklist-based approach to prevent CSRF. I was able to bypass it and use it as an XS-Leak in default configs.
I’ll be writing a detailed write-up soon about it :)

[roughwire @roughwire]

@pxmme1337 Haha that New Delhi guy 🤣🤣

[Six2dez 🇵🇸 @Six2dez1]

This is the first public release of Burp AI Agent.

Expect rough edges. If something isn’t clear after reading the docs or you hit a bug, feel free to open an issue.

Feedback and improvements are very welcome.

Repo: https://t.co/tSIHsmY4wE
Docs: https://t.co/khQnwiJ2ZE

[payloadartist @payloadartist]

Somebody built an AI agent to audit smart contracts and managed to find a $250k bug on Immunefi 🤯

https://t.co/Ou6lyrEGyX

Are you still sleeping on AI anon?

#bugbounty #bugbountytips

[Youssef Sammouda (sam0) @samm0uda]

Datr cookie theft and AI leading to Facebook account takeover ($24,000)
https://t.co/n2MVZKxDBg
Two-click Facebook account takeover via FXAuth ($30,000) https://t.co/MtuvFzGRsS
Self-XSS in Facebook payments flow leads to account takeovers ($62,500)
https://t.co/D7qXu1Avim

[Behi @Behi_Sec]

IDOR Trick:

If you're dealing with a UUID-based IDOR, try this:

00000000-0000-0000-0000-000000000000

This might expose default objects or unintended access.

[André Baptista @0xacb]

If you found a package.json file in the wild, you might find some internal packages vulnerable to a dependency confusion attack 👀

Check for it quicker using this cool new tool by JSMon: https://t.co/zjdmSzRfqy 👇

[binaryboy @b1n4r1b01]

Brief info and POC for this week's Apple 0click iOS 18.6.1 RCE bug CVE-2025-43300 https://t.co/EL3qg56N8X

[Debangshu 🇮🇳🥷 @ThisIsDK999]

https://t.co/Obc7lYSirT

Super-nice technique!
Something refreshing to see in the AI-everything era :)

[André Baptista @0xacb]

If you're learning about vibe hacking, here's a cool article demonstrating how @mattrkeeley used AI to create a working exploit for CVE-2025-32433 before any public PoCs existed!

Worth a read 👇
https://t.co/74ALoE8V48

[JS0N Haddix @Jhaddix]

https://t.co/8UPWxpqrKd

[Intigriti @intigriti]

💡 Tip!

Injecting Log4Shell payloads is also possible in PDF files! eelyvy has a dedicated GitHub repository showing exactly how to craft your PDF payload file! 😎

🔗 https://t.co/fjMU9yOYje