Twehbe

[Wiz @wiz_io]

Huge kudos to GitHub for addressing the issue 👏
Full technical breakdown here → https://t.co/pH0kNpxY72

[SandboxEscaper @WeirdQuadratic]

Fyi I started blogging about windows secure channel a while back, you could probably get a couple of bug bounties out of certificate chain building related code, its a big attack surface: https://t.co/pIIxMwyDna

[NullSecurityX @NullSecurityX]

Exploiting llama.cpp’s RPC Server - From Null Buffer to RCE Against PIE + Full RELRO + NX | CVE-2026-34159:
The vulnerability is a one-line logic bug in the RPC server’s tensor deserialization pipeline.
Youtube: https://t.co/7gcPGHd27g

Blog: https://t.co/POwWG9aZZ9

[Pingiskok @pingiskok]

Every JWT writeup online covers 2–3 attacks and stops.
I got tired of jumping between 40 blog posts, so I wrote the whole thing. All in one place.
https://t.co/iCSzQ4GjcS

#infosec #appsec #bugbounty #websec #jwt

[TheOuts1derX @TheOuts1derX]

Cloud hacking tools for bug bounty hunters:

CloudFox
https://t.co/htfw49SLGM

Pacu
https://t.co/CXdO5YRnIG

S3Scanner
https://t.co/cIb5YdxfI8

Extra tools, not purely cloud but used a lot in this workflow:

Nuclei
https://t.co/UiXI7zZFT1

TruffleHog
https://t.co/lEqC1BzIyj

#BugBounty #CloudSecurity #Pentesting #InfoSec #EthicalHacking #CyberSecurity

[obscaries ❘ AppSec @obscaries]

If you're into bug bounty, this repo is gold.

A massive collection of real-world writeups categorized by vulnerability type, XSS, IDOR, SSRF, RCE & more.

Stop guessing. Study how real hackers actually find bugs 👇

https://t.co/qebk8UGu9T

#BugBounty #InfoSec #Hacking #Pentesting #CyberSecurity

[obscaries ❘ AppSec @obscaries]

Every pentester should have these in their toolkit 👇🔥

From Shodan to https://t.co/jroBP3BGxS, this list covers servers, OSINT, attack surface, code search & threat intel

Did I miss anything? Drop your favorite tools in the comments 👇

#BugBounty #CyberSecurity #Infosec #Hacking #Recon

[Brut 🇮🇳 @wtf_yodhha]

🌐A complete Web Application Bug Bounty Methodology — 59 pages, 20 chapters, real techniques I actually use. Covers everything from recon to JWT attacks, SSRF, XSS, file upload RCE, HTTP smuggling, reporting and more.

▶️ https://t.co/OWquG73Ei9

#bugbounty #bugbountytips

[TheOuts1derX @TheOuts1derX]

Mind maps and methodologies for bug bounty hunters:

Methodologies:

- TBHM: https://t.co/4sxQe7soM3
- OWASP WSTG: https://t.co/QACTPoNHyF
- HackTricks: https://t.co/zsjIgdvT94
- PayloadsAllTheThings: https://t.co/s0WXLdKYrz
- HowToHunt: https://t.co/NcrbEFFvQn
- Pentest Book: https://t.co/82Mp1OAqWO
- The Hacker Recipes: https://t.co/Ne2XMSnKBZ

Mind maps:

- Mind-Maps: https://t.co/SESZ18KrOw
- Assessment-mindset: https://t.co/K5HbEs67q5
- Harsh Bothra XMind: https://t.co/PCJkb42N1D

#bugbounty #bugbountytips #infosec #cybersecurity #pentesting #appsec

[Muqsit 𝕏 @mqst_]

🧱 How to Break a WAF: ModSecurity CRS

Blog: https://t.co/87rGSxfLHp

Author: @0xInfection

[TheOuts1derX @TheOuts1derX]

API Hacking for bug bounty hunters:

Knowledge base

- OWASP API Security Top 10 - https://t.co/IUVqsJHofZ
- Hacking APIs by Corey J Ball - https://t.co/pjyfnTdUnh
- Black Hat GraphQL by Aleks & Farhi - https://t.co/9RpnPKsqwK
- OWASP API Security Cheat Sheet - https://t.co/woqtoYQdMW
- Inon Shkedy's 31 Days of API Security Tips - https://t.co/bMloymWcja

Training

- APIsec University (free) - https://t.co/AMr5DO57uG
- PortSwigger Web Security Academy - https://t.co/T96FawbxKM
- HackTheBox Academy API Attacks - https://t.co/T8z91yUvNs
- PentesterLab API Badge - https://t.co/qsZFW0ttEo

Vulnerable labs

- crAPI (OWASP) - https://t.co/zJwkFSwFaQ
- vAPI - https://t.co/BOWR9I2gDs
- VAmPI - https://t.co/Za7nw5wxEd
- DVGA - https://t.co/K6a0RQjKo8
- DVWS-node - https://t.co/ik6LBfhWgu
- Pixi - https://t.co/L3iWD3tiZ9
- Tiredful-API - https://t.co/7r7qPwu9lA
- Websheep - https://t.co/fK9CPnu6Xk
- OWASP Juice Shop - https://t.co/RW5wL85C6e

API specific tools

- Kiterunner - https://t.co/72mVLjb8xP
- Arjun - https://t.co/1WTBMkrCAl
- Postman - https://t.co/JcswCBmEB1
- Insomnia - https://t.co/B4SbDGnxjw
- Bruno - https://t.co/GxhsjyFwdr
- mitmproxy - https://t.co/GxCKrjHnfg
- Hetty - https://t.co/A8qlIwdRUX
- Akto - https://t.co/tfVImvmDua
- JWT_Tool - https://t.co/JE72Wkcgjw
- https://t.co/SWlcnfflYo - https://t.co/bFPMDK3Onk
- Clairvoyance - https://t.co/T6mevmnQdB
- InQL - https://t.co/UDWOyjL2zt
- Param Miner - https://t.co/NAoFiYHhqw
- Swagger-EZ - https://t.co/y5i2BeKz1C

Checklists and methodology

- hAPI Hacker - https://t.co/Ll4DeUOkrN
- HackTricks API Pentesting - https://t.co/PABVfJqcV1
- API-Pentesting-Resources - https://t.co/FHbwXdLS2D
- Shieldfy API Security Checklist - https://t.co/BpxGmU3Vkl

Wordlists

- SecLists - https://t.co/pQhPXSNccf
- Kiterunner routes - https://t.co/72mVLjb8xP
- Assetnote wordlists - https://t.co/LRam6JnkUR

#BugBounty #APISecurity #APIHacking #InfoSec #CyberSecurity #PenTesting #EthicalHacking #WebSecurity

[sin99xx @sin99xx]

All my write-ups are available soon and I'm gonna drop a breakdown on a presentation, which is still relevant in 2026. Check my GitHub https://t.co/VIGQ4r76WK for old write-ups and I will try to also post the bugs which I found most are state machine and business logic, not generic but high-value, high-impact.

[3NVZ | Robert S. @YourFinalSin]

Here is a little dork for you, if you wanna learn a thing or two about Client-Side Vuln Hunting!

site:https://t.co/6ohtbhA5UD "client-side"

[Twehbe @Twsec83]

@Oliviacoder1 Claude

[Twehbe @Twsec83]

@Suryanshti777 LLM

[Julien | MrTuxracer 🇪🇺 @MrTuxracer]

Pwning TRUfusion Enterprise again: chaining a pre-auth SSRF (CVE-2025-32355), a default password, and a path traversal (CVE-2025-59793) to gain RCE.

#security

https://t.co/0VmQ6SaQZc

[Twehbe @Twsec83]

@TommiPedruzzi 90

[obscaries ❘ AppSec @obscaries]

Static JS analysis just got smarter.

jsluice is a Go-based tool that parses JavaScript using ASTs to extract endpoints, secrets, and interesting artifacts — no noisy regex scraping.

🔗source: https://t.co/7eyaQjt337

Perfect for bug bounty hunters who actually read JS instead of just grepping it. 🔎⚡

If you’re serious about client-side recon, this deserves a spot in your toolkit.

#BugBounty #AppSec #JavaScript #Recon

[Harley Kimball @infinitelogins]

I analyze thousands of bug bounty content items every month. Less than 5% makes it to the newsletter.

I distilled those curated selections down to the top 25 resources for 2026 and put them in this PDF. It includes the top platforms, tools, and people that consistently deliver high signal content.

Comment RESOURCES and I'll DM you the PDF for free. (Make sure your DMs are open)

#BugBounty

[Muqsit 𝕏 @mqst_]

🍽 Resources: Beginners Guide to Learning about Dependency Confusion.

Guide: https://t.co/kQCkwYz85w
Blog 1: https://t.co/aG9hNeq5C5
Blog 2: https://t.co/RB2IKEzEdh

#infosec