st0x_r0

Bug Bounty

[Bug Bounty Insights 🪄 @bbr_bug]

Webhook SSRF filter bypass: many servers block 301/302 redirects but follow 303 See Other.

Host a PHP script returning 303 to the internal target:

ex.👇

Source: Omise #508459 (AWS keys leaked in webhook delivery log).

[st0x_r0 @tx_shengxia]

@0rang3c4t @WolfTrainer_101 盲猜kiro反代

[st0x_r0 @tx_shengxia]

@hir0k1sawada 终究还是要来了，害

[Swissky @pentest_swissky]

Studying LLM Workflows Until They Actually Find Cool Bugs - @Elliot_belt
https://t.co/qaWULzzr7h

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

We just got a new post by @avlidienbrunn on the lab!

He brought it up in the #researchers exclusive chat and we HAD to post it.
Go check it out!
https://t.co/v2yNzTTYNK

[Joseph Thacker @rez0__]

The hackbot @xssdoctor and I made has found 126 reportable bugs this year 😊 88 were High or Critical!! :)

Check it out: https://t.co/V15zqqx8XR

[EchoXu @EchoXuAI]

这篇文章看完后，我真正注意到的点不是比哪个模型更厉害。作者拿AI跑了一圈实际的安全研究测试。Semgrep直接没找到。Strix接GLM 5.1跑了12小时，花了接近6000万tokens，还是没抓到关键漏洞。Cursor配GPT 5.5偶尔能碰上，但结果不稳定，有时候有有时候没有。真正每次都稳稳打中的，是本地模型加上他自己写的那个harness。这个做法确实有意思。他没有让agent一口把整个仓库全审完，而是把项目拆开，一个源码文件一个源码文件地喂给模型，然后把报告收回来汇总。PHPIPAM的LFI漏洞就这样每次都能跑出来。后来他又拿myVesta试了试，大概8小时左右就挖到了一个authenticated RCE。我看这才是本地AI做安全研究最有价值的地方。不是说本地模型现在已经全面超过Claude或者GPT了。而是它不怕把token烧光钱包，不用把代码丢给第三方，也没有云端模型动不动就拒答的限制。在安全场景里，能自己掌握主动权，这点真的重要。

原文👇
https://t.co/8LmsQNtW0R

#LocalAI #CyberSecurity #LLM #AIAgent #Pentest #CodeReview #SecurityResearch

[Jorian @J0R1AN]

This new HTML feature just shipped in Chrome 150, it's gonna be veeeeery interesting 👀
https://t.co/mbvgknxHJZ

[st0x_r0 @tx_shengxia]

@NoraX2026 ???

[Fat @fattselimi]

Bug Bounty Hunters don't find bugs everyday but atleast they try to find bugs everyday

[obscaries ❘ AppSec @obscaries]

https://t.co/9HNAjBDATQ

[st0x_r0 @tx_shengxia]

@darkshadow2bd How did you come up with that?

[Jorian @J0R1AN]

I won't keep you in mystery any longer, here's how I found an XSS vulnerability *in* Shazzer!
The chain involved some interesting browser techniques no sane developer could foresee. Check out the details below:
https://t.co/nY20Anz0VO
(and thanks @garethheyes for making Shazzer!)

[st0x_r0 @tx_shengxia]

@pxmme1337 依托答辩

[castilho @castilho101]

My first research with Ethiack just came out. Abusing redirect discrepancies to leak secrets in URLs by using the browser's fragment handling. Hope you like it

https://t.co/0Gd5wQlkZo

[skull @brutecat]

StubZero: $148,337 RCE in Google Cloud Production

https://t.co/m7cBnSTaj4

[st0x_r0 @tx_shengxia]

@brutecat nb

[0xSabir @0xSabir]

$13,337 Google Bug Bounty

1-click Oauth client takeover through henhouse UI by rand0m_unk0wn

👨‍💻 rand0m_unk0wn
🔗 https://t.co/oH6MRZaedq

[Gareth Heyes \u2028 @garethheyes]

@aidenybai Yeah it's messed up

1,{"\
"(){alert(1)}}['']()

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

HackerNotes TLDR for episode 174: https://t.co/KiOUyb0VVg

►⠀Salesforce Marketing Cloud got popped through Ampscript template injection plus an unauthenticated CBC bit-flipping attack. The 8 null-byte trick to leak the IV is the kind of crypto move you should keep in mind.
►⠀cPanel WHM auth bypass (CVE-2026-41940) chains a CRLF injection into a session file on disk with two different auth methods, then beats a cache to land a pre-auth session.
►⠀A single .git directory delete on Google Cloud Looker leads to RCE because git falls back to reading config from the working directory when .git is missing. Variant goldmine for any code sandbox that lets you touch the filesystem.
►⠀Skill optimizer from Tessl, prompt injection to deterministic XSS, and GPT-5.5 actually competing with Claude on black-box hacking. Lots of moving pieces this week.