Vikas Varshney

[Bug Bounty Village @BugBountyDEFCON]

Time for another giveaway!

We will pick 6 winners to win one of the following:

1x Annual VIP @hackthebox_eu Licence
5x @PentesterLab 3 Month Licences

To enter:
1️⃣ Follow us @BugBountyDefcon
2️⃣ Like this post ❤️
3️⃣ Re-tweet this post 🔁

Giveaway open until Monday June 15th! GOOD LUCK!

[International Cyber Digest @IntCyberDigest]

‼️🚨 Pwn2Own Berlin 2026 just hit a wall. For the first time in 19-years, ZDI rejected dozens of working zero-day RCE submissions because organizers ran out of contest slots.

Rejected hackers are now going public with PoC demos and direct vendor disclosures, breaking Pwn2Own's usual secrecy.

▪️ AI surfaces a massive wave of 0-day RCEs.
▪️ Submissions overwhelm ZDI past max capacity.
▪️ Slots run out. Researchers with working chains get rejected.
▪️ "Revenge disclosures" begin. ← we are here.

Confirmed casualties so far:
▪️ @xchglabs : 86 vulnerabilities prepared (PyTorch, NVIDIA, Linux KVM, Oracle, Docker, Ollama, Chroma, LiteLLM, llama.cpp). All rejected. Now reporting directly to vendors with writeups dropping as patches land.
▪️ @ggwhyp : full-chain Firefox RCE on Windows. Rejected. Publicly demoed (HTML page → cmd.exe → calc.exe). Responsibly disclosed to Mozilla.
▪️ @yunsu_dev : working RCE chain, rejected. Submitting elsewhere.
▪️ @ryotkak : tried to register for 3+ weeks. ZDI confirmed "at maximum capacity, can't add extra contest days." Considered canceling flight and hotel.
▪️ @anzuukino2802 : Claude Code RCE PoC. Rejected.
▪️ @desckimh : 0-day RCEs in Ollama and LM Studio. Rejected.

Reported impact: a community-estimated 150+ researchers tried to register. Accepted contestants are now being warned about collisions. Rejected vulnerabilities going to bug bounty programs may trigger pre-event patches that invalidate the work of those who got in.

ZDI has not publicly addressed the capacity issue. The event still runs May 14-16 in Berlin.

[8kSec @8kSec]

🌍 Earth Day Giveaway - Learn Mobile or AI Security, On Us

One beautiful planet we all share. Let's patch it together. 🌱

To celebrate Earth Day, we're planting 3 free seats 🌱 in any 8kSec Academy course - winner's choice of the whole forest:

• Practical AI Security: Attacks, Defenses, and Applications
• Practical Mobile Application Exploitation
• Offensive Mobile Reversing and Exploitation
• Offensive iOS Internals
• Offensive Android Internals

Explore the catalog → https://t.co/B8Q31o3o8q

How to enter (zero carbon footprint 🍃):
🌿 Follow us
🌿 Like this post
🌎 Repost to spread the seeds

🌟 Bonus: double your chances!
💬 Comment your favorite place on Earth that you have visited or would like to visit 🌍, and we'll count your entry twice
3 winners sprout on April 27. We’ll DM each winner to select their course.

[Vikas Varshney @vikas_varshney_]

@Cloud_Breach Breaching Azure Advanced (OASE) 😇

[CloudBreach @Cloud_Breach]

🐣 EASTER GIVEAWAY 🎁
Forget the chocolate, we’re hunting vulnerabilities! 🐰

We’re giving 3 winners free access to their choice of:
☁️ Breaching Azure (OASP)
🌩️ Breaching Azure Advanced (OASE)
☁️ Breaching AWS (OAWSP)

To Enter:
1️⃣ Like
2️⃣ Retweet
3️⃣ Comment

📅 Ends: 13 April 2026

Train like an attacker. Stop the breach. 👉 https://t.co/BgRrolAJMI

#CloudSecurity #EasterGiveaway #InfoSec #Azure #AWS #RedTeam #CyberSecurity #Hacking #Giveaway #BlueTeam #RedTeam

[Vikas Varshney @vikas_varshney_]

@cyberwarfarelab #AzRTS

[Vikas Varshney @vikas_varshney_]

@theXSSrat "RAT" 🐀

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

🎁 CYBERSECURITY GIVEAWAY 🎁

I’m giving away 1 COPY of the "Endless Bundle" (€799 Value). Access EVERYTHING I’ve ever built + every future update. Forever. 🐀🔥

The Prize:✅ 44+ Hacking Courses ✅ Private Discord + Mentorship ✅ Realistic Labs (No CTF toys) ✅ Sunday Live Workshops

To Enter:1️⃣ Follow @theXSSrat and @_Freakyclown_ 2️⃣ Retweet this post 🔄 3️⃣ Reply with "RAT" 🐀

Winner chosen in 72 hours. Good luck!

See what you’re winning:👇 https://t.co/eG19mekvMi

[JS0N Haddix @Jhaddix]

Day FOUR of FIVE days of celebrating our 2 year ARCANUM-VERSARY! @arcanuminfosec

5th Giveaway = FOUR seats to our ONE OF A KIND course on using AI to scale you as a Red, Blue, or Purple Teamer:

!! Red Blue Purple AI !!

👍 1 Like = 1 Entry!
♻️ 1 Share = 2 Entries!

Winners announced 1/21! Syllabus link below 👇

[JS0N Haddix @Jhaddix]

Day THREE of FIVE days of celebrating our 2 year ARCANUM-VERSARY! @arcanuminfosec

4th Giveaway = FOUR seats to our FLAGSHIP course on modern application assessment and recon:

The Bug Hunter's Methodology!

👍 1 Like = 1 Entry!
♻️ 1 Share = 2 Entries!

Winners announced 1/21! Syllabus link below 👇

[Phillip Wylie @PhillipWylie]

To help celebrate @arcanuminfosec Information Security's two-year anniversary, @Jhaddix gave me 5 codes good for any Arcanum course to give away!

Winners will be announced on 1/22.

👍 1 Like = 1 Entry!

♻️ 1 Share = 2 Entries!

[dawgyg - Defcon @thedawgyg]

Alright so to end 2025 I am going to post something that people have been requesting for quite some time.. As alot know, I have made over $1 million dollars from SSRF vulnerabilities alone. #ssrftips Below I will provide some information on some of the ways that I beat the blacklists/deny lists and cashed in. Any method I post below has worked for me personally in the past. I am not claiming that any of these ways are 'my' discoveries, and in no way am I trying to claim other's work as my own. Simply answering a question that gets asked of me almost daily. #bugbounty #bugbountytips #togetherwehitharder #ittakesacrowd #hackers #hacking #NewYearsEveBountyTips

So lets get into it:

Encoding:
Everyone knows (or should know) about the ability to encode IP addresses. What alot of people dont know is that you can combine encoding types on a single IP. SO instead of encoding the entire IP, encode single octets etc.
Example: Changing the Metadata IP to: 0251.254.169.254 this octal encodes the 1st octet only, leaving the rest of the IP the same. This is the exact method that allowed for my $180,000 from the Yahoo Bug Bounty Program in Oct 2018

Redirects:
Alot of SSRF vulnerable functionality will follow redirects. What many people dont consider is multiple redirects. Never stop at just one. I have found many instances where an SSRF followed all redirects, and would properly block the final redirect to the target internal service (internal ip/metadata server). DO NOT STOP AT 1 REDIRECT! Instead of a single redirect, setup a simple php redirect script that will redirect the request back to the same end point multiple times before finally sending to the target IP/host. I have had many instances in the past where the target properly checks the response of the first 1,2, 3 ....6 redirects then magically on the 7th it no longer performs any valdiation and allows you to hit the metadata. I can't explain why this happens, but its happened enough that this is one of the very first things i test for when it comes to SSRF testing.

TOCTOU:
This is one of my fav's because it almost always can be used to bypass the initial fixes for an SSRF vulnerability. TOCTOU stands for: Time of Check Time of Use. When you pass a url to an SSRF vuln end point, the backend will take the host of this, resolve it (if its not already an IP), check against the allow/block list, then take action. Many frameworks will not cache the DNS lookup response that happens during the initial validation phase. When they forget to do this, having a subdomain properly setup for a TOCTOU check can allow for tricking their checks to allow for hitting banned resources.
How it works: Server resolves https://t.co/aKo0eb63ft to 1.1.1.1 and does their checks to make sure its not a blocked IP. After passing these checks the domain is passed to the function that will actually make the call. If the server did not cache the previous response, it will then resolve the host again as part of the flow to make the request. If you have a properly setup nameserver for this attack, then the instance they make the 1st DNS call, your server quickly changes the DNS entry and points it to the target IP (Metadata/Internal), so that when it gets to the function that makes the request, it resolves the host again and makes the request.

HTTP 2 vs HTTP/1.1 vs HTTP/1.0 vs HTTP/0.9
Several have had success with this in the past. And again, I am not sure why this works sometimes. But if the request is using HTTP/2 and blocks your attempt, try and change it to an older version. I have had success with each of the above at least once (most of the time on Yahoo, but others as well).

Simple/more common things:
dns rebinding, create a hostname on your domain pointing to localhost or an internal IP.

simplify the IP. example: 127.0.0.1 is blocked, so try 127.1, or 0.0.0.0, 0 etc.

Theres tons of other ways that you can get creative and do things like this. This post is just sharing some of the more fun/more unique ways that I have had success in the past. This is not ment to be an exhaustive list of things to try, and is only ment to start your brain working to come up with weird/random/fun ways to beat the black lists.

If you like the information, drop a like/comment/follow and let me know which of the above you have tried in the past, or are looking forward to trying out in 2026. If you end up having success with these, let me know as well!

[Ben Sadeghipour @NahamSec]

🚨 Giveaway + Update:
We just updated my Hands-on Web Exploitation Course with a new Client-Side Path Traversal module which includes new labs and an hour of video content. I have create a code to give you 60% off (limited to 15 people only). https://t.co/IYKDeLHTUV

Retweet and respond with a 🎉 to enter. Winners will be announced on January 2.

[Vikas Varshney @vikas_varshney_]

@NahamSec 🎉

[I am Jakoby @I_Am_Jakoby]

@0x45o https://t.co/ReBEbCoAYP

Websites designed to look like a windows desktop that teaches powershell hacking

[Vikas Varshney @vikas_varshney_]

@vxunderground @nikhil_mitt @struppigel Thank u for this big giveway

[Vikas Varshney @vikas_varshney_]

@vxunderground @mrgretzky It's a evilngnix phishing ..so it's a phishing

[Vikas Varshney @vikas_varshney_]

@vxunderground @Octoberfest73 Wish me a luck

[Vikas Varshney @vikas_varshney_]

@_0b1d1 Pdf

[Vikas Varshney @vikas_varshney_]

@vxunderground Mal DevAcademy 😇