Andy

To the moon and cyber security.

[Vivek | Cybersecurity @VivekIntel]

📝 Awesome Bug Bounty Writeups — Learn From Real Reports, Not Theory

A curated collection of hundreds of real-world bug bounty writeups covering vulnerability discovery, exploitation techniques, bypasses, and attack chains from top security researchers.

Categories Covered:
• Cross-Site Scripting (XSS)
• Server-Side Request Forgery (SSRF)
• Insecure Direct Object Reference (IDOR)
• SQL Injection (SQLi)
• Cross-Site Request Forgery (CSRF)
• Authentication & 2FA Bypass
• CORS Misconfigurations
• Local File Inclusion (LFI)
• Subdomain Takeovers
• Race Conditions
• Remote Code Execution (RCE)
• Android Security Testing

Why it's valuable:
• Learn real attack methodologies
• Understand vulnerability chaining
• Improve bug bounty hunting skills
• Study report writing and impact assessment
• Discover bypass techniques used in actual programs

Instead of reading generic tutorials, study how researchers found, exploited, and reported vulnerabilities on platforms like Google, Microsoft, PayPal, Facebook, Uber, Yahoo, Tesla, Amazon, and many more.

🔗 https://t.co/3qM2rTkzyi

#bugbounty #Pentesting #WebSecurity #AppSec #XSS #SSRF #IDOR #SQLInjection #CyberSecurity

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

File upload bugs are still everywhere. My 2026 playbook:

1. Map every upload — profile pic, resume, CSV, KYC, support attachments. Different code paths, different bugs.

2. Beat the extension filter:
- shell.PHP (case)
- shell.php.jpg / shell.jpg.php
- .phtml .php5 .phar .pht
- %00 null byte
- shell.php;.jpg (IIS)

3. Spoof Content-Type: image/jpeg in Burp. Half the time it's the only check.

4. Beat magic bytes — prepend GIF89a; to your PHP. Valid image header, valid PHP.

5. SVG = XML = <script>. Stored XSS via image view. Bonus: XXE via DOCTYPE.

6. Path traversal in filenames + Zip Slip in ZIP uploads.

7. Look at what processes the file after upload — ImageMagick, FFmpeg, headless Chrome PDF renderers. SSRF + LFI hide there.

8. Race the antivirus — upload, hammer the URL before the scanner deletes.

9. Trap: hunters test the obvious field and leave. Real bugs live in admin/import/bulk uploads no one tests.

10. Report on IMPACT not the upload. ".phtml uploaded" = medium. ".phtml + RCE PoC at /uploads/" = critical.

What's the wildest upload bug you've found?

[Het Mehta @hetmehtaa]

Best malware analysis blogs on the internet:

Malware Unicorn → https://t.co/ctP9ISZeC5
Hexacorn → https://t.co/cUtJxUUaGV
Didier Stevens → https://t.co/2swSJFTQrR
DFIR Report → https://t.co/7IjW1sjoRU
Malware Traffic Analysis → https://t.co/Cptin440m2
MalwareTech → https://t.co/H8uYA8FFzy
Elastic Security Labs → https://t.co/VtBvJNHn6z

[Steven Cheng @stevencheng]

If you don’t have air conditioning at home, be sure to watch this video. I’ll show you how to build a powerful DIY air conditioner in just a few minutes.

[Steven Cheng @stevencheng]

Built version 3.0 of AI mosquito defense system during the holiday.

Now equipped with multi-sensor tracking, a redesigned high-speed gimbal, and a toy Gatling-style launcher for maximum mosquito elimination efficiency 🦟🔥

0.6s full rotation.
0.001° precision.

[The Meritocrat @themerit0crat]

👇 gud list :)

[TheOuts1derX @TheOuts1derX]

Secret detection and validation tools for bug bounty hunters:

secrets-patterns-db
https://t.co/DxZzWdj30z

keyhacks, not actively maintained but still relevant
https://t.co/T42MWUhK8V

#BugBounty #BugBountyTips #Recon #InfoSec

[JS0N Haddix @Jhaddix]

Our sponsor this week is @harmonicsec!

Want to see every plugin, skill, MCP server, connector, extension, and scheduled task running in Claude Desktop?

Now you can thanks to @harmonicsec’s free tool:

claudit-sec: https://t.co/NdbKhaktBT

[Haipo Yang @yhaiyang]

加密交易所永续合约的资金费率中,包含一个约万分之一的基础利率。该利率每天收取三次,折合年化约10%。这意味着,即使合约价格与现货价格之间不存在任何基差,市场依然会向多头收取一个年化10%的正向资金费率。
这一费率带来了两方面的影响。一方面,它为市场的资金费率套利者提供了年化5%到10%的基础收益率。之所以达不到满额的10%,是因为套利本质上伴随着杠杆行为——你需要一���买入现货,一边做空合约,导致资金利用率无法达到100%。根据交易者不同的杠杆率和风控偏好,最终的年化收益率通常落在5%到10%之间。另一方面,这笔费用对多头而言,实质上是一种持续性的”税收”。虽然单次收取比例看似不高,但对于频繁交易者来说,叠加杠杆后每年支付的利息成本其实非常高昂,甚至会超过本金本身。
那么,这个数值究竟是怎么来的?实际上很多人从未深究过背后的原因,甚至包括币安、OKX等现今大部分交易所的设计者们,也未必清楚设定这个费率的初衷。因为本质上,行业内的产品大多是互相照搬,产品经��们并不理解为什么存在这么一个机制。小交易所由于缺乏主导权,只能被动与大交易所对齐;而大交易所最初其实都是在模仿BitMEX。
至于BitMEX为何会设定这个数值,要回到当时的市场结构。如今普遍使用USDT作为保证金,而2017、2018年的BitMEX使用的是BTC作为保证金。在那种机制下,做多隐含着借入美元的需求,做空则隐含着借入BTC的需求。当时BitMEX主要参考的利率市场是Bitfinex。在Bitfinex上,借入美元的年化利率大约在10%左右,而借入BTC的利率接近于零,因为当时市场以做多为主,做空较少。因此,BitMEX引入了这个约10%的年化基础利率,并根据市场情况动态调整。尽管现在的市场结构和利率环境都已发生翻天覆地的变化,但这个基础资金费率却被照搬保留了下来。说白了,大家在互相抄袭中早已忘记了最初的逻辑,也根本没人敢去改动这个核心数值。
更关键的是,在当下的U本位机制下,按同样逻辑,“正确”的基础利率应该等于USDT借贷利率减去标的资产的借贷利率。USDT在主流借贷市场利率只有三四个点,而BTC、ETH这类标的本身有staking和链上原生收益,借贷利率并不为零。两者相减,理论基础利率应该远低于10%,某些标的甚至可能为负。错的不只是数值的来源,在新的保证金体系下连方向都不对。
而且这个错误参数,被它自己催生的套利资金反向锁死了。资金费率本应是一个动态的市场化收敛机制,一个人为预设的非零基础利率,等于在上面叠加了一个固定方向的偏置——这已经不是收敛机制,而是伪装成利率的转移支付。接收方是delta-neutral套利资金:现货多+合约空,赚的就是基础利率减借贷成本的差。这部分资金沉淀下来,在交易所盘口、staking收益、USDe等合成美元上层层堆叠,基础利率不再是一个参数,而是被无数资产负债表定价进去的常数。Ethena的sUSDE、各家U本位”理财”、做市商的carry策略,全都默认这个10%继续存在。谁先改谁就是破坏者:改低,套利资金撤出,合约深度塌陷,做市商点差扩大,用户直接迁移到不改的对手盘。所以理性策略就是没人改。
不过客观来讲,这个数值确实为整个加密市场奠定了一个基础的年化收益率。围绕着这一资金费率,不仅催生了庞大的套利资金以及相关的资管项目和业务,还延伸出了诸如USDe这样的代币项目。这些衍生创新,本质上也是建立在此基础利率之上的���财方式。它已经不再是一个交易所参数,而是被默认的”加密美元无风险利率”——一个由抄袭固化、由套利资金供奉、由所有参与者共谋维持的人为锚点。

[TheOuts1derX @TheOuts1derX]

Google dorks for bug bounty hunters:

1. https://t.co/7opvbqZP7P
2. https://t.co/r43rTkSlBN
3. https://t.co/MmzehdlwRk
4. https://t.co/qPon4dyDZq
5. https://t.co/jVyTWQg8gk

#BugBounty #GoogleDorks #Recon #InfoSec

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

My DORK generator tool can generate Google Yahoo Shodan and more dorks

https://t.co/DTqNXM9zW6

And yeah it is free!

[Dark Web Informer @DarkWebInformer]

Telegram Scraper will have an update later today...

- Proxy Support
- Search database

[低等生物 @didengshengwu]

真好玩呀，脑洞真大

这是把科技玩出花了

线上线下结合，真人绝对求生！

[obscaries ❘ AppSec @obscaries]

Arjun by s0md3v is a powerful open-source tool for discovering hidden HTTP parameters in web applications.

Widely used in bug bounty and penetration testing to uncover attack surfaces that aren’t visible in standard requests.

Source: https://t.co/tPq9oc8IGp

#CyberSecurity #BugBounty #EthicalHacking #InfoSec

[0xSero @0xSero]

It’s time to test these claims out: https://t.co/WpgdQnzR0W

GLM-5.1 + Ghidra + Hermes

[left curve dev @leftcurvedev_]

As someone who scraped for a living for years, anyone recommending lightpanda to do it shows that they don’t have any experience regarding the subject.

Only one thing to understand:
TLS Fingerprinting

You can have the fastest headless setup, puppeteer, lightpanda,… one wrong ClientHello and Cloudflare/Akamai lights you up instantly. CAPTCHA city.
Lightpanda/Zig stuff is fun for tiny sites but gets cooked the second real anti-bot shows up. Cloudflare? Protects 20%+ of all websites on the internet

What is a ClientHello?
It’s the very first message your browser (or bot) sends during the TLS handshake. It openly announces your TLS version, the list of supported cipher suites, elliptic curves, extensions order, GREASE values, and other data. Anti-bot systems like Cloudflare and Akamai read this instantly and turn it into a fingerprint. If it doesn’t match a real browser’s exact signature… you’re flagged as a bot right away.

The key here is simple: real TLS fingerprint spoofing requires low-level control. You can’t do it properly in JS or Python. You need languages like C++ or Rust to actually rewrite the ClientHello, cipher suites, extensions, and all the tiny details that Cloudflare and Akamai check instantly. Anything higher-level just leaves obvious artifacts that scream ‘bot’

What I recommend: Camofox
An actual Firefox fork with proper C++ fingerprint spoofing, native TLS behavior, proxy/geo baked in, built so your agents don’t die on protected pages.

Top-tier protections might flag it following interaction speed on the pages, ip addresses and other factors but there’s NO match between lightpanda and this

"Camofox patches Firefox at the C++ implementation level - navigator.hardwareConcurrency, WebGL renderers, AudioContext, screen geometry, WebRTC are all spoofed"
Basically, everything is spoofed BEFORE the JS on the page can even see the values. Which is not possible with python/js libraries.

On another note, I talked about it to @Teknium on @NousResearch discord and literally 2 hours later it was implemented in Hermes Agent, it just shows that they take feedback very seriously and want to give the smoothest agent experience they can

Level-up your setup right now

https://t.co/f2PSLfud9A

[HackingHub @hackinghub_io]

Your FFUF command isn’t returning anything useful, is it?

The problem usually isn’t the wordlist. You’re likely getting filtered or rate-limited.

Slow it down, control your rate, use realistic headers like a browser, and filter the noise so real endpoints stand out.

Try now 👇

[chiefofautism @chiefofautism]

someone made the most ADDICTIVE game to learn DATA CENTER networking

its called Data Center, $6 game, you start with bare floors, buy racks, mount servers, route every cable by hand

the INSANE part, every customers traffic shows as colored balls rolling through your cables... you literally see bottlenecks in real time

180 reviews in 48 hours, people with RTX 4090 rigs are HOOKED on a $6 cabling sim

[obscaries ❘ AppSec @obscaries]

An absolute goldmine for bug bounty hunters 👀💥

A massive collection of real, disclosed HackerOne reports — organized by vulnerability type, impact, and target 🎯

If you want to go beyond theory and actually understand how real-world exploits work… this is it.

Study patterns. Learn impact. Hack smarter. 🚀

🔗 Source: https://t.co/yMey4fzDbn

#BugBounty #InfoSec #CyberSecurity #EthicalHackin

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

I earned more than 4k$ using this simple methodology:
https://t.co/XX93c7eLBA