leo aung

[HackingHub @hackinghub_io]

Nahamsec walks us through a $30,000 bug bounty finding where he was able to impersonate an admin user with a secret token he found.

Let’s watch! 👇

[Intigriti @intigriti]

you will find a critical vulnerability
you will find a critical vulnerability
you will find a critical vulnerability
you will find a critical vulnerability
you will find a critical vulnerability
you will find a critical vulnerability
you will find a critical vulnerability

[bugcrowd @Bugcrowd]

The ONLY tip you need if you’re starting from zero. 

@the_IDORminator gives solid advice on how you can get STARTED hacking without spending a dime. 😎

Check it out! 👇
https://t.co/aNx4pOuVEW

[BRute Logic @BRuteLogic]

Bypass Is Our Business

Most 403 bypass tools cover path tricks and a handful of headers. They miss the cases that require understanding how the stack actually works.

Hop-by-hop header stripping is one of those cases. List a restricted header in the Connection field and the proxy strips it in transit. The backend never sees it. You get 200.

unKover covers techniques like this that others miss.

We validated it against our comprehensive testbed covering Nginx, Apache, and reverse proxy chains.

Available on GitHub and integrated into Brute One, our AI-powered bug bounty hunting platform.

[Luke Stephens (hakluke) @hakluke]

🚨 New blog! 🚨

Are bug bounties cooked? Is cybersecurity cooked? I'm worried about backlash from releasing my opinions on this, but here it is anyway.

https://t.co/Oliw0yxkoB

[bugcrowd @Bugcrowd]

12 out of 15 top-tier hackers ignore standard security methodologies.

🤯

New research into hacker cognition reveals that elite researchers don’t follow rigid checklists when testing a target. Instead, they rely on fast, intuitive pattern recognition built from years of building, breaking, and tinkering.

Compliance scripts find basic bugs. Human intuition stops catastrophic breaches. ✋🌪️

A checklist can't replicate what a diverse crowd natively possesses. Hackers don't come from a single mold, and that is exactly why they see the blind spots your automated tools miss.

The blog by Andrew shows more data behind how hackers actually make decisions: https://t.co/qN56r9KF4K

[Katie Paxton-Fear @InsiderPhD]

npm finally killed postinstall and preinstall scripts, THANK GOD, so I wrote an obituary for npm's worst feature which will finally die in v12

[bugcrowd @Bugcrowd]

Reflected XSS to stored XSS via cache misconfig flaw. 

How? 🤔 

@hbenja_m explains.👇

[the_IDORminator @the_IDORminator]

Did you know I had a 10-part feature series on the Bugcrowd blog back in 2021? The good old days!

I went from $100 (first payout in 2020) to being #1 or #2 on the platform in 2025 for lifetime bounties earned, it was a pretty crazy run and countless hours of work.

But I'm totally burnt-out on all the red-tape and humanity in the process. If you are in the field, stay positive as long as you can, and if you don't have it, develop patience... massive quantities of patience. #bugbounty

And when your patience finally burns out, there's always day trading, still uses the 12345.

https://t.co/JeGB7EMdq9

https://t.co/ZycjV2CzLy

https://t.co/F4VaxjGRiJ

https://t.co/g2wnFyKe8k

https://t.co/Xj6L8rz5Sl

https://t.co/NZ8Ig5bVlZ

https://t.co/KMn97qkOaO

https://t.co/dVWQazaw1Q

[Bug Bounty Village @BugBountyDEFCON]

Time for another giveaway!

We will pick 6 winners to win one of the following:

1x Annual VIP @hackthebox_eu Licence
5x @PentesterLab 3 Month Licences

To enter:
1️⃣ Follow us @BugBountyDefcon
2️⃣ Like this post ❤️
3️⃣ Re-tweet this post 🔁

Giveaway open until Monday June 15th! GOOD LUCK!

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

Most people fail at bug bounty before they ever find a bug.

Not because they can't hack — because they hack ONE page on ONE host and call it recon.

Real recon = making the target bigger before you make it bleed. Here's the pipeline I run on every program:

1. Read the scope properly. *.target.com in scope? That's a goldmine, not one site. Note what's explicitly OUT too.

2. Enumerate subdomains. subfinder + amass + assetfinder + https://t.co/qyWccMgsAu. Stack the sources — each finds ones the others miss.

3. Resolve + probe what's alive. dnsx to resolve, httpx to find live web servers (grab status, title, tech, CDN). Dead hosts waste your time.

4. Find the forgotten stuff. The bug isn't on www. It's on staging., dev., old., api-v1., admin. — boxes nobody patched since 2021.

5. Content + param discovery. katana / gau / waybackurls for old URLs, ffuf for hidden dirs, then mine params (Param Miner / arjun). Old endpoints = old code = old bugs.

6. Read the JavaScript. Every SPA leaks API routes, keys, internal hostnames in its bundles. getJS + LinkFinder. This is where the real attack surface hides.

7. Run nuclei over the live hosts for known CVEs/misconfigs — then go MANUAL on the interesting ones.

The hunter who maps 400 hosts and 3000 endpoints beats the one staring at the homepage. Every time.

Want to drill the bugs you'll find on those endpoints? Free labs:

Tools:

What's your go-to recon tool?

— The XSS Rat

[NullSecurityX @NullSecurityX]

New Videoo: Strikoder Complete OSCP Journey | From Failure to 70+ Pass (Full Exam Review & Resources) is live.
No “3 months OSCP” story here just the real journey: failures, technical mistakes, AD struggles, lab experience, and what actually worked...
https://t.co/O5LlbQfXnR

[bugcrowd @Bugcrowd]

What EXACTLY is an IDOR? 🤔 

@InsiderPhD gives a digestible explanation.

Check it out. 👇

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

🐀 912 Uncle Rat's Pentesting Paradise

21 courses. 3 certs. Lifetime updates. One price.

€129.99 (was €1,200+)

→

#bugbounty #pentesting #cybersecurity #infosec

[Web Security Academy @WebSecAcademy]

You should learn how to hack LLMs.

Most disclosed vulnerabilities involving LLMs are discovered using simple techniques (like indirect prompt injection) that beginners can execute. You just need creativity.

Interested?

Learn how to hack LLMs here. 👇
https://t.co/Xkn6EZr74s

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

Business logic flaws are the bugs that pay the most and tools find the least.

No scanner finds them. No payload triggers them. They live in how a target's features are SUPPOSED to work - and what happens when you use them in a way the devs never imagined.

The playbook:

1. Map the intended flow first. Click through the whole feature like a normal user - checkout, signup, refund, transfer, invite. Write down every step and the assumption behind it. The bug is almost always a step you can skip, repeat, or reorder.

2. Attack the assumptions:
- Skip a step -> reach "order confirmed" without paying?
- Repeat a step -> apply one coupon 10x? redeem a gift card twice?
- Reverse a step -> cancel after the goods ship?
- Break inputs -> quantity -1 (refund?), 0, or 0.1 (rounds to free?).
- Tamper with the price/currency in the request, not the UI.

3. Hit the money math. Coupons, loyalty points, store credit, wallets, partial refunds, currency conversion. Race two redemptions. Stack discounts that shouldn't stack. Refund more than you paid.

4. Abuse trust between steps. The frontend validated it - does the backend re-check? Set your cart to one price, pay another. Confirm a booking the server thinks is still "pending."

5. Think like the feature's worst customer, not a hacker: "What would let me get this for free / twice / or get someone else's?"

Report on IMPACT in business terms: "I bought a $2000 laptop for $0.01 by editing the price param" - not "parameter tampering possible."

The trap: hunters chase XSS and SQLi all day because tools point there. The logic bugs sit untouched because they require actually understanding the business. That's exactly why they pay.

No tool will hand you these. Your brain is the scanner.

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

My first ever bug was a reflected XSS I almost didn't report because I thought "surely someone already found this."

They hadn't. That moment changed everything. 🐀

912 Uncle Rat's Pentesting Paradise is the deep collection I wish I'd had back then. Discount via the link 👇
https://t.co/Gqmxzg3ZUf
#Pentesting

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

Real bug bounty exploit — API scope bypass, broken down in under 4 minutes.

Watch: https://t.co/zRYfTkT0oh

#infosec #bugbounty

[NullSecurityX @NullSecurityX]

New Videoo0o! Account Takeover via Email Verification Redirect Exploit | $650

We demonstrate how a user-controlled redirect parameter in an email verification flow led to verification token exposure and a potential Account Takeover (ATO).
Watch 👇

https://t.co/VhzR5aCIyk