Yūzā

Security Research

[Yūzā @yuzadef]

@wetw0rk7 @ret2systems You're doing great work man. Respect 🫡

[Yūzā @yuzadef]

@norsyx @thedawgyg Models offered by ollama are getting smarter. I personally tried with qwen3.5 model and it satisfy my needs. It's worth it to try since you control everything, easier to maneuver as well.

[Yūzā @yuzadef]

@warlocksmurf Wouldn't be ethical without letting your org know first about the vulnerability before u start disclosing it. Like the other guy said, report and let them remediate, then ask for permission. If u insists, at least mask anything that can hint at the org being vulnerable.

[Yūzā @yuzadef]

@q1uf3ng @rez0__ What models were used in the workflow? $50 only for the APIs?? That's cheaper than I thought it would be for a workflow with no human in the loop.

[Renwa @RenwaX23]

I think I have completed client-side security , just one report:

Self-XSS -> Drag-Drop Payload -> Scroll-To-Fragment -> Unchecked postMessage Listener -> Text Injection -> DOM-XSS -> OAuth State Misconfiguration -> Cookie Bomb -> Account Takeover

https://t.co/xQmtZE5At0

[dawgyg - WoH @thedawgyg]

Since he appears to be alive... Remember... Fuck Netanyahu and every single member of the Zionist regime that backs the genocide in Gaza, the destruction in Lebanon, and the illegal war in Iran.

[dawgyg - WoH @thedawgyg]

Happy Friday and always remember... Fuck Netanyahu and the murderous Zionist child killing regime.

[julaibib @julaibib18]

Praying and worshiping in a place like this is a great blessing. Kashmir

[Mustafa Bilgici @mustafabilgicii]

The Psychological Aspect of Bug Bounty Training and Sustainability Without Burnout

Social Media vs. Real Life
In this article, I want to talk about the less-discussed aspects of bug bounty.
In the bug bounty world, most of us see the success posts of famous hackers on Twitter and the high rewards they earn. From the outside, everything looks very smooth, as if bugs are constantly being found. But behind the scenes, there is serious patience, stress, and a psychological battle.
Beginners usually have the same questions in their minds:
Which platform should I start with?
Which target should I choose?
Of course, these are not unimportant things, but what is actually decisive most of the time is discipline.

What Really Pays Off Is Consistency, Not the Platform
Whether you manually test targets, use automation, are on HackerOne or on Synack doesn’t make much difference in my opinion — what matters is progressing consistently on one of them.
The common point among almost all bug hunters is regularly testing targets and publishing findings.
Many bug hunters:
submit reports knowing they might be duplicates
accept getting rejected
spend weeks talking with the triager trying to prove their report is valid
Sometimes a vulnerability is accepted but the payment takes months. Sometimes you find nothing for days. Even for weeks.
You might have a great month and earn good bounties, and then at the beginning of the next month you can find almost nothing — which seriously affects motivation.
The non-technical but hardest part of bug bounty, in my opinion, is exactly this:
Psychological resilience.
This is not a sprint; it’s more like an endurance marathon. When you approach it this way, you produce more findings in the long run, and there are periods where you might even close the year strong — but of course, it’s also important to control your spending :xd. By the way, I think this is exactly the main reason many people quit bug bounty. And sometimes, you really need to take breaks while doing this work.

Full-Time Bug Hunting and Financial Pressure
If you are doing bug hunting full-time and you don’t have another income or savings, everything changes.
Having to earn a certain amount every month creates serious pressure.
For example, one month you might get dozens of critical or high reports accepted and earn the equivalent of two or three months — but financially you actually need to control yourself here. The next month, you might find almost nothing.
Especially during low-report periods:
it becomes harder to focus
motivation drops
the time spent looking at targets increases but productivity decreases
This cycle is mentally quite exhausting.

Clearing Your Mind While Doing Bug Bounty & The Impact of Combat Sports
One of the best things you can do at this point is to create a space for yourself outside of bug bounty. Starting a sport is very beneficial — and as a few bug hunter friends of mine do, starting a combat sport really makes a big difference.
For example, I do MMA, and the friend I collaborate with when we get stuck on reports has been doing BJJ for a year. It has seriously improved our performance.
Because fundamentally:
your mind clears
stress decreases
when you sit back at the computer, you can focus more comfortably
But the most important thing here is balance. These activities should not disrupt bug hunting. On the contrary, they should make it more sustainable.

Mental Advice for Beginners
Bug bounty doesn’t only have a technical side. The mental side is a separate process that must also be learned.
The clearest advice I can give to beginners:
Don’t compare yourself to others. The success posts on Twitter are not your journey — and in my opinion, most of them are not very realistic.
Be process-oriented, not result-oriented. Looking at targets every day is more valuable than finding one bug per month. Because if you look consistently, you will eventually find something.
Don’t see days without findings as failure. On those days, you are actually improving your methodology.
Don’t be afraid to take breaks. Burnout resets productivity and focus to zero.

Bug Bounty Is Not a Sprint, It’s a Marathon
In short, bug bounty is not a job done only with technical knowledge.
It is a long journey that requires patience, discipline, and mental resilience.
Unless you build a sustainable system for yourself, no matter how technical you are, it becomes difficult to continue this work in the long term.
Wishing all bug hunters a more focused, more balanced, and more sustainable bug bounty journey.

#BugBounty

[the_IDORminator @the_IDORminator]

I hear tale Google API keys may make you $$ in bounty now: https://t.co/JAvnpK43vg

Anybody pulled this off yet?

[Yūzā @yuzadef]

@VenkatDev789 @4osp3l Right click on the request and view in source. Modern browsers automatically beautify the minified versions. Of course, you can't realistically get the really clean version unless .map is available.

There are also cases where developers prevent the JavaScript from beutification.

[Yūzā @yuzadef]

@shakquraa I been following all the articles you posted. Any chance you will post something on js dynamic analysis soon?

[Idris @7signxx]

7 bullets after torture.
May Allah have mercy on his soul and send lots of light to his grave...

[Yūzā @yuzadef]

https://t.co/qfrUo3pP3c

[George Mack @george__mack]

https://t.co/Ia3eV2lEY3

[serènity @cultureartislam]

despite everything..