Totobarjo retweeted
❗️ HackerOne's AI bot blocked bug hunter Will Dormann's report because its CVE was "from the future."
The bot thought it was 2024. He got past it by rewriting CVE-2026-114820 as CVE-[redacted]-114820.
HackerOne is solving AI slop "by introducing a layer of AI slop," he says.
Totobarjo retweeted
Nouvelle idée pour les crédits @yeswehack :
Quand un hunter atteint un gros score, il débloque le droit de noter les programmes.
+4 pts pour un triage propre
-4 pts pour “N/A” ou "NMI" après 3 mois
-10 pts pour “working as intended” quand tu get full PII
Let’s be clear: @Hacker0x01 is using researchers’ work to train their AI and profit from it without consent. That’s not “innovation” — that’s exploitation. Our reports, our research, our time — turned into their product, while we get nothing.
This violates client agreements. Vulnerabilities belong to the companies and the researchers — not HackerOne. Yet they’re monetizing it anyway.
Layoffs, shrinking bounties, and now this? The platform is collapsing, and instead of fixing it, they’re squeezing the community that built it.
Researchers made HackerOne. Programs trusted HackerOne. And now both are being treated like disposable data sources.
If you’re a company, review your contracts immediately. If you’re a researcher, stop feeding them your work.
HackerOne isn’t supporting the community anymore it’s exploiting it. And people are finally waking up.
Many programs have already shifted to self-hosted , such as Salesforce.
#BugBounty
Thread - My own opinion & this is to the Bug Hunters, What @Hacker0x01 is doing re AI, is essentially stealing “our work” “our research” for their own profitability. They are for sure breaking client agreements, wherein a clients data / vulns belong to the client. Not H1!!
Totobarjo retweeted
Thread - My own opinion & this is to the Bug Hunters, What @Hacker0x01 is doing re AI, is essentially stealing “our work” “our research” for their own profitability. They are for sure breaking client agreements, wherein a clients data / vulns belong to the client. Not H1!!
Totobarjo retweeted
🚨 Doing a giveaway for my Blind XSS Masterclass
Most people think they know XSS, until they meet blind XSS, the kind that fires where you’ll never see it.
Same methods that helped me earn $250K+ from real reports. hhub.io/nahamsecbxss
🎁 Retweet and reply to enter.
Totobarjo retweeted
🚨𝗧𝗛𝗘 𝗨𝗟𝗧𝗜𝗠𝗔𝗧𝗘 𝗚𝗜𝗧𝗛𝗨𝗕 𝗗𝗢𝗥𝗞𝗦 𝗟𝗜𝗦𝗧 𝗩𝟯 🚨
A total of now 𝟱𝟬𝟬+ dorks for sensitive information exposure to find easy wins.
Text file and my tool to automate these dorks
tinyurl.com/gitdorks
#BugBounty #bugbountytip #bugbountytips #github #infosec
Totobarjo retweeted
Hacking Tools Arsenal:-
Part 2:-
github.com/technicaldada/BES…
github.com/hahwul/MobileHack…
github.com/mgeeky/Penetratio…
github.com/madhuakula/hacker…
github.com/ShuBhamg0sain/All…
github.com/six2dez/reconftw
github.com/ByteHackr/Hacking…
github.com/ViduraRandika/Top…
github.com/vaib25vicky/aweso…
github.com/calebmadrigal/net…
Totobarjo retweeted
📢 THE TIME HAS COME📢
Today I make public ALL *recordings* and updated slides (+ FAQ) for my mobile security class, MOBISEC 2020!
Everything is available, for free, at: mobisec.reyammer.io/slides!
Few words about this release in a short thread 👇
Totobarjo retweeted
Due to your request I just posted it on my GitHub! :)
github.com/dirsoooo/dotfiles














