Ancora imparo 🛌

Joined May 2020
Reached level 4 🫣.
4
2
28
3,508
Roronoa retweeted
6 months ago I found these vulnerabilities across several companies and earned $15K in bounties I haven’t hunted on web apps in a while and I really miss it Hope my writeup helps other hunters Broken access control on Next js server actions parsasec.com/writeups/nextjs…
10
73
1
498
13,464
Roronoa retweeted
unKover v1.3 is out. Download github.com/brutelogic/unkove… Catching 403/401 now, and the 2 new testbed cases: 1. Parser Confusion (breaker + static ext) 2. RFC 7239 Forwarded Header Trust Test it on 403.brutelogic.net/access/rp… Don’t let a 403 or 401 stop you.
7
62
2
365
18,399
Most beginners hunt IDOR wrong. They change one ID, see nothing, and move on. Here's the 15-minute playbook I actually use: 1. Make TWO accounts (A and B). Always. 2. With A, create everything you can: profile, order, file, invoice, message. 3. Proxy the traffic and note every ID: numeric, UUID, slug, even IDs inside JSON bodies and headers. 4. Replay A's requests using B's session cookie/token. Does B read or edit A's data? 5. Test every verb: GET works, but try PUT, PATCH, DELETE too. Devs often only protect one. 6. Look at the boring stuff: export, PDF download, share links, API v1 vs v2, mobile endpoints. 7. Report it with 2 requests: A's object, then B accessing it. Show impact in one sentence. UUIDs are not protection. If you can find them (in other responses, emails, shares), you can exploit them. Practice this today on a free lab: labs.hackxpert.com/ Want to go deeper? Uncle Rat's Pentesting Paradise is the natural next step (discount applies via the link): thexssrat.podia.com/912-uncl… What's the weirdest IDOR you've found?
2
17
129
6,590
Roronoa retweeted
How to use LLMs for vulnerability research by @ZephrFish (Andy Gill) MCP: blog.zsec.uk/bullyingllms/ Harness: blog.zsec.uk/harnessing-harn… #infosec #llm
4
129
1
682
31,418
Roronoa retweeted
Made over $25K hacking marketplace app permission issues across various bug bounty programs. Here's my latest writeup on how a malicious app might take over a GitHub repository: jeetbhdr.github.io/github-gr… #bugbounty
12
43
448
12,626
Roronoa retweeted
Are you still searching for your first valid vulnerability? Q2 is just around the corner! It's time to lock in! 🫡 Join us in #BugQuest! Starting today, we'll share bug bounty tips, techniques, and resources that anyone can use to find Broken Access Control (BAC) vulnerabilities, no matter your experience level, background, or skill set, for 31 days. Wish to stay ahead? Be sure to: ✅ Follow @INTIGRITI ✅ Share this post with your hacker friends ✅ Tag your bounty buddies who should join Day 1 is live now! Swipe through to see today's post on learning what Broken Access Control (BAC) vulnerabilities are Come back daily to unlock more tips. Let's end Q1 2026 with at least a valid finding and start Q2 2026 with even more submissions! 💪 #BugBounty #HackWithIntigriti
2
17
129
7,307
I've decided to finally release my vulnerability hunting methodology that I've been using for several months now, both in testing as well as live engagements with great success. I was inspired by (and huge congrats to) the @Blackfrost_AI team open-sourcing Cyber-Frost Harness, their reproducible security-agent runtime with procedural skills, an evidence ledger, and isolated Docker targets for red/blue/purple work. 🎉 If you like the Cyber Frost Harness, and want some out of the box vulnerabilty hunting and POC development kit to go along with it - check out my VulnHunter. It's already loadable: their harness reads standard SKILL.md skills. Point skill_dir at VulnHunter's (or run its installer), and the hunting, falsification, and PoC disciplines load immediately. Repo: github.com/nealbridges/VulnH… CREDITS: This is fork of @CapitalOne original repo. I simply took it a step further on POC development and model agnostic. I'm also actively developing in my forked repo as I make more changes to it and welcome the contributions from the community as well. I think I'm doing the whole "respect who you give credit to" drama, and I asked my model to double and triple check it. So i can blame the model if its wrong. Otherwise, dont put me on blast on X if i suck at credits. /s Looking forward to developing on this further with the community.
31
220
9
1,564
103,913
Real
43
1,608
26
12,293
216,450
Top 43 AI Security Skills, MCP Servers & GitHub Repos Every Bug Hunter Needs by Abhishek meena medium.com/@Aacle/top-43-ai-… #bugbounty #infosec #hacking
3
44
2,799
Roronoa retweeted
Know every way to break a JWT. 38 pages, 47 techniques. brutelogic.net/ebooks/broken… With original research and tested payloads.
3
22
116
6,858
This scrappy setup got him 10+ account takeovers on the same program 👇🏼
3
73
412
15,607
Roronoa retweeted
That person who stopped using instagram.
290
4,047
666
33,082
767,823