Roronoa retweeted
6 months ago I found these vulnerabilities across several companies and earned $15K in bounties
I haven’t hunted on web apps in a while and I really miss it
Hope my writeup helps other hunters
Broken access control on Next js server actions
parsasec.com/writeups/nextjs…
Roronoa retweeted
unKover v1.3 is out.
Download
github.com/brutelogic/unkove…
Catching 403/401 now, and the 2 new testbed cases:
1. Parser Confusion (breaker + static ext)
2. RFC 7239 Forwarded Header Trust
Test it on
403.brutelogic.net/access/rp…
Don’t let a 403 or 401 stop you.
Roronoa retweeted
Most beginners hunt IDOR wrong. They change one ID, see nothing, and move on.
Here's the 15-minute playbook I actually use:
1. Make TWO accounts (A and B). Always.
2. With A, create everything you can: profile, order, file, invoice, message.
3. Proxy the traffic and note every ID: numeric, UUID, slug, even IDs inside JSON bodies and headers.
4. Replay A's requests using B's session cookie/token. Does B read or edit A's data?
5. Test every verb: GET works, but try PUT, PATCH, DELETE too. Devs often only protect one.
6. Look at the boring stuff: export, PDF download, share links, API v1 vs v2, mobile endpoints.
7. Report it with 2 requests: A's object, then B accessing it. Show impact in one sentence.
UUIDs are not protection. If you can find them (in other responses, emails, shares), you can exploit them.
Practice this today on a free lab: labs.hackxpert.com/
Want to go deeper? Uncle Rat's Pentesting Paradise is the natural next step (discount applies via the link): thexssrat.podia.com/912-uncl…
What's the weirdest IDOR you've found?
How to use LLMs for vulnerability research by @ZephrFish (Andy Gill)
MCP: blog.zsec.uk/bullyingllms/
Harness: blog.zsec.uk/harnessing-harn…
#infosec #llm
Roronoa retweeted
Whoever created this, huge respect.
webhacklist.com/
Made over $25K hacking marketplace app permission issues across various bug bounty programs.
Here's my latest writeup on how a malicious app might take over a GitHub repository: jeetbhdr.github.io/github-gr…
#bugbounty
Roronoa retweeted
new era site for reading top bug bounty writeups
webhacklist.com/#museum
Roronoa retweeted
Are you still searching for your first valid vulnerability? Q2 is just around the corner! It's time to lock in! 🫡
Join us in #BugQuest! Starting today, we'll share bug bounty tips, techniques, and resources that anyone can use to find Broken Access Control (BAC) vulnerabilities, no matter your experience level, background, or skill set, for 31 days.
Wish to stay ahead? Be sure to:
✅ Follow @INTIGRITI
✅ Share this post with your hacker friends
✅ Tag your bounty buddies who should join
Day 1 is live now! Swipe through to see today's post on learning what Broken Access Control (BAC) vulnerabilities are
Come back daily to unlock more tips. Let's end Q1 2026 with at least a valid finding and start Q2 2026 with even more submissions! 💪
#BugBounty #HackWithIntigriti
Roronoa retweeted
I've decided to finally release my vulnerability hunting methodology that I've been using for several months now, both in testing as well as live engagements with great success.
I was inspired by (and huge congrats to) the @Blackfrost_AI team open-sourcing Cyber-Frost Harness, their reproducible security-agent runtime with procedural skills, an evidence ledger, and isolated Docker targets for red/blue/purple work. 🎉
If you like the Cyber Frost Harness, and want some out of the box vulnerabilty hunting and POC development kit to go along with it - check out my VulnHunter.
It's already loadable: their harness reads standard SKILL.md skills. Point skill_dir at VulnHunter's (or run its installer), and the hunting, falsification, and PoC disciplines load immediately.
Repo: github.com/nealbridges/VulnH…
CREDITS: This is fork of @CapitalOne original repo. I simply took it a step further on POC development and model agnostic. I'm also actively developing in my forked repo as I make more changes to it and welcome the contributions from the community as well.
I think I'm doing the whole "respect who you give credit to" drama, and I asked my model to double and triple check it. So i can blame the model if its wrong. Otherwise, dont put me on blast on X if i suck at credits. /s
Looking forward to developing on this further with the community.
Roronoa retweeted
For those yet to see it
Full hunting flow now all urs
github.com/mdpsec/bug-bounty…
Roronoa retweeted
Give your AI agent eyes to see the entire internet. Read & search Twitter, Reddit, YouTube, GitHub, Bilibili, XiaoHongShu — one CLI, zero API fees.
github.com/Panniantong/Agent…
Roronoa retweeted
Top 43 AI Security Skills, MCP Servers & GitHub Repos Every Bug Hunter Needs by Abhishek meena medium.com/@Aacle/top-43-ai-…
#bugbounty #infosec #hacking
Roronoa retweeted
enjoy all
github.com/mdpsec/bug-bounty…
This really helps for SSRFs!
brutelogic.net/r/
Thanks @BRuteLogic : )
Roronoa retweeted
Know every way to break a JWT.
38 pages, 47 techniques.
brutelogic.net/ebooks/broken…
With original research and tested payloads.
Roronoa retweeted
Found a great disclosed reports of Full account takeover with just email-verification manipulation.
github.com/MalikHettige/Bug-…
Roronoa retweeted
How I Found Two Critical PII Exposure Vulnerabilities on a HackerOne Public Program Using Pure — by 0xbatot
medium.com/@0xbatot/how-i-fo…
Join us on Telegram:
t.me/bugbountywizard
#bugbounty #bugbountytips #bugbountytip



























