@bbwriteup

Bug Bounty | Top Security Researchers Writeups ✨ #BugBountyTips #CyberSecurity

Joined September 2024
  • Tweets17.2K
  • Following0
  • Followers876
2Media
"Microsoft Copilot for Word Prompt Injection: Hidden Instructions Can Silently Alter AI-Generated…" by Germano Costi #InfoSec #CyberSecurity #Hacking #BugBounty medium.com/@costigermano/mic…

Microsoft Copilot for Word Prompt Injection: Hidden Instructions Can Silently Alter AI-Generated…

Researchers reveal how invisible prompts can manipulate Microsoft 365 Copilot and persist across Word documents

medium.com
1
189
"AI Stack Explained (Part 1): Understanding the Foundations Behind Modern AI" by Abhinav Pathak #InfoSec #CyberSecurity #Hacking #BugBounty medium.com/illumination/ai-s…

AI Stack Explained (Part 1): Understanding the Foundations Behind Modern AI

Artificial intelligence is a topic that everyone is discussing.

medium.com
1
151
"Stop Trusting Alerts Alone: Why Your Wazuh Setup Needs a Behavioral Baseline" by Neetrox #InfoSec #CyberSecurity #Hacking #BugBounty aloulouomarr.medium.com/stop…

Stop Trusting Alerts Alone, Your Wazuh SIEM Needs a Behavioral Baseline

I built UEBA on top of Wazuh with one n8n workflow

osintteam.blog
1
108
"Hacker Holidays 2026: Day 3 Walkthrough (Complimentary)" by Dhanush N #InfoSec #CyberSecurity #Hacking #BugBounty infosecwriteups.com/hacker-h…

Hacker Holidays 2026: Day 3 Walkthrough (Complimentary)

A wellness app was quietly handing out AWS credentials to every visitor. We used them to dump the entire database. Here is how.

infosecwriteups.com
3
115
"File Upload Bypasses — The $10k Bug That Sneaks Past Filters (Part 2: Advanced)" by cyber-ninjaaa #InfoSec #CyberSecurity #Hacking #BugBounty medium.com/@cyber-ninjaaa/fi…

File Upload Bypasses — The $10k Bug That Sneaks Past Filters (Part 2: Advanced)

Part 1 covered the basics. Double extensions. Null bytes. Content-Type spoofing.

medium.com
2
112
"The Mathematics That Secures Bitcoin" by Michael P. Di Fulvio #InfoSec #CyberSecurity #Hacking #BugBounty medium.com/coinmonks/the-mat…

The Mathematics That Secures Bitcoin

A Protocol-Level Explanation of How secp256k1 Transforms a Private Key Into a Public Key, an Address, and Verifiable Ownership

medium.com
1
69
"The underrated security fields you should actually be watching for the next 5 years" by h@shtalk #InfoSec #CyberSecurity #Hacking #BugBounty eva-georgieva.medium.com/the…

The underrated security fields you should actually be watching for the next 5 years

Everyone’s staring at AI security like it’s the only room in the building. Here’s what’s quietly happening in the rooms nobody’s bothering…

eva-georgieva.medium.com
5
126
"How Attackers Abuse LLMs to Build Malware Faster" by Ismail Tasdelen #InfoSec #CyberSecurity #Hacking #BugBounty blog.cubed.run/how-attackers…

How Attackers Abuse LLMs to Build Malware Faster

The rapid adoption of Artificial Intelligence, particularly Large Language Models (LLMs), has created unprecedented opportunities for…

blog.cubed.run
2
117
"My 3-Step Bug Bounty Recon Blueprint: The Ultimate 2026 Web Crawling Cheatsheet" by Nitin yadav #InfoSec #CyberSecurity #Hacking #BugBounty kd-200.medium.com/my-3-step-…

My 3-Step Bug Bounty Recon Blueprint: The Ultimate 2026 Web Crawling Cheatsheet

If you are just throwing standard tools at a target and walking away, you are leaving thousands of dollars on the table. Modern bug bounty…

kd-200.medium.com
3
168
"I Broke an AI Chatbot’s Safety Filters Using Nothing but Arabic Small Talk" by MOAMEN REZK #InfoSec #CyberSecurity #Hacking #BugBounty medium.com/@momenrezkk90/i-b…

I Broke an AI Chatbot’s Safety Filters Using Nothing but Arabic Small Talk

I Broke an AI Chatbot’s Safety Filters Using Nothing but Arabic Small Talk How a joke about a password file turned into a full safety-filter bypass on one of the world’s biggest AI …

medium.com
2
9
491
"SQL Injection Explained Simply: How Attackers Trick Databases & How to Stop Them" by Pop123 #InfoSec #CyberSecurity #Hacking #BugBounty osintteam.blog/sql-injection…

SQL Injection Explained Simply: How Attackers Trick Databases & How to Stop Them

A 5-minute visual walkthrough of unsanitized inputs, payload mechanics, and parameterized queries.

osintteam.blog
2
92
"How I Got My Highest Payout" by Adhamkhairy #InfoSec #CyberSecurity #Hacking #BugBounty 0xsponge.medium.com/how-i-go…

How I Got My Highest Payout

The target was an application portal. You register, you fill out a genuinely ENORMOUS form, and at the end it generates a PDF of everything…

infosecwriteups.com
2
103
"Google VRP: An Authorization Bypass in NotebookLM That Can Permanently Lock the Owner Out" by Vivek PS #InfoSec #CyberSecurity #Hacking #BugBounty medium.com/@vivekps143/googl…

Google VRP: An Authorization Bypass in NotebookLM That Can Permanently Lock the Owner Out

A walkthrough of an authorization gap in NotebookLM’s Gemini import flow, and an argument for why locking out an owner is a different class…

osintteam.blog
4
13
896
"CORS Misconfigurations: The Closest Thing to a Free Bounty on Every Program" by samael0x4 #InfoSec #CyberSecurity #Hacking #BugBounty samael0x4.medium.com/cors-mi…

CORS Misconfigurations: The Closest Thing to a Free Bounty on Every Program

TL;DR: CORS bugs still pay in 2026 because most hunters stop at “the header reflects my origin” instead of proving actual impact. This…

samael0x4.medium.com
2
78
"When Password Reset Becomes Login: A Real-World Session Puzzling Vulnerability" by Hossein Zarei #InfoSec #CyberSecurity #Hacking #BugBounty medium.com/@hossein.za68/whe…

When Password Reset Becomes Login: A Real-World Session Puzzling Vulnerability

A few months ago, I was conducting a penetration test on an enterprise system belonging to a municipality. The goal was to assess different…

medium.com
1
223
"Pakistan’s First Bug Bounty Platform: Meet BugChase.com" by Muhammad Qasim #InfoSec #CyberSecurity #Hacking #BugBounty medium.com/@m_kasim2/pakista…

Bug Bounty Platform Pakistan | BugChase

Launch a VDP or bug bounty program in Pakistan. PKR rewards, vetted researchers, escrow payouts, coordinated disclosure.

bugchase.com
1
1
117
"Prompt Injection Isn’t Magic. It’s an AI Following the Wrong Instructions" by Vitaly Sem #InfoSec #CyberSecurity #Hacking #BugBounty medium.com/@virtualik/prompt…

Prompt Injection Isn’t Magic. It’s an AI Following the Wrong Instructions

A simple document experiment shows why indirect prompt injection is so easy to trigger — and why AI agents make it dangerous

medium.com
2
86
"Finding Vulnerabilities Is Easy. Reporting Them Well Is the Real Skill." by Jevon Davis #InfoSec #CyberSecurity #Hacking #BugBounty javy26.medium.com/finding-vu…

Finding Vulnerabilities Is Easy. Reporting Them Well Is the Real Skill.

One of the biggest misconceptions about cybersecurity is that finding vulnerabilities is the hard part.

javy26.medium.com
1
57
"Unauthenticated IPFS Uploads Led to Stored XSS on a Web3 Platform" by default_0x #InfoSec #CyberSecurity #Hacking #BugBounty medium.com/@default_Ox/unaut…

Unauthenticated IPFS Uploads Led to Stored XSS on a Web3 Platform

Overview

medium.com
1
49
"Python Web Penetration Testing — Day 8: Chaining Vulnerabilities — The Art of the Exploit Chain" by Aman Sharma #InfoSec #CyberSecurity #Hacking #BugBounty osintteam.blog/python-web-pe…

Python Web Penetration Testing — Day 8: Chaining Vulnerabilities — The Art of the Exploit Chain

I found a self-XSS. Low severity.

osintteam.blog
6
142
Load more