@soeckly

22 | Bug Bounty Hunter

 Vienna, Austria
simonkoeck.com
Joined July 2020
  • Tweets584
  • Following187
  • Followers4.7K
74Media
To clarify, Google actually deployed a hotfix within ~24h of me sending my report. The status was only updated two months later, once they had fixed all the tickets.
Simon@soecklyOct 12
I got $90,000 for a RCE in Google. simonkoeck.com/writeups/goog…

How I Found a $90,000 Remote Code Execution Vulnerability in Google | Simon Koeck

A Flask cookie on developers.google.com was signed with a secret it was also carrying inside itself. Pulling that secret out turned a forged session into code execution across seven Google domains.

simonkoeck.com
2
1
1
47
3,638
I got $90,000 for a RCE in Google. simonkoeck.com/writeups/goog…

How I Found a $90,000 Remote Code Execution Vulnerability in Google | Simon Koeck

A Flask cookie on developers.google.com was signed with a secret it was also carrying inside itself. Pulling that secret out turned a forged session into code execution across seven Google domains.

simonkoeck.com
56
306
15
2,459
184,329
Simon retweeted
Paul@pauxelsOct 8
I get it, AI slop is real. But this hits the wrong people. Your own FAQ says N/A means "genuine and well-intentioned error." Now it counts as a rejection, while the categories separating honest mistakes from slop come "later." Build that first, then penalize. 🧵 (1/4)
bugcrowd
@BugcrowdOct 8
We are continuously reviewing the mechanics of the Bugcrowd Platform to safeguard triage capacity, uphold signal quality across all engagements, and improve the experience for everyone. Read about our latest update here: bugcrowd.com/blog/evolving-o…

Evolving our submission accuracy and throttling controls to protect triage speed | @Bugcrowd

Bugcrowd updates its submission accuracy metric and throttling rules to curb AI-generated spam and speed up triage. See how the changes affect researchers.

bugcrowd.com
1
1
1
3
429
One unauthenticated POST freezes any Next.js server. Reported to Meta, fixed as CVE-2026-23870, no credit and no reply. So here's the writeup: simonkoeck.com/writeups/reac…

CVE-2026-23870: A Single POST Freezes Any Next.js Server | Simon Koeck

To rebuild one submitted form, React scanned every field in the request once for each reference it contained. Nothing capped either number, so one 900 KB POST makes the server do 100 million checks...

simonkoeck.com
28
2,403
I reported a vulnerability to @metabugbounty 18 weeks ago. The issue has since been fixed, a CVE was issued, and a GitHub advisory was published. I’ve received no response, credit, or bounty. Nice
2
1
22
2,395
From part-time bug hunter to Top 10 on Bugcrowd in July. If you're wondering whether you can make meaningful progress without doing this full-time - the answer is yes.
5
1
21
2,519
> 5. migrate to cloudflare
Hassan
@buildwithhassanApr 19
Replying to @vercel
> 1. rotate all env vars and secrets in your vercel dashboard right now > 2. regenerate any github tokens connected through vercel's git integration > 3. check build logs for cached secrets from old deployments > 4. revoke API keys for stripe, databases, anything sitting in that dashboard
7
1,868
I sent a abuse report to @Cloudflare. TWO hours later they flagged the website.
1
11
1,651
I've started using zed
1
6
1,171
What a great time to be a security researcher
6
1,010
Hetzner? 🙄
4
9
1,887
Simon retweeted
Paul@pauxelsFeb 23
🚨 don't put 2FA codes in your password manager
chronark
@chronarkFeb 23
hey @Cloudflare can you please fix your logins, it takes 30s to go from cloudflare.com to actually being in the correct workspace 1. go to cloudflare.com 2. click deny cookies 3. click "Log in" 4. cloudflare loading spinner 5. click "Continue with Google" 6. captcha loading spinner 7. click captcha 8. captcha loading spinner 9. cloudflare loading spinner 10. 2FA appears 11. fill 2FA with 1password 12. cloudflare loading spinner 13. account loading skeleton 14. click account 15. cloudflare loading spinner 16. click on whatever product I need 17. cloudflare loading spinner @ritakozlov please
1
1
5
475
Once and for all.
2
3
1,033
Simon retweeted
Paul@pauxelsFeb 13
That's some insane curve right here.
Tom Dörr
@tom_doerrFeb 10
Verifies email addresses with one click github.com/authfill/authfill
1
7
1,063
Verifies email addresses with one click github.com/authfill/authfill
5
17
2
235
19,933
The reason why trademarks exist.
1
4
868
I'm addicted to CVE hunting... Found a new critical vulnerability in n8n: github.com/n8n-io/n8n/securi…

OS Command Injection in Git Node

## Impact Vulnerabilities in the Git node allowed authenticated users with permission to create or modify workflows to execute arbitrary system commands or read arbitrary files on the n8n host. ...

github.com
2
7
962
Got my first CVE 😍
2
13
1,038
Wait a minute
1
8
537
Load more