Bug bounty Tips
前往频道在 Telegram
🛡️ Cybersecurity enthusiast | 💻 Helping secure the digital world | 🌐 Web App Tester | 🕵️♂️ OSINT Specialist Admin: @laazy_hack3r
显示更多6 192
订阅者
+924 小时
+737 天
+35430 天
数据加载中...
吸引订阅者
七月 '26
七月 '26
+331
在0个频道中
六月 '26
+419
在0个频道中
Get PRO
五月 '26
+588
在0个频道中
Get PRO
四月 '26
+543
在0个频道中
Get PRO
三月 '26
+358
在0个频道中
Get PRO
二月 '26
+318
在0个频道中
Get PRO
一月 '26
+360
在0个频道中
Get PRO
十二月 '25
+411
在1个频道中
Get PRO
十一月 '25
+464
在0个频道中
Get PRO
十月 '25
+152
在0个频道中
Get PRO
九月 '25
+74
在0个频道中
Get PRO
八月 '25
+213
在1个频道中
Get PRO
七月 '25
+41
在0个频道中
Get PRO
六月 '25
+15
在0个频道中
Get PRO
五月 '25
+27
在0个频道中
Get PRO
四月 '25
+43
在0个频道中
Get PRO
三月 '25
+41
在0个频道中
Get PRO
二月 '25
+45
在0个频道中
Get PRO
一月 '25
+88
在1个频道中
Get PRO
十二月 '24
+73
在2个频道中
Get PRO
十一月 '24
+234
在2个频道中
Get PRO
十月 '24
+372
在2个频道中
Get PRO
九月 '24
+307
在2个频道中
Get PRO
八月 '24
+414
在2个频道中
Get PRO
七月 '24
+131
在1个频道中
Get PRO
六月 '24
+84
在0个频道中
Get PRO
五月 '24
+196
在2个频道中
Get PRO
四月 '24
+117
在0个频道中
Get PRO
三月 '24
+41
在0个频道中
Get PRO
二月 '24
+76
在0个频道中
Get PRO
一月 '24
+47
在0个频道中
Get PRO
十二月 '23
+13
在0个频道中
Get PRO
十一月 '23
+79
在0个频道中
Get PRO
十月 '23
+282
在0个频道中
| 日期 | 订阅者增长 | 提及 | 频道 | |
| 25 七月 | +5 | |||
| 24 七月 | +11 | |||
| 23 七月 | +13 | |||
| 22 七月 | +12 | |||
| 21 七月 | +15 | |||
| 20 七月 | +10 | |||
| 19 七月 | +10 | |||
| 18 七月 | +14 | |||
| 17 七月 | +18 | |||
| 16 七月 | +18 | |||
| 15 七月 | +22 | |||
| 14 七月 | +19 | |||
| 13 七月 | +14 | |||
| 12 七月 | +13 | |||
| 11 七月 | +11 | |||
| 10 七月 | +12 | |||
| 09 七月 | +9 | |||
| 08 七月 | +9 | |||
| 07 七月 | +18 | |||
| 06 七月 | +20 | |||
| 05 七月 | +10 | |||
| 04 七月 | +9 | |||
| 03 七月 | +15 | |||
| 02 七月 | +14 | |||
| 01 七月 | +10 |
频道帖子
#AIOps
#DevOps
#MLSecOps
"They’ll Verify. They Just Won’t Act. How Authority Framing and Laundered Code Turn a Trusted Agentic CI/CD Pipeline Into an Attack Surface", Jul 2026.
]-> Dataset and reproduction code
// Prompt secrecy and distributed verification are not security controls: a trusted agentic pipeline shipped attacker-specified secret exfiltration because an authority claim made verifiers rubber-stamp code whose malice they could see, while content controls were blind to it..
| 2 |  Android bug bounty tips
APK unpacking
Never assume API keys or endpoints are hidden just because they are inside a mobile application.
Use apktool to unpack the APK and then use grep (Linux) or ag (Silver Searcher) to find sensitive strings:
#bugbountytips | 420 |
| 3 |  Found a naked IP redirecting to a main hostname?
Don't skip it.
Fuzz the Host header directly against
that IP: 👇
Easiest way to bypass front-facing WAFs & expose hidden staging endpoints. #bugbounty | 385 |
| 4 | #tools
#Offensive_security
#Red_Team_Tactics
"Astral Projection: Advanced Module Stomping", Apr. 2026.
]-> source code of the UDRL
// one-way of doing module stomping that is pretty ideal to avoid most of the IOCs that you’d have with the normal module stomping | 482 |
| 5 | #Offensive_security
#Red_Team_Tactics
Exploring cross-domain & cross-forest RBCD
Part 1 - Exploring cross-forest RBCD
Part 2 - Recursive S4U2Self[+U2U] / S4U2Proxy implementation | 454 |
| 6 | #AIOps
#reversing
"Automatically Attacking Software Reverse Engineering AI Agents", May 2026.
// The paper demonstrates that LLM-based reverse engineering tools (e.g., tool-using systems built around Ghidra) can be deceived through adversarial prompt injections, highlighting new cybersecurity vulnerabilities | 426 |
| 7 | #Malware_analysis
1⃣ RedLine Stealer
https://www.vmray.com/the-redline-thread-that-led-to-a-maritime-bec-infrastructure-cluster
2⃣ HelloNet campaign - new malicious modules launched through the ViPNet update system
https://securelist.com/tr/hellonet-vipnet/120700
3⃣ DinDoor, DenoRAT, and NightshadeC2: Analyzing TAG-150's Evolving Tradecraft
https://www.esentire.com/blog/dindoor-denorat-and-nightshadec2-analyzing-tag-150s-evolving-tradecraft
4⃣ Operation Capsule Vault: RokRAT Attack Chain Analysis Using EMBED_PAYLOAD_v2
https://www.genians.co.kr/en/blog/threat_intelligence/rokrat_capsule_vault
5⃣ OkoBot malware framework
https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660 | 379 |
| 8 | #NetSec
#AppSec
#Mobile_security
"MVPNalyzer: An Investigative Framework for Auditing the Security & Privacy of Mobile VPNs", 2026.
]-> tools
// research investigates the security of the VPN and circumvention tool ecosystem through a combination of empirical system evaluations and user-centered studies | 333 |
| 9 | #exploit
#Blue_Team_Techniques
LegacyHive: Windows user profile service arbitrary hive load EoP vulnerability
https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive
// The PoC requires another standard user credentials and a third username (which can be an administrator account), if the PoC is successful, it will end up mounting the target user hive in current user classes root
]-> Detections (scripts) for LegacyHive exploitation
]-> BlueHammer (CVE-2026-33825) Yara/Sigma rules
]-> Sigma rule for MiniPlasma (CVE-2020-17103)
]-> Sigma rule for GreenPlasma (CVE-2026-45586)
]-> GreatXML detect rules
]-> RedSun (CVE-2026-41091), BlueHammer, UnDefend (CVE-2026-45498) Detection Pack | 293 |
| 10 | #AppSec
#WebApp_Security
"TRANSPARENT: Taint-style Vulnerability Detection in Generic Single Page Applications through Automated Framework Abstraction", Feb. 2026.
]-> Artifact Evaluation
// Presentation of a new static analysis framework, TRANSPARENT, aimed at identifying hidden vulnerabilities (incl. DOM-based XSS and context injection) in modern front-end apps | 287 |
| 11 | #SCA
#reversing
"SNPeek: Side-Channel Analysis for Privacy Applications on Confidential VMs", Jun 2025.
]-> Repo
// The report focuses on offensive security analysis of secure execution environments. Researchers developed the SNPeek toolkit for side-channel tracing on commercial AMD processors with SEV-SNP technology | 299 |
| 12 | #Hardware_Security
Vulnerabilities of Realtek SD Card Reader
Part 1 - Vulnerabilities in RtsPer*sys (PoCs)
Part 2 - DMA vulnerability (PoC)
// CVE-2022-25477, CVE-2022-25478, CVE-2022-25479, CVE-2022-25480, CVE-2024-40431, CVE-2024-40432, CVE-2024-25476 | 330 |
| 13 | #exploit
#Offensive_security
#Red_Team_Tactics
CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining
https://mrtiz.github.io/cet-callstack-spoofing-thread-pool-trampoline
]-> PoC (Rust)
// a new call stack spoofing technique that combines thread pool execution, call rescheduling via enumeration callbacks, and indirect system calls into a chain that creates a completely legitimate call stack at the time of syscall execution
// Disclaimer | 348 |
| 14 |  Recon pro-tip:
Stop scanning just the official corporate GitHub organization.
Developers constantly push corporate API keys and secrets to their personal repos by mistake.
Track down the public profiles of the devs working there and run gitleaks over them. 🛠️ | 448 |
| 15 |  I used to think prompt injection was an AI safety problem.
Then I wrote it up as SSRF and the whole thing clicked.
→ The boundary is the same.
→ The bug is the same.
→ The bounty table row already exists.
Part 3 of the MCP bug bounty guide:
https://medium.com/@Aacle/prompt-injection-is-just-ssrf-for-text-7c864c73571e?sk=72f8e982df275aaa51704ec32e733d99 | 478 |
| 16 |  1/ Everyone knows HackTricks and PortSwigger.
These are the resources that actually find bugs.
Less hyped, higher yield.
A short list I keep going back to. 🧵
https://x.com/aacle_/status/2078389119261258011?s=20 | 437 |
| 17 | 🦾 **VulnOps Daily Digest**
☀️ 17 Jul 2026 · 01:06 PM IST
📰 Spirals: New Stealthy Ransomware Deployed Against Asian IT Company
https://news.google.com/rss/articles/CBMifkFVX3lxTE5ha05oZUJsZm1qNDI0eFJ5UjNadVVGM1pCUGxNVmtTT3RsbmJkNUZkdXdheENXNGxyRTFGNV9zNW1Cd3hjandja2g5R0huQjJPWHA2b0FacV9hN0xqQ2RXU1Z0enpCeWFhUHUtb3hnNWE5Y29aQWNqLXdSRzRjUQ?oc=5
📰 Coca-Cola suspended production at its Fairlife dairy after a ransomware attack
https://news.google.com/rss/articles/CBMiswFBVV95cUxOdVJ0RHFka3ZpZlFfaC1HM1MzMFFJcDJieFpkVl83UVFpYm16bzZ2ejNwYzEyYWYtX0JuYzJhczN0bHR2VjBrTmdfV2FfZmtPZGxrR2JsQXlTMGxGVGZhaThTblJUdWJwRkJFcVZMVWtiOEIyZ2FFbVZUVmdFVFYtOHVtZmJoaDg2V0Q3M3U1dF9OZmhQaW1qNDZxbnZmVmx3QVk3Vi1lUEtfVF8wc2RBbkJ4QQ?oc=5
📰 CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
https://news.google.com/rss/articles/CBMihAFBVV95cUxOZGJwSVBuSnlYN0stdzlQdGlyeURSSkRQLXBrREpFb2tmaTdLeXZORHNpUjNFcXE1amVDdGVXR2FvSV9vU2kxekZOSWU3MkZORk1YQzhyY1ktRFNNTEVmTXd0NEdXVWdfa2NNOXRJYXd2cDktMjNlS0wzNVNEdWdNQ0JkM1k?oc=5
📰 The July 2026 Security Update Review
https://news.google.com/rss/articles/CBMif0FVX3lxTE15aXJ1RkZ3TThXdTF5QldwRlNYRUtVZjE4SXdGZ3ZrZEJDTG5BS29wZnF4R0p3YU5XZDFBd2t4VUZsMkdua2ZzQmpsZkZnTi1mdFN2ZnNyNjlsNDcxdnRPSEhNakt0ZHJVb2lOTnVBMkFWS1R4bjlTSUh4VGNXVUk?oc=5
📰 Ransomware Attack Halts Milk Production at Coca-Cola's Fairlife Brand
https://news.google.com/rss/articles/CBMimwFBVV95cUxQaVdEREI1a2lxVkVsZF9QT0pSbTduRmNTczUxLVlILW03d0kxT281czhmVl90aHhjZXFZMzFIRkE2OFgzeWEwUWprY1gzMnBXUWlIQkhPWUVQSHNheGlIenM4djhoQi1vRzBQdTlnREFhMDBGU0tXVTkyazlTb28walZWYkdINFpVcHRHSDBlSTBRaXUtUlVVOXpMaw?oc=5
💡 Rate-limit login endpoints. Credential stuffing is automated and cheap.
⚡ _VulnOps · AI-Powered Security_ | 802 |
| 18 |  EC-Council Certified Ethical Hacker (CEH v13) — Complete Training & Labs
(CEH v13 • Hands-on Labs • AI-Powered Ethical Hacking • Practical Exercises)
Link: https://drive.google.com/drive/u/0/mobile/folders/14jjSnprC7AxqPCo8pl6hDZYtg8tuehs- | 683 |
| 19 |  🖼️ Daily Cybersecurity Meme
"MEMORIZING OWASP TOP 10"
"COPYING curl COMMANDS FROM HACKERONE REPORTS" | 857 |
| 20 |  🖼️ Daily Cybersecurity Meme
"CLIENT: "OUR SECURITY IS"
"ROCK SOLID, NO WORRIES""
"THEIR PASSWORD POLICY: min 1 char" | 815 |
