Bug bounty Tips
Ir al canal en Telegram
🛡️ Cybersecurity enthusiast | 💻 Helping secure the digital world | 🌐 Web App Tester | 🕵️♂️ OSINT Specialist Admin: @laazy_hack3r
Mostrar más6 192
Suscriptores
+924 horas
+737 días
+35430 días
Carga de datos en curso...
Canales Similares
Nube de Etiquetas
Menciones Entrantes y Salientes
---
---
---
---
---
---
Atraer Suscriptores
julio '26
julio '26
+331
en 0 canales
junio '26
+419
en 0 canales
Get PRO
mayo '26
+588
en 0 canales
Get PRO
abril '26
+543
en 0 canales
Get PRO
marzo '26
+358
en 0 canales
Get PRO
febrero '26
+318
en 0 canales
Get PRO
enero '26
+360
en 0 canales
Get PRO
diciembre '25
+411
en 1 canales
Get PRO
noviembre '25
+464
en 0 canales
Get PRO
octubre '25
+152
en 0 canales
Get PRO
septiembre '25
+74
en 0 canales
Get PRO
agosto '25
+213
en 1 canales
Get PRO
julio '25
+41
en 0 canales
Get PRO
junio '25
+15
en 0 canales
Get PRO
mayo '25
+27
en 0 canales
Get PRO
abril '25
+43
en 0 canales
Get PRO
marzo '25
+41
en 0 canales
Get PRO
febrero '25
+45
en 0 canales
Get PRO
enero '25
+88
en 1 canales
Get PRO
diciembre '24
+73
en 2 canales
Get PRO
noviembre '24
+234
en 2 canales
Get PRO
octubre '24
+372
en 2 canales
Get PRO
septiembre '24
+307
en 2 canales
Get PRO
agosto '24
+414
en 2 canales
Get PRO
julio '24
+131
en 1 canales
Get PRO
junio '24
+84
en 0 canales
Get PRO
mayo '24
+196
en 2 canales
Get PRO
abril '24
+117
en 0 canales
Get PRO
marzo '24
+41
en 0 canales
Get PRO
febrero '24
+76
en 0 canales
Get PRO
enero '24
+47
en 0 canales
Get PRO
diciembre '23
+13
en 0 canales
Get PRO
noviembre '23
+79
en 0 canales
Get PRO
octubre '23
+282
en 0 canales
| Fecha | Crecimiento de Suscriptores | Menciones | Canales | |
| 25 julio | +5 | |||
| 24 julio | +11 | |||
| 23 julio | +13 | |||
| 22 julio | +12 | |||
| 21 julio | +15 | |||
| 20 julio | +10 | |||
| 19 julio | +10 | |||
| 18 julio | +14 | |||
| 17 julio | +18 | |||
| 16 julio | +18 | |||
| 15 julio | +22 | |||
| 14 julio | +19 | |||
| 13 julio | +14 | |||
| 12 julio | +13 | |||
| 11 julio | +11 | |||
| 10 julio | +12 | |||
| 09 julio | +9 | |||
| 08 julio | +9 | |||
| 07 julio | +18 | |||
| 06 julio | +20 | |||
| 05 julio | +10 | |||
| 04 julio | +9 | |||
| 03 julio | +15 | |||
| 02 julio | +14 | |||
| 01 julio | +10 |
Publicaciones del Canal
#AIOps
#DevOps
#MLSecOps
"They’ll Verify. They Just Won’t Act. How Authority Framing and Laundered Code Turn a Trusted Agentic CI/CD Pipeline Into an Attack Surface", Jul 2026.
]-> Dataset and reproduction code
// Prompt secrecy and distributed verification are not security controls: a trusted agentic pipeline shipped attacker-specified secret exfiltration because an authority claim made verifiers rubber-stamp code whose malice they could see, while content controls were blind to it..
| 2 |  Android bug bounty tips
APK unpacking
Never assume API keys or endpoints are hidden just because they are inside a mobile application.
Use apktool to unpack the APK and then use grep (Linux) or ag (Silver Searcher) to find sensitive strings:
#bugbountytips | 420 |
| 3 |  Found a naked IP redirecting to a main hostname?
Don't skip it.
Fuzz the Host header directly against
that IP: 👇
Easiest way to bypass front-facing WAFs & expose hidden staging endpoints. #bugbounty | 385 |
| 4 | #tools
#Offensive_security
#Red_Team_Tactics
"Astral Projection: Advanced Module Stomping", Apr. 2026.
]-> source code of the UDRL
// one-way of doing module stomping that is pretty ideal to avoid most of the IOCs that you’d have with the normal module stomping | 482 |
| 5 | #Offensive_security
#Red_Team_Tactics
Exploring cross-domain & cross-forest RBCD
Part 1 - Exploring cross-forest RBCD
Part 2 - Recursive S4U2Self[+U2U] / S4U2Proxy implementation | 454 |
| 6 | #AIOps
#reversing
"Automatically Attacking Software Reverse Engineering AI Agents", May 2026.
// The paper demonstrates that LLM-based reverse engineering tools (e.g., tool-using systems built around Ghidra) can be deceived through adversarial prompt injections, highlighting new cybersecurity vulnerabilities | 426 |
| 7 | #Malware_analysis
1⃣ RedLine Stealer
https://www.vmray.com/the-redline-thread-that-led-to-a-maritime-bec-infrastructure-cluster
2⃣ HelloNet campaign - new malicious modules launched through the ViPNet update system
https://securelist.com/tr/hellonet-vipnet/120700
3⃣ DinDoor, DenoRAT, and NightshadeC2: Analyzing TAG-150's Evolving Tradecraft
https://www.esentire.com/blog/dindoor-denorat-and-nightshadec2-analyzing-tag-150s-evolving-tradecraft
4⃣ Operation Capsule Vault: RokRAT Attack Chain Analysis Using EMBED_PAYLOAD_v2
https://www.genians.co.kr/en/blog/threat_intelligence/rokrat_capsule_vault
5⃣ OkoBot malware framework
https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660 | 379 |
| 8 | #NetSec
#AppSec
#Mobile_security
"MVPNalyzer: An Investigative Framework for Auditing the Security & Privacy of Mobile VPNs", 2026.
]-> tools
// research investigates the security of the VPN and circumvention tool ecosystem through a combination of empirical system evaluations and user-centered studies | 333 |
| 9 | #exploit
#Blue_Team_Techniques
LegacyHive: Windows user profile service arbitrary hive load EoP vulnerability
https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive
// The PoC requires another standard user credentials and a third username (which can be an administrator account), if the PoC is successful, it will end up mounting the target user hive in current user classes root
]-> Detections (scripts) for LegacyHive exploitation
]-> BlueHammer (CVE-2026-33825) Yara/Sigma rules
]-> Sigma rule for MiniPlasma (CVE-2020-17103)
]-> Sigma rule for GreenPlasma (CVE-2026-45586)
]-> GreatXML detect rules
]-> RedSun (CVE-2026-41091), BlueHammer, UnDefend (CVE-2026-45498) Detection Pack | 293 |
| 10 | #AppSec
#WebApp_Security
"TRANSPARENT: Taint-style Vulnerability Detection in Generic Single Page Applications through Automated Framework Abstraction", Feb. 2026.
]-> Artifact Evaluation
// Presentation of a new static analysis framework, TRANSPARENT, aimed at identifying hidden vulnerabilities (incl. DOM-based XSS and context injection) in modern front-end apps | 287 |
| 11 | #SCA
#reversing
"SNPeek: Side-Channel Analysis for Privacy Applications on Confidential VMs", Jun 2025.
]-> Repo
// The report focuses on offensive security analysis of secure execution environments. Researchers developed the SNPeek toolkit for side-channel tracing on commercial AMD processors with SEV-SNP technology | 299 |
| 12 | #Hardware_Security
Vulnerabilities of Realtek SD Card Reader
Part 1 - Vulnerabilities in RtsPer*sys (PoCs)
Part 2 - DMA vulnerability (PoC)
// CVE-2022-25477, CVE-2022-25478, CVE-2022-25479, CVE-2022-25480, CVE-2024-40431, CVE-2024-40432, CVE-2024-25476 | 330 |
| 13 | #exploit
#Offensive_security
#Red_Team_Tactics
CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining
https://mrtiz.github.io/cet-callstack-spoofing-thread-pool-trampoline
]-> PoC (Rust)
// a new call stack spoofing technique that combines thread pool execution, call rescheduling via enumeration callbacks, and indirect system calls into a chain that creates a completely legitimate call stack at the time of syscall execution
// Disclaimer | 348 |
| 14 |  Recon pro-tip:
Stop scanning just the official corporate GitHub organization.
Developers constantly push corporate API keys and secrets to their personal repos by mistake.
Track down the public profiles of the devs working there and run gitleaks over them. 🛠️ | 448 |
| 15 |  I used to think prompt injection was an AI safety problem.
Then I wrote it up as SSRF and the whole thing clicked.
→ The boundary is the same.
→ The bug is the same.
→ The bounty table row already exists.
Part 3 of the MCP bug bounty guide:
https://medium.com/@Aacle/prompt-injection-is-just-ssrf-for-text-7c864c73571e?sk=72f8e982df275aaa51704ec32e733d99 | 478 |
| 16 |  1/ Everyone knows HackTricks and PortSwigger.
These are the resources that actually find bugs.
Less hyped, higher yield.
A short list I keep going back to. 🧵
https://x.com/aacle_/status/2078389119261258011?s=20 | 437 |
| 17 | 🦾 **VulnOps Daily Digest**
☀️ 17 Jul 2026 · 01:06 PM IST
📰 Spirals: New Stealthy Ransomware Deployed Against Asian IT Company
https://news.google.com/rss/articles/CBMifkFVX3lxTE5ha05oZUJsZm1qNDI0eFJ5UjNadVVGM1pCUGxNVmtTT3RsbmJkNUZkdXdheENXNGxyRTFGNV9zNW1Cd3hjandja2g5R0huQjJPWHA2b0FacV9hN0xqQ2RXU1Z0enpCeWFhUHUtb3hnNWE5Y29aQWNqLXdSRzRjUQ?oc=5
📰 Coca-Cola suspended production at its Fairlife dairy after a ransomware attack
https://news.google.com/rss/articles/CBMiswFBVV95cUxOdVJ0RHFka3ZpZlFfaC1HM1MzMFFJcDJieFpkVl83UVFpYm16bzZ2ejNwYzEyYWYtX0JuYzJhczN0bHR2VjBrTmdfV2FfZmtPZGxrR2JsQXlTMGxGVGZhaThTblJUdWJwRkJFcVZMVWtiOEIyZ2FFbVZUVmdFVFYtOHVtZmJoaDg2V0Q3M3U1dF9OZmhQaW1qNDZxbnZmVmx3QVk3Vi1lUEtfVF8wc2RBbkJ4QQ?oc=5
📰 CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
https://news.google.com/rss/articles/CBMihAFBVV95cUxOZGJwSVBuSnlYN0stdzlQdGlyeURSSkRQLXBrREpFb2tmaTdLeXZORHNpUjNFcXE1amVDdGVXR2FvSV9vU2kxekZOSWU3MkZORk1YQzhyY1ktRFNNTEVmTXd0NEdXVWdfa2NNOXRJYXd2cDktMjNlS0wzNVNEdWdNQ0JkM1k?oc=5
📰 The July 2026 Security Update Review
https://news.google.com/rss/articles/CBMif0FVX3lxTE15aXJ1RkZ3TThXdTF5QldwRlNYRUtVZjE4SXdGZ3ZrZEJDTG5BS29wZnF4R0p3YU5XZDFBd2t4VUZsMkdua2ZzQmpsZkZnTi1mdFN2ZnNyNjlsNDcxdnRPSEhNakt0ZHJVb2lOTnVBMkFWS1R4bjlTSUh4VGNXVUk?oc=5
📰 Ransomware Attack Halts Milk Production at Coca-Cola's Fairlife Brand
https://news.google.com/rss/articles/CBMimwFBVV95cUxQaVdEREI1a2lxVkVsZF9QT0pSbTduRmNTczUxLVlILW03d0kxT281czhmVl90aHhjZXFZMzFIRkE2OFgzeWEwUWprY1gzMnBXUWlIQkhPWUVQSHNheGlIenM4djhoQi1vRzBQdTlnREFhMDBGU0tXVTkyazlTb28walZWYkdINFpVcHRHSDBlSTBRaXUtUlVVOXpMaw?oc=5
💡 Rate-limit login endpoints. Credential stuffing is automated and cheap.
⚡ _VulnOps · AI-Powered Security_ | 802 |
| 18 |  EC-Council Certified Ethical Hacker (CEH v13) — Complete Training & Labs
(CEH v13 • Hands-on Labs • AI-Powered Ethical Hacking • Practical Exercises)
Link: https://drive.google.com/drive/u/0/mobile/folders/14jjSnprC7AxqPCo8pl6hDZYtg8tuehs- | 683 |
| 19 |  🖼️ Daily Cybersecurity Meme
"MEMORIZING OWASP TOP 10"
"COPYING curl COMMANDS FROM HACKERONE REPORTS" | 857 |
| 20 |  🖼️ Daily Cybersecurity Meme
"CLIENT: "OUR SECURITY IS"
"ROCK SOLID, NO WORRIES""
"THEIR PASSWORD POLICY: min 1 char" | 815 |
