Bug bounty Tips
رفتن به کانال در Telegram
🛡️ Cybersecurity enthusiast | 💻 Helping secure the digital world | 🌐 Web App Tester | 🕵️♂️ OSINT Specialist Admin: @laazy_hack3r
نمایش بیشتر6 192
مشترکین
+924 ساعت
+737 روز
+35430 روز
در حال بارگیری داده...
کانالهای مشابه
ابر برچسبها
اشارات ورودی و خروجی
---
---
---
---
---
---
جذب مشترکین
ژوئیه '26
ژوئیه '26
+331
در 0 کانالها
ژوئن '26
+419
در 0 کانالها
Get PRO
مه '26
+588
در 0 کانالها
Get PRO
آوریل '26
+543
در 0 کانالها
Get PRO
مارس '26
+358
در 0 کانالها
Get PRO
فوریه '26
+318
در 0 کانالها
Get PRO
ژانویه '26
+360
در 0 کانالها
Get PRO
دسامبر '25
+411
در 1 کانالها
Get PRO
نوامبر '25
+464
در 0 کانالها
Get PRO
اکتبر '25
+152
در 0 کانالها
Get PRO
سپتامبر '25
+74
در 0 کانالها
Get PRO
اوت '25
+213
در 1 کانالها
Get PRO
ژوئیه '25
+41
در 0 کانالها
Get PRO
ژوئن '25
+15
در 0 کانالها
Get PRO
مه '25
+27
در 0 کانالها
Get PRO
آوریل '25
+43
در 0 کانالها
Get PRO
مارس '25
+41
در 0 کانالها
Get PRO
فوریه '25
+45
در 0 کانالها
Get PRO
ژانویه '25
+88
در 1 کانالها
Get PRO
دسامبر '24
+73
در 2 کانالها
Get PRO
نوامبر '24
+234
در 2 کانالها
Get PRO
اکتبر '24
+372
در 2 کانالها
Get PRO
سپتامبر '24
+307
در 2 کانالها
Get PRO
اوت '24
+414
در 2 کانالها
Get PRO
ژوئیه '24
+131
در 1 کانالها
Get PRO
ژوئن '24
+84
در 0 کانالها
Get PRO
مه '24
+196
در 2 کانالها
Get PRO
آوریل '24
+117
در 0 کانالها
Get PRO
مارس '24
+41
در 0 کانالها
Get PRO
فوریه '24
+76
در 0 کانالها
Get PRO
ژانویه '24
+47
در 0 کانالها
Get PRO
دسامبر '23
+13
در 0 کانالها
Get PRO
نوامبر '23
+79
در 0 کانالها
Get PRO
اکتبر '23
+282
در 0 کانالها
| تاریخ | رشد مشترکین | اشارات | کانالها | |
| 25 ژوئیه | +5 | |||
| 24 ژوئیه | +11 | |||
| 23 ژوئیه | +13 | |||
| 22 ژوئیه | +12 | |||
| 21 ژوئیه | +15 | |||
| 20 ژوئیه | +10 | |||
| 19 ژوئیه | +10 | |||
| 18 ژوئیه | +14 | |||
| 17 ژوئیه | +18 | |||
| 16 ژوئیه | +18 | |||
| 15 ژوئیه | +22 | |||
| 14 ژوئیه | +19 | |||
| 13 ژوئیه | +14 | |||
| 12 ژوئیه | +13 | |||
| 11 ژوئیه | +11 | |||
| 10 ژوئیه | +12 | |||
| 09 ژوئیه | +9 | |||
| 08 ژوئیه | +9 | |||
| 07 ژوئیه | +18 | |||
| 06 ژوئیه | +20 | |||
| 05 ژوئیه | +10 | |||
| 04 ژوئیه | +9 | |||
| 03 ژوئیه | +15 | |||
| 02 ژوئیه | +14 | |||
| 01 ژوئیه | +10 |
پستهای کانال
#AIOps
#DevOps
#MLSecOps
"They’ll Verify. They Just Won’t Act. How Authority Framing and Laundered Code Turn a Trusted Agentic CI/CD Pipeline Into an Attack Surface", Jul 2026.
]-> Dataset and reproduction code
// Prompt secrecy and distributed verification are not security controls: a trusted agentic pipeline shipped attacker-specified secret exfiltration because an authority claim made verifiers rubber-stamp code whose malice they could see, while content controls were blind to it..
| 2 |  Android bug bounty tips
APK unpacking
Never assume API keys or endpoints are hidden just because they are inside a mobile application.
Use apktool to unpack the APK and then use grep (Linux) or ag (Silver Searcher) to find sensitive strings:
#bugbountytips | 420 |
| 3 |  Found a naked IP redirecting to a main hostname?
Don't skip it.
Fuzz the Host header directly against
that IP: 👇
Easiest way to bypass front-facing WAFs & expose hidden staging endpoints. #bugbounty | 385 |
| 4 | #tools
#Offensive_security
#Red_Team_Tactics
"Astral Projection: Advanced Module Stomping", Apr. 2026.
]-> source code of the UDRL
// one-way of doing module stomping that is pretty ideal to avoid most of the IOCs that you’d have with the normal module stomping | 482 |
| 5 | #Offensive_security
#Red_Team_Tactics
Exploring cross-domain & cross-forest RBCD
Part 1 - Exploring cross-forest RBCD
Part 2 - Recursive S4U2Self[+U2U] / S4U2Proxy implementation | 454 |
| 6 | #AIOps
#reversing
"Automatically Attacking Software Reverse Engineering AI Agents", May 2026.
// The paper demonstrates that LLM-based reverse engineering tools (e.g., tool-using systems built around Ghidra) can be deceived through adversarial prompt injections, highlighting new cybersecurity vulnerabilities | 426 |
| 7 | #Malware_analysis
1⃣ RedLine Stealer
https://www.vmray.com/the-redline-thread-that-led-to-a-maritime-bec-infrastructure-cluster
2⃣ HelloNet campaign - new malicious modules launched through the ViPNet update system
https://securelist.com/tr/hellonet-vipnet/120700
3⃣ DinDoor, DenoRAT, and NightshadeC2: Analyzing TAG-150's Evolving Tradecraft
https://www.esentire.com/blog/dindoor-denorat-and-nightshadec2-analyzing-tag-150s-evolving-tradecraft
4⃣ Operation Capsule Vault: RokRAT Attack Chain Analysis Using EMBED_PAYLOAD_v2
https://www.genians.co.kr/en/blog/threat_intelligence/rokrat_capsule_vault
5⃣ OkoBot malware framework
https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660 | 379 |
| 8 | #NetSec
#AppSec
#Mobile_security
"MVPNalyzer: An Investigative Framework for Auditing the Security & Privacy of Mobile VPNs", 2026.
]-> tools
// research investigates the security of the VPN and circumvention tool ecosystem through a combination of empirical system evaluations and user-centered studies | 333 |
| 9 | #exploit
#Blue_Team_Techniques
LegacyHive: Windows user profile service arbitrary hive load EoP vulnerability
https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive
// The PoC requires another standard user credentials and a third username (which can be an administrator account), if the PoC is successful, it will end up mounting the target user hive in current user classes root
]-> Detections (scripts) for LegacyHive exploitation
]-> BlueHammer (CVE-2026-33825) Yara/Sigma rules
]-> Sigma rule for MiniPlasma (CVE-2020-17103)
]-> Sigma rule for GreenPlasma (CVE-2026-45586)
]-> GreatXML detect rules
]-> RedSun (CVE-2026-41091), BlueHammer, UnDefend (CVE-2026-45498) Detection Pack | 293 |
| 10 | #AppSec
#WebApp_Security
"TRANSPARENT: Taint-style Vulnerability Detection in Generic Single Page Applications through Automated Framework Abstraction", Feb. 2026.
]-> Artifact Evaluation
// Presentation of a new static analysis framework, TRANSPARENT, aimed at identifying hidden vulnerabilities (incl. DOM-based XSS and context injection) in modern front-end apps | 287 |
| 11 | #SCA
#reversing
"SNPeek: Side-Channel Analysis for Privacy Applications on Confidential VMs", Jun 2025.
]-> Repo
// The report focuses on offensive security analysis of secure execution environments. Researchers developed the SNPeek toolkit for side-channel tracing on commercial AMD processors with SEV-SNP technology | 299 |
| 12 | #Hardware_Security
Vulnerabilities of Realtek SD Card Reader
Part 1 - Vulnerabilities in RtsPer*sys (PoCs)
Part 2 - DMA vulnerability (PoC)
// CVE-2022-25477, CVE-2022-25478, CVE-2022-25479, CVE-2022-25480, CVE-2024-40431, CVE-2024-40432, CVE-2024-25476 | 330 |
| 13 | #exploit
#Offensive_security
#Red_Team_Tactics
CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining
https://mrtiz.github.io/cet-callstack-spoofing-thread-pool-trampoline
]-> PoC (Rust)
// a new call stack spoofing technique that combines thread pool execution, call rescheduling via enumeration callbacks, and indirect system calls into a chain that creates a completely legitimate call stack at the time of syscall execution
// Disclaimer | 348 |
| 14 |  Recon pro-tip:
Stop scanning just the official corporate GitHub organization.
Developers constantly push corporate API keys and secrets to their personal repos by mistake.
Track down the public profiles of the devs working there and run gitleaks over them. 🛠️ | 448 |
| 15 |  I used to think prompt injection was an AI safety problem.
Then I wrote it up as SSRF and the whole thing clicked.
→ The boundary is the same.
→ The bug is the same.
→ The bounty table row already exists.
Part 3 of the MCP bug bounty guide:
https://medium.com/@Aacle/prompt-injection-is-just-ssrf-for-text-7c864c73571e?sk=72f8e982df275aaa51704ec32e733d99 | 478 |
| 16 |  1/ Everyone knows HackTricks and PortSwigger.
These are the resources that actually find bugs.
Less hyped, higher yield.
A short list I keep going back to. 🧵
https://x.com/aacle_/status/2078389119261258011?s=20 | 437 |
| 17 | 🦾 **VulnOps Daily Digest**
☀️ 17 Jul 2026 · 01:06 PM IST
📰 Spirals: New Stealthy Ransomware Deployed Against Asian IT Company
https://news.google.com/rss/articles/CBMifkFVX3lxTE5ha05oZUJsZm1qNDI0eFJ5UjNadVVGM1pCUGxNVmtTT3RsbmJkNUZkdXdheENXNGxyRTFGNV9zNW1Cd3hjandja2g5R0huQjJPWHA2b0FacV9hN0xqQ2RXU1Z0enpCeWFhUHUtb3hnNWE5Y29aQWNqLXdSRzRjUQ?oc=5
📰 Coca-Cola suspended production at its Fairlife dairy after a ransomware attack
https://news.google.com/rss/articles/CBMiswFBVV95cUxOdVJ0RHFka3ZpZlFfaC1HM1MzMFFJcDJieFpkVl83UVFpYm16bzZ2ejNwYzEyYWYtX0JuYzJhczN0bHR2VjBrTmdfV2FfZmtPZGxrR2JsQXlTMGxGVGZhaThTblJUdWJwRkJFcVZMVWtiOEIyZ2FFbVZUVmdFVFYtOHVtZmJoaDg2V0Q3M3U1dF9OZmhQaW1qNDZxbnZmVmx3QVk3Vi1lUEtfVF8wc2RBbkJ4QQ?oc=5
📰 CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
https://news.google.com/rss/articles/CBMihAFBVV95cUxOZGJwSVBuSnlYN0stdzlQdGlyeURSSkRQLXBrREpFb2tmaTdLeXZORHNpUjNFcXE1amVDdGVXR2FvSV9vU2kxekZOSWU3MkZORk1YQzhyY1ktRFNNTEVmTXd0NEdXVWdfa2NNOXRJYXd2cDktMjNlS0wzNVNEdWdNQ0JkM1k?oc=5
📰 The July 2026 Security Update Review
https://news.google.com/rss/articles/CBMif0FVX3lxTE15aXJ1RkZ3TThXdTF5QldwRlNYRUtVZjE4SXdGZ3ZrZEJDTG5BS29wZnF4R0p3YU5XZDFBd2t4VUZsMkdua2ZzQmpsZkZnTi1mdFN2ZnNyNjlsNDcxdnRPSEhNakt0ZHJVb2lOTnVBMkFWS1R4bjlTSUh4VGNXVUk?oc=5
📰 Ransomware Attack Halts Milk Production at Coca-Cola's Fairlife Brand
https://news.google.com/rss/articles/CBMimwFBVV95cUxQaVdEREI1a2lxVkVsZF9QT0pSbTduRmNTczUxLVlILW03d0kxT281czhmVl90aHhjZXFZMzFIRkE2OFgzeWEwUWprY1gzMnBXUWlIQkhPWUVQSHNheGlIenM4djhoQi1vRzBQdTlnREFhMDBGU0tXVTkyazlTb28walZWYkdINFpVcHRHSDBlSTBRaXUtUlVVOXpMaw?oc=5
💡 Rate-limit login endpoints. Credential stuffing is automated and cheap.
⚡ _VulnOps · AI-Powered Security_ | 802 |
| 18 |  EC-Council Certified Ethical Hacker (CEH v13) — Complete Training & Labs
(CEH v13 • Hands-on Labs • AI-Powered Ethical Hacking • Practical Exercises)
Link: https://drive.google.com/drive/u/0/mobile/folders/14jjSnprC7AxqPCo8pl6hDZYtg8tuehs- | 683 |
| 19 |  🖼️ Daily Cybersecurity Meme
"MEMORIZING OWASP TOP 10"
"COPYING curl COMMANDS FROM HACKERONE REPORTS" | 857 |
| 20 |  🖼️ Daily Cybersecurity Meme
"CLIENT: "OUR SECURITY IS"
"ROCK SOLID, NO WORRIES""
"THEIR PASSWORD POLICY: min 1 char" | 815 |
