Bug bounty Tips
Открыть в Telegram
🛡️ Cybersecurity enthusiast | 💻 Helping secure the digital world | 🌐 Web App Tester | 🕵️♂️ OSINT Specialist Admin: @laazy_hack3r
Больше6 192
Подписчики
+924 часа
+737 дней
+35430 день
Загрузка данных...
Похожие каналы
Облако тегов
Входящие и исходящие упоминания
---
---
---
---
---
---
Привлечение подписчиков
июль '26
июль '26
+331
в 0 каналах
июнь '26
+419
в 0 каналах
Get PRO
май '26
+588
в 0 каналах
Get PRO
апрель '26
+543
в 0 каналах
Get PRO
март '26
+358
в 0 каналах
Get PRO
февраль '26
+318
в 0 каналах
Get PRO
январь '26
+360
в 0 каналах
Get PRO
декабрь '25
+411
в 1 каналах
Get PRO
ноябрь '25
+464
в 0 каналах
Get PRO
октябрь '25
+152
в 0 каналах
Get PRO
сентябрь '25
+74
в 0 каналах
Get PRO
август '25
+213
в 1 каналах
Get PRO
июль '25
+41
в 0 каналах
Get PRO
июнь '25
+15
в 0 каналах
Get PRO
май '25
+27
в 0 каналах
Get PRO
апрель '25
+43
в 0 каналах
Get PRO
март '25
+41
в 0 каналах
Get PRO
февраль '25
+45
в 0 каналах
Get PRO
январь '25
+88
в 1 каналах
Get PRO
декабрь '24
+73
в 2 каналах
Get PRO
ноябрь '24
+234
в 2 каналах
Get PRO
октябрь '24
+372
в 2 каналах
Get PRO
сентябрь '24
+307
в 2 каналах
Get PRO
август '24
+414
в 2 каналах
Get PRO
июль '24
+131
в 1 каналах
Get PRO
июнь '24
+84
в 0 каналах
Get PRO
май '24
+196
в 2 каналах
Get PRO
апрель '24
+117
в 0 каналах
Get PRO
март '24
+41
в 0 каналах
Get PRO
февраль '24
+76
в 0 каналах
Get PRO
январь '24
+47
в 0 каналах
Get PRO
декабрь '23
+13
в 0 каналах
Get PRO
ноябрь '23
+79
в 0 каналах
Get PRO
октябрь '23
+282
в 0 каналах
| Дата | Привлечение подписчиков | Упоминания | Каналы | |
| 25 июля | +5 | |||
| 24 июля | +11 | |||
| 23 июля | +13 | |||
| 22 июля | +12 | |||
| 21 июля | +15 | |||
| 20 июля | +10 | |||
| 19 июля | +10 | |||
| 18 июля | +14 | |||
| 17 июля | +18 | |||
| 16 июля | +18 | |||
| 15 июля | +22 | |||
| 14 июля | +19 | |||
| 13 июля | +14 | |||
| 12 июля | +13 | |||
| 11 июля | +11 | |||
| 10 июля | +12 | |||
| 09 июля | +9 | |||
| 08 июля | +9 | |||
| 07 июля | +18 | |||
| 06 июля | +20 | |||
| 05 июля | +10 | |||
| 04 июля | +9 | |||
| 03 июля | +15 | |||
| 02 июля | +14 | |||
| 01 июля | +10 |
Посты канала
#AIOps
#DevOps
#MLSecOps
"They’ll Verify. They Just Won’t Act. How Authority Framing and Laundered Code Turn a Trusted Agentic CI/CD Pipeline Into an Attack Surface", Jul 2026.
]-> Dataset and reproduction code
// Prompt secrecy and distributed verification are not security controls: a trusted agentic pipeline shipped attacker-specified secret exfiltration because an authority claim made verifiers rubber-stamp code whose malice they could see, while content controls were blind to it..
| 2 |  Android bug bounty tips
APK unpacking
Never assume API keys or endpoints are hidden just because they are inside a mobile application.
Use apktool to unpack the APK and then use grep (Linux) or ag (Silver Searcher) to find sensitive strings:
#bugbountytips | 420 |
| 3 |  Found a naked IP redirecting to a main hostname?
Don't skip it.
Fuzz the Host header directly against
that IP: 👇
Easiest way to bypass front-facing WAFs & expose hidden staging endpoints. #bugbounty | 385 |
| 4 | #tools
#Offensive_security
#Red_Team_Tactics
"Astral Projection: Advanced Module Stomping", Apr. 2026.
]-> source code of the UDRL
// one-way of doing module stomping that is pretty ideal to avoid most of the IOCs that you’d have with the normal module stomping | 482 |
| 5 | #Offensive_security
#Red_Team_Tactics
Exploring cross-domain & cross-forest RBCD
Part 1 - Exploring cross-forest RBCD
Part 2 - Recursive S4U2Self[+U2U] / S4U2Proxy implementation | 454 |
| 6 | #AIOps
#reversing
"Automatically Attacking Software Reverse Engineering AI Agents", May 2026.
// The paper demonstrates that LLM-based reverse engineering tools (e.g., tool-using systems built around Ghidra) can be deceived through adversarial prompt injections, highlighting new cybersecurity vulnerabilities | 426 |
| 7 | #Malware_analysis
1⃣ RedLine Stealer
https://www.vmray.com/the-redline-thread-that-led-to-a-maritime-bec-infrastructure-cluster
2⃣ HelloNet campaign - new malicious modules launched through the ViPNet update system
https://securelist.com/tr/hellonet-vipnet/120700
3⃣ DinDoor, DenoRAT, and NightshadeC2: Analyzing TAG-150's Evolving Tradecraft
https://www.esentire.com/blog/dindoor-denorat-and-nightshadec2-analyzing-tag-150s-evolving-tradecraft
4⃣ Operation Capsule Vault: RokRAT Attack Chain Analysis Using EMBED_PAYLOAD_v2
https://www.genians.co.kr/en/blog/threat_intelligence/rokrat_capsule_vault
5⃣ OkoBot malware framework
https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660 | 379 |
| 8 | #NetSec
#AppSec
#Mobile_security
"MVPNalyzer: An Investigative Framework for Auditing the Security & Privacy of Mobile VPNs", 2026.
]-> tools
// research investigates the security of the VPN and circumvention tool ecosystem through a combination of empirical system evaluations and user-centered studies | 333 |
| 9 | #exploit
#Blue_Team_Techniques
LegacyHive: Windows user profile service arbitrary hive load EoP vulnerability
https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive
// The PoC requires another standard user credentials and a third username (which can be an administrator account), if the PoC is successful, it will end up mounting the target user hive in current user classes root
]-> Detections (scripts) for LegacyHive exploitation
]-> BlueHammer (CVE-2026-33825) Yara/Sigma rules
]-> Sigma rule for MiniPlasma (CVE-2020-17103)
]-> Sigma rule for GreenPlasma (CVE-2026-45586)
]-> GreatXML detect rules
]-> RedSun (CVE-2026-41091), BlueHammer, UnDefend (CVE-2026-45498) Detection Pack | 293 |
| 10 | #AppSec
#WebApp_Security
"TRANSPARENT: Taint-style Vulnerability Detection in Generic Single Page Applications through Automated Framework Abstraction", Feb. 2026.
]-> Artifact Evaluation
// Presentation of a new static analysis framework, TRANSPARENT, aimed at identifying hidden vulnerabilities (incl. DOM-based XSS and context injection) in modern front-end apps | 287 |
| 11 | #SCA
#reversing
"SNPeek: Side-Channel Analysis for Privacy Applications on Confidential VMs", Jun 2025.
]-> Repo
// The report focuses on offensive security analysis of secure execution environments. Researchers developed the SNPeek toolkit for side-channel tracing on commercial AMD processors with SEV-SNP technology | 299 |
| 12 | #Hardware_Security
Vulnerabilities of Realtek SD Card Reader
Part 1 - Vulnerabilities in RtsPer*sys (PoCs)
Part 2 - DMA vulnerability (PoC)
// CVE-2022-25477, CVE-2022-25478, CVE-2022-25479, CVE-2022-25480, CVE-2024-40431, CVE-2024-40432, CVE-2024-25476 | 330 |
| 13 | #exploit
#Offensive_security
#Red_Team_Tactics
CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining
https://mrtiz.github.io/cet-callstack-spoofing-thread-pool-trampoline
]-> PoC (Rust)
// a new call stack spoofing technique that combines thread pool execution, call rescheduling via enumeration callbacks, and indirect system calls into a chain that creates a completely legitimate call stack at the time of syscall execution
// Disclaimer | 348 |
| 14 |  Recon pro-tip:
Stop scanning just the official corporate GitHub organization.
Developers constantly push corporate API keys and secrets to their personal repos by mistake.
Track down the public profiles of the devs working there and run gitleaks over them. 🛠️ | 448 |
| 15 |  I used to think prompt injection was an AI safety problem.
Then I wrote it up as SSRF and the whole thing clicked.
→ The boundary is the same.
→ The bug is the same.
→ The bounty table row already exists.
Part 3 of the MCP bug bounty guide:
https://medium.com/@Aacle/prompt-injection-is-just-ssrf-for-text-7c864c73571e?sk=72f8e982df275aaa51704ec32e733d99 | 478 |
| 16 |  1/ Everyone knows HackTricks and PortSwigger.
These are the resources that actually find bugs.
Less hyped, higher yield.
A short list I keep going back to. 🧵
https://x.com/aacle_/status/2078389119261258011?s=20 | 437 |
| 17 | 🦾 **VulnOps Daily Digest**
☀️ 17 Jul 2026 · 01:06 PM IST
📰 Spirals: New Stealthy Ransomware Deployed Against Asian IT Company
https://news.google.com/rss/articles/CBMifkFVX3lxTE5ha05oZUJsZm1qNDI0eFJ5UjNadVVGM1pCUGxNVmtTT3RsbmJkNUZkdXdheENXNGxyRTFGNV9zNW1Cd3hjandja2g5R0huQjJPWHA2b0FacV9hN0xqQ2RXU1Z0enpCeWFhUHUtb3hnNWE5Y29aQWNqLXdSRzRjUQ?oc=5
📰 Coca-Cola suspended production at its Fairlife dairy after a ransomware attack
https://news.google.com/rss/articles/CBMiswFBVV95cUxOdVJ0RHFka3ZpZlFfaC1HM1MzMFFJcDJieFpkVl83UVFpYm16bzZ2ejNwYzEyYWYtX0JuYzJhczN0bHR2VjBrTmdfV2FfZmtPZGxrR2JsQXlTMGxGVGZhaThTblJUdWJwRkJFcVZMVWtiOEIyZ2FFbVZUVmdFVFYtOHVtZmJoaDg2V0Q3M3U1dF9OZmhQaW1qNDZxbnZmVmx3QVk3Vi1lUEtfVF8wc2RBbkJ4QQ?oc=5
📰 CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
https://news.google.com/rss/articles/CBMihAFBVV95cUxOZGJwSVBuSnlYN0stdzlQdGlyeURSSkRQLXBrREpFb2tmaTdLeXZORHNpUjNFcXE1amVDdGVXR2FvSV9vU2kxekZOSWU3MkZORk1YQzhyY1ktRFNNTEVmTXd0NEdXVWdfa2NNOXRJYXd2cDktMjNlS0wzNVNEdWdNQ0JkM1k?oc=5
📰 The July 2026 Security Update Review
https://news.google.com/rss/articles/CBMif0FVX3lxTE15aXJ1RkZ3TThXdTF5QldwRlNYRUtVZjE4SXdGZ3ZrZEJDTG5BS29wZnF4R0p3YU5XZDFBd2t4VUZsMkdua2ZzQmpsZkZnTi1mdFN2ZnNyNjlsNDcxdnRPSEhNakt0ZHJVb2lOTnVBMkFWS1R4bjlTSUh4VGNXVUk?oc=5
📰 Ransomware Attack Halts Milk Production at Coca-Cola's Fairlife Brand
https://news.google.com/rss/articles/CBMimwFBVV95cUxQaVdEREI1a2lxVkVsZF9QT0pSbTduRmNTczUxLVlILW03d0kxT281czhmVl90aHhjZXFZMzFIRkE2OFgzeWEwUWprY1gzMnBXUWlIQkhPWUVQSHNheGlIenM4djhoQi1vRzBQdTlnREFhMDBGU0tXVTkyazlTb28walZWYkdINFpVcHRHSDBlSTBRaXUtUlVVOXpMaw?oc=5
💡 Rate-limit login endpoints. Credential stuffing is automated and cheap.
⚡ _VulnOps · AI-Powered Security_ | 802 |
| 18 |  EC-Council Certified Ethical Hacker (CEH v13) — Complete Training & Labs
(CEH v13 • Hands-on Labs • AI-Powered Ethical Hacking • Practical Exercises)
Link: https://drive.google.com/drive/u/0/mobile/folders/14jjSnprC7AxqPCo8pl6hDZYtg8tuehs- | 683 |
| 19 |  🖼️ Daily Cybersecurity Meme
"MEMORIZING OWASP TOP 10"
"COPYING curl COMMANDS FROM HACKERONE REPORTS" | 857 |
| 20 |  🖼️ Daily Cybersecurity Meme
"CLIENT: "OUR SECURITY IS"
"ROCK SOLID, NO WORRIES""
"THEIR PASSWORD POLICY: min 1 char" | 815 |
