Begin n Bounty

@Dinosn crazy

Stryker cyber attack: Employees still unable to work more than a week after hack mlive.com/news/kalamazoo…

@heygurisingh marketing trend

🚨 BREAKING: The cybersecurity industry is about to get completely disrupted. Someone just open-sourced a fully autonomous AI Red Team. It's called PentAGI. 8,200+ stars on GitHub. Not one AI agent. An entire simulated security firm. Researchers, developers, pentesters, and risk analysts. All AI. All coordinating with each other before launching a single attack. No Cobalt Strike. No $100K/year pentest retainers. No OSCP required. Here's what's inside this thing: → An Orchestrator agent that plans the full attack chain → A Researcher agent that gathers intel from the web, search engines, and vulnerability databases → A Developer agent that writes custom exploit code on the fly → An Executor agent that runs 20+ pro security tools (nmap, metasploit, sqlmap, and more) → A memory system that learns from every engagement and gets smarter over time Here's the wildest part: It runs everything inside sandboxed Docker containers. Full isolation. It picks the right container image for each task automatically. It has a knowledge graph powered by Neo4j that tracks relationships between targets, vulnerabilities, tools, and techniques across every single test. Cybersecurity firms charge $25K-$150K per engagement for this exact workflow. This is free. 100% Open Source. MIT License.

@shreyas_chavhan i can feel your pain bravo

Imagine the pain of getting a critical (10.0) duped just by one day 😭. PS. (this is a different one than my previous post)

@NahamSec make a compete AI series

I'm documenting my journey of learning how to hack LLMs and building with AI so I'm so excited for this week's video: BECOMING AN AI HACKER (Episode 1) 👉🏼 youtu.be/dG6NFXQOmsE

@HackenProof @thedawgyg

Which bug hunter inspires you most right now? Tag them below👇

@thedawgyg 😂😂

Just incase anyone forgot.... Fuck Netanyahu.

Alright, alright. I admit it. I’m tired of living a lie. Claude code can’t find any bugs. Cancel your subs.

@ctbbpodcast GOAT

We finally had @thedawgyg on the pod to talk about his origin story, recent Chrome research and how he optimises his AI workflow, his famous 180K payout on Yahoo and a LOT more. This is an episode we know a lot of people have been looking forward to, check it out! youtu.be/kpFfde3rNFs

@Steiner254 creativity

What it takes to be in the industry ;p #BugBounty

@CristiVlad25 @intigriti congrats 🥂

I am honored @intigriti 🙏

@YourAnonOne seriously they don’t have balls

JUST IN: 🇦🇪🇮🇷 UAE considers taking action against Iran.

@thedawgyg @UK_Daniel_Card those morons can only kill school childrens or babies.

@UK_Daniel_Card These idiots don't know what the hell they are doing. They fact that he repeatedly claimed he completely 'obliterated' them was enough to know they likely didn't do shit.

did trump not say they totally destroyed all the nukes a few months ago?

@m19o__ @IAMERICAbooted they are baby killers

@IAMERICAbooted So you are supporting killing civilians, destroying middle east?

You're next.

@Masonhck3571 holy shit

My fellow Indians:…is the news always this intense?? 😂😂😂

@Michael1026H1 @Hacker0x01 congrats 🥂

Finally hit $1m on @Hacker0x01

@0xMstar @Bugcrowd 🐐

19k points on @Bugcrowd .

@ArchAngelDDay @Hacker0x01 🐐

Officially 2,500 reports filed on @Hacker0x01 !🥳

@Behi_Sec no doubt h1

Which platform is the best currently? H1, Bugcrowd or Intigriti?

@I_Am_Jakoby @github you are nailing it👍

got my 1st thanks on hackerone thanks @github 🥰 now finish my bounty and pay it out lol

@hunter0x7 crazy

Critical: Client-Side Encryption Collapse site.com ↓ some_javascript.js ↓ Line no 80519 → encObj + base64 key ↓ atob(val) → "Encoded_Password" ↓ CryptoJS.AES.decrypt(encObj, passphrase) ↓ 55 configuration properties → 107 operational secrets exposed → Azure AD client_secret → OAuth client_credentials flow → RSA public keys → Forge encrypted /enc/ API requests → HMAC key → Backend-accepted payload signing → Direct Line token → Production chatbot access → Monitoring / RUM keys → Telemetry manipulation → Auth0 + reCAPTCHA config → Auth flow manipulation → 31+ encrypted authentication endpoints mapped ↓ Use extracted Azure AD credentials ↓ Request token from Microsoft OAuth endpoint (client_credentials) ↓ Receive valid JWT with high-privilege role (e.g., AllAccess) ↓ “Super token” accepted by backend across protected API routes (No user interaction required, role-based authorization granted) ↓ All sensitive authentication and account endpoints were wrapped in client-side hybrid encryption → Every request payload encrypted in browser → AES-256-CBC used for body encryption → RSA-OAEP used to wrap per-request AES key → Server accepts any request that decrypts successfully → Decryption success treated as implicit authorization ↓ Reverse-engineer encryption module (@**6246) → Algorithm: AES-256-CBC + RSA-OAEP (SHA-512) → Random 32-byte AES key per request → IV derived client-side → AES key wrapped with embedded RSA public key (promocode_pem) → Final format: { "key": base64(RSA_key), "body": hex(AES_ciphertext) } ↓ Hook JSON.stringify + XMLHttpRequest ↓ Capture plaintext BEFORE encryption (credentials, OTPs, tokens) Capture encrypted wrapper AFTER encryption Capture correlated server responses ↓ Analyze MFA implementation ↓ IP-based rate limiting only (lockout resets on IP change) OTP expiration not strictly enforced server-side Encrypted payload fields trusted after decryption ↓ Mass takeover method ↓ 1. Trigger MFA or password reset 2. Rotate IP to bypass rate limiting 3. Reuse or brute-force OTP under weak enforcement 4. Complete password reset flow 5. Authenticate as victim 6. Capture decrypted OTP and auth tokens via runtime hook 7. Reuse valid 2FA tokens for subsequent authenticated requests ↓ Full attack chain achieved: → Extract secrets from client bundle → Generate high-privilege JWT (“super token”) → Read any plaintext request (credentials, PII, tokens) → Forge any encrypted request the server will accept → Bypass MFA protections via IP rotation → Reset victim passwords → Decrypt authentication flows in runtime → Mass account takeover