@infosec_au I thought I was suffering from luck of motivation, I don't feel like hacking and reporting anymore, a lot of panic attacks on the often and feeling like I should really quit now.
English
Kyaiden
331 posts
I never realized how much of this space revolves around marketing companies and AI agents until I learned more about them. Some companies and most “AI agent” guys are just doing pure marketing nonsense, nothing more and nothing less. Meanwhile, blackhats keep showing us what real work looks like by hacking a new project almost every day. So ignore all this nonsense, focus on securing people’s money, improving your skills, and earning good rewards for yourself.
English
@ZeroK_____ Great time to level up and get bugs since the stupid marketing is scaring people off from the actual work, high quality learning materials, AI is always there to help you understand things more than a million ways, and less competition because everyone is quiting.
English
Password Reset = Authentication.
If the reset flow is weak, the entire security model collapses.
Writeup 👇
wadgamaraldeen.medium.com/critical-zero-…
Methodology 👇
github.com/wadgamaraldeen…
#BugBounty #CyberSecurity #AccountTakeover #AppSec
English
بفضل الله سبحانه وتعالى ❤️
أنهيت منتصف الربع الثاني من 2026 بتحقيق المركز الثالث على مستوى السودان في منصة @Hacker0x01. خلال الأشهر الماضية ركزت بشكل أساسي على كسر Authentication Design Flows واكتشاف ثغرات الـ Account Takeover.
العربية
Everyone, the $100 course discount is live! Get out there and slay those bugs. Remember, share for a chance to win one of the free give away codes on May 14th. 🤟
the_IDORminator@the_IDORminator
🚨 As of tomorrow I am permanently reducing my course cost by 50% to $100 so more people have access to it and can get those bounties while they are still hot. And yes, they are still hot. The internet is still full of stupid problems waiting to be found for those looking, at least for now... t.co/HsobzB2lOi I suspect we have about 2 years of decent #bugbounty hunting left before most companies have access to and properly leverage the tools like Mythos that effectively replace "most" hackers. Using the EXACT methods in this course, I found 20+ critical bugs on a target in a matter of hours the other day. Nothing fancy. The internet is just too dang big to fix and patch in a small amount of time, even if AI is finding the bugs. Internal legacy human processes with 500 steps are still bottle-necking remediation. What the bug bounty world becomes next is anyone's guess. My suspicions, hackers will be paid flat rates for hacking and/or patching targets any way they can (be it AI, manually, or both). So, here's to the next evolution of hacking, which is hopefully round-table LHE's where we all work together on targets to harden them as best as possible, instead of working against each other to try to "be the best hacker". Re-post for a chance to win 1 of 5 course coupons for a give away on May 14th. I'll have Grok pick the winners.
English
So he found a real ffmpeg bug with a fuzzer then let gemini convince him it was a chrome RCE. wrote a fake proof of concept that doesn't even use ffmpeg, just his own code writing past his own buffer going "look RCE!" google asked if it works in a browser. he said "me and gemini have been trying to figure that out." it did not work in a browser. wontfixed.
dawgyg - WoH@thedawgyg
Well since Google sucks fat donkey dick (still annoyed they waited >2 months to reject my RCE payload because i used the --single-thread flag in repro)... This was disclosed yesterday: issuetracker.google.com/u/1/issues/478… It was my 1st attempt to report the vuln that allows for RCE on every Chromium browser since Dec 2018. This one was rejected because I was still learning how to prove Chrome reachability. Ended up filing a new report a week later after figuring out a trick to bypass Chromium's validation on video files and being able to prove reachability.
English
@the_IDORminator If I remove a nail with a hammer - is the hammer using me or am I using the hammer ? 🤣🤣
English
Just remember, if AI finds security bugs for you, you are not a hacking -- it is. It is the hacker now, and you are the tool its using to tell it where to look
Fighting words 🤣
English
@the_IDORminator just reading the threads, I know there is someone who will see red after reading this tweet. 😅🤣🤣
English
Today's Update
I chose a program to start with, learnt about new recon tools like Nuclei and co, looked for subdomains then did recon for an hour, also learnt new terminologies used in the bug bounty world, nothing much , we go again tomorrow
#hackerone
#cybersecurity #bugbounty
Kyrian@kyr19n
It's been a while, I'm starting my big bounty journey today, It'll also be documented here. I am still learning but I'll hunt while learning. I'll start with VDP's first before going fully into bug bounty. #CyberSecurity #BugBounty #bugbountytips
English
Kyaiden retweetledi
The depth of your assumptions and the persistence of your efforts determine your skill ceiling 🕶️
English