YesWeHack ⠵

Meet Jarvis, the Iron Man-inspired Claude Code setup steered by @Icare1337 🤖 This self-managing, multi-agent system has turbocharged his Bug Bounty workflow, but one rule remains ironclad: every finding needs human validation 👇 yeswehack.com/community/llms…

@0xOFFA That's great! Congratulations 👏

Thanks @YesWeHack for the amazing swag 😍😍

Autonomous attacks + a validator agent to catch bugs and avoid false positives = that is how @Rhynorater uses AI to hunt faster without sacrificing quality. He also shares how Claude Code helped uncover one of his proudest XSS finds. Full interview 👇 yeswehack.com/community/llms…

Ever looked at a "Forgot password" form? It might be building the reset link from a header you control 🤔 Add X-Forwarded-Host: domain.com to the reset request. If the email link points to evil.com, the victim clicks → their reset token lands on your server 🎯 #BugBountyTips #YesWeRHackers

We have our monthly Dojo champions! 🏆 Kudos to tio123, VictorTrend1 and Zwenkyz for solving Streamcore - you’ve earned a nice @yeswehack swag pack 😎🎁 Keep an eye on your mailbox 📬 ⚔️ Didn’t win this time? Stay tuned: dojo-yeswehack.com/challenge-of-t… #BugBounty #CTF

⏱️ 31 hours, 200+ reports, 71 hunters Our live hacking event at @_leHACK_ put @PUMA's systems to the test – our biggest leHACK #BugBounty yet. AI was in the mix, but the overall winners (@Vozec1, @_Worty) actually skipped automation. A win for human ingenuity 🧠 Full recap 👇 yeswehack.com/news/puma-live…

@R1s666 That's great! Congratulations 👏

Just got a reward for a vulnerability submitted on @yeswehack -- Improper Access Control - Generic (CWE-284). #YesWeRHackers

Last chance! 🚩 Streamcore is live until July 12. Can you figure out what is Streamcore hiding and read system files before time runs out? ⏳ The clock is ticking: dojo-yeswehack.com/challenge-of-t…

“YesWeHack saving our butts!” In the latest episode of @ctbbpodcast, @Rhynorater highlights our joint research with @sekoia_io. We exposed an undocumented supply chain attack targeting hackers via fake CVE PoCs. He also highlighted our @PUMA Live Hacking event at @_leHACK_ - 200+ reports in just 32 hours was indeed something! Enjoy the episode 👇 youtu.be/IESlRFjT0G8?si…

HTTP Request Smuggling can be hard to spot... but not impossible 😉 Our practical guide breaks down CL.TE, TE.CL, TE.TE and HTTP/2 variants, with examples to help you understand how to detect and exploit them 👇 yeswehack.com/learn-bug-boun…

Today, and until July 24, Swiss Post launches the annual Public Intrusion Test of its e-voting system 🚀 💰 Rewards of up to €230,000 for confirmed findings ⚡ Additional €3,000 for the first three confirmed findings 👉 Start hunting now: yeswehack.com/programs/swiss…

5️⃣ Want to go deeper on header-based attacks, CPDoS & cache deception? Our guide covers the full toolkit 👇 yeswehack.com/learn-bug-boun…

4️⃣ Cache Deception: Trick the cache into treating an authenticated page as a static asset. Append a fake extension/segment: /account/profile.css, /account/settings/foo.js If the cache stores it, an attacker reads another user's data via the cached URL 🎯

Ever found a cached response with an unkeyed input reflected into it? That's the whole cache serving your payload to every visitor 🤔 Tips to identify & exploit Web Cache Poisoning 👇 #YesWeRHackers #BugBountyTips

We're thrilled to welcome @yeswehack as a Silver Sponsor of Bug Bounty Village at DEF CON 34! Their ongoing support helps us create a space for hackers to connect, learn, and push boundaries. #defcon #bugbounty #bbv #bugbountyvillage

@CyberFrozenk This is impressive. GG! 🔥

Just got a reward for a vulnerability submitted on @yeswehack -- Open Redirect (CWE-601). yeswehack.com/hunters/frozenk #YesWeRHackers