Bug Bounty Insights πŸͺ„@bbr_bug

I share bug bounty insights to the bug bounty community

Joined November 2022
192 Photos and videos
$76K from one Bugcrowd program no program-hopping β†’ 7-8 endpoints not forcing HTTPS, reported separately β†’ email HTML injection, drip-fed one at a time β†’ SSTI that took six days of payloads β†’ a scope update caught early, new forms fell first try anonhunter.medium.com/how-i-…

How I Earned $76,000 From a Single Program on Bugcrowd

Consistency and patience are not soft skills in bug bounty. They are the strategy.

anonhunter.medium.com
3
338
🚨 OpenAI research agent HACKED live access-control flaws on Australia's Medicare portal the government's response was to complain about the disclosure πŸ’€ found by a machine, on a government portal, and the argument is about etiquette we're so not ready for this ⚑
1
250
one link, one admin click, RCE WordPress core‼️ fixed in 7.1.1 (chain CVSS 9.6) the admin's session is forced to install a vulnerable theme β†’ the Customizer runs its inactive PHP in preview β†’ a no-permission-check handler runs a package the victim's session supplies it all
2
11
605
Hacking AI support agents two From headers, one email: SPF passes the attacker's domain, the AI agent resolves the victim's account β†’ attacker(comment)@domain beats rate limits β†’ spoofed email + real reset = OTP lands with attacker identity resolution is the new auth bypass
2
8
550
Must Read this πŸ‘‡intigriti.com/researchers/bl…

Hacking AI customer service agents

As AI agents are deployed to automate more tasks, they become more capable. And as the famous quote goes: "With great power comes great responsibility." Assuming that humans in the loop can mitigate...

intigriti.com
1
62
🚨 OnePlus confirmed a researcher's two root bugs, then threatened legal action over the disclosure. so he published everything. zero-permission app β†’ AtlasService injects text into a root command β†’ olc2 runs any shell command β†’ full system control. still unpatched 🀯
2
15
103
6,404
Must Read blog.nns.ee/2026/09/24/onepl…
3
11
585
Full writeup: Arvin Shivram's $148,337 Google Cloud RCE Chain 1: leaked proto definitions for internal Google APIs β†’ internal workflow queue β†’ a workflow task that executes Stubby RPCs with Google's own prod identity πŸ‘‡
1
6
62
4,475
Chain 2: cross-tenant IDORs + a filter-based binary search that reconstructs victim UUIDs in ~128 requests Both chains reach "Google treats this as RCE": brutecat.com/articles/google…

StubZero: $148,337 RCE in Google Cloud Production

A chance Discord message, two missing pieces, and one hour before the window closed: From info leak to RCE on Google Cloud. Three months later, it happened again.

brutecat.com
7
439
Security resources worth bookmarking #16 awesome-hacker-search-engines - replace your scattered recon bookmarks with one list 550+ engines, 28 categories: domains, certificates, code, leaks, threat intel, CVEs Intersting do check it out..... github.com/edoardottt/awesom…
7
495
Security resources worth bookmarking #14 Vulhub ➑ pre-built docker environments for real CVEs git clone β‡’ cd into a CVE folder β‡’ docker compose up -d From Shellshock to the Next.js middleware bypass, each folder has a README with repro steps github.com/vulhub/vulhub

GitHub - vulhub/vulhub: Pre-Built Vulnerable Environments Based on Docker-Compose

Pre-Built Vulnerable Environments Based on Docker-Compose - vulhub/vulhub

github.com
3
9
575
Security resources worth bookmarking - #13 Hackviser. A practical collection of cheat sheets and methodology for web application pentesting. Recon, authentication, access control, XSS, SSRF, SQLi & more. hackviser.com/
3
362
Bug Bounty Insights πŸͺ„ retweeted
Abhishek
@aacle_
Sep 11
GitLab security team waking up every few weeks: β€œyeah… another critical one.” CVE-2026-85706 is CVSS 10.0. Unauthenticated path traversal β†’ arbitrary file read via the repository commits API. Self-hosted GitLab admins: please patch your shit. πŸ’€
4
3
42
3,175
Bug Bounty Insights πŸͺ„ retweeted
Abhishek
@aacle_
Aug 28
updated my jwt testing checklist as per 2026
2
21
174
6,067
Security resources worth bookmarking - #10 Pentest Monkey. A classic collection of reverse shell cheat sheets and penetration testing references. Simple, practical, and still useful when you need the right one-liner quickly. pentestmonkey.net/cheat-shee…
8
433
A security resource worth bookmarking - #9 Assetnote Wordlists. High-quality wordlists built from real internet-scale data. Useful for subdomain enumeration, content discovery, API testing, and other tasks. An excellent resource when standard wordlists aren't enough.
1
1
27
1,169
Wordlist πŸ‘‡ wordlists.assetnote.io/

Assetnote Wordlists

Wordlists that are up to date and effective against the most popular technologies on the internet.

wordlists.assetnote.io
3
125
Sentry SSRF: with "source code scraping" on, the server follows URLs in error report stack traces. Send a crafted error with an internal URL in the filename field: POST /api/30/store/?sentry_key=KEY, stacktrace "filename":"http://169.254.169.254/" Blind GET to that URL.
1
15
939
Security resources worth bookmarking - #8 CyberChef. The Swiss Army knife for data analysis. Decode, encode, decrypt, extract, transform & analyze data β€” all in your browser. Useful for CTFs, pentesting, incident response, and everyday security work. gchq.github.io/CyberChef/
4
429
OAuth parsing mismatch: client splits params on & only. Server splits on both & and ;. Append ;@attacker.com to the host parameter. Server sees a valid host. Client navigates to attacker's domain. OAuth credentials leak. Source: Twitter/Digits #126522.
2
15
1,067
Load more